CVEs

386,596 total · page 6711 of 7,732

CVE	Vendor / Product	Risk	CVSS	EPSS	Published	Description
CVE-2012-3385	WordPress WordPress	0.00	—	0.02	Jul 22, 2012	WordPress before 3.4.1 does not properly restrict access to post contents such as private or draft posts, which allows remote authors or contributors to obtain sensitive information via unknown vectors.
CVE-2012-3384	WordPress WordPress	0.00	—	0.01	Jul 22, 2012	Cross-site request forgery (CSRF) vulnerability in the customizer in WordPress before 3.4.1 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVE-2012-3383	WordPress WordPress	0.00	—	0.03	Jul 22, 2012	The map_meta_cap function in wp-includes/capabilities.php in WordPress 3.4.x before 3.4.2, when the multisite feature is enabled, does not properly assign the unfiltered_html capability, which allows remote authenticated users to bypass intended access restrictions and conduct…
CVE-2012-2737	Ray Stode Accountsservice	0.00	—	0.00	Jul 22, 2012	The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in AccountsService before 0.6.22 does not properly check the UID when copying an icon file to the system cache directory, which allows local users to read arbitrary files via a race condition.
CVE-2012-2113	LibTIFF Libtiff	0.00	—	0.06	Jul 22, 2012	Multiple integer overflows in tiff2pdf in libtiff before 4.0.2 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted tiff image, which triggers a heap-based buffer overflow.
CVE-2012-2088	LibTIFF Libtiff	0.01	—	0.06	Jul 22, 2012	Integer signedness error in the TIFFReadDirectory function in tif_dirread.c in libtiff 3.9.4 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a negative tile depth in a tiff image, which triggers an…
CVE-2011-3464	Libpng Libpng	0.00	—	0.03	Jul 22, 2012	Off-by-one error in the png_formatted_warning function in pngerror.c in libpng 1.5.4 through 1.5.7 might allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via unspecified vectors, which trigger a stack-based buffer…
CVE-2011-3149	Linux Pam Linux Pam	0.00	—	0.01	Jul 22, 2012	The _expand_arg function in the pam_env module (modules/pam_env/pam_env.c) in Linux-PAM (aka pam) before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service (CPU consumption).
CVE-2011-3148	Linux Pam Linux Pam	0.00	—	0.01	Jul 22, 2012	Stack-based buffer overflow in the _assemble_line function in modules/pam_env/pam_env.c in Linux-PAM (aka pam) before 1.1.5 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long string of white spaces at the beginning of the…
CVE-2011-2199	TFTP TFTP	0.00	—	0.05	Jul 22, 2012	Buffer overflow in tftp-hpa before 5.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via the utimeout option.
CVE-2012-3361	OpenStack Essex	0.00	—	0.03	Jul 22, 2012	virt/disk/api.py in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an image.
CVE-2012-3360	OpenStack Essex	0.00	—	0.03	Jul 22, 2012	Directory traversal vulnerability in virt/disk/api.py in OpenStack Compute (Nova) Folsom (2012.2) and Essex (2012.1), when used over libvirt-based hypervisors, allows remote authenticated users to write arbitrary files to the disk image via a .. (dot dot) in the path attribute…
CVE-2012-3357	Viewvc Viewvc	0.00	—	0.02	Jul 22, 2012	The SVN revision view (lib/vclib/svn/svn_repos.py) in ViewVC before 1.1.15 does not properly handle log messages when a readable path is copied from an unreadable path, which allows remote attackers to obtain sensitive information, related to a "log msg leak."
CVE-2012-3356	Viewvc Viewvc	0.00	—	0.02	Jul 22, 2012	The remote SVN views functionality (lib/vclib/svn/svn_ra.py) in ViewVC before 1.1.15 does not properly perform authorization, which allows remote attackers to bypass intended access restrictions via unspecified vectors.
CVE-2012-2751	Trustwave Modsecurity	0.00	—	0.03	Jul 22, 2012	ModSecurity before 2.6.6, when used with PHP, does not properly handle single quotes not at the beginning of a request parameter value in the Content-Disposition field of a request with a multipart/form-data Content-Type header, which allows remote attackers to bypass filtering…
CVE-2012-2738	Nalin Dahyabhai Vte	0.04	—	0.11	Jul 22, 2012	The VteTerminal in gnome-terminal (vte) before 0.32.2 allows remote authenticated users to cause a denial of service (long loop and CPU consumption) via an escape sequence with a large repeat count value.
CVE-2009-5031	Trustwave Modsecurity	0.00	—	0.03	Jul 22, 2012	ModSecurity before 2.5.11 treats request parameter values containing single quotes as files, which allows remote attackers to bypass filtering rules and perform other attacks such as cross-site scripting (XSS) attacks via a single quote in a request parameter in the…
CVE-2012-2367	Moodle Moodle	0.00	—	0.02	Jul 21, 2012	Moodle 1.9.x before 1.9.18, 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to bypass the moodle/calendar:manageownentries capability requirement and add a calendar entry via a New Entry action.
CVE-2012-2366	Moodle Moodle	0.00	—	0.01	Jul 21, 2012	mod/data/preset.php in Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 does not properly iterate through an array, which allows remote authenticated users to overwrite arbitrary database activity presets via unspecified vectors.
CVE-2012-2365	Moodle Moodle	0.00	—	0.01	Jul 21, 2012	Cross-site scripting (XSS) vulnerability in Moodle 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to inject arbitrary web script or HTML via the idnumber field to cohort/edit.php.
CVE-2012-2364	Moodle Moodle	0.00	—	0.01	Jul 21, 2012	Cross-site scripting (XSS) vulnerability in lib/filelib.php in Moodle 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to inject arbitrary web script or HTML via an assignment submission with zip compression, leading to text/html…
CVE-2012-2363	Moodle Moodle	0.00	—	0.01	Jul 21, 2012	SQL injection vulnerability in calendar/event.php in the calendar implementation in Moodle 1.9.x before 1.9.18 allows remote authenticated users to execute arbitrary SQL commands via a crafted calendar event.
CVE-2012-2362	Moodle Moodle	0.00	—	0.01	Jul 21, 2012	Cross-site scripting (XSS) vulnerability in blog/lib.php in the blog implementation in Moodle 1.9.x before 1.9.18, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via a crafted parameter to blog/index.php.
CVE-2012-2361	Moodle Moodle	0.00	—	0.01	Jul 21, 2012	Cross-site scripting (XSS) vulnerability in admin/webservice/forms.php in the web services implementation in Moodle 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to inject arbitrary web script or HTML via the name field (aka the…
CVE-2012-2360	Moodle Moodle	0.00	—	0.01	Jul 21, 2012	Cross-site scripting (XSS) vulnerability in the Wiki subsystem in Moodle 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted string that is inserted into a page title.
CVE-2012-2359	Moodle Moodle	0.00	—	0.01	Jul 21, 2012	admin/roles/override.php in Moodle 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to gain privileges by leveraging the teacher role and modifying their own capabilities, as demonstrated by obtaining the backup:userinfo capability.
CVE-2012-2358	Moodle Moodle	0.00	—	0.02	Jul 21, 2012	Moodle 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to bypass an activity's read-only state and modify the database by leveraging the student role and editing database activity entries that already exist.
CVE-2012-2357	Moodle Moodle	0.00	—	0.01	Jul 21, 2012	The Multi-Authentication feature in the Central Authentication Service (CAS) functionality in auth/cas/cas_form.html in Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 does not use HTTPS, which allows remote attackers to obtain credentials by sniffing the network.
CVE-2012-2356	Moodle Moodle	0.00	—	0.01	Jul 21, 2012	The question-bank functionality in Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to bypass intended capability requirements and save questions via a save_question action.
CVE-2012-2355	Moodle Moodle	0.00	—	0.01	Jul 21, 2012	Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to bypass question:use* capability requirements and add arbitrary questions to a quiz via the questions feature.
CVE-2012-2354	Moodle Moodle	0.00	—	0.01	Jul 21, 2012	Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to bypass the moodle/site:readallmessages capability requirement and read arbitrary messages by using the "Recent conversations" feature with a modified parameter in a URL.
CVE-2012-2353	Moodle Moodle	0.00	—	0.01	Jul 21, 2012	Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to obtain sensitive user information from hidden fields by leveraging the teacher role and navigating to "Enrolled users" under the Users Settings section.
CVE-2012-3365	PHP PHP	0.00	—	0.03	Jul 20, 2012	The SQLite functionality in PHP before 5.3.15 allows remote attackers to bypass the open_basedir protection mechanism via unspecified vectors.
CVE-2012-3008	Osisoft Pi Opc Da Interface	0.00	—	0.05	Jul 20, 2012	Stack-based buffer overflow in OSIsoft PI OPC DA Interface before 2.3.20.9 allows remote authenticated users to execute arbitrary code by sending packet data during the processing of messages associated with OPC items.
CVE-2012-2955	IBM Lotus Protector For Mail Security	0.03	—	0.02	Jul 20, 2012	Multiple cross-site scripting (XSS) vulnerabilities in the administrative user interface in IBM Lotus Protector for Mail Security 2.1, 2.5, 2.5.1, and 2.8 and IBM ISS Proventia Network Mail Security System allow remote attackers to inject arbitrary web script or HTML via the…
CVE-2012-2688	PHP PHP	0.01	—	0.10	Jul 20, 2012	Unspecified vulnerability in the _php_stream_scandir function in the stream implementation in PHP before 5.3.15 and 5.4.x before 5.4.5 has unknown impact and remote attack vectors, related to an "overflow."
CVE-2011-4593	Moodle Moodle	0.00	—	0.02	Jul 20, 2012	Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 does not properly handle user/action_redir group messages, which allows remote authenticated users to discover e-mail addresses by visiting the messaging interface.
CVE-2011-4592	Moodle Moodle	0.00	—	0.01	Jul 20, 2012	The command-line cron implementation in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 does not properly interact with IP blocking, which might allow remote attackers to bypass intended IP address restrictions by leveraging a configuration in which IP blocking was disabled to…
CVE-2011-4591	Moodle Moodle	0.00	—	0.02	Jul 20, 2012	Cross-site scripting (XSS) vulnerability in the print_object function in lib/datalib.php in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3, when a developer debugging script is enabled, allows remote attackers to inject arbitrary web script or HTML via vectors involving object…
CVE-2011-4590	Moodle Moodle	0.00	—	0.01	Jul 20, 2012	The web services implementation in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 does not properly consider the maintenance-mode state and account attributes during login attempts, which allows remote authenticated users to bypass intended access restrictions by connecting to…
CVE-2011-4589	Moodle Moodle	0.00	—	0.01	Jul 20, 2012	backup/moodle2/restore_stepslib.php in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 does not check for the moodle/course:changeidnumber privilege during handling of course ID numbers, which allows remote authenticated users to overwrite ID numbers via a restore action.
CVE-2011-4588	Moodle Moodle	0.00	—	0.02	Jul 20, 2012	The ip_in_range function in mnet/lib.php in MNET in Moodle 1.9.x before 1.9.15 uses an incorrect data type, which allows remote attackers to bypass intended IP address restrictions via an XMLRPC request.
CVE-2011-4587	Moodle Moodle	0.00	—	0.02	Jul 20, 2012	lib/moodlelib.php in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 does not properly handle certain zero values in the password policy, which makes it easier for remote attackers to obtain access by leveraging the possible existence of user accounts that…
CVE-2011-4586	Moodle Moodle	0.00	—	0.02	Jul 20, 2012	CRLF injection vulnerability in calendar/set.php in the Calendar subsystem in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
CVE-2011-4585	Moodle Moodle	0.00	—	0.02	Jul 20, 2012	login/change_password.php in Moodle 1.9.x before 1.9.15 does not use https for the change-password form even if the httpslogin option is enabled, which allows remote attackers to obtain credentials by sniffing the network.
CVE-2011-4584	Moodle Moodle	0.00	—	0.02	Jul 20, 2012	The MNET authentication functionality in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 allows remote authenticated users to impersonate other user accounts by using the Login As feature in conjunction with a remote MNET single sign-on capability, as…
CVE-2011-4583	Moodle Moodle	0.00	—	0.01	Jul 20, 2012	Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 displays web service tokens associated with (1) disabled services and (2) users who no longer have authorization, which allows remote authenticated users to have an unspecified impact by reading these tokens.
CVE-2011-4582	Moodle Moodle	0.00	—	0.01	Jul 20, 2012	Open redirect vulnerability in the Calendar set page in Moodle 2.1.x before 2.1.3 allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via a redirection URL.
CVE-2011-4581	Moodle Moodle	0.00	—	0.01	Jul 20, 2012	mod/wiki/pagelib.php in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 allows remote authenticated users to discover the username of a wiki creator by visiting the history and deletion user interface.
CVE-2012-4025	Squashfs Project Squashfs	0.00	—	0.04	Jul 19, 2012	Integer overflow in the queue_init function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted block_log field in the superblock of a .sqsh file, leading to a heap-based buffer overflow.

CVE-2012-3385Jul 22, 2012
WordPress
WordPress
risk 0.00cvss —epss 0.02
WordPress before 3.4.1 does not properly restrict access to post contents such as private or draft posts, which allows remote authors or contributors to obtain sensitive information via unknown vectors.
CVE-2012-3384Jul 22, 2012
WordPress
WordPress
risk 0.00cvss —epss 0.01
Cross-site request forgery (CSRF) vulnerability in the customizer in WordPress before 3.4.1 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVE-2012-3383Jul 22, 2012
WordPress
WordPress
risk 0.00cvss —epss 0.03
The map_meta_cap function in wp-includes/capabilities.php in WordPress 3.4.x before 3.4.2, when the multisite feature is enabled, does not properly assign the unfiltered_html capability, which allows remote authenticated users to bypass intended access restrictions and conduct…
CVE-2012-2737Jul 22, 2012
Ray Stode
Accountsservice
risk 0.00cvss —epss 0.00
The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in AccountsService before 0.6.22 does not properly check the UID when copying an icon file to the system cache directory, which allows local users to read arbitrary files via a race condition.
CVE-2012-2113Jul 22, 2012
LibTIFF
Libtiff
risk 0.00cvss —epss 0.06
Multiple integer overflows in tiff2pdf in libtiff before 4.0.2 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted tiff image, which triggers a heap-based buffer overflow.
CVE-2012-2088Jul 22, 2012
LibTIFF
Libtiff
risk 0.01cvss —epss 0.06
Integer signedness error in the TIFFReadDirectory function in tif_dirread.c in libtiff 3.9.4 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a negative tile depth in a tiff image, which triggers an…
CVE-2011-3464Jul 22, 2012
Libpng
Libpng
risk 0.00cvss —epss 0.03
Off-by-one error in the png_formatted_warning function in pngerror.c in libpng 1.5.4 through 1.5.7 might allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via unspecified vectors, which trigger a stack-based buffer…
CVE-2011-3149Jul 22, 2012
Linux Pam
Linux Pam
risk 0.00cvss —epss 0.01
The _expand_arg function in the pam_env module (modules/pam_env/pam_env.c) in Linux-PAM (aka pam) before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service (CPU consumption).
CVE-2011-3148Jul 22, 2012
Linux Pam
Linux Pam
risk 0.00cvss —epss 0.01
Stack-based buffer overflow in the _assemble_line function in modules/pam_env/pam_env.c in Linux-PAM (aka pam) before 1.1.5 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long string of white spaces at the beginning of the…
CVE-2011-2199Jul 22, 2012
TFTP
TFTP
risk 0.00cvss —epss 0.05
Buffer overflow in tftp-hpa before 5.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via the utimeout option.
CVE-2012-3361Jul 22, 2012
OpenStack
Essex
risk 0.00cvss —epss 0.03
virt/disk/api.py in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an image.
CVE-2012-3360Jul 22, 2012
OpenStack
Essex
risk 0.00cvss —epss 0.03
Directory traversal vulnerability in virt/disk/api.py in OpenStack Compute (Nova) Folsom (2012.2) and Essex (2012.1), when used over libvirt-based hypervisors, allows remote authenticated users to write arbitrary files to the disk image via a .. (dot dot) in the path attribute…
CVE-2012-3357Jul 22, 2012
Viewvc
Viewvc
risk 0.00cvss —epss 0.02
The SVN revision view (lib/vclib/svn/svn_repos.py) in ViewVC before 1.1.15 does not properly handle log messages when a readable path is copied from an unreadable path, which allows remote attackers to obtain sensitive information, related to a "log msg leak."
CVE-2012-3356Jul 22, 2012
Viewvc
Viewvc
risk 0.00cvss —epss 0.02
The remote SVN views functionality (lib/vclib/svn/svn_ra.py) in ViewVC before 1.1.15 does not properly perform authorization, which allows remote attackers to bypass intended access restrictions via unspecified vectors.
CVE-2012-2751Jul 22, 2012
Trustwave
Modsecurity
risk 0.00cvss —epss 0.03
ModSecurity before 2.6.6, when used with PHP, does not properly handle single quotes not at the beginning of a request parameter value in the Content-Disposition field of a request with a multipart/form-data Content-Type header, which allows remote attackers to bypass filtering…
CVE-2012-2738Jul 22, 2012
Nalin Dahyabhai
Vte
risk 0.04cvss —epss 0.11
The VteTerminal in gnome-terminal (vte) before 0.32.2 allows remote authenticated users to cause a denial of service (long loop and CPU consumption) via an escape sequence with a large repeat count value.
CVE-2009-5031Jul 22, 2012
Trustwave
Modsecurity
risk 0.00cvss —epss 0.03
ModSecurity before 2.5.11 treats request parameter values containing single quotes as files, which allows remote attackers to bypass filtering rules and perform other attacks such as cross-site scripting (XSS) attacks via a single quote in a request parameter in the…
CVE-2012-2367Jul 21, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.02
Moodle 1.9.x before 1.9.18, 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to bypass the moodle/calendar:manageownentries capability requirement and add a calendar entry via a New Entry action.
CVE-2012-2366Jul 21, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.01
mod/data/preset.php in Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 does not properly iterate through an array, which allows remote authenticated users to overwrite arbitrary database activity presets via unspecified vectors.
CVE-2012-2365Jul 21, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Moodle 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to inject arbitrary web script or HTML via the idnumber field to cohort/edit.php.
CVE-2012-2364Jul 21, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in lib/filelib.php in Moodle 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to inject arbitrary web script or HTML via an assignment submission with zip compression, leading to text/html…
CVE-2012-2363Jul 21, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.01
SQL injection vulnerability in calendar/event.php in the calendar implementation in Moodle 1.9.x before 1.9.18 allows remote authenticated users to execute arbitrary SQL commands via a crafted calendar event.
CVE-2012-2362Jul 21, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in blog/lib.php in the blog implementation in Moodle 1.9.x before 1.9.18, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via a crafted parameter to blog/index.php.
CVE-2012-2361Jul 21, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in admin/webservice/forms.php in the web services implementation in Moodle 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to inject arbitrary web script or HTML via the name field (aka the…
CVE-2012-2360Jul 21, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the Wiki subsystem in Moodle 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted string that is inserted into a page title.
CVE-2012-2359Jul 21, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.01
admin/roles/override.php in Moodle 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to gain privileges by leveraging the teacher role and modifying their own capabilities, as demonstrated by obtaining the backup:userinfo capability.
CVE-2012-2358Jul 21, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.02
Moodle 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to bypass an activity's read-only state and modify the database by leveraging the student role and editing database activity entries that already exist.
CVE-2012-2357Jul 21, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.01
The Multi-Authentication feature in the Central Authentication Service (CAS) functionality in auth/cas/cas_form.html in Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 does not use HTTPS, which allows remote attackers to obtain credentials by sniffing the network.
CVE-2012-2356Jul 21, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.01
The question-bank functionality in Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to bypass intended capability requirements and save questions via a save_question action.
CVE-2012-2355Jul 21, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.01
Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to bypass question:use* capability requirements and add arbitrary questions to a quiz via the questions feature.
CVE-2012-2354Jul 21, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.01
Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to bypass the moodle/site:readallmessages capability requirement and read arbitrary messages by using the "Recent conversations" feature with a modified parameter in a URL.
CVE-2012-2353Jul 21, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.01
Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to obtain sensitive user information from hidden fields by leveraging the teacher role and navigating to "Enrolled users" under the Users Settings section.
CVE-2012-3365Jul 20, 2012
PHP
PHP
risk 0.00cvss —epss 0.03
The SQLite functionality in PHP before 5.3.15 allows remote attackers to bypass the open_basedir protection mechanism via unspecified vectors.
CVE-2012-3008Jul 20, 2012
Osisoft
Pi Opc Da Interface
risk 0.00cvss —epss 0.05
Stack-based buffer overflow in OSIsoft PI OPC DA Interface before 2.3.20.9 allows remote authenticated users to execute arbitrary code by sending packet data during the processing of messages associated with OPC items.
CVE-2012-2955Jul 20, 2012
IBM
Lotus Protector For Mail Security
risk 0.03cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in the administrative user interface in IBM Lotus Protector for Mail Security 2.1, 2.5, 2.5.1, and 2.8 and IBM ISS Proventia Network Mail Security System allow remote attackers to inject arbitrary web script or HTML via the…
CVE-2012-2688Jul 20, 2012
PHP
PHP
risk 0.01cvss —epss 0.10
Unspecified vulnerability in the _php_stream_scandir function in the stream implementation in PHP before 5.3.15 and 5.4.x before 5.4.5 has unknown impact and remote attack vectors, related to an "overflow."
CVE-2011-4593Jul 20, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.02
Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 does not properly handle user/action_redir group messages, which allows remote authenticated users to discover e-mail addresses by visiting the messaging interface.
CVE-2011-4592Jul 20, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.01
The command-line cron implementation in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 does not properly interact with IP blocking, which might allow remote attackers to bypass intended IP address restrictions by leveraging a configuration in which IP blocking was disabled to…
CVE-2011-4591Jul 20, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in the print_object function in lib/datalib.php in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3, when a developer debugging script is enabled, allows remote attackers to inject arbitrary web script or HTML via vectors involving object…
CVE-2011-4590Jul 20, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.01
The web services implementation in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 does not properly consider the maintenance-mode state and account attributes during login attempts, which allows remote authenticated users to bypass intended access restrictions by connecting to…
CVE-2011-4589Jul 20, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.01
backup/moodle2/restore_stepslib.php in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 does not check for the moodle/course:changeidnumber privilege during handling of course ID numbers, which allows remote authenticated users to overwrite ID numbers via a restore action.
CVE-2011-4588Jul 20, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.02
The ip_in_range function in mnet/lib.php in MNET in Moodle 1.9.x before 1.9.15 uses an incorrect data type, which allows remote attackers to bypass intended IP address restrictions via an XMLRPC request.
CVE-2011-4587Jul 20, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.02
lib/moodlelib.php in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 does not properly handle certain zero values in the password policy, which makes it easier for remote attackers to obtain access by leveraging the possible existence of user accounts that…
CVE-2011-4586Jul 20, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.02
CRLF injection vulnerability in calendar/set.php in the Calendar subsystem in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
CVE-2011-4585Jul 20, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.02
login/change_password.php in Moodle 1.9.x before 1.9.15 does not use https for the change-password form even if the httpslogin option is enabled, which allows remote attackers to obtain credentials by sniffing the network.
CVE-2011-4584Jul 20, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.02
The MNET authentication functionality in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 allows remote authenticated users to impersonate other user accounts by using the Login As feature in conjunction with a remote MNET single sign-on capability, as…
CVE-2011-4583Jul 20, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.01
Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 displays web service tokens associated with (1) disabled services and (2) users who no longer have authorization, which allows remote authenticated users to have an unspecified impact by reading these tokens.
CVE-2011-4582Jul 20, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.01
Open redirect vulnerability in the Calendar set page in Moodle 2.1.x before 2.1.3 allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via a redirection URL.
CVE-2011-4581Jul 20, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.01
mod/wiki/pagelib.php in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 allows remote authenticated users to discover the username of a wiki creator by visiting the history and deletion user interface.
CVE-2012-4025Jul 19, 2012
Squashfs Project
Squashfs
risk 0.00cvss —epss 0.04
Integer overflow in the queue_init function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted block_log field in the superblock of a .sqsh file, leading to a heap-based buffer overflow.