CVEs

386,593 total · page 6715 of 7,732

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2011-4282	Moodle Moodle		0.00	—	0.02	Jul 16, 2012	Multiple cross-site scripting (XSS) vulnerabilities in the course-tags functionality in tag/coursetags_more.php in Moodle 2.0.x before 2.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) sort or (2) show parameter.
CVE-2011-4281	Moodle Moodle		0.00	—	0.01	Jul 16, 2012	Multiple cross-site request forgery (CSRF) vulnerabilities in Moodle 2.0.x before 2.0.2 allow remote attackers to hijack the authentication of arbitrary users for requests that mark the completion of (1) an activity or (2) a course.
CVE-2011-4280	Moodle Moodle		0.00	—	0.04	Jul 16, 2012	Cross-site scripting (XSS) vulnerability in the Spike PHPCoverage (aka spikephpcoverage) library, as used in Moodle 2.0.x before 2.0.2 and other products, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2011-4279	Moodle Moodle		0.00	—	0.01	Jul 16, 2012	Moodle 2.0.x before 2.0.2 does not use the forceloginforprofiles setting for course-profiles access control, which makes it easier for remote attackers to obtain potentially sensitive information via vectors involving use of a search engine, as demonstrated by the search…
CVE-2011-4278	Moodle Moodle		0.00	—	0.02	Jul 16, 2012	Cross-site scripting (XSS) vulnerability in the tag autocomplete functionality in Moodle 1.9.x before 1.9.11 and 2.0.x before 2.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2011-4133	Moodle Moodle		0.00	—	0.01	Jul 16, 2012	Cross-site request forgery (CSRF) vulnerability in Moodle 1.9.x before 1.9.11 allows remote attackers to hijack the authentication of unspecified victims for requests that modify an RSS feed in an RSS block.
CVE-2012-2280	Rsa Authentication Manager		0.00	—	0.01	Jul 13, 2012	EMC RSA Authentication Manager 7.1 before SP4 P14 and RSA SecurID Appliance 3.0 before SP4 P14 do not properly use frames, which allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to a "Cross frame scripting vulnerability."
CVE-2012-2279	Rsa Authentication Manager		0.00	—	0.01	Jul 13, 2012	Open redirect vulnerability in the Security Console in EMC RSA Authentication Manager 7.1 before SP4 P14 and RSA SecurID Appliance 3.0 before SP4 P14 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVE-2012-2278	Rsa Authentication Manager		0.00	—	0.01	Jul 13, 2012	Multiple cross-site scripting (XSS) vulnerabilities in the (1) Self-Service Console and (2) Security Console in EMC RSA Authentication Manager 7.1 before SP4 P14 and RSA SecurID Appliance 3.0 before SP4 P14 allow remote attackers to inject arbitrary web script or HTML via…
CVE-2012-0283	Dokuwiki Dokuwiki		0.00	—	0.01	Jul 13, 2012	Cross-site scripting (XSS) vulnerability in the tpl_mediaFileList function in inc/template.php in DokuWiki before 2012-01-25b allows remote attackers to inject arbitrary web script or HTML via the ns parameter in a medialist action to lib/exe/ajax.php.
CVE-2012-2845	Curtis Galloway Exif		0.00	—	0.04	Jul 13, 2012	Integer overflow in the jpeg_data_load_data function in jpeg-data.c in libjpeg in exif 0.6.20 allows remote attackers to cause a denial of service (buffer over-read and application crash) or obtain potentially sensitive information via a crafted JPEG file.
CVE-2012-2841	Libexif Project Libexif		0.00	—	0.06	Jul 13, 2012	Integer underflow in the exif_entry_get_value function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) 0.6.20 might allow remote attackers to execute arbitrary code via vectors involving a crafted buffer-size parameter during the formatting of an EXIF tag, leading…
CVE-2012-2840	Libexif Project Libexif		0.00	—	0.05	Jul 13, 2012	Off-by-one error in the exif_convert_utf16_to_utf8 function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) before 0.6.21 allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted EXIF tags in an image.
CVE-2012-2837	Libexif Project Libexif		0.00	—	0.04	Jul 13, 2012	The mnote_olympus_entry_get_value function in olympus/mnote-olympus-entry.c in the EXIF Tag Parsing Library (aka libexif) before 0.6.21 allows remote attackers to cause a denial of service (divide-by-zero error) via an image with crafted EXIF tags that are not properly handled…
CVE-2012-2836	Libexif Project Libexif		0.00	—	0.06	Jul 13, 2012	The exif_data_load_data function in exif-data.c in the EXIF Tag Parsing Library (aka libexif) before 0.6.21 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from process memory via crafted EXIF tags in an image.
CVE-2012-2814	Libexif Project Libexif		0.01	—	0.08	Jul 13, 2012	Buffer overflow in the exif_entry_format_value function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) 0.6.20 allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted EXIF tags in an image.
CVE-2012-2813	Libexif Project Libexif		0.00	—	0.04	Jul 13, 2012	The exif_convert_utf16_to_utf8 function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) before 0.6.21 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from process memory via crafted EXIF tags in an…
CVE-2012-2812	Libexif Project Libexif		0.00	—	0.04	Jul 13, 2012	The exif_entry_get_value function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) before 0.6.21 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from process memory via crafted EXIF tags in an image.
CVE-2012-4000	Fckeditor Fckeditor		0.03	—	0.04	Jul 12, 2012	Cross-site scripting (XSS) vulnerability in the print_textinputs_var function in editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.php in FCKeditor 2.6.7 and earlier allows remote attackers to inject arbitrary web script or HTML via textinputs array…
CVE-2012-3999	Sayakbanerjee Sticky Notes		0.00	—	0.01	Jul 12, 2012	Cross-site scripting (XSS) vulnerability in admin/login.php in Sticky Notes 0.3.09062012.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter.
CVE-2012-3998	Sayakbanerjee Sticky Notes		0.00	—	0.02	Jul 12, 2012	Multiple SQL injection vulnerabilities in Sticky Notes before 0.2.27052012.5 allow remote attackers to execute arbitrary SQL commands via the (1) paste id in admin/modules/mod_pastes.php or (2) show.php, (3) user id to admin/modules/mod_users.php, (4) project to list.php, or (5)…
CVE-2012-3997	Sayakbanerjee Sticky Notes		0.00	—	0.02	Jul 12, 2012	Multiple cross-site scripting (XSS) vulnerabilities in Sticky Notes before 0.2.27052012.5 allow remote attackers to inject arbitrary web script or HTML via the (1) paste_user or (2) paste_lang parameter to (a) list.php or (b) show.php.
CVE-2012-3382	Mono Mono		0.00	—	0.02	Jul 12, 2012	Cross-site scripting (XSS) vulnerability in the ProcessRequest function in mcs/class/System.Web/System.Web/HttpForbiddenHandler.cs in Mono 2.10.8 and earlier allows remote attackers to inject arbitrary web script or HTML via a file with a crafted name and a forbidden extension,…
CVE-2012-3377	VideoLAN VLC media player		0.00	—	0.04	Jul 12, 2012	Heap-based buffer overflow in the Ogg_DecodePacket function in the OGG demuxer (modules/demux/ogg.c) in VideoLAN VLC media player before 2.0.2 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted OGG file.
CVE-2012-3350	Webmatic Webmatic		0.03	—	0.03	Jul 12, 2012	SQL injection vulnerability in index.php in Webmatic 3.1.1 allows remote attackers to execute arbitrary SQL commands via the Referer HTTP header.
CVE-2012-3236	GIMP Gimp		0.04	—	0.11	Jul 12, 2012	fits-io.c in GIMP before 2.8.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a malformed XTENSION header of a .fit file, as demonstrated using a long string.
CVE-2012-2844	Google Chrome		0.00	—	0.02	Jul 12, 2012	The PDF functionality in Google Chrome before 20.0.1132.57 does not properly handle JavaScript code, which allows remote attackers to cause a denial of service (incorrect object access) or possibly have unspecified other impact via a crafted document.
CVE-2012-2843	Google Chrome		0.00	—	0.02	Jul 12, 2012	Use-after-free vulnerability in Google Chrome before 20.0.1132.57 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to layout height tracking.
CVE-2012-2842	Google Chrome		0.00	—	0.01	Jul 12, 2012	Use-after-free vulnerability in Google Chrome before 20.0.1132.57 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to counter handling.
CVE-2012-2614	Lattice Diamond Programmer		0.03	—	0.04	Jul 12, 2012	Buffer overflow in programmer.exe in Lattice Diamond Programmer 1.4.2 allows user-assisted remote attackers to cause a denial of service (application crash) and execute arbitrary code via a long string in a version attribute of an ispXCF element in an .xcf file.
CVE-2012-1661	Esri Arcmap		0.05	—	0.24	Jul 12, 2012	ESRI ArcMap 9 and ArcGIS 10.0.2.3200 and earlier does not properly prompt users before executing embedded VBA macros, which allows user-assisted remote attackers to execute arbitrary VBA code via a crafted map (.mxd) file.
CVE-2012-3362	Extplorer Extplorer		0.00	—	0.01	Jul 12, 2012	Cross-site request forgery (CSRF) vulnerability in eXtplorer 2.1 RC3 and earlier allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via an adduser admin action.
CVE-2012-2653	Lawrence Berkeley National Laboratory Arpwatch		0.00	—	0.03	Jul 12, 2012	arpwatch 2.1a15, as used by Red Hat, Debian, Fedora, and possibly others, does not properly drop supplementary groups, which might allow attackers to gain root privileges by leveraging other vulnerabilities in the daemon.
CVE-2012-2351	Mahara (software) Mahara		0.00	—	0.02	Jul 12, 2012	The default configuration of the auth/saml plugin in Mahara before 1.4.2 sets the "Match username attribute to Remote username" option to false, which allows remote SAML IdP servers to spoof users of other SAML IdP servers by using the same internal username.
CVE-2012-1174	Linux Systemd		0.00	—	0.00	Jul 12, 2012	The rm_rf_children function in util.c in the systemd-logind login manager in systemd before 44, when logging out, allows local users to delete arbitrary files via a symlink attack on unspecified files, related to "particular records related with user session."
CVE-2012-1163	Libzip Libzip		0.00	—	0.03	Jul 12, 2012	Integer overflow in the _zip_readcdir function in zip_open.c in libzip 0.10 allows remote attackers to execute arbitrary code via the size and offset values for the central directory in a zip archive, which triggers "improper restrictions of operations within the bounds of a…
CVE-2012-1162	Libzip Libzip		0.00	—	0.04	Jul 12, 2012	Heap-based buffer overflow in the _zip_readcdir function in zip_open.c in libzip 0.10 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a zip archive with the number of directories set to 0, related to an "incorrect…
CVE-2012-1037	Glpi Project Glpi		0.00	—	0.01	Jul 12, 2012	PHP remote file inclusion vulnerability in front/popup.php in GLPI 0.78 through 0.80.61 allows remote authenticated users to execute arbitrary PHP code via a URL in the sub_type parameter.
CVE-2012-0215	Tryton Trytond		0.00	—	0.02	Jul 12, 2012	model/modelstorage.py in the Tryton application framework (trytond) before 2.4.0 for Python does not properly restrict access to the Many2Many field in the relation model, which allows remote authenticated users to modify the privileges of arbitrary users via a (1) create, (2)…
CVE-2012-3996	Tiki Tikiwiki CMS\/groupware		0.03	—	0.05	Jul 12, 2012	TikiWiki CMS/Groupware 8.3 and earlier allows remote attackers to obtain the installation path via a direct request to (1) admin/include_calendar.php, (2) tiki-rss_error.php, or (3) tiki-watershed_service.php.
CVE-2012-3881	Adrian Chadd Rtg		0.00	—	0.01	Jul 12, 2012	Multiple SQL injection vulnerabilities in RTG 0.7.4 and RTG2 0.9.2 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) 95.php, (2) view.php, or (3) rtg.php.
CVE-2012-3805	Kajona Kajona		0.03	—	0.02	Jul 12, 2012	Multiple cross-site scripting (XSS) vulnerabilities in the getAllPassedParams function in system/functions.php in Kajona before 3.4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) absender_name, (2) absender_email, or (3) absender_nachricht parameter…
CVE-2012-3399	Artis.imag Basilic		0.08	—	0.65	Jul 12, 2012	Config/diff.php in Basilic 1.5.14 allows remote attackers to execute arbitrary commands via shell metacharacters in the file parameter.
CVE-2012-3376	Apache Hadoop		0.00	—	0.03	Jul 12, 2012	DataNodes in Apache Hadoop 2.0.0 alpha does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out the same BlockPool twice from a NodeName, which might allow remote clients to read arbitrary blocks, write to blocks to which they only have…
CVE-2012-2763	GIMP Gimp		0.10	—	0.82	Jul 12, 2012	Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/scheme.c in GIMP 2.6.12 and earlier, and possibly 2.6.13, allows remote attackers to execute arbitrary code via a long string in a command to the script-fu server.
CVE-2012-1620	Suckless Slock		0.00	—	0.01	Jul 12, 2012	slock 0.9 does not properly handle the XRaiseWindow event when the screen is locked, which might allow physically proximate attackers to obtain sensitive information by pressing a button, which reveals the desktop and active windows.
CVE-2012-0911	Tiki Tikiwiki CMS\/groupware	Cri	0.72	9.8	0.63	Jul 12, 2012	TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows remote attackers to execute arbitrary PHP code via a crafted serialized object in the (1) cookieName to lib/banners/bannerlib.php; (2) printpages or (3) printstructures parameter to (a) tiki-print_multi_pages.php or (b)…
CVE-2012-3076	Cisco Systems, Inc. Telepresence Recording Server		0.00	—	0.02	Jul 12, 2012	The administrative web interface on Cisco TelePresence Recording Server before 1.8.0 allows remote authenticated users to execute arbitrary commands via unspecified vectors, aka Bug ID CSCth85804.
CVE-2012-3075	Cisco Systems, Inc. Telepresence System Software		0.00	—	0.02	Jul 12, 2012	The administrative web interface on Cisco TelePresence Immersive Endpoint Devices before 1.7.4 allows remote authenticated users to execute arbitrary commands via a malformed request on TCP port 443, aka Bug ID CSCtn99724.
CVE-2012-3074	Cisco Systems, Inc. Telepresence System Software		0.00	—	0.01	Jul 12, 2012	An unspecified API on Cisco TelePresence Immersive Endpoint Devices before 1.9.1 allows remote attackers to execute arbitrary commands by leveraging certain adjacency and sending a malformed request on TCP port 61460, aka Bug ID CSCtz38382.

CVE-2011-4282Jul 16, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in the course-tags functionality in tag/coursetags_more.php in Moodle 2.0.x before 2.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) sort or (2) show parameter.
CVE-2011-4281Jul 16, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.01
Multiple cross-site request forgery (CSRF) vulnerabilities in Moodle 2.0.x before 2.0.2 allow remote attackers to hijack the authentication of arbitrary users for requests that mark the completion of (1) an activity or (2) a course.
CVE-2011-4280Jul 16, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.04
Cross-site scripting (XSS) vulnerability in the Spike PHPCoverage (aka spikephpcoverage) library, as used in Moodle 2.0.x before 2.0.2 and other products, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2011-4279Jul 16, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.01
Moodle 2.0.x before 2.0.2 does not use the forceloginforprofiles setting for course-profiles access control, which makes it easier for remote attackers to obtain potentially sensitive information via vectors involving use of a search engine, as demonstrated by the search…
CVE-2011-4278Jul 16, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in the tag autocomplete functionality in Moodle 1.9.x before 1.9.11 and 2.0.x before 2.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2011-4133Jul 16, 2012
Moodle
Moodle
risk 0.00cvss —epss 0.01
Cross-site request forgery (CSRF) vulnerability in Moodle 1.9.x before 1.9.11 allows remote attackers to hijack the authentication of unspecified victims for requests that modify an RSS feed in an RSS block.
CVE-2012-2280Jul 13, 2012
Rsa
Authentication Manager
risk 0.00cvss —epss 0.01
EMC RSA Authentication Manager 7.1 before SP4 P14 and RSA SecurID Appliance 3.0 before SP4 P14 do not properly use frames, which allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to a "Cross frame scripting vulnerability."
CVE-2012-2279Jul 13, 2012
Rsa
Authentication Manager
risk 0.00cvss —epss 0.01
Open redirect vulnerability in the Security Console in EMC RSA Authentication Manager 7.1 before SP4 P14 and RSA SecurID Appliance 3.0 before SP4 P14 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVE-2012-2278Jul 13, 2012
Rsa
Authentication Manager
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in the (1) Self-Service Console and (2) Security Console in EMC RSA Authentication Manager 7.1 before SP4 P14 and RSA SecurID Appliance 3.0 before SP4 P14 allow remote attackers to inject arbitrary web script or HTML via…
CVE-2012-0283Jul 13, 2012
Dokuwiki
Dokuwiki
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the tpl_mediaFileList function in inc/template.php in DokuWiki before 2012-01-25b allows remote attackers to inject arbitrary web script or HTML via the ns parameter in a medialist action to lib/exe/ajax.php.
CVE-2012-2845Jul 13, 2012
Curtis Galloway
Exif
risk 0.00cvss —epss 0.04
Integer overflow in the jpeg_data_load_data function in jpeg-data.c in libjpeg in exif 0.6.20 allows remote attackers to cause a denial of service (buffer over-read and application crash) or obtain potentially sensitive information via a crafted JPEG file.
CVE-2012-2841Jul 13, 2012
Libexif Project
Libexif
risk 0.00cvss —epss 0.06
Integer underflow in the exif_entry_get_value function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) 0.6.20 might allow remote attackers to execute arbitrary code via vectors involving a crafted buffer-size parameter during the formatting of an EXIF tag, leading…
CVE-2012-2840Jul 13, 2012
Libexif Project
Libexif
risk 0.00cvss —epss 0.05
Off-by-one error in the exif_convert_utf16_to_utf8 function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) before 0.6.21 allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted EXIF tags in an image.
CVE-2012-2837Jul 13, 2012
Libexif Project
Libexif
risk 0.00cvss —epss 0.04
The mnote_olympus_entry_get_value function in olympus/mnote-olympus-entry.c in the EXIF Tag Parsing Library (aka libexif) before 0.6.21 allows remote attackers to cause a denial of service (divide-by-zero error) via an image with crafted EXIF tags that are not properly handled…
CVE-2012-2836Jul 13, 2012
Libexif Project
Libexif
risk 0.00cvss —epss 0.06
The exif_data_load_data function in exif-data.c in the EXIF Tag Parsing Library (aka libexif) before 0.6.21 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from process memory via crafted EXIF tags in an image.
CVE-2012-2814Jul 13, 2012
Libexif Project
Libexif
risk 0.01cvss —epss 0.08
Buffer overflow in the exif_entry_format_value function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) 0.6.20 allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted EXIF tags in an image.
CVE-2012-2813Jul 13, 2012
Libexif Project
Libexif
risk 0.00cvss —epss 0.04
The exif_convert_utf16_to_utf8 function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) before 0.6.21 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from process memory via crafted EXIF tags in an…
CVE-2012-2812Jul 13, 2012
Libexif Project
Libexif
risk 0.00cvss —epss 0.04
The exif_entry_get_value function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) before 0.6.21 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from process memory via crafted EXIF tags in an image.
CVE-2012-4000Jul 12, 2012
Fckeditor
Fckeditor
risk 0.03cvss —epss 0.04
Cross-site scripting (XSS) vulnerability in the print_textinputs_var function in editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.php in FCKeditor 2.6.7 and earlier allows remote attackers to inject arbitrary web script or HTML via textinputs array…
CVE-2012-3999Jul 12, 2012
Sayakbanerjee
Sticky Notes
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in admin/login.php in Sticky Notes 0.3.09062012.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter.
CVE-2012-3998Jul 12, 2012
Sayakbanerjee
Sticky Notes
risk 0.00cvss —epss 0.02
Multiple SQL injection vulnerabilities in Sticky Notes before 0.2.27052012.5 allow remote attackers to execute arbitrary SQL commands via the (1) paste id in admin/modules/mod_pastes.php or (2) show.php, (3) user id to admin/modules/mod_users.php, (4) project to list.php, or (5)…
CVE-2012-3997Jul 12, 2012
Sayakbanerjee
Sticky Notes
risk 0.00cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in Sticky Notes before 0.2.27052012.5 allow remote attackers to inject arbitrary web script or HTML via the (1) paste_user or (2) paste_lang parameter to (a) list.php or (b) show.php.
CVE-2012-3382Jul 12, 2012
Mono
Mono
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in the ProcessRequest function in mcs/class/System.Web/System.Web/HttpForbiddenHandler.cs in Mono 2.10.8 and earlier allows remote attackers to inject arbitrary web script or HTML via a file with a crafted name and a forbidden extension,…
CVE-2012-3377Jul 12, 2012
VideoLAN
VLC media player
risk 0.00cvss —epss 0.04
Heap-based buffer overflow in the Ogg_DecodePacket function in the OGG demuxer (modules/demux/ogg.c) in VideoLAN VLC media player before 2.0.2 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted OGG file.
CVE-2012-3350Jul 12, 2012
Webmatic
Webmatic
risk 0.03cvss —epss 0.03
SQL injection vulnerability in index.php in Webmatic 3.1.1 allows remote attackers to execute arbitrary SQL commands via the Referer HTTP header.
CVE-2012-3236Jul 12, 2012
GIMP
Gimp
risk 0.04cvss —epss 0.11
fits-io.c in GIMP before 2.8.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a malformed XTENSION header of a .fit file, as demonstrated using a long string.
CVE-2012-2844Jul 12, 2012
Google
Chrome
risk 0.00cvss —epss 0.02
The PDF functionality in Google Chrome before 20.0.1132.57 does not properly handle JavaScript code, which allows remote attackers to cause a denial of service (incorrect object access) or possibly have unspecified other impact via a crafted document.
CVE-2012-2843Jul 12, 2012
Google
Chrome
risk 0.00cvss —epss 0.02
Use-after-free vulnerability in Google Chrome before 20.0.1132.57 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to layout height tracking.
CVE-2012-2842Jul 12, 2012
Google
Chrome
risk 0.00cvss —epss 0.01
Use-after-free vulnerability in Google Chrome before 20.0.1132.57 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to counter handling.
CVE-2012-2614Jul 12, 2012
Lattice
Diamond Programmer
risk 0.03cvss —epss 0.04
Buffer overflow in programmer.exe in Lattice Diamond Programmer 1.4.2 allows user-assisted remote attackers to cause a denial of service (application crash) and execute arbitrary code via a long string in a version attribute of an ispXCF element in an .xcf file.
CVE-2012-1661Jul 12, 2012
Esri
Arcmap
risk 0.05cvss —epss 0.24
ESRI ArcMap 9 and ArcGIS 10.0.2.3200 and earlier does not properly prompt users before executing embedded VBA macros, which allows user-assisted remote attackers to execute arbitrary VBA code via a crafted map (.mxd) file.
CVE-2012-3362Jul 12, 2012
Extplorer
Extplorer
risk 0.00cvss —epss 0.01
Cross-site request forgery (CSRF) vulnerability in eXtplorer 2.1 RC3 and earlier allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via an adduser admin action.
CVE-2012-2653Jul 12, 2012
Lawrence Berkeley National Laboratory
Arpwatch
risk 0.00cvss —epss 0.03
arpwatch 2.1a15, as used by Red Hat, Debian, Fedora, and possibly others, does not properly drop supplementary groups, which might allow attackers to gain root privileges by leveraging other vulnerabilities in the daemon.
CVE-2012-2351Jul 12, 2012
Mahara (software)
Mahara
risk 0.00cvss —epss 0.02
The default configuration of the auth/saml plugin in Mahara before 1.4.2 sets the "Match username attribute to Remote username" option to false, which allows remote SAML IdP servers to spoof users of other SAML IdP servers by using the same internal username.
CVE-2012-1174Jul 12, 2012
Linux
Systemd
risk 0.00cvss —epss 0.00
The rm_rf_children function in util.c in the systemd-logind login manager in systemd before 44, when logging out, allows local users to delete arbitrary files via a symlink attack on unspecified files, related to "particular records related with user session."
CVE-2012-1163Jul 12, 2012
Libzip
Libzip
risk 0.00cvss —epss 0.03
Integer overflow in the _zip_readcdir function in zip_open.c in libzip 0.10 allows remote attackers to execute arbitrary code via the size and offset values for the central directory in a zip archive, which triggers "improper restrictions of operations within the bounds of a…
CVE-2012-1162Jul 12, 2012
Libzip
Libzip
risk 0.00cvss —epss 0.04
Heap-based buffer overflow in the _zip_readcdir function in zip_open.c in libzip 0.10 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a zip archive with the number of directories set to 0, related to an "incorrect…
CVE-2012-1037Jul 12, 2012
Glpi Project
Glpi
risk 0.00cvss —epss 0.01
PHP remote file inclusion vulnerability in front/popup.php in GLPI 0.78 through 0.80.61 allows remote authenticated users to execute arbitrary PHP code via a URL in the sub_type parameter.
CVE-2012-0215Jul 12, 2012
Tryton
Trytond
risk 0.00cvss —epss 0.02
model/modelstorage.py in the Tryton application framework (trytond) before 2.4.0 for Python does not properly restrict access to the Many2Many field in the relation model, which allows remote authenticated users to modify the privileges of arbitrary users via a (1) create, (2)…
CVE-2012-3996Jul 12, 2012
Tiki
Tikiwiki CMS\/groupware
risk 0.03cvss —epss 0.05
TikiWiki CMS/Groupware 8.3 and earlier allows remote attackers to obtain the installation path via a direct request to (1) admin/include_calendar.php, (2) tiki-rss_error.php, or (3) tiki-watershed_service.php.
CVE-2012-3881Jul 12, 2012
Adrian Chadd
Rtg
risk 0.00cvss —epss 0.01
Multiple SQL injection vulnerabilities in RTG 0.7.4 and RTG2 0.9.2 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) 95.php, (2) view.php, or (3) rtg.php.
CVE-2012-3805Jul 12, 2012
Kajona
Kajona
risk 0.03cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in the getAllPassedParams function in system/functions.php in Kajona before 3.4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) absender_name, (2) absender_email, or (3) absender_nachricht parameter…
CVE-2012-3399Jul 12, 2012
Artis.imag
Basilic
risk 0.08cvss —epss 0.65
Config/diff.php in Basilic 1.5.14 allows remote attackers to execute arbitrary commands via shell metacharacters in the file parameter.
CVE-2012-3376Jul 12, 2012
Apache
Hadoop
risk 0.00cvss —epss 0.03
DataNodes in Apache Hadoop 2.0.0 alpha does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out the same BlockPool twice from a NodeName, which might allow remote clients to read arbitrary blocks, write to blocks to which they only have…
CVE-2012-2763Jul 12, 2012
GIMP
Gimp
risk 0.10cvss —epss 0.82
Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/scheme.c in GIMP 2.6.12 and earlier, and possibly 2.6.13, allows remote attackers to execute arbitrary code via a long string in a command to the script-fu server.
CVE-2012-1620Jul 12, 2012
Suckless
Slock
risk 0.00cvss —epss 0.01
slock 0.9 does not properly handle the XRaiseWindow event when the screen is locked, which might allow physically proximate attackers to obtain sensitive information by pressing a button, which reveals the desktop and active windows.
CVE-2012-0911CriJul 12, 2012
Tiki
Tikiwiki CMS\/groupware
risk 0.72cvss 9.8epss 0.63
TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows remote attackers to execute arbitrary PHP code via a crafted serialized object in the (1) cookieName to lib/banners/bannerlib.php; (2) printpages or (3) printstructures parameter to (a) tiki-print_multi_pages.php or (b)…
CVE-2012-3076Jul 12, 2012
Cisco Systems, Inc.
Telepresence Recording Server
risk 0.00cvss —epss 0.02
The administrative web interface on Cisco TelePresence Recording Server before 1.8.0 allows remote authenticated users to execute arbitrary commands via unspecified vectors, aka Bug ID CSCth85804.
CVE-2012-3075Jul 12, 2012
Cisco Systems, Inc.
Telepresence System Software
risk 0.00cvss —epss 0.02
The administrative web interface on Cisco TelePresence Immersive Endpoint Devices before 1.7.4 allows remote authenticated users to execute arbitrary commands via a malformed request on TCP port 443, aka Bug ID CSCtn99724.
CVE-2012-3074Jul 12, 2012
Cisco Systems, Inc.
Telepresence System Software
risk 0.00cvss —epss 0.01
An unspecified API on Cisco TelePresence Immersive Endpoint Devices before 1.9.1 allows remote attackers to execute arbitrary commands by leveraging certain adjacency and sending a malformed request on TCP port 61460, aka Bug ID CSCtz38382.