CVEs

386,593 total · page 6717 of 7,732

CVE	Vendor / Product	Risk	CVSS	EPSS	Published	Description
CVE-2012-2640	NEC BIGLOBE Yome Collection	0.00	—	0.01	Jul 5, 2012	The NEC BIGLOBE Yome Collection application 1.8.3 and earlier for Android allows remote attackers to read the IMEI value from an SD card via a crafted application that lacks the READ_PHONE_STATE permission.
CVE-2012-0303	Symantec Message Filter	0.00	—	0.01	Jul 5, 2012	Multiple cross-site request forgery (CSRF) vulnerabilities in Brightmail Control Center in Symantec Message Filter 6.3 allow remote attackers to hijack the authentication of arbitrary users for requests that (1) execute application commands or (2) create admin accounts.
CVE-2012-0302	Symantec Message Filter	0.00	—	0.01	Jul 5, 2012	Cross-site scripting (XSS) vulnerability in Brightmail Control Center in Symantec Message Filter 6.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-0301	Symantec Message Filter	0.00	—	0.01	Jul 5, 2012	Session fixation vulnerability in Brightmail Control Center in Symantec Message Filter 6.3 allows remote attackers to hijack web sessions via unspecified vectors.
CVE-2012-0300	Symantec Message Filter	0.00	—	0.01	Jul 5, 2012	Brightmail Control Center in Symantec Message Filter 6.3 does not properly restrict establishment of sessions to the listening port, which allows remote attackers to obtain potentially sensitive version information via unspecified vectors.
CVE-2012-2281	Rsa Access Manager Agent	0.00	—	0.01	Jul 5, 2012	EMC RSA Access Manager Server 6.x before 6.1 SP4 and RSA Access Manager Agent do not properly validate session tokens after a logout, which might allow remote attackers to conduct replay attacks via unspecified vectors.
CVE-2012-2143	PHP PHP	0.00	—	0.06	Jul 5, 2012	The crypt_des (aka DES-based crypt) function in FreeBSD before 9.0-RELEASE-p2, as used in PHP, PostgreSQL, and other products, does not process the complete cleartext password if this password contains a 0x80 character, which makes it easier for context-dependent attackers to…
CVE-2012-0410	Novell Groupwise	0.00	—	0.04	Jul 5, 2012	Directory traversal vulnerability in WebAccess in Novell GroupWise before 8.03 allows remote attackers to read arbitrary files via the User.interface parameter.
CVE-2012-3847	Invensys Wonderware Application Server	0.00	—	0.01	Jul 5, 2012	slssvc.exe in Invensys Wonderware SuiteLink in Invensys InTouch 2012 and Wonderware Application Server 2012 allows remote attackers to cause a denial of service (resource consumption) via a long Unicode string, a different vulnerability than CVE-2012-3007.
CVE-2012-3007	Invensys Wonderware Application Server	0.00	—	0.02	Jul 5, 2012	Stack-based buffer overflow in slssvc.exe before 58.x in Invensys Wonderware SuiteLink in the Invensys System Platform software suite, as used in InTouch/Wonderware Application Server IT before 10.5 and WAS before 3.5, DASABCIP before 4.1 SP2, DASSiDirect before 3.0, DAServer…
CVE-2012-2560	Wellintech Kingview	0.00	—	0.03	Jul 5, 2012	Directory traversal vulnerability in WellinTech KingView 6.53 allows remote attackers to read arbitrary files via a crafted HTTP request to port 8001.
CVE-2012-2559	Wellintech Kinghistorian	0.00	—	0.05	Jul 5, 2012	WellinTech KingHistorian 3.0 allows remote attackers to execute arbitrary code or cause a denial of service (invalid pointer write) via a crafted packet to TCP port 5678.
CVE-2012-2516	Ge Intelligent Platforms Proficy Historian	0.06	—	0.40	Jul 5, 2012	An ActiveX control in KeyHelp.ocx in KeyWorks KeyHelp Module (aka the HTML Help component), as used in GE Intelligent Platforms Proficy Historian 3.1, 3.5, 4.0, and 4.5; Proficy HMI/SCADA iFIX 5.0 and 5.1; Proficy Pulse 1.0; Proficy Batch Execution 5.6; SI7 I/O Driver 7.20…
CVE-2012-2515	Ge Intelligent Platforms Proficy Historian	0.05	—	0.28	Jul 5, 2012	Multiple stack-based buffer overflows in the KeyHelp.KeyCtrl.1 ActiveX control in KeyHelp.ocx 1.2.312 in KeyWorks KeyHelp Module (aka the HTML Help component), as used in EMC Documentum ApplicationXtender Desktop 5.4; EMC Captiva Quickscan Pro 4.6 SP1; GE Intelligent Platforms…
CVE-2012-1832	Wellintech Kingview	0.00	—	0.06	Jul 5, 2012	WellinTech KingView 6.53 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via a crafted packet to (1) TCP or (2) UDP port 2001.
CVE-2012-1831	Wellintech Kingview	0.04	—	0.16	Jul 5, 2012	Heap-based buffer overflow in WellinTech KingView 6.53 allows remote attackers to execute arbitrary code via a crafted packet to TCP port 555.
CVE-2012-1830	Wellintech Kingview	0.04	—	0.08	Jul 5, 2012	Stack-based buffer overflow in WellinTech KingView 6.53 allows remote attackers to execute arbitrary code via a crafted packet to TCP port 555.
CVE-2012-3846	PHP Pastebin PHP-pastebin	0.00	—	0.01	Jul 3, 2012	Cross-site scripting (XSS) vulnerability in index.php in PHP-pastebin 2.1 allows remote attackers to inject arbitrary web script or HTML via the title parameter.
CVE-2012-3845	Lan Messenger Lan Messenger1.2.28	0.03	—	0.03	Jul 3, 2012	Buffer overflow in LAN Messenger 1.2.28 and earlier allows remote attackers to cause a denial of service (crash) via a long string in an initiation request.
CVE-2012-3844	Jelsoft Vbulletin	0.00	—	0.01	Jul 3, 2012	Cross-site scripting (XSS) vulnerability in vBulletin 4.1.12 allows remote attackers to inject arbitrary web script or HTML via a long string in the subject parameter when creating a post.
CVE-2012-3843	E107 E107	0.00	—	0.01	Jul 3, 2012	Cross-site scripting (XSS) vulnerability in the registration page in e107, probably 1.0.1, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-3842	Directadmin Directadmin	0.00	—	0.01	Jul 3, 2012	Multiple cross-site scripting (XSS) vulnerabilities in CMD_DOMAIN in JBMC Software DirectAdmin 1.403 allow remote authenticated users with certain privileges to inject arbitrary web script or HTML via the (1) select0 or (2) select8 parameters.
CVE-2012-3841	Kmplayer Kmplayer	0.00	—	0.03	Jul 3, 2012	Untrusted search path vulnerability in KMPlayer 3.2.0.19 allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse ehtrace.dll that is located in the current working directory.
CVE-2012-3840	Myclientbase Myclientbase	0.03	—	0.02	Jul 3, 2012	Multiple cross-site scripting (XSS) vulnerabilities in index.php/users/form/user_id in MyClientBase 0.12 allow remote attackers to inject arbitrary web script or HTML via the (1) first_name or (2) last_name parameters.
CVE-2012-3839	Myclientbase Myclientbase	0.03	—	0.02	Jul 3, 2012	Multiple SQL injection vulnerabilities in application/core/MY_Model.php in MyClientBase 0.12 allow remote attackers to execute arbitrary SQL commands via the (1) invoice_number or (2) tags parameter to index.php/invoice_search.
CVE-2012-3838	Babygekko Babygekko	0.03	—	0.03	Jul 3, 2012	Gekko before 1.2.0 allows remote attackers to obtain the installation path via a direct request to (1) admin/templates/babygekko/index.php or (2) templates/html5demo/index.php.
CVE-2012-3837	Babygekko Babygekko	0.03	—	0.02	Jul 3, 2012	Multiple cross-site scripting (XSS) vulnerabilities in apps/users/registration.template.php in Baby Gekko 1.2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) username, (2) email_address, (3) password, (4) password_verify, (5) firstname,…
CVE-2012-3836	Babygekko Babygekko	0.03	—	0.02	Jul 3, 2012	Multiple cross-site scripting (XSS) vulnerabilities in Baby Gekko before 1.2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) groupname parameter in a savecategory in the users module; (2) virtual_filename, (3) branch, (4) contact_person, (5) street,…
CVE-2012-3835	Alienvault Open Source Security Information Management	0.03	—	0.02	Jul 3, 2012	Multiple cross-site scripting (XSS) vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) 3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) url parameter to top.php or (2) time[0][0] parameter to…
CVE-2012-3834	Alienvault Open Source Security Information Management	0.03	—	0.01	Jul 3, 2012	SQL injection vulnerability in forensics/base_qry_main.php in AlienVault Open Source Security Information Management (OSSIM) 3.1 allows remote authenticated users to execute arbitrary SQL commands via the time[0][0] parameter.
CVE-2012-3833	Open Solution Quick.CMS	0.00	—	0.01	Jul 3, 2012	Cross-site scripting (XSS) vulnerability in the default index page in admin/ in Quick.CMS 4.0 allows remote attackers to inject arbitrary web script or HTML via the p parameter.
CVE-2012-3832	Milesj Decoda	0.00	—	0.01	Jul 3, 2012	Cross-site scripting (XSS) vulnerability in decoda/Decoda.php in Decoda before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors related to (1) b or (2) div tags.
CVE-2012-3831	Milesj Decoda	0.00	—	0.02	Jul 3, 2012	Cross-site scripting (XSS) vulnerability in decoda/templates/video.php in Decoda before 3.3.1 allows remote attackers to inject arbitrary web script or HTML via multiple URLs in an img tag.
CVE-2012-3830	Milesj Decoda	0.00	—	0.04	Jul 3, 2012	Cross-site scripting (XSS) vulnerability in decoda/templates/video.php in Decoda before 3.3.3 allows remote attackers to inject arbitrary web script or HTML via the video directive.
CVE-2012-3829	Joomla Joomla!	0.00	—	0.01	Jul 3, 2012	Joomla! 2.5.3 allows remote attackers to obtain the installation path via the Host HTTP Header.
CVE-2012-3828	Joomla Joomla!	0.00	—	0.02	Jul 3, 2012	Cross-site scripting (XSS) vulnerability in Joomla! 2.5.3 allows remote attackers to inject arbitrary web script or HTML via the Host HTTP Header.
CVE-2012-2314	Fedoraproject Anaconda	0.00	—	0.00	Jul 3, 2012	The bootloader configuration module (pyanaconda/bootloader.py) in Anaconda uses 755 permissions for /etc/grub.d, which allows local users to obtain password hashes and conduct brute force password guessing attacks.
CVE-2012-3368	dtach dtach	0.00	—	0.02	Jul 3, 2012	Integer signedness error in attach.c in dtach 0.8 allows remote attackers to obtain sensitive information from daemon stack memory in opportunistic circumstances by reading application data after an improper connection-close request, as demonstrated by running an IRC client in…
CVE-2012-2181	IBM Websphere Portal	0.00	—	0.03	Jul 3, 2012	Directory traversal vulnerability in the Dojo module in IBM WebSphere Portal 7.0.0.1 and 7.0.0.2 before CF14, and 8.0, allows remote attackers to read arbitrary files via a crafted URL.
CVE-2011-5096	Avaya Aura Application Server 5300	0.00	—	0.04	Jul 3, 2012	Stack-based buffer overflow in cstore.exe in the Media Application Server (MAS) in Avaya Aura Application Server 5300 (formerly Nortel Media Application Server) 1.x before 1.0.2 and 2.0 before Patch Bundle 10 allows remote attackers to execute arbitrary code via a crafted…
CVE-2012-3811	Avaya IP Office Customer Call Reporter	0.08	—	0.63	Jul 3, 2012	Unrestricted file upload vulnerability in ImageUpload.ashx in the Wallboard application in Avaya IP Office Customer Call Reporter 7.0 before 7.0.5.8 Q1 2012 Maintenance Release and 8.0 before 8.0.9.13 Q1 2012 Maintenance Release allows remote attackers to execute arbitrary code…
CVE-2012-2748	Joomla Joomla!	0.00	—	0.02	Jul 3, 2012	Unspecified vulnerability in Joomla! 2.5.x before 2.5.5 allows remote attackers to obtain sensitive information via vectors related to "Inadequate filtering" and a "SQL error."
CVE-2012-2747	Joomla Joomla!	0.00	—	0.02	Jul 3, 2012	Unspecified vulnerability in Joomla! 2.5.x before 2.5.5 allows remote attackers to gain privileges via unknown attack vectors related to "Inadequate checking."
CVE-2012-2318	Pidgin (software) Pidgin	0.00	—	0.02	Jul 3, 2012	msg.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.4 does not properly handle crafted characters, which allows remote servers to cause a denial of service (application crash) by placing these characters in a text/plain message.
CVE-2012-2214	Pidgin (software) Pidgin	0.00	—	0.02	Jul 3, 2012	proxy.c in libpurple in Pidgin before 2.10.4 does not properly handle canceled SOCKS5 connection attempts, which allows user-assisted remote authenticated users to cause a denial of service (application crash) via a sequence of XMPP file-transfer requests.
CVE-2012-1148	Apple Inc. Mac OS X	0.00	—	0.04	Jul 3, 2012	Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service (memory consumption) via a large number of crafted XML files that cause improperly-handled reallocation failures when expanding…
CVE-2012-1147	Apple Inc. Mac OS X	0.00	—	0.03	Jul 3, 2012	readfilemap.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service (file descriptor consumption) via a large number of crafted XML files.
CVE-2012-0876	Python (programming language) Python	0.00	—	0.06	Jul 3, 2012	The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML file with many identifiers with the…
CVE-2011-4029	Xorg Xserver	0.03	—	0.01	Jul 3, 2012	The LockServer function in os/utils.c in X.Org xserver before 1.11.2 allows local users to change the permissions of arbitrary files to 444, read those files, and possibly cause a denial of service (removed execution permission) via a symlink attack on a temporary lock file.
CVE-2011-4028	Xorg Xserver	0.00	—	0.00	Jul 3, 2012	The LockServer function in os/utils.c in X.Org xserver before 1.11.2 allows local users to determine the existence of arbitrary files via a symlink attack on a temporary lock file, which is handled differently if the file exists.

CVE-2012-2640Jul 5, 2012
NEC
BIGLOBE Yome Collection
risk 0.00cvss —epss 0.01
The NEC BIGLOBE Yome Collection application 1.8.3 and earlier for Android allows remote attackers to read the IMEI value from an SD card via a crafted application that lacks the READ_PHONE_STATE permission.
CVE-2012-0303Jul 5, 2012
Symantec
Message Filter
risk 0.00cvss —epss 0.01
Multiple cross-site request forgery (CSRF) vulnerabilities in Brightmail Control Center in Symantec Message Filter 6.3 allow remote attackers to hijack the authentication of arbitrary users for requests that (1) execute application commands or (2) create admin accounts.
CVE-2012-0302Jul 5, 2012
Symantec
Message Filter
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Brightmail Control Center in Symantec Message Filter 6.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-0301Jul 5, 2012
Symantec
Message Filter
risk 0.00cvss —epss 0.01
Session fixation vulnerability in Brightmail Control Center in Symantec Message Filter 6.3 allows remote attackers to hijack web sessions via unspecified vectors.
CVE-2012-0300Jul 5, 2012
Symantec
Message Filter
risk 0.00cvss —epss 0.01
Brightmail Control Center in Symantec Message Filter 6.3 does not properly restrict establishment of sessions to the listening port, which allows remote attackers to obtain potentially sensitive version information via unspecified vectors.
CVE-2012-2281Jul 5, 2012
Rsa
Access Manager Agent
risk 0.00cvss —epss 0.01
EMC RSA Access Manager Server 6.x before 6.1 SP4 and RSA Access Manager Agent do not properly validate session tokens after a logout, which might allow remote attackers to conduct replay attacks via unspecified vectors.
CVE-2012-2143Jul 5, 2012
PHP
PHP
risk 0.00cvss —epss 0.06
The crypt_des (aka DES-based crypt) function in FreeBSD before 9.0-RELEASE-p2, as used in PHP, PostgreSQL, and other products, does not process the complete cleartext password if this password contains a 0x80 character, which makes it easier for context-dependent attackers to…
CVE-2012-0410Jul 5, 2012
Novell
Groupwise
risk 0.00cvss —epss 0.04
Directory traversal vulnerability in WebAccess in Novell GroupWise before 8.03 allows remote attackers to read arbitrary files via the User.interface parameter.
CVE-2012-3847Jul 5, 2012
Invensys
Wonderware Application Server
risk 0.00cvss —epss 0.01
slssvc.exe in Invensys Wonderware SuiteLink in Invensys InTouch 2012 and Wonderware Application Server 2012 allows remote attackers to cause a denial of service (resource consumption) via a long Unicode string, a different vulnerability than CVE-2012-3007.
CVE-2012-3007Jul 5, 2012
Invensys
Wonderware Application Server
risk 0.00cvss —epss 0.02
Stack-based buffer overflow in slssvc.exe before 58.x in Invensys Wonderware SuiteLink in the Invensys System Platform software suite, as used in InTouch/Wonderware Application Server IT before 10.5 and WAS before 3.5, DASABCIP before 4.1 SP2, DASSiDirect before 3.0, DAServer…
CVE-2012-2560Jul 5, 2012
Wellintech
Kingview
risk 0.00cvss —epss 0.03
Directory traversal vulnerability in WellinTech KingView 6.53 allows remote attackers to read arbitrary files via a crafted HTTP request to port 8001.
CVE-2012-2559Jul 5, 2012
Wellintech
Kinghistorian
risk 0.00cvss —epss 0.05
WellinTech KingHistorian 3.0 allows remote attackers to execute arbitrary code or cause a denial of service (invalid pointer write) via a crafted packet to TCP port 5678.
CVE-2012-2516Jul 5, 2012
Ge
Intelligent Platforms Proficy Historian
risk 0.06cvss —epss 0.40
An ActiveX control in KeyHelp.ocx in KeyWorks KeyHelp Module (aka the HTML Help component), as used in GE Intelligent Platforms Proficy Historian 3.1, 3.5, 4.0, and 4.5; Proficy HMI/SCADA iFIX 5.0 and 5.1; Proficy Pulse 1.0; Proficy Batch Execution 5.6; SI7 I/O Driver 7.20…
CVE-2012-2515Jul 5, 2012
Ge
Intelligent Platforms Proficy Historian
risk 0.05cvss —epss 0.28
Multiple stack-based buffer overflows in the KeyHelp.KeyCtrl.1 ActiveX control in KeyHelp.ocx 1.2.312 in KeyWorks KeyHelp Module (aka the HTML Help component), as used in EMC Documentum ApplicationXtender Desktop 5.4; EMC Captiva Quickscan Pro 4.6 SP1; GE Intelligent Platforms…
CVE-2012-1832Jul 5, 2012
Wellintech
Kingview
risk 0.00cvss —epss 0.06
WellinTech KingView 6.53 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via a crafted packet to (1) TCP or (2) UDP port 2001.
CVE-2012-1831Jul 5, 2012
Wellintech
Kingview
risk 0.04cvss —epss 0.16
Heap-based buffer overflow in WellinTech KingView 6.53 allows remote attackers to execute arbitrary code via a crafted packet to TCP port 555.
CVE-2012-1830Jul 5, 2012
Wellintech
Kingview
risk 0.04cvss —epss 0.08
Stack-based buffer overflow in WellinTech KingView 6.53 allows remote attackers to execute arbitrary code via a crafted packet to TCP port 555.
CVE-2012-3846Jul 3, 2012
PHP Pastebin
PHP-pastebin
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in index.php in PHP-pastebin 2.1 allows remote attackers to inject arbitrary web script or HTML via the title parameter.
CVE-2012-3845Jul 3, 2012
Lan Messenger
Lan Messenger1.2.28
risk 0.03cvss —epss 0.03
Buffer overflow in LAN Messenger 1.2.28 and earlier allows remote attackers to cause a denial of service (crash) via a long string in an initiation request.
CVE-2012-3844Jul 3, 2012
Jelsoft
Vbulletin
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in vBulletin 4.1.12 allows remote attackers to inject arbitrary web script or HTML via a long string in the subject parameter when creating a post.
CVE-2012-3843Jul 3, 2012
E107
E107
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the registration page in e107, probably 1.0.1, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-3842Jul 3, 2012
Directadmin
Directadmin
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in CMD_DOMAIN in JBMC Software DirectAdmin 1.403 allow remote authenticated users with certain privileges to inject arbitrary web script or HTML via the (1) select0 or (2) select8 parameters.
CVE-2012-3841Jul 3, 2012
Kmplayer
Kmplayer
risk 0.00cvss —epss 0.03
Untrusted search path vulnerability in KMPlayer 3.2.0.19 allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse ehtrace.dll that is located in the current working directory.
CVE-2012-3840Jul 3, 2012
Myclientbase
Myclientbase
risk 0.03cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in index.php/users/form/user_id in MyClientBase 0.12 allow remote attackers to inject arbitrary web script or HTML via the (1) first_name or (2) last_name parameters.
CVE-2012-3839Jul 3, 2012
Myclientbase
Myclientbase
risk 0.03cvss —epss 0.02
Multiple SQL injection vulnerabilities in application/core/MY_Model.php in MyClientBase 0.12 allow remote attackers to execute arbitrary SQL commands via the (1) invoice_number or (2) tags parameter to index.php/invoice_search.
CVE-2012-3838Jul 3, 2012
Babygekko
Babygekko
risk 0.03cvss —epss 0.03
Gekko before 1.2.0 allows remote attackers to obtain the installation path via a direct request to (1) admin/templates/babygekko/index.php or (2) templates/html5demo/index.php.
CVE-2012-3837Jul 3, 2012
Babygekko
Babygekko
risk 0.03cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in apps/users/registration.template.php in Baby Gekko 1.2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) username, (2) email_address, (3) password, (4) password_verify, (5) firstname,…
CVE-2012-3836Jul 3, 2012
Babygekko
Babygekko
risk 0.03cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in Baby Gekko before 1.2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) groupname parameter in a savecategory in the users module; (2) virtual_filename, (3) branch, (4) contact_person, (5) street,…
CVE-2012-3835Jul 3, 2012
Alienvault
Open Source Security Information Management
risk 0.03cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) 3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) url parameter to top.php or (2) time[0][0] parameter to…
CVE-2012-3834Jul 3, 2012
Alienvault
Open Source Security Information Management
risk 0.03cvss —epss 0.01
SQL injection vulnerability in forensics/base_qry_main.php in AlienVault Open Source Security Information Management (OSSIM) 3.1 allows remote authenticated users to execute arbitrary SQL commands via the time[0][0] parameter.
CVE-2012-3833Jul 3, 2012
Open Solution
Quick.CMS
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the default index page in admin/ in Quick.CMS 4.0 allows remote attackers to inject arbitrary web script or HTML via the p parameter.
CVE-2012-3832Jul 3, 2012
Milesj
Decoda
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in decoda/Decoda.php in Decoda before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors related to (1) b or (2) div tags.
CVE-2012-3831Jul 3, 2012
Milesj
Decoda
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in decoda/templates/video.php in Decoda before 3.3.1 allows remote attackers to inject arbitrary web script or HTML via multiple URLs in an img tag.
CVE-2012-3830Jul 3, 2012
Milesj
Decoda
risk 0.00cvss —epss 0.04
Cross-site scripting (XSS) vulnerability in decoda/templates/video.php in Decoda before 3.3.3 allows remote attackers to inject arbitrary web script or HTML via the video directive.
CVE-2012-3829Jul 3, 2012
Joomla
Joomla!
risk 0.00cvss —epss 0.01
Joomla! 2.5.3 allows remote attackers to obtain the installation path via the Host HTTP Header.
CVE-2012-3828Jul 3, 2012
Joomla
Joomla!
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in Joomla! 2.5.3 allows remote attackers to inject arbitrary web script or HTML via the Host HTTP Header.
CVE-2012-2314Jul 3, 2012
Fedoraproject
Anaconda
risk 0.00cvss —epss 0.00
The bootloader configuration module (pyanaconda/bootloader.py) in Anaconda uses 755 permissions for /etc/grub.d, which allows local users to obtain password hashes and conduct brute force password guessing attacks.
CVE-2012-3368Jul 3, 2012
dtach
dtach
risk 0.00cvss —epss 0.02
Integer signedness error in attach.c in dtach 0.8 allows remote attackers to obtain sensitive information from daemon stack memory in opportunistic circumstances by reading application data after an improper connection-close request, as demonstrated by running an IRC client in…
CVE-2012-2181Jul 3, 2012
IBM
Websphere Portal
risk 0.00cvss —epss 0.03
Directory traversal vulnerability in the Dojo module in IBM WebSphere Portal 7.0.0.1 and 7.0.0.2 before CF14, and 8.0, allows remote attackers to read arbitrary files via a crafted URL.
CVE-2011-5096Jul 3, 2012
Avaya
Aura Application Server 5300
risk 0.00cvss —epss 0.04
Stack-based buffer overflow in cstore.exe in the Media Application Server (MAS) in Avaya Aura Application Server 5300 (formerly Nortel Media Application Server) 1.x before 1.0.2 and 2.0 before Patch Bundle 10 allows remote attackers to execute arbitrary code via a crafted…
CVE-2012-3811Jul 3, 2012
Avaya
IP Office Customer Call Reporter
risk 0.08cvss —epss 0.63
Unrestricted file upload vulnerability in ImageUpload.ashx in the Wallboard application in Avaya IP Office Customer Call Reporter 7.0 before 7.0.5.8 Q1 2012 Maintenance Release and 8.0 before 8.0.9.13 Q1 2012 Maintenance Release allows remote attackers to execute arbitrary code…
CVE-2012-2748Jul 3, 2012
Joomla
Joomla!
risk 0.00cvss —epss 0.02
Unspecified vulnerability in Joomla! 2.5.x before 2.5.5 allows remote attackers to obtain sensitive information via vectors related to "Inadequate filtering" and a "SQL error."
CVE-2012-2747Jul 3, 2012
Joomla
Joomla!
risk 0.00cvss —epss 0.02
Unspecified vulnerability in Joomla! 2.5.x before 2.5.5 allows remote attackers to gain privileges via unknown attack vectors related to "Inadequate checking."
CVE-2012-2318Jul 3, 2012
Pidgin (software)
Pidgin
risk 0.00cvss —epss 0.02
msg.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.4 does not properly handle crafted characters, which allows remote servers to cause a denial of service (application crash) by placing these characters in a text/plain message.
CVE-2012-2214Jul 3, 2012
Pidgin (software)
Pidgin
risk 0.00cvss —epss 0.02
proxy.c in libpurple in Pidgin before 2.10.4 does not properly handle canceled SOCKS5 connection attempts, which allows user-assisted remote authenticated users to cause a denial of service (application crash) via a sequence of XMPP file-transfer requests.
CVE-2012-1148Jul 3, 2012
Apple Inc.
Mac OS X
risk 0.00cvss —epss 0.04
Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service (memory consumption) via a large number of crafted XML files that cause improperly-handled reallocation failures when expanding…
CVE-2012-1147Jul 3, 2012
Apple Inc.
Mac OS X
risk 0.00cvss —epss 0.03
readfilemap.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service (file descriptor consumption) via a large number of crafted XML files.
CVE-2012-0876Jul 3, 2012
Python (programming language)
Python
risk 0.00cvss —epss 0.06
The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML file with many identifiers with the…
CVE-2011-4029Jul 3, 2012
Xorg
Xserver
risk 0.03cvss —epss 0.01
The LockServer function in os/utils.c in X.Org xserver before 1.11.2 allows local users to change the permissions of arbitrary files to 444, read those files, and possibly cause a denial of service (removed execution permission) via a symlink attack on a temporary lock file.
CVE-2011-4028Jul 3, 2012
Xorg
Xserver
risk 0.00cvss —epss 0.00
The LockServer function in os/utils.c in X.Org xserver before 1.11.2 allows local users to determine the existence of arbitrary files via a symlink attack on a temporary lock file, which is handled differently if the file exists.