CVEs

386,593 total · page 6722 of 7,732

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	KEV	Published	Description
CVE-2012-3578	WordPress Fcchat Widget		0.04	—	0.08		Jun 17, 2012	Unrestricted file upload vulnerability in html/Upload.php in the FCChat Widget plugin 2.2.13.1 and earlier for WordPress allows remote attackers to execute arbitrary code by uploading a file with a file with an executable extension followed by a safe extension, then accessing it…
CVE-2012-3577	WordPress Nmedia Member Conversation		0.04	—	0.14		Jun 17, 2012	Unrestricted file upload vulnerability in doupload.php in the Nmedia Member Conversation plugin before 1.4 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in…
CVE-2012-2693	Red Hat Libvirt		0.00	—	0.00		Jun 17, 2012	libvirt, possibly before 0.9.12, does not properly assign USB devices to virtual machines when multiple devices have the same vendor and product ID, which might cause the wrong device to be associated with a guest and might allow local users to access unintended USB devices.
CVE-2012-2692	Mantisbt Mantisbt		0.00	—	0.01		Jun 17, 2012	MantisBT before 1.2.11 does not check the delete_attachments_threshold permission when form_security_validation is set to OFF, which allows remote authenticated users with certain privileges to bypass intended access restrictions and delete arbitrary attachments.
CVE-2012-2691	Mantisbt Mantisbt		0.00	—	0.04		Jun 17, 2012	The mc_issue_note_update function in the SOAP API in MantisBT before 1.2.11 does not properly check privileges, which allows remote attackers with bug reporting privileges to edit arbitrary bugnotes via a SOAP request.
CVE-2012-2672	Oracle Corporation Mojarra		0.00	—	0.01		Jun 17, 2012	Oracle Mojarra 2.1.7 does not properly "clean up" the FacesContext reference during startup, which allows local users to obtain context information an access resources from another WAR file by calling the FacesContext.getCurrentInstance function.
CVE-2012-2671	Rtomayko Rack Cach		0.00	—	0.02		Jun 17, 2012	The Rack::Cache rubygem 0.3.0 through 1.1 caches Set-Cookie and other sensitive headers, which allows attackers to obtain sensitive cookie information, hijack web sessions, or have other unspecified impact by accessing the cache.
CVE-2012-2670	Collabtive Collabtive		0.00	—	0.02		Jun 17, 2012	manageuser.php in Collabtive before 0.7.6 allows remote authenticated users, and possibly unauthenticated attackers, to bypass intended access restrictions and upload and execute arbitrary files by uploading an avatar file with an accepted Content-Type such as image/jpeg, then…
CVE-2012-2668	OpenLDAP Openldap		0.00	—	0.04		Jun 17, 2012	libraries/libldap/tls_m.c in OpenLDAP, possibly 2.4.31 and earlier, when using the Mozilla NSS backend, always uses the default cipher suite even when TLSCipherSuite is set, which might cause OpenLDAP to use weaker ciphers than intended and make it easier for remote attackers to…
CVE-2012-2417	Dlitz Pycrypto		0.00	—	0.02		Jun 17, 2012	PyCrypto before 2.6 does not produce appropriate prime numbers when using an ElGamal scheme to generate a key, which reduces the signature space or public key space and makes it easier for attackers to conduct brute force attacks to obtain the private key.
CVE-2012-2091	Flightgear Flightgear		0.01	—	0.06		Jun 17, 2012	Multiple buffer overflows in FlightGear 2.6 and earlier and SimGear 2.6 and earlier allow user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a (1) long string in a rotor tag of an aircraft xml model to the…
CVE-2012-2090	Flightgear Flightgear		0.00	—	0.06		Jun 17, 2012	Multiple format string vulnerabilities in FlightGear 2.6 and earlier and SimGear 2.6 and earlier allow user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via format string specifiers in certain data chunk values in an aircraft xml…
CVE-2012-0037	Libreoffice Libreoffice	Med	0.36	6.5	0.14		Jun 17, 2012	Redland Raptor (aka libraptor) before 2.0.7, as used by OpenOffice 3.3 and 3.4 Beta, LibreOffice before 3.4.6 and 3.5.x before 3.5.1, and other products, allows user-assisted remote attackers to read arbitrary files via a crafted XML external entity (XXE) declaration and…
CVE-2012-1726	Sun Corporation Java SE		0.00	—	0.03		Jun 16, 2012	Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries.
CVE-2012-1725	Sun Corporation Jre		0.00	—	0.06		Jun 16, 2012	Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, and 5 update 35 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to…
CVE-2012-1724	Sun Corporation Jre		0.00	—	0.04		Jun 16, 2012	Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, and 6 update 32 and earlier, allows remote attackers to affect availability, related to JAXP.
CVE-2012-1723	Oracle Corporation Jre	Cri	0.92	9.8	0.94	KEV	Jun 16, 2012	Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect confidentiality, integrity, and availability via…
CVE-2012-1722	Sun Corporation Java SE		0.00	—	0.05		Jun 16, 2012	Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, and 6 update 32 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different…
CVE-2012-1721	Sun Corporation Java SE		0.00	—	0.05		Jun 16, 2012	Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, and 6 update 32 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different…
CVE-2012-1720	Sun Corporation Jre		0.00	—	0.00		Jun 16, 2012	Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier, when running on Solaris, allows local users to affect confidentiality, integrity, and…
CVE-2012-1719	Sun Corporation Jre		0.00	—	0.03		Jun 16, 2012	Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect integrity, related to CORBA.
CVE-2012-1718	Sun Corporation Jre		0.00	—	0.04		Jun 16, 2012	Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect availability via unknown vectors related to Security.
CVE-2012-1717	Sun Corporation Java SE		0.00	—	0.00		Jun 16, 2012	Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows local users to affect confidentiality via unknown vectors related to printing on…
CVE-2012-1716	Sun Corporation Jre		0.00	—	0.06		Jun 16, 2012	Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, and 5 update 35 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to…
CVE-2012-1713	Sun Corporation Jre		0.00	—	0.06		Jun 16, 2012	Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, 1.4.2_37 and earlier, and JavaFX 2.1 and earlier allows remote attackers to affect confidentiality, integrity,…
CVE-2012-1711	Sun Corporation Jre		0.00	—	0.03		Jun 16, 2012	Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related…
CVE-2012-1583	Linux Kernel		0.00	—	0.04		Jun 16, 2012	Double free vulnerability in the xfrm6_tunnel_rcv function in net/ipv6/xfrm6_tunnel.c in the Linux kernel before 2.6.22, when the xfrm6_tunnel module is enabled, allows remote attackers to cause a denial of service (panic) via crafted IPv6 packets.
CVE-2011-5094	Mozilla Corporation Network Security Services		0.00	—	0.03		Jun 16, 2012	Mozilla Network Security Services (NSS) 3.x, with certain settings of the SSL_ENABLE_RENEGOTIATION option, does not properly restrict client-initiated renegotiation within the SSL and TLS protocols, which might make it easier for remote attackers to cause a denial of service…
CVE-2011-1473	OpenSSL Project OpenSSL		0.05	—	0.67		Jun 16, 2012	OpenSSL before 0.9.8l, and 0.9.8m through 1.x, does not properly restrict client-initiated renegotiation within the SSL and TLS protocols, which might make it easier for remote attackers to cause a denial of service (CPU consumption) by performing many renegotiations within a…
CVE-2012-3576	WordPress Wpstorecart		0.04	—	0.18		Jun 16, 2012	Unrestricted file upload vulnerability in php/upload.php in the wpStoreCart plugin before 2.5.30 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in…
CVE-2012-3575	Rbx Gallery Rbx Gallery		0.04	—	0.15		Jun 16, 2012	Unrestricted file upload vulnerability in uploader.php in the RBX Gallery plugin 2.1 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploads/rbxslider.
CVE-2012-3574	WordPress MM Forms Community		0.04	—	0.11		Jun 16, 2012	Unrestricted file upload vulnerability in includes/doajaxfileupload.php in the MM Forms Community plugin 2.2.5 and 2.2.6 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to…
CVE-2012-2395	Cobbler Project Cobbler		0.00	—	0.06		Jun 16, 2012	Incomplete blacklist vulnerability in action_power.py in Cobbler 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) username or (2) password fields to the power_system method in the xmlrpc API.
CVE-2012-1502	Pypam Pypam		0.04	—	0.14		Jun 16, 2012	Double free vulnerability in the PyPAM_conv in PAMmodule.c in PyPam 0.5.0 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a NULL byte in a password string.
CVE-2012-1145	Red Hat Satellite		0.00	—	0.03		Jun 16, 2012	spacewalk-backend in Red Hat Network Satellite 5.4 on Red Hat Enterprise Linux 6 does not properly authorize or authenticate uploads to the NULL organization when mod_wsgi is used, which allows remote attackers to cause a denial of service (/var partition disk consumption and…
CVE-2012-0212	Devscripts Devel Team Devscripts		0.00	—	0.06		Jun 16, 2012	debdiff.pl in devscripts 2.10.x before 2.10.69 and 2.11.x before 2.11.4 allows remote attackers to execute arbitrary code via shell metacharacters in the file name argument.
CVE-2012-0211	Devscripts Devel Team Devscripts		0.00	—	0.06		Jun 16, 2012	debdiff.pl in devscripts 2.10.x before 2.10.69 and 2.11.x before 2.11.4 allows remote attackers to execute arbitrary code via a crafted tarball file name in the top-level directory of an original (.orig) source tarball of a source package.
CVE-2012-0210	Devscripts Devel Team Devscripts		0.00	—	0.05		Jun 16, 2012	debdiff.pl in devscripts 2.10.x before 2.10.69 and 2.11.x before 2.11.4 allows remote attackers to obtain system information and execute arbitrary code via the file name in a (1) .dsc or (2) .changes file.
CVE-2011-4409	Ubuntu ubuntu-sso-client		0.00	—	0.02		Jun 16, 2012	The Ubuntu One Client for Ubuntu 10.04 LTS, 11.04, 11.10, and 12.04 LTS does not properly validate SSL certificates, which allows remote attackers to spoof a server and modify or read sensitive information via a man-in-the-middle (MITM) attack.
CVE-2011-4408	Ubuntu ubuntu-sso-client		0.00	—	0.01		Jun 16, 2012	The Single Sign On Client (ubuntu-sso-client) for Ubuntu 11.04 and 11.10 does not properly validate SSL certificates when using HTTPS, which allows remote attackers to spoof a server and modify or read sensitive data via a man-in-the-middle (MITM) attack.
CVE-2011-4328	GNU Gnash		0.00	—	0.02		Jun 16, 2012	plugin/npapi/plugin.cpp in Gnash before 0.8.10 uses weak permissions (world readable) for cookie files with predictable names in /tmp, which allows local users to obtain sensitive information.
CVE-2011-3194	Qt Qt		0.01	—	0.07		Jun 16, 2012	Buffer overflow in the TIFF reader in gui/image/qtiffhandler.cpp in Qt 4.7.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the TIFFTAG_SAMPLESPERPIXEL tag in a greyscale TIFF image with multiple samples per pixel.
CVE-2011-3193	Qt Qt		0.01	—	0.07		Jun 16, 2012	Heap-based buffer overflow in the Lookup_MarkMarkPos function in the HarfBuzz module (harfbuzz-gpos.c), as used by Qt before 4.7.4 and Pango, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted font file.
CVE-2012-2635	Dolphin Browser Dolphin Browser Hd		0.00	—	0.01		Jun 15, 2012	The Dolphin Browser HD application before 7.6 and Dolphin for Pad application before 1.0.1 for Android do not properly implement the WebView class, which allows remote attackers to obtain sensitive information via a crafted application.
CVE-2012-2634	Newsgator Feeddemon		0.00	—	0.02		Jun 15, 2012	Cross-site scripting (XSS) vulnerability in FeedDemon before 4.0, when the feed preview option is enabled, allows remote attackers to inject arbitrary web script or HTML via a feed.
CVE-2012-2633	WordPress Wassup Plugin		0.00	—	0.02		Jun 15, 2012	Cross-site scripting (XSS) vulnerability in wassup.php in the WassUp plugin before 1.8.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header.
CVE-2012-2632	Seil B1		0.00	—	0.01		Jun 15, 2012	SEIL routers with firmware SEIL/x86 1.00 through 2.35, SEIL/X1 2.30 through 3.75, SEIL/X2 2.30 through 3.75, and SEIL/B1 2.30 through 3.75, when the http-proxy and application-gateway features are enabled, do not properly handle the CONNECT command, which allows remote attackers…
CVE-2012-3345	Ioquake3 Ioquake3 Engine		0.00	—	0.00		Jun 15, 2012	ioquake3 before r2253 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/ioq3.pid temporary file.
CVE-2012-2631	@WEB ShoppingCart @WEB ShoppingCart		0.00	—	0.01		Jun 15, 2012	Cross-site scripting (XSS) vulnerability in WEBLOGIC @WEB ShoppingCart before 1.5.2.0, and @WEB ShoppingCart T 1.5.0.1 and earlier, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-3289	VMware Workstation		0.00	—	0.02		Jun 14, 2012	VMware Workstation 8.x before 8.0.4, VMware Player 4.x before 4.0.4, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 allow remote attackers to cause a denial of service (guest OS crash) via crafted traffic from a remote virtual device.

CVE-2012-3578Jun 17, 2012
WordPress
Fcchat Widget
risk 0.04cvss —epss 0.08
Unrestricted file upload vulnerability in html/Upload.php in the FCChat Widget plugin 2.2.13.1 and earlier for WordPress allows remote attackers to execute arbitrary code by uploading a file with a file with an executable extension followed by a safe extension, then accessing it…
CVE-2012-3577Jun 17, 2012
WordPress
Nmedia Member Conversation
risk 0.04cvss —epss 0.14
Unrestricted file upload vulnerability in doupload.php in the Nmedia Member Conversation plugin before 1.4 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in…
CVE-2012-2693Jun 17, 2012
Red Hat
Libvirt
risk 0.00cvss —epss 0.00
libvirt, possibly before 0.9.12, does not properly assign USB devices to virtual machines when multiple devices have the same vendor and product ID, which might cause the wrong device to be associated with a guest and might allow local users to access unintended USB devices.
CVE-2012-2692Jun 17, 2012
Mantisbt
Mantisbt
risk 0.00cvss —epss 0.01
MantisBT before 1.2.11 does not check the delete_attachments_threshold permission when form_security_validation is set to OFF, which allows remote authenticated users with certain privileges to bypass intended access restrictions and delete arbitrary attachments.
CVE-2012-2691Jun 17, 2012
Mantisbt
Mantisbt
risk 0.00cvss —epss 0.04
The mc_issue_note_update function in the SOAP API in MantisBT before 1.2.11 does not properly check privileges, which allows remote attackers with bug reporting privileges to edit arbitrary bugnotes via a SOAP request.
CVE-2012-2672Jun 17, 2012
Oracle Corporation
Mojarra
risk 0.00cvss —epss 0.01
Oracle Mojarra 2.1.7 does not properly "clean up" the FacesContext reference during startup, which allows local users to obtain context information an access resources from another WAR file by calling the FacesContext.getCurrentInstance function.
CVE-2012-2671Jun 17, 2012
Rtomayko
Rack Cach
risk 0.00cvss —epss 0.02
The Rack::Cache rubygem 0.3.0 through 1.1 caches Set-Cookie and other sensitive headers, which allows attackers to obtain sensitive cookie information, hijack web sessions, or have other unspecified impact by accessing the cache.
CVE-2012-2670Jun 17, 2012
Collabtive
Collabtive
risk 0.00cvss —epss 0.02
manageuser.php in Collabtive before 0.7.6 allows remote authenticated users, and possibly unauthenticated attackers, to bypass intended access restrictions and upload and execute arbitrary files by uploading an avatar file with an accepted Content-Type such as image/jpeg, then…
CVE-2012-2668Jun 17, 2012
OpenLDAP
Openldap
risk 0.00cvss —epss 0.04
libraries/libldap/tls_m.c in OpenLDAP, possibly 2.4.31 and earlier, when using the Mozilla NSS backend, always uses the default cipher suite even when TLSCipherSuite is set, which might cause OpenLDAP to use weaker ciphers than intended and make it easier for remote attackers to…
CVE-2012-2417Jun 17, 2012
Dlitz
Pycrypto
risk 0.00cvss —epss 0.02
PyCrypto before 2.6 does not produce appropriate prime numbers when using an ElGamal scheme to generate a key, which reduces the signature space or public key space and makes it easier for attackers to conduct brute force attacks to obtain the private key.
CVE-2012-2091Jun 17, 2012
Flightgear
Flightgear
risk 0.01cvss —epss 0.06
Multiple buffer overflows in FlightGear 2.6 and earlier and SimGear 2.6 and earlier allow user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a (1) long string in a rotor tag of an aircraft xml model to the…
CVE-2012-2090Jun 17, 2012
Flightgear
Flightgear
risk 0.00cvss —epss 0.06
Multiple format string vulnerabilities in FlightGear 2.6 and earlier and SimGear 2.6 and earlier allow user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via format string specifiers in certain data chunk values in an aircraft xml…
CVE-2012-0037MedJun 17, 2012
Libreoffice
Libreoffice
risk 0.36cvss 6.5epss 0.14
Redland Raptor (aka libraptor) before 2.0.7, as used by OpenOffice 3.3 and 3.4 Beta, LibreOffice before 3.4.6 and 3.5.x before 3.5.1, and other products, allows user-assisted remote attackers to read arbitrary files via a crafted XML external entity (XXE) declaration and…
CVE-2012-1726Jun 16, 2012
Sun Corporation
Java SE
risk 0.00cvss —epss 0.03
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries.
CVE-2012-1725Jun 16, 2012
Sun Corporation
Jre
risk 0.00cvss —epss 0.06
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, and 5 update 35 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to…
CVE-2012-1724Jun 16, 2012
Sun Corporation
Jre
risk 0.00cvss —epss 0.04
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, and 6 update 32 and earlier, allows remote attackers to affect availability, related to JAXP.
CVE-2012-1723CriKEVJun 16, 2012
Oracle Corporation
Jre
risk 0.92cvss 9.8epss 0.94
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect confidentiality, integrity, and availability via…
CVE-2012-1722Jun 16, 2012
Sun Corporation
Java SE
risk 0.00cvss —epss 0.05
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, and 6 update 32 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different…
CVE-2012-1721Jun 16, 2012
Sun Corporation
Java SE
risk 0.00cvss —epss 0.05
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, and 6 update 32 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different…
CVE-2012-1720Jun 16, 2012
Sun Corporation
Jre
risk 0.00cvss —epss 0.00
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier, when running on Solaris, allows local users to affect confidentiality, integrity, and…
CVE-2012-1719Jun 16, 2012
Sun Corporation
Jre
risk 0.00cvss —epss 0.03
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect integrity, related to CORBA.
CVE-2012-1718Jun 16, 2012
Sun Corporation
Jre
risk 0.00cvss —epss 0.04
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect availability via unknown vectors related to Security.
CVE-2012-1717Jun 16, 2012
Sun Corporation
Java SE
risk 0.00cvss —epss 0.00
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows local users to affect confidentiality via unknown vectors related to printing on…
CVE-2012-1716Jun 16, 2012
Sun Corporation
Jre
risk 0.00cvss —epss 0.06
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, and 5 update 35 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to…
CVE-2012-1713Jun 16, 2012
Sun Corporation
Jre
risk 0.00cvss —epss 0.06
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, 1.4.2_37 and earlier, and JavaFX 2.1 and earlier allows remote attackers to affect confidentiality, integrity,…
CVE-2012-1711Jun 16, 2012
Sun Corporation
Jre
risk 0.00cvss —epss 0.03
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related…
CVE-2012-1583Jun 16, 2012
Linux
Kernel
risk 0.00cvss —epss 0.04
Double free vulnerability in the xfrm6_tunnel_rcv function in net/ipv6/xfrm6_tunnel.c in the Linux kernel before 2.6.22, when the xfrm6_tunnel module is enabled, allows remote attackers to cause a denial of service (panic) via crafted IPv6 packets.
CVE-2011-5094Jun 16, 2012
Mozilla Corporation
Network Security Services
risk 0.00cvss —epss 0.03
Mozilla Network Security Services (NSS) 3.x, with certain settings of the SSL_ENABLE_RENEGOTIATION option, does not properly restrict client-initiated renegotiation within the SSL and TLS protocols, which might make it easier for remote attackers to cause a denial of service…
CVE-2011-1473Jun 16, 2012
OpenSSL Project
OpenSSL
risk 0.05cvss —epss 0.67
OpenSSL before 0.9.8l, and 0.9.8m through 1.x, does not properly restrict client-initiated renegotiation within the SSL and TLS protocols, which might make it easier for remote attackers to cause a denial of service (CPU consumption) by performing many renegotiations within a…
CVE-2012-3576Jun 16, 2012
WordPress
Wpstorecart
risk 0.04cvss —epss 0.18
Unrestricted file upload vulnerability in php/upload.php in the wpStoreCart plugin before 2.5.30 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in…
CVE-2012-3575Jun 16, 2012
Rbx Gallery
Rbx Gallery
risk 0.04cvss —epss 0.15
Unrestricted file upload vulnerability in uploader.php in the RBX Gallery plugin 2.1 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploads/rbxslider.
CVE-2012-3574Jun 16, 2012
WordPress
MM Forms Community
risk 0.04cvss —epss 0.11
Unrestricted file upload vulnerability in includes/doajaxfileupload.php in the MM Forms Community plugin 2.2.5 and 2.2.6 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to…
CVE-2012-2395Jun 16, 2012
Cobbler Project
Cobbler
risk 0.00cvss —epss 0.06
Incomplete blacklist vulnerability in action_power.py in Cobbler 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) username or (2) password fields to the power_system method in the xmlrpc API.
CVE-2012-1502Jun 16, 2012
Pypam
Pypam
risk 0.04cvss —epss 0.14
Double free vulnerability in the PyPAM_conv in PAMmodule.c in PyPam 0.5.0 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a NULL byte in a password string.
CVE-2012-1145Jun 16, 2012
Red Hat
Satellite
risk 0.00cvss —epss 0.03
spacewalk-backend in Red Hat Network Satellite 5.4 on Red Hat Enterprise Linux 6 does not properly authorize or authenticate uploads to the NULL organization when mod_wsgi is used, which allows remote attackers to cause a denial of service (/var partition disk consumption and…
CVE-2012-0212Jun 16, 2012
Devscripts Devel Team
Devscripts
risk 0.00cvss —epss 0.06
debdiff.pl in devscripts 2.10.x before 2.10.69 and 2.11.x before 2.11.4 allows remote attackers to execute arbitrary code via shell metacharacters in the file name argument.
CVE-2012-0211Jun 16, 2012
Devscripts Devel Team
Devscripts
risk 0.00cvss —epss 0.06
debdiff.pl in devscripts 2.10.x before 2.10.69 and 2.11.x before 2.11.4 allows remote attackers to execute arbitrary code via a crafted tarball file name in the top-level directory of an original (.orig) source tarball of a source package.
CVE-2012-0210Jun 16, 2012
Devscripts Devel Team
Devscripts
risk 0.00cvss —epss 0.05
debdiff.pl in devscripts 2.10.x before 2.10.69 and 2.11.x before 2.11.4 allows remote attackers to obtain system information and execute arbitrary code via the file name in a (1) .dsc or (2) .changes file.
CVE-2011-4409Jun 16, 2012
Ubuntu
ubuntu-sso-client
risk 0.00cvss —epss 0.02
The Ubuntu One Client for Ubuntu 10.04 LTS, 11.04, 11.10, and 12.04 LTS does not properly validate SSL certificates, which allows remote attackers to spoof a server and modify or read sensitive information via a man-in-the-middle (MITM) attack.
CVE-2011-4408Jun 16, 2012
Ubuntu
ubuntu-sso-client
risk 0.00cvss —epss 0.01
The Single Sign On Client (ubuntu-sso-client) for Ubuntu 11.04 and 11.10 does not properly validate SSL certificates when using HTTPS, which allows remote attackers to spoof a server and modify or read sensitive data via a man-in-the-middle (MITM) attack.
CVE-2011-4328Jun 16, 2012
GNU
Gnash
risk 0.00cvss —epss 0.02
plugin/npapi/plugin.cpp in Gnash before 0.8.10 uses weak permissions (world readable) for cookie files with predictable names in /tmp, which allows local users to obtain sensitive information.
CVE-2011-3194Jun 16, 2012
Qt
Qt
risk 0.01cvss —epss 0.07
Buffer overflow in the TIFF reader in gui/image/qtiffhandler.cpp in Qt 4.7.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the TIFFTAG_SAMPLESPERPIXEL tag in a greyscale TIFF image with multiple samples per pixel.
CVE-2011-3193Jun 16, 2012
Qt
Qt
risk 0.01cvss —epss 0.07
Heap-based buffer overflow in the Lookup_MarkMarkPos function in the HarfBuzz module (harfbuzz-gpos.c), as used by Qt before 4.7.4 and Pango, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted font file.
CVE-2012-2635Jun 15, 2012
Dolphin Browser
Dolphin Browser Hd
risk 0.00cvss —epss 0.01
The Dolphin Browser HD application before 7.6 and Dolphin for Pad application before 1.0.1 for Android do not properly implement the WebView class, which allows remote attackers to obtain sensitive information via a crafted application.
CVE-2012-2634Jun 15, 2012
Newsgator
Feeddemon
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in FeedDemon before 4.0, when the feed preview option is enabled, allows remote attackers to inject arbitrary web script or HTML via a feed.
CVE-2012-2633Jun 15, 2012
WordPress
Wassup Plugin
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in wassup.php in the WassUp plugin before 1.8.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header.
CVE-2012-2632Jun 15, 2012
Seil
B1
risk 0.00cvss —epss 0.01
SEIL routers with firmware SEIL/x86 1.00 through 2.35, SEIL/X1 2.30 through 3.75, SEIL/X2 2.30 through 3.75, and SEIL/B1 2.30 through 3.75, when the http-proxy and application-gateway features are enabled, do not properly handle the CONNECT command, which allows remote attackers…
CVE-2012-3345Jun 15, 2012
Ioquake3
Ioquake3 Engine
risk 0.00cvss —epss 0.00
ioquake3 before r2253 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/ioq3.pid temporary file.
CVE-2012-2631Jun 15, 2012
@WEB ShoppingCart
@WEB ShoppingCart
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in WEBLOGIC @WEB ShoppingCart before 1.5.2.0, and @WEB ShoppingCart T 1.5.0.1 and earlier, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-3289Jun 14, 2012
VMware
Workstation
risk 0.00cvss —epss 0.02
VMware Workstation 8.x before 8.0.4, VMware Player 4.x before 4.0.4, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 allow remote attackers to cause a denial of service (guest OS crash) via crafted traffic from a remote virtual device.