CVEs

386,585 total · page 6738 of 7,732

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2012-0147	Microsoft Forefront Unified Access Gateway		0.03	—	0.36	Apr 10, 2012	Microsoft Forefront Unified Access Gateway (UAG) 2010 SP1 and SP1 Update 1 does not properly configure the default web site, which allows remote attackers to obtain sensitive information via a crafted HTTPS request, aka "Unfiltered Access to UAG Default Website Vulnerability."
CVE-2012-0146	Microsoft Forefront Unified Access Gateway		0.01	—	0.11	Apr 10, 2012	Open redirect vulnerability in Microsoft Forefront Unified Access Gateway (UAG) 2010 SP1 and SP1 Update 1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL, aka "UAG Blind HTTP Redirect Vulnerability."
CVE-2012-2215	Novell Zenworks Configuration Management		0.05	—	0.28	Apr 9, 2012	Directory traversal vulnerability in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allows remote attackers to read arbitrary files via an opcode 0x21 request.
CVE-2012-0742	IBM Tivoli Event Pump		0.00	—	0.00	Apr 9, 2012	IBM Tivoli Event Pump 4.2.2, when the LOG_REQUESTS and VALIDATE_SOAP_USERS options are enabled, places credentials into the AOPSCLOG (aka AOPLOG) data set, which allows local users to obtain sensitive information by reading the data.
CVE-2011-4188	Novell Imanager		0.00	—	0.01	Apr 9, 2012	Buffer overflow in the Create Attribute function in jclient in Novell iManager 2.7.4 before patch 4 allows remote authenticated users to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted EnteredAttrName parameter, a related…
CVE-2011-3176	Novell Zenworks Configuration Management		0.09	—	0.70	Apr 9, 2012	Stack-based buffer overflow in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allows remote attackers to execute arbitrary code via an opcode 0x4c request.
CVE-2011-3175	Novell Zenworks Configuration Management		0.08	—	0.66	Apr 9, 2012	Stack-based buffer overflow in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allows remote attackers to execute arbitrary code via an opcode 0x6c request.
CVE-2012-0725	Google Chrome		0.00	—	0.02	Apr 6, 2012	Adobe Flash Player before 11.2.202.229 in Google Chrome before 18.0.1025.151 allow attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2012-0724.
CVE-2012-0724	Google Chrome		0.00	—	0.02	Apr 6, 2012	Adobe Flash Player before 11.2.202.229 in Google Chrome before 18.0.1025.151 allow attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2012-0725.
CVE-2012-1902	PhpMyAdmin phpMyAdmin		0.00	—	0.02	Apr 6, 2012	show_config_errors.php in phpMyAdmin 3.4.x before 3.4.10.2, when a configuration file does not exist, allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message about this missing file.
CVE-2012-1239	Toshiba e-Studio		0.03	—	0.05	Apr 6, 2012	The TopAccess web-based management interface on TOSHIBA TEC e-Studio multi-function peripheral (MFP) devices with firmware 30x through 302, 35x through 354, and 4xx through 421 allows remote attackers to bypass authentication and obtain administrative privileges via unspecified…
CVE-2012-1238	Icz Sencha Sns		0.00	—	0.01	Apr 6, 2012	Session fixation vulnerability in SENCHA SNS before 1.0.2 allows remote attackers to hijack web sessions via unspecified vectors.
CVE-2012-1237	Sencha SNS		0.00	—	0.01	Apr 6, 2012	Cross-site request forgery (CSRF) vulnerability in SENCHA SNS before 1.0.2 allows remote attackers to hijack the authentication of arbitrary users.
CVE-2011-3077	Google Chrome		0.00	—	0.02	Apr 5, 2012	Use-after-free vulnerability in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving the script bindings, related to a "read-after-free" issue.
CVE-2011-3076	Google Chrome		0.00	—	0.02	Apr 5, 2012	Use-after-free vulnerability in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to focus handling.
CVE-2011-3075	Google Chrome		0.00	—	0.02	Apr 5, 2012	Use-after-free vulnerability in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to style-application commands.
CVE-2011-3074	Google Chrome		0.00	—	0.02	Apr 5, 2012	Use-after-free vulnerability in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of media.
CVE-2011-3073	Google Chrome		0.00	—	0.02	Apr 5, 2012	Use-after-free vulnerability in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of SVG resources.
CVE-2011-3072	Google Chrome		0.00	—	0.01	Apr 5, 2012	Google Chrome before 18.0.1025.151 allows remote attackers to bypass the Same Origin Policy via vectors related to pop-up windows.
CVE-2011-3071	Google Chrome		0.00	—	0.02	Apr 5, 2012	Use-after-free vulnerability in the HTMLMediaElement implementation in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVE-2011-3070	Google Chrome		0.00	—	0.02	Apr 5, 2012	Use-after-free vulnerability in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the Google V8 bindings.
CVE-2011-3069	Google Chrome		0.00	—	0.02	Apr 5, 2012	Use-after-free vulnerability in the Cascading Style Sheets (CSS) implementation in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to line boxes.
CVE-2011-3068	Google Chrome		0.00	—	0.02	Apr 5, 2012	Use-after-free vulnerability in the Cascading Style Sheets (CSS) implementation in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to run-in boxes.
CVE-2011-3067	Google Chrome		0.00	—	0.01	Apr 5, 2012	Google Chrome before 18.0.1025.151 allows remote attackers to bypass the Same Origin Policy via vectors related to replacement of IFRAME elements.
CVE-2011-3066	Google Chrome		0.00	—	0.02	Apr 5, 2012	Skia, as used in Google Chrome before 18.0.1025.151, does not properly perform clipping, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVE-2012-2055	GitHub GitHub	Hig	0.49	7.5	0.02	Apr 5, 2012	GitHub Enterprise before 20120304 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the public_key[user_id] value via a modified URL for the public-key update form, related to a "mass assignment"…
CVE-2012-2054	Redmine Redmine		0.00	—	0.02	Apr 5, 2012	Redmine before 1.3.2 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set attributes in the (1) Comment, (2) Document, (3) IssueCategory, (4) MembersController, (5) Message, (6) News, (7) TimeEntry, (8)…
CVE-2012-2053	F5, Inc. FirePass 4100		0.00	—	0.00	Apr 5, 2012	The sudoers file in the Linux system configuration in F5 FirePass 6.0.0 through 6.1.0 and 7.0.0 does not require a password for executing commands as root, which allows local users to gain privileges via the sudo program, as demonstrated by the user account that executes PHP…
CVE-2012-1982	Socialcms Socialcms		0.00	—	0.01	Apr 5, 2012	Cross-site scripting (XSS) vulnerability in my_admin/admin1_list_pages.php in SocialCMS 1.0.2 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the TR_title parameter in an edit action.
CVE-2012-1777	F5, Inc. FirePass 4100		0.00	—	0.02	Apr 5, 2012	SQL injection vulnerability in my.activation.php3 in F5 FirePass 6.0.0 through 6.1.0 and 7.0.0 allows remote attackers to execute arbitrary SQL commands via the state parameter.
CVE-2012-0327	Redmine Redmine		0.00	—	0.02	Apr 5, 2012	Cross-site scripting (XSS) vulnerability in Redmine before 1.3.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2011-5000	OpenSSH OpenSSH		0.00	—	0.03	Apr 5, 2012	The ssh_gssapi_parse_ename function in gss-serv.c in OpenSSH 5.8 and earlier, when gssapi-with-mic authentication is enabled, allows remote authenticated users to cause a denial of service (memory consumption) via a large value in a certain length field. NOTE: there may be…
CVE-2012-0131	Microfocus Distributed Computing Environment		0.01	—	0.07	Apr 5, 2012	Distributed Computing Environment (DCE) 1.8 and 1.9 on HP HP-UX B.11.11 and B.11.23 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVE-2012-0255	Quagga (software) Quagga		0.00	—	0.03	Apr 5, 2012	The BGP implementation in bgpd in Quagga before 0.99.20.1 does not properly use message buffers for OPEN messages, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a message associated with a malformed Four-octet AS Number…
CVE-2012-0250	Quagga (software) Quagga		0.00	—	0.01	Apr 5, 2012	Buffer overflow in the OSPFv2 implementation in ospfd in Quagga before 0.99.20.1 allows remote attackers to cause a denial of service (daemon crash) via a Link State Update (aka LS Update) packet containing a network-LSA link-state advertisement for which the data-structure…
CVE-2012-0249	Quagga (software) Quagga		0.00	—	0.02	Apr 5, 2012	Buffer overflow in the ospf_ls_upd_list_lsa function in ospf_packet.c in the OSPFv2 implementation in ospfd in Quagga before 0.99.20.1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a Link State Update (aka LS Update) packet that is…
CVE-2012-0130	Microfocus Onboard Administrator		0.00	—	0.04	Apr 5, 2012	HP Onboard Administrator (OA) before 3.50 allows remote attackers to obtain sensitive information via unspecified vectors.
CVE-2012-0129	Microfocus Onboard Administrator		0.01	—	0.08	Apr 5, 2012	HP Onboard Administrator (OA) before 3.50 allows remote attackers to bypass intended access restrictions and execute arbitrary code via unspecified vectors.
CVE-2012-0128	Microfocus Onboard Administrator		0.00	—	0.03	Apr 5, 2012	HP Onboard Administrator (OA) before 3.50 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVE-2012-0132	Microfocus Business Availability Center		0.00	—	0.02	Apr 5, 2012	Cross-site scripting (XSS) vulnerability in HP Business Availability Center (BAC) 9.01 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2008-7311	Spree Spree		0.00	—	0.01	Apr 5, 2012	The session cookie store implementation in Spree 0.2.0 uses a hardcoded config.action_controller_session hash value (aka secret key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging an application that contains this value…
CVE-2008-7310	Spree Spree		0.00	—	0.01	Apr 5, 2012	Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the Order state value and bypass the intended payment step via a modified URL, related to a "mass assignment" vulnerability.
CVE-2008-7309	Insoshi Insoshi		0.00	—	0.01	Apr 5, 2012	Insoshi before 20080920 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the ForumPost user_id value via a modified URL, related to a "mass assignment" vulnerability.
CVE-2012-1337	Cisco Systems, Inc. Webex Recording Format Player		0.02	—	0.24	Apr 5, 2012	Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 L through SP11 EP26, T27 LB through SP21 EP10, T27 LC before SP25 EP10, and T27 LD before SP32 CP1 allows remote attackers to execute arbitrary code via a crafted WRF file, a different vulnerability than…
CVE-2012-1336	Cisco Systems, Inc. Webex Recording Format Player		0.00	—	0.05	Apr 5, 2012	Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 L through SP11 EP26, T27 LB through SP21 EP10, T27 LC before SP25 EP10, and T27 LD before SP32 CP1 allows remote attackers to execute arbitrary code via a crafted WRF file, a different vulnerability than…
CVE-2012-1335	Cisco Systems, Inc. Webex Recording Format Player		0.00	—	0.04	Apr 5, 2012	Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 L through SP11 EP26, T27 LB through SP21 EP10, T27 LC before SP25 EP10, and T27 LD before SP32 CP1 allows remote attackers to execute arbitrary code via a crafted WRF file, a different vulnerability than…
CVE-2011-4535	Scadatec Modbustagserver		0.05	—	0.27	Apr 3, 2012	Buffer overflow in TurboPower Abbrevia before 4.0, as used in ScadaTEC ScadaPhone 5.3.11.1230 and earlier, ScadaTEC ModbusTagServer 4.1.1.81 and earlier, and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary…
CVE-2011-4045	ARC Informatique PcVue		0.03	—	0.04	Apr 3, 2012	Buffer overflow in an unspecified ActiveX control in aipgctl.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to cause a denial of service via a crafted HTML document.
CVE-2011-4044	ARC Informatique PcVue		0.05	—	0.27	Apr 3, 2012	An unspecified ActiveX control in SVUIGrd.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to modify files via calls to unknown methods.
CVE-2011-4043	ARC Informatique PcVue		0.04	—	0.07	Apr 3, 2012	Integer overflow in an unspecified ActiveX control in SVUIGrd.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to execute arbitrary code via a large value for an integer parameter, leading to a buffer overflow.

CVE-2012-0147Apr 10, 2012
Microsoft
Forefront Unified Access Gateway
risk 0.03cvss —epss 0.36
Microsoft Forefront Unified Access Gateway (UAG) 2010 SP1 and SP1 Update 1 does not properly configure the default web site, which allows remote attackers to obtain sensitive information via a crafted HTTPS request, aka "Unfiltered Access to UAG Default Website Vulnerability."
CVE-2012-0146Apr 10, 2012
Microsoft
Forefront Unified Access Gateway
risk 0.01cvss —epss 0.11
Open redirect vulnerability in Microsoft Forefront Unified Access Gateway (UAG) 2010 SP1 and SP1 Update 1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL, aka "UAG Blind HTTP Redirect Vulnerability."
CVE-2012-2215Apr 9, 2012
Novell
Zenworks Configuration Management
risk 0.05cvss —epss 0.28
Directory traversal vulnerability in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allows remote attackers to read arbitrary files via an opcode 0x21 request.
CVE-2012-0742Apr 9, 2012
IBM
Tivoli Event Pump
risk 0.00cvss —epss 0.00
IBM Tivoli Event Pump 4.2.2, when the LOG_REQUESTS and VALIDATE_SOAP_USERS options are enabled, places credentials into the AOPSCLOG (aka AOPLOG) data set, which allows local users to obtain sensitive information by reading the data.
CVE-2011-4188Apr 9, 2012
Novell
Imanager
risk 0.00cvss —epss 0.01
Buffer overflow in the Create Attribute function in jclient in Novell iManager 2.7.4 before patch 4 allows remote authenticated users to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted EnteredAttrName parameter, a related…
CVE-2011-3176Apr 9, 2012
Novell
Zenworks Configuration Management
risk 0.09cvss —epss 0.70
Stack-based buffer overflow in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allows remote attackers to execute arbitrary code via an opcode 0x4c request.
CVE-2011-3175Apr 9, 2012
Novell
Zenworks Configuration Management
risk 0.08cvss —epss 0.66
Stack-based buffer overflow in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allows remote attackers to execute arbitrary code via an opcode 0x6c request.
CVE-2012-0725Apr 6, 2012
Google
Chrome
risk 0.00cvss —epss 0.02
Adobe Flash Player before 11.2.202.229 in Google Chrome before 18.0.1025.151 allow attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2012-0724.
CVE-2012-0724Apr 6, 2012
Google
Chrome
risk 0.00cvss —epss 0.02
Adobe Flash Player before 11.2.202.229 in Google Chrome before 18.0.1025.151 allow attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2012-0725.
CVE-2012-1902Apr 6, 2012
PhpMyAdmin
phpMyAdmin
risk 0.00cvss —epss 0.02
show_config_errors.php in phpMyAdmin 3.4.x before 3.4.10.2, when a configuration file does not exist, allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message about this missing file.
CVE-2012-1239Apr 6, 2012
Toshiba
e-Studio
risk 0.03cvss —epss 0.05
The TopAccess web-based management interface on TOSHIBA TEC e-Studio multi-function peripheral (MFP) devices with firmware 30x through 302, 35x through 354, and 4xx through 421 allows remote attackers to bypass authentication and obtain administrative privileges via unspecified…
CVE-2012-1238Apr 6, 2012
Icz
Sencha Sns
risk 0.00cvss —epss 0.01
Session fixation vulnerability in SENCHA SNS before 1.0.2 allows remote attackers to hijack web sessions via unspecified vectors.
CVE-2012-1237Apr 6, 2012
Sencha
SNS
risk 0.00cvss —epss 0.01
Cross-site request forgery (CSRF) vulnerability in SENCHA SNS before 1.0.2 allows remote attackers to hijack the authentication of arbitrary users.
CVE-2011-3077Apr 5, 2012
Google
Chrome
risk 0.00cvss —epss 0.02
Use-after-free vulnerability in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving the script bindings, related to a "read-after-free" issue.
CVE-2011-3076Apr 5, 2012
Google
Chrome
risk 0.00cvss —epss 0.02
Use-after-free vulnerability in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to focus handling.
CVE-2011-3075Apr 5, 2012
Google
Chrome
risk 0.00cvss —epss 0.02
Use-after-free vulnerability in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to style-application commands.
CVE-2011-3074Apr 5, 2012
Google
Chrome
risk 0.00cvss —epss 0.02
Use-after-free vulnerability in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of media.
CVE-2011-3073Apr 5, 2012
Google
Chrome
risk 0.00cvss —epss 0.02
Use-after-free vulnerability in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of SVG resources.
CVE-2011-3072Apr 5, 2012
Google
Chrome
risk 0.00cvss —epss 0.01
Google Chrome before 18.0.1025.151 allows remote attackers to bypass the Same Origin Policy via vectors related to pop-up windows.
CVE-2011-3071Apr 5, 2012
Google
Chrome
risk 0.00cvss —epss 0.02
Use-after-free vulnerability in the HTMLMediaElement implementation in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVE-2011-3070Apr 5, 2012
Google
Chrome
risk 0.00cvss —epss 0.02
Use-after-free vulnerability in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the Google V8 bindings.
CVE-2011-3069Apr 5, 2012
Google
Chrome
risk 0.00cvss —epss 0.02
Use-after-free vulnerability in the Cascading Style Sheets (CSS) implementation in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to line boxes.
CVE-2011-3068Apr 5, 2012
Google
Chrome
risk 0.00cvss —epss 0.02
Use-after-free vulnerability in the Cascading Style Sheets (CSS) implementation in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to run-in boxes.
CVE-2011-3067Apr 5, 2012
Google
Chrome
risk 0.00cvss —epss 0.01
Google Chrome before 18.0.1025.151 allows remote attackers to bypass the Same Origin Policy via vectors related to replacement of IFRAME elements.
CVE-2011-3066Apr 5, 2012
Google
Chrome
risk 0.00cvss —epss 0.02
Skia, as used in Google Chrome before 18.0.1025.151, does not properly perform clipping, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVE-2012-2055HigApr 5, 2012
GitHub
GitHub
risk 0.49cvss 7.5epss 0.02
GitHub Enterprise before 20120304 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the public_key[user_id] value via a modified URL for the public-key update form, related to a "mass assignment"…
CVE-2012-2054Apr 5, 2012
Redmine
Redmine
risk 0.00cvss —epss 0.02
Redmine before 1.3.2 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set attributes in the (1) Comment, (2) Document, (3) IssueCategory, (4) MembersController, (5) Message, (6) News, (7) TimeEntry, (8)…
CVE-2012-2053Apr 5, 2012
F5, Inc.
FirePass 4100
risk 0.00cvss —epss 0.00
The sudoers file in the Linux system configuration in F5 FirePass 6.0.0 through 6.1.0 and 7.0.0 does not require a password for executing commands as root, which allows local users to gain privileges via the sudo program, as demonstrated by the user account that executes PHP…
CVE-2012-1982Apr 5, 2012
Socialcms
Socialcms
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in my_admin/admin1_list_pages.php in SocialCMS 1.0.2 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the TR_title parameter in an edit action.
CVE-2012-1777Apr 5, 2012
F5, Inc.
FirePass 4100
risk 0.00cvss —epss 0.02
SQL injection vulnerability in my.activation.php3 in F5 FirePass 6.0.0 through 6.1.0 and 7.0.0 allows remote attackers to execute arbitrary SQL commands via the state parameter.
CVE-2012-0327Apr 5, 2012
Redmine
Redmine
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in Redmine before 1.3.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2011-5000Apr 5, 2012
OpenSSH
OpenSSH
risk 0.00cvss —epss 0.03
The ssh_gssapi_parse_ename function in gss-serv.c in OpenSSH 5.8 and earlier, when gssapi-with-mic authentication is enabled, allows remote authenticated users to cause a denial of service (memory consumption) via a large value in a certain length field. NOTE: there may be…
CVE-2012-0131Apr 5, 2012
Microfocus
Distributed Computing Environment
risk 0.01cvss —epss 0.07
Distributed Computing Environment (DCE) 1.8 and 1.9 on HP HP-UX B.11.11 and B.11.23 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVE-2012-0255Apr 5, 2012
Quagga (software)
Quagga
risk 0.00cvss —epss 0.03
The BGP implementation in bgpd in Quagga before 0.99.20.1 does not properly use message buffers for OPEN messages, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a message associated with a malformed Four-octet AS Number…
CVE-2012-0250Apr 5, 2012
Quagga (software)
Quagga
risk 0.00cvss —epss 0.01
Buffer overflow in the OSPFv2 implementation in ospfd in Quagga before 0.99.20.1 allows remote attackers to cause a denial of service (daemon crash) via a Link State Update (aka LS Update) packet containing a network-LSA link-state advertisement for which the data-structure…
CVE-2012-0249Apr 5, 2012
Quagga (software)
Quagga
risk 0.00cvss —epss 0.02
Buffer overflow in the ospf_ls_upd_list_lsa function in ospf_packet.c in the OSPFv2 implementation in ospfd in Quagga before 0.99.20.1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a Link State Update (aka LS Update) packet that is…
CVE-2012-0130Apr 5, 2012
Microfocus
Onboard Administrator
risk 0.00cvss —epss 0.04
HP Onboard Administrator (OA) before 3.50 allows remote attackers to obtain sensitive information via unspecified vectors.
CVE-2012-0129Apr 5, 2012
Microfocus
Onboard Administrator
risk 0.01cvss —epss 0.08
HP Onboard Administrator (OA) before 3.50 allows remote attackers to bypass intended access restrictions and execute arbitrary code via unspecified vectors.
CVE-2012-0128Apr 5, 2012
Microfocus
Onboard Administrator
risk 0.00cvss —epss 0.03
HP Onboard Administrator (OA) before 3.50 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVE-2012-0132Apr 5, 2012
Microfocus
Business Availability Center
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in HP Business Availability Center (BAC) 9.01 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2008-7311Apr 5, 2012
Spree
Spree
risk 0.00cvss —epss 0.01
The session cookie store implementation in Spree 0.2.0 uses a hardcoded config.action_controller_session hash value (aka secret key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging an application that contains this value…
CVE-2008-7310Apr 5, 2012
Spree
Spree
risk 0.00cvss —epss 0.01
Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the Order state value and bypass the intended payment step via a modified URL, related to a "mass assignment" vulnerability.
CVE-2008-7309Apr 5, 2012
Insoshi
Insoshi
risk 0.00cvss —epss 0.01
Insoshi before 20080920 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the ForumPost user_id value via a modified URL, related to a "mass assignment" vulnerability.
CVE-2012-1337Apr 5, 2012
Cisco Systems, Inc.
Webex Recording Format Player
risk 0.02cvss —epss 0.24
Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 L through SP11 EP26, T27 LB through SP21 EP10, T27 LC before SP25 EP10, and T27 LD before SP32 CP1 allows remote attackers to execute arbitrary code via a crafted WRF file, a different vulnerability than…
CVE-2012-1336Apr 5, 2012
Cisco Systems, Inc.
Webex Recording Format Player
risk 0.00cvss —epss 0.05
Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 L through SP11 EP26, T27 LB through SP21 EP10, T27 LC before SP25 EP10, and T27 LD before SP32 CP1 allows remote attackers to execute arbitrary code via a crafted WRF file, a different vulnerability than…
CVE-2012-1335Apr 5, 2012
Cisco Systems, Inc.
Webex Recording Format Player
risk 0.00cvss —epss 0.04
Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 L through SP11 EP26, T27 LB through SP21 EP10, T27 LC before SP25 EP10, and T27 LD before SP32 CP1 allows remote attackers to execute arbitrary code via a crafted WRF file, a different vulnerability than…
CVE-2011-4535Apr 3, 2012
Scadatec
Modbustagserver
risk 0.05cvss —epss 0.27
Buffer overflow in TurboPower Abbrevia before 4.0, as used in ScadaTEC ScadaPhone 5.3.11.1230 and earlier, ScadaTEC ModbusTagServer 4.1.1.81 and earlier, and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary…
CVE-2011-4045Apr 3, 2012
ARC Informatique
PcVue
risk 0.03cvss —epss 0.04
Buffer overflow in an unspecified ActiveX control in aipgctl.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to cause a denial of service via a crafted HTML document.
CVE-2011-4044Apr 3, 2012
ARC Informatique
PcVue
risk 0.05cvss —epss 0.27
An unspecified ActiveX control in SVUIGrd.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to modify files via calls to unknown methods.
CVE-2011-4043Apr 3, 2012
ARC Informatique
PcVue
risk 0.04cvss —epss 0.07
Integer overflow in an unspecified ActiveX control in SVUIGrd.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to execute arbitrary code via a large value for an integer parameter, leading to a buffer overflow.