Overview 53,126 matches · 1,413 in Waratek scope · 58 protected · 456 exploited · 77 CISA KEV · 17,453 public PoC · 990 EPSS ≥ 0.5
53,126matches
1,413in Waratek scope2.7%
58protected0.1%
456exploited0.9%
77CISA KEV0.1%
17,453public PoC32.9%
990EPSS ≥ 0.51.9%
Protected by Waratek
58
0.1%
Rule in development
0
0.0%
Mitigation candidate
101
0.2%
No exploit published
1,254
2.4%
Outside Waratek scope
608
1.1%
Not applicable
50,634
95.3%
Withdrawn CVE
471
0.9%
blocked by ARMR today
58
0.1%
partly blocked
0
0.0%
not blocked
53,067
99.9%
not established
1
0.0%
unrecorded
0
0.0%
split by
peak 6,659 / year
19882
Not applicable2
High2
not blocked2
Working exploit published1
No public exploit1
19893
Not applicable3
High2
Medium1
not blocked3
No public exploit3
199011
Not applicable11
High8
Medium2
Low1
not blocked11
Working exploit published1
No public exploit10
199115
Not applicable15
High11
Medium4
not blocked15
Working exploit published2
No public exploit13
199214
Not applicable13
Withdrawn CVE1
High12
Low1
Unknown1
not blocked14
No public exploit14
199313
Not applicable13
High8
Medium3
Low2
not blocked13
No public exploit13
199426
Not applicable25
Withdrawn CVE1
High14
Medium10
Low1
Unknown1
not blocked26
Working exploit published6
No public exploit20
199525
Not applicable25
Critical1
High17
Medium6
Low1
not blocked25
Working exploit published5
No public exploit20
199675
No exploit published1
Not applicable73
Withdrawn CVE1
Critical1
High43
Medium21
Low9
Unknown1
not blocked75
Working exploit published18
Forecast only1
No public exploit56
1997253
Not applicable252
Withdrawn CVE1
Critical1
High143
Medium89
Low19
Unknown1
not blocked253
Exploited2
Working exploit published73
Forecast only2
No public exploit176
1998247
Not applicable246
Withdrawn CVE1
Critical1
High137
Medium85
Low23
Unknown1
not blocked247
Exploited1
Working exploit published50
No public exploit196
1999923
No exploit published2
Outside Waratek scope1
Not applicable891
Withdrawn CVE29
Critical3
High423
Medium357
Low111
Unknown29
not blocked923
Exploited2
Working exploit published282
No public exploit639
20001,020
Mitigation candidate6
No exploit published6
Outside Waratek scope2
Not applicable1,005
Withdrawn CVE1
Critical2
High454
Medium467
Low96
Unknown1
not blocked1,020
Exploited5
Working exploit published427
Forecast only1
No public exploit587
20011,679
Protected by Waratek1
Mitigation candidate2
No exploit published10
Outside Waratek scope14
Not applicable1,649
Withdrawn CVE3
Critical12
High776
Medium706
Low182
Unknown3
blocked by ARMR today1
not blocked1,678
Exploited14
Working exploit published480
Forecast only2
No public exploit1,183
20022,170
Protected by Waratek3
Mitigation candidate8
No exploit published26
Outside Waratek scope12
Not applicable2,107
Withdrawn CVE14
Critical10
High1,023
Medium980
Low143
Unknown14
blocked by ARMR today3
not blocked2,167
Exploited12
Working exploit published545
Forecast only9
No public exploit1,604
20031,548
Protected by Waratek2
Mitigation candidate7
No exploit published30
Outside Waratek scope6
Not applicable1,482
Withdrawn CVE21
Critical9
High674
Medium747
Low97
Unknown21
blocked by ARMR today2
not blocked1,546
Exploited10
Working exploit published499
Forecast only1
No public exploit1,038
20042,479
Protected by Waratek2
Mitigation candidate1
No exploit published24
Outside Waratek scope8
Not applicable2,416
Withdrawn CVE28
Critical10
High973
Medium1,265
Low203
Unknown28
blocked by ARMR today2
not blocked2,477
Exploited21
Working exploit published755
Forecast only1
No public exploit1,702
20055,010
Protected by Waratek3
Mitigation candidate4
No exploit published75
Outside Waratek scope17
Not applicable4,833
Withdrawn CVE78
Critical13
High2,048
Medium2,430
Low441
Unknown78
blocked by ARMR today3
not blocked5,007
Exploited22
Working exploit published1,341
Forecast only11
No public exploit3,636
20066,659
Protected by Waratek8
Mitigation candidate4
No exploit published121
Outside Waratek scope67
Not applicable6,408
Withdrawn CVE51
Critical12
High2,763
Medium3,324
Low509
Unknown51
blocked by ARMR today8
not blocked6,651
Exploited37
Working exploit published2,440
Proof of concept only1
Forecast only6
No public exploit4,175
20076,596
Protected by Waratek6
Mitigation candidate10
No exploit published134
Outside Waratek scope83
Not applicable6,283
Withdrawn CVE80
Critical21
High3,162
Medium3,101
Low232
Unknown80
blocked by ARMR today6
not blocked6,590
Exploited47
Working exploit published2,495
Proof of concept only5
Forecast only5
No public exploit4,044
20085,664
Protected by Waratek7
Mitigation candidate9
No exploit published120
Outside Waratek scope74
Not applicable5,422
Withdrawn CVE32
Critical19
High2,846
Medium2,582
Low185
Unknown32
blocked by ARMR today7
not blocked5,657
Exploited42
Working exploit published2,518
Proof of concept only4
Forecast only9
No public exploit3,091
20095,778
Protected by Waratek9
Mitigation candidate13
No exploit published181
Outside Waratek scope62
Not applicable5,467
Withdrawn CVE46
Critical15
High2,734
Medium2,786
Low197
Unknown46
blocked by ARMR today9
not blocked5,769
Exploited73
Working exploit published2,591
Proof of concept only2
Forecast only3
No public exploit3,109
20104,667
Protected by Waratek9
Mitigation candidate12
No exploit published162
Outside Waratek scope86
Not applicable4,370
Withdrawn CVE28
Critical28
High2,093
Medium2,241
Low277
Unknown28
blocked by ARMR today9
not blocked4,658
Exploited73
Working exploit published1,313
Proof of concept only1
Forecast only9
No public exploit3,271
20114,172
Protected by Waratek6
Mitigation candidate9
No exploit published178
Outside Waratek scope116
Not applicable3,841
Withdrawn CVE22
Critical5
High1,784
Medium2,101
Low260
Unknown22
blocked by ARMR today6
not blocked4,166
Exploited50
Working exploit published691
Proof of concept only5
Forecast only4
No public exploit3,422
20124,077
Protected by Waratek2
Mitigation candidate16
No exploit published184
Outside Waratek scope60
Not applicable3,782
Withdrawn CVE33
Critical15
High1,338
Medium2,329
Low362
Unknown33
blocked by ARMR today2
not blocked4,074
not established1
Exploited45
Working exploit published615
Proof of concept only5
Forecast only45
No public exploit3,367
1988199019921994199619982000200220042006200820102012
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2012-5197 | High | 2012-09-28 | Not applicable | No public exploit | Multiple unspecified vulnerabilities in Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 have unknown impact and attack vectors related to "error checking of system calls." |
| CVE-2012-5196 | High | 2012-09-28 | Not applicable | No public exploit | Multiple buffer overflows in Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 have unknown impact and attack vectors. |
| CVE-2012-5049 | High | 2012-09-28 | Not applicable | Working exploit published | APIFTP Server in Optimalog Optima PLC 1.5.2 and earlier allows remote attackers to cause a denial of service (infinite loop) via a malformed packet. |
| CVE-2012-5048 | High | 2012-09-28 | Not applicable | Working exploit published | APIFTP Server in Optimalog Optima PLC 1.5.2 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted packet. |
| CVE-2012-4912 | Medium | 2012-09-28 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the WebAccess component in Novell GroupWise 8.0 before Support Pack 3 and 2012 before Support Pack 1 allows remote attackers to inject arbitrary web script or HTML via a crafted signature in an HTML e-mail message. |
| CVE-2012-4448 | Medium | 2012-09-28 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in wp-admin/index.php in WordPress 3.4.2 allows remote attackers to hijack the authentication of administrators for requests that modify an RSS URL via a dashboard_incoming_links edit action. |
| CVE-2012-4051 | Medium | 2012-09-28 | Not applicable | Working exploit published | Multiple cross-site request forgery (CSRF) vulnerabilities in editAccount.html in the JAMF Software Server (JSS) interface in JAMF Casper Suite before 8.61 allow remote attackers to hijack the authentication of administrators for requests that (1) create user accounts or (2) change passwords via a Save action. |
| CVE-2012-4017 | Medium | 2012-09-28 | Not applicable | No public exploit | The jigbrowser+ application before 1.5.0 for Android does not properly implement the WebView class, which allows remote attackers to obtain sensitive information via a crafted application. |
| CVE-2012-4016 | Medium | 2012-09-28 | Not applicable | No public exploit | The ATOK application before 1.0.4 for Android allows remote attackers to read the learning information file, and obtain sensitive input-string information, via a crafted application. |
| CVE-2012-3493 | Medium | 2012-09-28 | Not applicable | No public exploit | The command_give_request_ad function in condor_startd.V6/command.cpp Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 allows remote attackers to obtain sensitive information, and possibly control or start arbitrary jobs, via a ClassAd request to the condor_startd port, which leaks the ClaimId. |
| CVE-2012-3492 | Medium | 2012-09-28 | Not applicable | No public exploit | The filesystem authentication (condor_io/condor_auth_fs.cpp) in Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 uses authentication directories even when they have weak permissions, which allows remote attackers to impersonate users by renaming a user's authentication directory. |
| CVE-2012-3491 | Medium | 2012-09-28 | Not applicable | No public exploit | src/condor_schedd.V6/schedd.cpp in Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 does not properly check the permissions of jobs, which allows remote authenticated users to remove arbitrary idle jobs via unspecified vectors. |
| CVE-2012-3459 | Medium | 2012-09-28 | Not applicable | No public exploit | Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allows remote authenticated users to modify Condor attributes and possibly gain privileges via crafted additional parameters in an HTTP POST request, which triggers a job attribute change request to Condor. |
| CVE-2012-2998 | High | 2012-09-28 | Not applicable | Working exploit published | SQL injection vulnerability in the ad hoc query module in Trend Micro Control Manager (TMCM) before 5.5.0.1823 and 6.0 before 6.0.0.1449 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. |
| CVE-2012-2735 | Medium | 2012-09-28 | Not applicable | No public exploit | Session fixation vulnerability in Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allows remote attackers to hijack web sessions via a crafted session cookie. |
| CVE-2012-2734 | Medium | 2012-09-28 | Not applicable | No public exploit | Multiple cross-site request forgery (CSRF) vulnerabilities in Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allow remote attackers to hijack the authentication of arbitrary users for requests that execute commands via unspecified vectors. |
| CVE-2012-2685 | Medium | 2012-09-28 | Not applicable | No public exploit | Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allows remote authenticated users to cause a denial of service (memory consumption) via a large size in an image request. |
| CVE-2012-2684 | High | 2012-09-28 | Not applicable | No public exploit | Multiple SQL injection vulnerabilities in the get_sample_filters_by_signature function in Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allow remote attackers to execute arbitrary SQL commands via the (1) agent or (2) object id. |
| CVE-2012-2683 | Medium | 2012-09-28 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to (1) "error message displays" or (2) "in source HTML on certain pages." |
| CVE-2012-2681 | Medium | 2012-09-28 | Not applicable | No public exploit | Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, uses predictable random numbers to generate session keys, which makes it easier for remote attackers to guess the session key. |
| CVE-2012-2680 | Medium | 2012-09-28 | Not applicable | No public exploit | Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, does not properly restrict access to resources, which allows remote attackers to obtain sensitive information via unspecified vectors related to (1) "web pages," (2) "export functionality," and (3) "image viewing." |
| CVE-2012-2145 | Medium | 2012-09-28 | Not applicable | No public exploit | Apache Qpid 0.17 and earlier does not properly restrict incoming client connections, which allows remote attackers to cause a denial of service (file descriptor consumption) via a large number of incomplete connections. |
| CVE-2012-1833 | Medium | 2012-09-28 | Not applicable | No public exploit | VMware SpringSource Grails before 1.3.8, and 2.x before 2.0.2, does not properly restrict data binding, which might allow remote attackers to bypass intended access restrictions and modify arbitrary object properties via a crafted request parameter to an application. |
| CVE-2012-0956 | Medium | 2012-09-28 | Not applicable | No public exploit | ubiquity-slideshow-ubuntu before 58.2, during installation, allows remote man-in-the-middle attackers to execute arbitrary web script or HTML and read arbitrary files via a crafted attribute in the <a> tag of a Twitter feed. |
| CVE-2012-0419 | Medium | 2012-09-28 | Not applicable | No public exploit | Directory traversal vulnerability in the agent HTTP interfaces in Novell GroupWise 8.0 before Support Pack 3 and 2012 before Support Pack 1 allows remote attackers to read arbitrary files via directory traversal sequences in a request. |
| CVE-2012-0418 | High | 2012-09-28 | Not applicable | No public exploit | Unspecified vulnerability in the client in Novell GroupWise 8.0 before Support Pack 3 and 2012 before Support Pack 1 on Windows allows user-assisted remote attackers to execute arbitrary code via a crafted file. |
| CVE-2012-0417 | High | 2012-09-28 | Not applicable | No public exploit | Integer overflow in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before Support Pack 3 and 2012 before Support Pack 1 allows remote attackers to execute arbitrary code via unspecified vectors. |
| CVE-2012-4623 | High | 2012-09-27 | Not applicable | No public exploit | The DHCPv6 server in Cisco IOS 12.2 through 12.4 and 15.0 through 15.2 and IOS XE 2.1.x through 2.6.x, 3.1.xS before 3.1.4S, 3.1.xSG and 3.2.xSG before 3.2.5SG, 3.2.xS, 3.2.xXO, 3.3.xS, and 3.3.xSG before 3.3.1SG allows remote attackers to cause a denial of service (device reload) via a malformed DHCPv6 packet, aka Bug ID CSCto57723. |
| CVE-2012-4622 | High | 2012-09-27 | Not applicable | No public exploit | Cisco IOS XE 03.02.00.XO.15.0(2)XO on Catalyst 4500E series switches, when a Supervisor Engine 7L-E card is installed, allows remote attackers to cause a denial of service (card reload) via malformed packets that trigger uncorrected ECC error messages, aka Bug ID CSCty88456. |
| CVE-2012-4621 | High | 2012-09-27 | Not applicable | No public exploit | The Device Sensor feature in Cisco IOS 15.0 through 15.2 allows remote attackers to cause a denial of service (device reload) via a DHCP packet, aka Bug ID CSCty96049. |
| CVE-2012-4620 | High | 2012-09-27 | Not applicable | No public exploit | Cisco IOS 12.2 and 15.0 through 15.2 on Cisco 10000 series routers, when a tunnel interface exists, allows remote attackers to cause a denial of service (interface queue wedge) via tunneled (1) GRE/IP, (2) IPIP, or (3) IPv6 in IPv4 packets, aka Bug ID CSCts66808. |
| CVE-2012-4619 | High | 2012-09-27 | Not applicable | No public exploit | The NAT implementation in Cisco IOS 12.2, 12.4, and 15.0 through 15.2 allows remote attackers to cause a denial of service (device reload) via transit IP packets, aka Bug ID CSCtr46123. |
| CVE-2012-4618 | High | 2012-09-27 | Not applicable | No public exploit | The SIP ALG feature in the NAT implementation in Cisco IOS 12.2, 12.4, and 15.0 through 15.2 allows remote attackers to cause a denial of service (device reload) via transit IP packets, aka Bug ID CSCtn76183. |
| CVE-2012-4617 | High | 2012-09-27 | Not applicable | No public exploit | The BGP implementation in Cisco IOS 15.2, IOS XE 3.5.xS before 3.5.2S, and IOS XR 4.1.0 through 4.2.2 allows remote attackers to cause a denial of service (multiple connection resets) by leveraging a peer relationship and sending a malformed attribute, aka Bug IDs CSCtt35379, CSCty58300, CSCtz63248, and CSCtz62914. |
| CVE-2012-3950 | High | 2012-09-27 | Not applicable | No public exploit | The Intrusion Prevention System (IPS) feature in Cisco IOS 12.3 through 12.4 and 15.0 through 15.2, in certain configurations of enabled categories and missing signatures, allows remote attackers to cause a denial of service (device reload) via DNS packets, aka Bug ID CSCtw55976. |
| CVE-2012-3949 | High | 2012-09-27 | Outside Waratek scope | No public exploit | The SIP implementation in Cisco Unified Communications Manager (CUCM) 6.x and 7.x before 7.1(5b)su5, 8.x before 8.5(1)su4, and 8.6 before 8.6(2a)su1; Cisco IOS 12.2 through 12.4 and 15.0 through 15.2; and Cisco IOS XE 3.3.xSG before 3.3.1SG, 3.4.xS, and 3.5.xS allows remote attackers to cause a denial of service (service crash or device reload) via a crafted SIP message containing an SDP session description, aka Bug IDs CSCtw66721, CSCtj33003, and CSCtw84664. |
| CVE-2012-5164 | Medium | 2012-09-26 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in Fork CMS before 3.2.7 allow remote attackers to inject arbitrary web script or HTML via the term parameter to (1) autocomplete.php, (2) search/ajax/autosuggest.php, (3) livesuggest.php, or (4) save.php in frontend/modules/search/ajax. |
| CVE-2012-5163 | Medium | 2012-09-26 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in oc-admin/ajax/ajax.php in OSClass before 2.3.5 allows remote attackers to inject arbitrary web script or HTML via the id parameter in an enable_category action to index.php. |
| CVE-2012-5162 | Medium | 2012-09-26 | Not applicable | No public exploit | Multiple SQL injection vulnerabilities in oc-admin/ajax/ajax.php in OSClass before 2.3.5 allow remote attackers to execute arbitrary SQL commands via the id parameter in a (1) edit_category_post or (2) enable_category action to index.php. |
| CVE-2012-2897 | High | 2012-09-26 | Not applicable | No public exploit | The kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT, as used by Google Chrome before 22.0.1229.79 and other programs, do not properly handle objects in memory, which allows remote attackers to execute arbitrary code via a crafted TrueType font file, aka "Windows Font Parsing Vulnerability" or "TrueType Font Parsing Vulnerability." |
| CVE-2012-2896 | High | 2012-09-26 | Not applicable | No public exploit | Integer overflow in the WebGL implementation in Google Chrome before 22.0.1229.79 on Mac OS X allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. |
| CVE-2012-2895 | Medium | 2012-09-26 | Not applicable | No public exploit | The PDF functionality in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger out-of-bounds write operations. |
| CVE-2012-2894 | Medium | 2012-09-26 | Not applicable | No public exploit | Google Chrome before 22.0.1229.79 does not properly handle graphics-context data structures, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via unknown vectors. |
| CVE-2012-2893 | Medium | 2012-09-26 | Not applicable | No public exploit | Double free vulnerability in libxslt, as used in Google Chrome before 22.0.1229.79, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to XSL transforms. |
| CVE-2012-2892 | Medium | 2012-09-26 | Not applicable | No public exploit | Unspecified vulnerability in Google Chrome before 22.0.1229.79 allows remote attackers to bypass the pop-up blocker via unknown vectors. |
| CVE-2012-2891 | Medium | 2012-09-26 | Not applicable | No public exploit | The IPC implementation in Google Chrome before 22.0.1229.79 allows attackers to obtain potentially sensitive information about memory addresses via unspecified vectors. |
| CVE-2012-2890 | Medium | 2012-09-26 | Not applicable | No public exploit | Use-after-free vulnerability in the PDF functionality in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document. |
| CVE-2012-2889 | Medium | 2012-09-26 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Google Chrome before 22.0.1229.79 allows remote attackers to inject arbitrary web script or HTML via vectors involving frames, aka "Universal XSS (UXSS)." |
| CVE-2012-2888 | High | 2012-09-26 | Not applicable | No public exploit | Use-after-free vulnerability in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving SVG text references. |
| CVE-2012-2887 | High | 2012-09-26 | Not applicable | No public exploit | Use-after-free vulnerability in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving onclick events. |
| CVE-2012-2886 | Medium | 2012-09-26 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Google Chrome before 22.0.1229.79 allows remote attackers to inject arbitrary web script or HTML via vectors related to the Google V8 bindings, aka "Universal XSS (UXSS)." |
| CVE-2012-2885 | High | 2012-09-26 | Not applicable | No public exploit | Double free vulnerability in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to application exit. |
| CVE-2012-2884 | Medium | 2012-09-26 | Not applicable | No public exploit | Skia, as used in Google Chrome before 22.0.1229.79, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors. |
| CVE-2012-2883 | High | 2012-09-26 | Not applicable | No public exploit | Skia, as used in Google Chrome before 22.0.1229.79, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an out-of-bounds write operation, a different vulnerability than CVE-2012-2874. |
| CVE-2012-2882 | Medium | 2012-09-26 | Not applicable | No public exploit | FFmpeg, as used in Google Chrome before 22.0.1229.79, does not properly handle OGG containers, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors, related to a "wild pointer" issue. |
| CVE-2012-2881 | High | 2012-09-26 | Not applicable | No public exploit | Google Chrome before 22.0.1229.79 does not properly handle plug-ins, which allows remote attackers to cause a denial of service (DOM tree corruption) or possibly have unspecified other impact via unknown vectors. |
| CVE-2012-2880 | High | 2012-09-26 | Not applicable | No public exploit | Race condition in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the plug-in paint buffer. |
| CVE-2012-2879 | Medium | 2012-09-26 | Not applicable | No public exploit | Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service (DOM topology corruption) via a crafted document. |
| CVE-2012-2878 | High | 2012-09-26 | Not applicable | No public exploit | Use-after-free vulnerability in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to plug-in handling. |
| CVE-2012-2877 | Medium | 2012-09-26 | Not applicable | No public exploit | The extension system in Google Chrome before 22.0.1229.79 does not properly handle modal dialogs, which allows remote attackers to cause a denial of service (application crash) via unspecified vectors. |
| CVE-2012-2876 | High | 2012-09-26 | Not applicable | No public exploit | Buffer overflow in the SSE2 optimization functionality in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. |
| CVE-2012-2875 | Medium | 2012-09-26 | Not applicable | No public exploit | Multiple unspecified vulnerabilities in the PDF functionality in Google Chrome before 22.0.1229.79 allow remote attackers to have an unknown impact via a crafted document. |
| CVE-2012-2874 | High | 2012-09-26 | Not applicable | No public exploit | Skia, as used in Google Chrome before 22.0.1229.79, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an out-of-bounds write operation, a different vulnerability than CVE-2012-2883. |
| CVE-2012-1617 | Medium | 2012-09-26 | Not applicable | Working exploit published | Directory traversal vulnerability in combine.php in OSClass before 2.3.6 allows remote attackers to read and write arbitrary files via a .. (dot dot) in the type parameter. NOTE: this vulnerability can be leveraged to upload arbitrary files. |
| CVE-2012-1188 | Medium | 2012-09-26 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in Fork CMS before 3.2.7 allow remote attackers to inject arbitrary web script or HTML via the (1) type or (2) querystring parameters to private/en/error or (3) name parameter to private/en/locale/index. |
| CVE-2012-1117 | Medium | 2012-09-26 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Joomla! 2.5.0 and 2.5.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2012-1116 | High | 2012-09-26 | Not applicable | Working exploit published | SQL injection vulnerability in Joomla! 1.7.x and 2.5.x before 2.5.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. |
| CVE-2012-5159 | High | 2012-09-25 | Not applicable | Working exploit published | phpMyAdmin 3.5.2.2, as distributed by the cdnetworks-kr-1 mirror during an unspecified time frame in 2012, contains an externally introduced modification (Trojan Horse) in server_sync.php, which allows remote attackers to execute arbitrary PHP code via an eval injection attack. |
| CVE-2012-4015 | Medium | 2012-09-25 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the management screen in myLittleTools myLittleAdmin for SQL Server 2000 allows remote attackers to inject arbitrary web script or HTML via vectors that trigger a crafted database entry. |
| CVE-2012-4014 | High | 2012-09-25 | Not applicable | No public exploit | Unspecified vulnerability in McAfee Email Anti-virus (formerly WebShield SMTP) allows remote attackers to cause a denial of service via unknown vectors. |
| CVE-2012-3334 | High | 2012-09-25 | Not applicable | No public exploit | Stack-based buffer overflow in IBM Informix Dynamic Server (IDS) 11.50 before 11.50.xC9W2 and 11.70 before 11.70.xC5 allows remote authenticated users to execute arbitrary code via crafted arguments in a SET COLLATION statement. |
| CVE-2012-3324 | High | 2012-09-25 | Not applicable | No public exploit | Directory traversal vulnerability in the UTL_FILE module in IBM DB2 and DB2 Connect 10.1 before FP1 on Windows allows remote authenticated users to modify, delete, or read arbitrary files via a pathname in the file field. |
| CVE-2012-3311 | Low | 2012-09-25 | No exploit published | No public exploit | IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.45, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1 on z/OS, in certain configurations involving Federated Repositories for IIOP connections and Optimized Local Adapters, does not perform CBIND checks, which allows local users to bypass intended access restrictions, and read or modify application data, via unspecified vectors. |
| CVE-2012-3306 | Medium | 2012-09-25 | No exploit published | No public exploit | IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.45, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1, when multi-domain support is configured, does not purge password data from the authentication cache, which has unspecified impact and remote attack vectors. |
| CVE-2012-3305 | Medium | 2012-09-25 | Protected by Waratek | No public exploit | Directory traversal vulnerability in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1 allows remote attackers to overwrite arbitrary files via a crafted application file. |
| CVE-2012-3304 | Medium | 2012-09-25 | No exploit published | No public exploit | The Administrative Console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.45, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1 allows remote attackers to hijack sessions via unspecified vectors. |
| CVE-2012-3300 | Low | 2012-09-25 | Not applicable | No public exploit | IBM WebSphere Commerce 7.0 before 7.0.0.6, when persistent sessions and personalization IDs are enabled, allows remote attackers to cause a denial of service (resource consumption) via unspecified vectors. |
| CVE-2012-3298 | High | 2012-09-25 | Not applicable | No public exploit | Unspecified vulnerability in the REST services framework in IBM WebSphere Commerce 7.0 Feature Pack 4 allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via unspecified vectors. |
| CVE-2012-3264 | High | 2012-09-25 | Not applicable | No public exploit | Unspecified vulnerability in a SOAP feature in HP SiteScope 11.10 through 11.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1472. |
| CVE-2012-3263 | High | 2012-09-25 | Not applicable | No public exploit | Unspecified vulnerability in a SOAP feature in HP SiteScope 11.10 through 11.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1465. |
| CVE-2012-3262 | High | 2012-09-25 | Not applicable | No public exploit | Unspecified vulnerability in a SOAP feature in HP SiteScope 11.10 through 11.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1464. |
| CVE-2012-3261 | High | 2012-09-25 | Not applicable | Working exploit published | Unspecified vulnerability in a SOAP feature in HP SiteScope 11.10 through 11.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1463. |
| CVE-2012-3260 | High | 2012-09-25 | Not applicable | Working exploit published | Unspecified vulnerability in a SOAP feature in HP SiteScope 11.10 through 11.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1462. |
| CVE-2012-3259 | High | 2012-09-25 | Not applicable | Forecast only | Unspecified vulnerability in a SOAP feature in HP SiteScope 11.10 through 11.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1461. |
| CVE-2012-3037 | Medium | 2012-09-25 | Not applicable | No public exploit | The Siemens SIMATIC S7-1200 2.x PLC does not properly protect the private key of the SIMATIC CONTROLLER Certification Authority certificate, which allows remote attackers to spoof the S7-1200 web server by using this key to create a forged certificate. |
| CVE-2012-3011 | High | 2012-09-25 | Not applicable | No public exploit | Directory traversal vulnerability in the web server in Fultek WinTr Scada 4.0.5 and earlier allows remote attackers to read arbitrary files via a crafted request. |
| CVE-2012-2287 | High | 2012-09-25 | Not applicable | No public exploit | The authentication functionality in EMC RSA Authentication Agent 7.1 and RSA Authentication Client 3.5 on Windows XP and Windows Server 2003, when an unspecified configuration exists, allows remote authenticated users to bypass an intended token-authentication step, and establish a login session to a remote host, by leveraging Windows credentials for that host. |
| CVE-2012-2199 | Medium | 2012-09-25 | Not applicable | No public exploit | The server message channel agent in the queue manager in the server in IBM WebSphere MQ 7.0.1 before 7.0.1.9, 7.1, and 7.5 on Solaris allows remote attackers to cause a denial of service (invalid address alignment exception and daemon crash) via vectors involving a multiplexed channel. |
| CVE-2012-2187 | Medium | 2012-09-25 | Not applicable | No public exploit | IBM Remote Supervisor Adapter II firmware for System x3650, x3850 M2, and x3950 M2 1.13 and earlier generates weak RSA keys, which makes it easier for attackers to defeat cryptographic protection mechanisms via unspecified vectors. |
| CVE-2012-1646 | Medium | 2012-09-25 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in the FAQ module 6.x-1.x before 6.x-1.13 and 7.x-1.x-rc1 for Drupal allow remote authenticated users to inject arbitrary web script or HTML via the (1) title parameter in faq.admin.inc or (2) detailed_question parameter in faq.module. |
| CVE-2012-1293 | Medium | 2012-09-25 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in fup in Frams' Fast File EXchange (F*EX, aka fex) before 20111129-2 allow remote attackers to inject arbitrary web script or HTML via the (1) to or (2) from parameters. |
| CVE-2012-1103 | Medium | 2012-09-25 | Not applicable | No public exploit | emacs/notmuch-mua.el in Notmuch before 0.11.1, when using the Emacs interface, allows user-assisted remote attackers to read arbitrary files via crafted MML tags, which are not properly quoted in an email reply cna cause the files to be attached to the message. |
| CVE-2012-0974 | Medium | 2012-09-25 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in the getParam function in oc-includes/osclass/core/Params.php in OSClass before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via the (1) sCity, (2) sPattern, (3) sPriceMax, and (4) sPriceMin parameters in a search action to index.php. |
| CVE-2012-0973 | High | 2012-09-25 | Not applicable | Working exploit published | Multiple SQL injection vulnerabilities in OSClass before 2.3.5 allow remote attackers to execute arbitrary SQL commands via the sCategory parameter to index.php, which is not properly handled by the (1) osc_search_category_id function in oc-includes/osclass/helpers/hSearch.php and (2) findBySlug function oc-includes/osclass/model/Category.php. NOTE: some of these details are obtained from third party information. |
| CVE-2012-0869 | Medium | 2012-09-25 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in fup in Frams' Fast File EXchange (F*EX, aka fex) before 20120215 allows remote attackers to inject arbitrary web script or HTML via the id parameter. |
| CVE-2012-0209 | High | 2012-09-25 | Not applicable | Working exploit published | Horde 3.3.12, Horde Groupware 1.2.10, and Horde Groupware Webmail Edition 1.2.10, as distributed by FTP between November 2011 and February 2012, contains an externally introduced modification (Trojan Horse) in templates/javascript/open_calendar.js, which allows remote attackers to execute arbitrary PHP code. |
| CVE-2011-4623 | Low | 2012-09-25 | Not applicable | No public exploit | Integer overflow in the rsCStrExtendBuf function in runtime/stringbuf.c in the imfile module in rsyslog 4.x before 4.6.6, 5.x before 5.7.4, and 6.x before 6.1.4 allows local users to cause a denial of service (daemon hang) via a large file, which triggers a heap-based buffer overflow. |
| CVE-2012-5054 | High | 2012-09-24 | Not applicable | Exploited | Integer overflow in the copyRawDataTo method in the Matrix3D class in Adobe Flash Player before 11.4.402.265 allows remote attackers to execute arbitrary code via malformed arguments. |
| CVE-2012-4655 | High | 2012-09-24 | Not applicable | No public exploit | The WebLaunch feature in Cisco Secure Desktop before 3.6.6020 does not properly validate binaries that are received by the downloader process, which allows remote attackers to execute arbitrary code via vectors involving (1) ActiveX or (2) Java components, aka Bug IDs CSCtz76128 and CSCtz78204. |
| CVE-2012-3451 | Medium | 2012-09-24 | No exploit published | No public exploit | Apache CXF before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to execute unintended web-service operations by sending a header with a SOAP Action String that is inconsistent with the message body. |