WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Published to 2012-01-31✕
Overview 32,275 matches · 1,150 in Waratek scope · 34 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
32,275matches 1,150in Waratek scope3.6% 34protected0.1% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 34 0.1% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 1,116 3.5% Outside Waratek scope 476 1.5% Not applicable 30,241 93.7% Withdrawn CVE 408 1.3%
Critical 96 0.3% High 13,118 40.6% Medium 16,103 49.9% Low 2,550 7.9% None 0 0.0% Unknown 408 1.3%
blocked by ARMR today 34 0.1% partly blocked 0 0.0% not blocked 32,241 99.9% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 32,275 100.0%
split by peak 4,175 / year
Withdrawn CVE: 408Not applicable: 30,241Outside Waratek scope: 476No exploit published: 1,116Protected by Waratek: 34 Unknown: 408Low: 2,550Medium: 16,103High: 13,118Critical: 96 not blocked: 32,241blocked by ARMR today: 34 No public exploit: 32,275
19881 Not applicable1 High1 not blocked1 No public exploit1 19893 Not applicable3 High2 Medium1 not blocked3 No public exploit3 199010 Not applicable10 High8 Medium1 Low1 not blocked10 No public exploit10 199113 Not applicable13 High9 Medium4 not blocked13 No public exploit13 199214 Not applicable13 Withdrawn CVE1 High12 Low1 Unknown1 not blocked14 No public exploit14 199313 Not applicable13 High8 Medium3 Low2 not blocked13 No public exploit13 199420 Not applicable19 Withdrawn CVE1 High11 Medium8 Unknown1 not blocked20 No public exploit20 199520 Not applicable20 High15 Medium4 Low1 not blocked20 No public exploit20 199656 No exploit published1 Not applicable55 Critical1 High30 Medium16 Low9 not blocked56 No public exploit56 1997176 Not applicable175 Withdrawn CVE1 Critical1 High90 Medium71 Low13 Unknown1 not blocked176 No public exploit176 1998196 Not applicable195 Withdrawn CVE1 High103 Medium74 Low18 Unknown1 not blocked196 No public exploit196 1999639 No exploit published2 Not applicable609 Withdrawn CVE28 Critical1 High289 Medium238 Low83 Unknown28 not blocked639 No public exploit639 2000587 No exploit published6 Not applicable580 Withdrawn CVE1 Critical1 High253 Medium270 Low62 Unknown1 not blocked587 No public exploit587 20011,183 Protected by Waratek1 No exploit published10 Outside Waratek scope10 Not applicable1,159 Withdrawn CVE3 Critical8 High546 Medium482 Low144 Unknown3 blocked by ARMR today1 not blocked1,182 No public exploit1,183 20021,604 Protected by Waratek3 No exploit published24 Outside Waratek scope8 Not applicable1,557 Withdrawn CVE12 Critical6 High735 Medium728 Low123 Unknown12 blocked by ARMR today3 not blocked1,601 No public exploit1,604 20031,038 Protected by Waratek1 No exploit published30 Outside Waratek scope4 Not applicable983 Withdrawn CVE20 Critical5 High428 Medium504 Low81 Unknown20 blocked by ARMR today1 not blocked1,037 No public exploit1,038 20041,702 Protected by Waratek2 No exploit published24 Outside Waratek scope7 Not applicable1,641 Withdrawn CVE28 Critical6 High661 Medium840 Low167 Unknown28 blocked by ARMR today2 not blocked1,700 No public exploit1,702 20053,636 Protected by Waratek2 No exploit published75 Outside Waratek scope13 Not applicable3,473 Withdrawn CVE73 Critical8 High1,374 Medium1,794 Low387 Unknown73 blocked by ARMR today2 not blocked3,634 No public exploit3,636 20064,175 Protected by Waratek6 No exploit published121 Outside Waratek scope60 Not applicable3,940 Withdrawn CVE48 Critical8 High1,535 Medium2,175 Low409 Unknown48 blocked by ARMR today6 not blocked4,169 No public exploit4,175 20074,044 Protected by Waratek5 No exploit published134 Outside Waratek scope71 Not applicable3,757 Withdrawn CVE77 Critical11 High1,720 Medium2,034 Low202 Unknown77 blocked by ARMR today5 not blocked4,039 No public exploit4,044 20083,091 Protected by Waratek2 No exploit published120 Outside Waratek scope67 Not applicable2,875 Withdrawn CVE27 Critical13 High1,311 Medium1,585 Low155 Unknown27 blocked by ARMR today2 not blocked3,089 No public exploit3,091 20093,109 Protected by Waratek5 No exploit published181 Outside Waratek scope53 Not applicable2,830 Withdrawn CVE40 Critical8 High1,256 Medium1,642 Low163 Unknown40 blocked by ARMR today5 not blocked3,104 No public exploit3,109 20103,271 Protected by Waratek4 No exploit published161 Outside Waratek scope73 Not applicable3,007 Withdrawn CVE26 Critical16 High1,304 Medium1,677 Low248 Unknown26 blocked by ARMR today4 not blocked3,267 No public exploit3,271 20113,422 Protected by Waratek3 No exploit published178 Outside Waratek scope108 Not applicable3,114 Withdrawn CVE19 High1,363 Medium1,794 Low246 Unknown19 blocked by ARMR today3 not blocked3,419 No public exploit3,422 2012252 No exploit published49 Outside Waratek scope2 Not applicable199 Withdrawn CVE2 Critical3 High54 Medium158 Low35 Unknown2 not blocked252 No public exploit252
1988199019921994199619982000200220042006200820102012
32,275 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 323 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2012-0817 Medium 2012-01-30 Not applicable No public exploit Memory leak in smbd in Samba 3.6.x before 3.6.3 allows remote attackers to cause a denial of service (memory and CPU consumption) by making many connection requests.
CVE-2012-0936 Medium 2012-01-29 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in web/springframework/security/SecurityAuthenticationEventOnmsEventBuilder.java in OpenNMS 1.8.x before 1.8.17, 1.9.93 and earlier, and 1.10.x before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via the Username field, related to login.
CVE-2012-0934 High 2012-01-29 Not applicable No public exploit PHP remote file inclusion vulnerability in ajax/savetag.php in the Theme Tuner plugin for WordPress before 0.8 allows remote attackers to execute arbitrary PHP code via a URL in the tt-abspath parameter.
CVE-2011-5070 Medium 2012-01-29 Not applicable No public exploit Multiple cross-site scripting (XSS) vulnerabilities in Support Incident Tracker (aka SiT!) 3.65 allow remote attackers to inject arbitrary web script or HTML via (1) the file name to incident_attachments.php; (2) unspecified vectors in link_add.php, possibly involving origref, linkref, linktype parameters, which are not properly handled in the clean_int function in lib/base.inc.php, or the redirect parameter, which is not properly handled in the html_redirect function in lib/html.inc.php; and (3) unspecified vectors in translate.php.
CVE-2011-5069 Medium 2012-01-29 Not applicable No public exploit Unrestricted file upload vulnerability in incident_attachments.php in Support Incident Tracker (aka SiT!) 3.65 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in unspecified directory, a different program than CVE-2011-3833.
CVE-2011-5068 Medium 2012-01-29 Not applicable No public exploit Multiple cross-site request forgery (CSRF) vulnerabilities in Support Incident Tracker (aka SiT!) 3.65 allow remote attackers to hijack the authentication of user for requests that delete a user via user_delete.php and other unspecified programs.
CVE-2011-5067 Medium 2012-01-29 Not applicable No public exploit move_uploaded_file.php in Support Incident Tracker (aka SiT!) 3.65 allows remote authenticated users to obtain sensitive information via the file name, which reveals the installation path in an error message.
CVE-2011-3832 Medium 2012-01-29 Not applicable No public exploit Eval injection vulnerability in config.php in Support Incident Tracker (aka SiT!) 3.65 allows remote authenticated administrators to execute arbitrary PHP code via the application_name parameter in a save action.
CVE-2011-3831 High 2012-01-29 Not applicable No public exploit SQL injection vulnerability in incident_attachments.php in Support Incident Tracker (aka SiT!) 3.65 allows remote attackers to execute arbitrary SQL commands via an uploaded file with a crafted file name.
CVE-2011-3830 Medium 2012-01-29 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in search.php in Support Incident Tracker (aka SiT!) 3.65 allows remote attackers to inject arbitrary web script or HTML via the search_string parameter.
CVE-2012-0931 Critical 2012-01-28 Not applicable No public exploit Schneider Electric Modicon Quantum PLC does not perform authentication between the Unity software and PLC, which allows remote attackers to cause a denial of service or possibly execute arbitrary code via unspecified vectors.
CVE-2012-0930 Medium 2012-01-28 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in Schneider Electric Modicon Quantum PLC allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-0929 High 2012-01-28 Not applicable No public exploit Multiple buffer overflows in Schneider Electric Modicon Quantum PLC allow remote attackers to cause a denial of service via malformed requests to the (1) FTP server or (2) HTTP server.
CVE-2012-0021 Low 2012-01-28 Not applicable No public exploit The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server 2.2.17 through 2.2.21, when a threaded MPM is used, does not properly handle a %{}C format string, which allows remote attackers to cause a denial of service (daemon crash) via a cookie that lacks both a name and a value.
CVE-2012-0814 Medium 2012-01-27 Not applicable No public exploit The auth_parse_options function in auth-options.c in sshd in OpenSSH before 5.7 provides debug messages containing authorized_keys command options, which allows remote authenticated users to obtain potentially sensitive information by reading these messages, as demonstrated by the shared user account required by Gitolite. NOTE: this can cross privilege boundaries because a user account may intentionally have no shell or filesystem access, and therefore may have no supported way to read an authorized_keys file in its own home directory.
CVE-2012-0807 Medium 2012-01-27 Not applicable No public exploit Stack-based buffer overflow in the suhosin_encrypt_single_cookie function in the transparent cookie-encryption feature in the Suhosin extension before 0.9.33 for PHP, when suhosin.cookie.encrypt and suhosin.multiheader are enabled, might allow remote attackers to execute arbitrary code via a long string that is used in a Set-Cookie HTTP header.
CVE-2012-0806 Medium 2012-01-27 Not applicable No public exploit Buffer overflow in Bip 0.8.8 and earlier might allow remote authenticated users to execute arbitrary code via vectors involving a series of TCP connections that triggers use of many open file descriptors.
CVE-2012-0395 High 2012-01-27 Not applicable No public exploit Buffer overflow in the server in EMC NetWorker 7.5.x and 7.6.x before 7.6.3 SP1 Cumulative Release build 851 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via unspecified vectors.
CVE-2012-0029 High 2012-01-27 Not applicable No public exploit Heap-based buffer overflow in the process_tx_desc function in the e1000 emulation (hw/e1000.c) in qemu-kvm 0.12, and possibly other versions, allows guest OS users to cause a denial of service (QEMU crash) and possibly execute arbitrary code via crafted legacy mode packets.
CVE-2011-4622 Medium 2012-01-27 Not applicable No public exploit The create_pit_timer function in arch/x86/kvm/i8254.c in KVM 83, and possibly other versions, does not properly handle when Programmable Interval Timer (PIT) interrupt requests (IRQs) when a virtual interrupt controller (irqchip) is not available, which allows local users to cause a denial of service (NULL pointer dereference) by starting a timer.
CVE-2011-4608 High 2012-01-27 No exploit published No public exploit mod_cluster in JBoss Enterprise Application Platform 5.1.2 for Red Hat Linux allows worker nodes to register with arbitrary virtual hosts, which allows remote attackers to bypass intended access restrictions and provide malicious content, hijack sessions, and steal credentials by registering from an external vhost that does not enforce security constraints.
CVE-2011-4354 Medium 2012-01-27 Not applicable No public exploit crypto/bn/bn_nist.c in OpenSSL before 0.9.8h on 32-bit platforms, as used in stunnel and other products, in certain circumstances involving ECDH or ECDHE cipher suites, uses an incorrect modular reduction algorithm in its implementation of the P-256 and P-384 NIST elliptic curves, which allows remote attackers to obtain the private key of a TLS server via multiple handshake attempts.
CVE-2011-4330 High 2012-01-27 Not applicable No public exploit Stack-based buffer overflow in the hfs_mac2asc function in fs/hfs/trans.c in the Linux kernel 2.6 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via an HFS image with a crafted len field.
CVE-2011-4325 Medium 2012-01-27 Not applicable No public exploit The NFS implementation in Linux kernel before 2.6.31-rc6 calls certain functions without properly initializing certain data, which allows local users to cause a denial of service (NULL pointer dereference and O_DIRECT oops), as demonstrated using diotest4 from LTP.
CVE-2011-4314 Medium 2012-01-27 No exploit published No public exploit message/ax/AxMessage.java in OpenID4Java before 0.9.6 final, as used in JBoss Enterprise Application Platform 5.1 before 5.1.2, Step2, Kay Framework before 1.0.2, and possibly other products does not verify that Attribute Exchange (AX) information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle (MITM) attack.
CVE-2011-4143 Medium 2012-01-27 Not applicable No public exploit EMC RSA enVision 4.0 before SP4 P5 and 4.1 before P3 allows remote attackers to obtain sensitive information about environment variables in the web system via unspecified vectors.
CVE-2011-4132 Low 2012-01-27 Not applicable No public exploit The cleanup_journal_tail function in the Journaling Block Device (JBD) functionality in the Linux kernel 2.6 allows local users to cause a denial of service (assertion error and kernel oops) via an ext3 or ext4 image with an "invalid log first block value."
CVE-2011-4110 Low 2012-01-27 Not applicable No public exploit The user_update function in security/keys/user_defined.c in the Linux kernel 2.6 allows local users to cause a denial of service (NULL pointer dereference and kernel oops) via vectors related to a user-defined key and "updating a negative key into a fully instantiated key."
CVE-2011-4077 Medium 2012-01-27 Not applicable No public exploit Buffer overflow in the xfs_readlink function in fs/xfs/xfs_vnodeops.c in XFS in the Linux kernel 2.6, when CONFIG_XFS_DEBUG is disabled, allows local users to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code via an XFS image containing a symbolic link with a long pathname.
CVE-2011-3874 High 2012-01-27 Not applicable No public exploit Stack-based buffer overflow in libsysutils in Android 2.2.x through 2.2.2 and 2.3.x through 2.3.6 allows user-assisted remote attackers to execute arbitrary code via an application that calls the FrameworkListener::dispatchCommand method with the wrong number of arguments, as demonstrated by zergRush to trigger a use-after-free error.
CVE-2011-3626 High 2012-01-27 Not applicable No public exploit Double free vulnerability in the prepare_exec function in src/exec.c in Logsurfer 1.5b and earlier, and Logsurfer+ 1.7 and earlier, allows remote attackers to execute arbitrary commands via crafted strings in a log file.
CVE-2011-2203 Low 2012-01-27 Not applicable No public exploit The hfs_find_init function in the Linux kernel 2.6 allows local users to cause a denial of service (NULL pointer dereference and Oops) by mounting an HFS file system with a malformed MDB extent record.
CVE-2011-1162 Low 2012-01-27 Not applicable No public exploit The tpm_read function in the Linux kernel 2.6 does not properly clear memory, which might allow local users to read the results of the previous TPM command.
CVE-2012-0312 Medium 2012-01-26 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in osCommerce 2.2MS1J before R9, and osCommerce Online Merchant before 2.3.1, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-0311 Medium 2012-01-26 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in osCommerce 2.2MS1J before R9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2011-1941 Medium 2012-01-26 Not applicable No public exploit Open redirect vulnerability in the redirector feature in phpMyAdmin 3.4.x before 3.4.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVE-2011-1940 Medium 2012-01-26 Not applicable No public exploit Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.3.x before 3.3.10.1 and 3.4.x before 3.4.1 allow remote attackers to inject arbitrary web script or HTML via a crafted table name that triggers improper HTML rendering on a Tracking page, related to (1) libraries/tbl_links.inc.php and (2) tbl_tracking.php.
CVE-2012-0885 Medium 2012-01-25 Not applicable No public exploit chan_sip.c in Asterisk Open Source 1.8.x before 1.8.8.2 and 10.x before 10.0.1, when the res_srtp module is used and media support is improperly configured, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted SDP message with a crypto attribute and a (1) video or (2) text media type, as demonstrated by CSipSimple.
CVE-2011-4867 Medium 2012-01-25 Not applicable No public exploit The Tencent QQPhoto (com.tencent.qqphoto) application 0.97 for Android does not properly protect data, which allows remote attackers to read or modify contact information and a password hash via a crafted application.
CVE-2011-4866 Medium 2012-01-25 Not applicable No public exploit The Kaixin001 (com.kaixin001.activity) application 1.3.1 and 1.3.3 for Android does not properly protect data, which allows remote attackers to read or modify contact information and a cleartext password via a crafted application.
CVE-2011-4865 Medium 2012-01-25 Not applicable No public exploit The Tencent WBlog (com.tencent.WBlog) 3.3.1 and MicroBlogPad 1.4.0 applications for Android do not properly protect data, which allows remote attackers to read or modify message drafts and search keywords via a crafted application.
CVE-2011-4864 Medium 2012-01-25 Not applicable No public exploit The Tencent MobileQQ (com.tencent.mobileqq) application 2.2 for Android does not properly protect data, which allows remote attackers to read or modify messages and a friends list via a crafted application.
CVE-2011-4863 Medium 2012-01-25 Not applicable No public exploit The Tencent QQPimSecure (com.tencent.qqpimsecure) application 3.0.2 for Android does not properly protect data, which allows remote attackers to read or modify SMS/MMS messages and a contact list via a crafted application.
CVE-2011-4773 Medium 2012-01-25 Not applicable No public exploit The AnGuanJia (com.anguanjia.safe) application 2.10.343 for Android does not properly protect data, which allows remote attackers to read or modify SMS messages and a contact list via a crafted application.
CVE-2011-4772 Medium 2012-01-25 Not applicable No public exploit The 360 KouXin (com.qihoo360.kouxin) application 1.5.3 for Android does not properly protect data, which allows remote attackers to read or modify SMS messages and a contact list via a crafted application.
CVE-2011-4771 Medium 2012-01-25 Not applicable No public exploit The Scan to PDF Free (com.scan.to.pdf.trial) application 2.0.4 for Android does not properly protect data, which allows remote attackers to read or modify scanned files and a Google account via a crafted application.
CVE-2011-4770 Medium 2012-01-25 Not applicable No public exploit The QIWI Wallet (ru.mw) application before 1.14.2 for Android does not properly protect data, which allows remote attackers to read or modify financial information via a crafted application.
CVE-2011-4769 Medium 2012-01-25 Not applicable No public exploit The 360 MobileSafe (com.qihoo360.mobilesafe) application 2.x before 2.3.0 for Android does not properly protect data, which allows remote attackers to read or modify SMS messages and a contact list via a crafted application.
CVE-2011-4705 Medium 2012-01-25 Not applicable No public exploit The Ming Blacklist Free (vc.software.blacklist) application 1.8.1 and 1.9.2.1 for Android does not properly protect data, which allows remote attackers to read or modify blacklists and a contact list via a crafted application that launches a "data-flow attack."
CVE-2011-4704 Medium 2012-01-25 Not applicable No public exploit The Voxofon (com.voxofon) application before 2.5.2 for Android does not properly protect data, which allows remote attackers to read or modify SMS information via a crafted application.
CVE-2011-4703 Medium 2012-01-25 Not applicable No public exploit The Limit My Call (com.limited.call.view) application 2.11 for Android does not properly protect data, which allows remote attackers to read or modify call logs and a contact list via a crafted application.
CVE-2011-4702 Medium 2012-01-25 Not applicable No public exploit The Nimbuzz (com.nimbuzz) application 2.0.8 and 2.0.10 for Android does not properly protect data, which allows remote attackers to read or modify a contact list via a crafted application.
CVE-2011-4701 Medium 2012-01-25 Not applicable No public exploit The CallConfirm (jp.gr.java_conf.ofnhwx.callconfirm) application 2.0.0 for Android does not properly protect data, which allows remote attackers to read or modify allow/block lists via a crafted application.
CVE-2011-4700 Medium 2012-01-25 Not applicable No public exploit The UberMedia UberSocial (com.twidroid) application 7.x before 7.2.4 for Android does not properly protect data, which allows remote attackers to read or modify Twitter information via a crafted application.
CVE-2011-4699 Medium 2012-01-25 Not applicable No public exploit The Ubermedia Twidroyd Legacy (com.twidroydlegacy) application 4.3.11 for Android does not properly protect data, which allows remote attackers to read or modify Twitter information via a crafted application.
CVE-2011-4698 Medium 2012-01-25 Not applicable No public exploit The AndroidAppTools Easy Filter (com.phoneblocker.android) application 1.1 and 1.2 for Android does not properly protect data, which allows remote attackers to read or modify SMS messages and call records via a crafted application.
CVE-2011-4697 Medium 2012-01-25 Not applicable No public exploit The Xiaomi MiTalk Messenger (com.xiaomi.channel) application before 2.1.320 for Android does not properly protect data, which allows remote attackers to read or modify messaging information via a crafted application.
CVE-2011-4276 Medium 2012-01-25 Not applicable No public exploit The Bluetooth service (com/android/phone/BluetoothHeadsetService.java) in Android 2.3 before 2.3.6 allows remote attackers within Bluetooth range to obtain contact data via an AT phonebook transfer.
CVE-2011-4123 Unknown 2012-01-25 Withdrawn CVE No public exploit Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2011-3874. Reason: This candidate is a duplicate of CVE-2011-3874. Notes: All CVE users should reference CVE-2011-3874 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE-2012-0919 Medium 2012-01-24 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in Hitachi IT Operations Director 02-50-01 through 02-50-07, 03-00 through 03-00-04, and possibly other versions before 03-00-06, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-0918 High 2012-01-24 Not applicable No public exploit Unspecified vulnerability in Hitachi COBOL2002 Net Developer, Net Server Suite, and Net Client Suite 01-00, 01-01 through 01-01-/D, 01-02 through 01-02-/F, 01-03 through 01-03-/F, 02-00 through 02-00-/D, 02-01 through 02-01-/C, and possibly other versions before 02-01-/D allows remote attackers to execute arbitrary code via unknown attack vectors.
CVE-2012-0917 Medium 2012-01-24 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in Hitachi IT Operations Analyzer 02-01, 02-51 through 02-51-01, and 02-53 through 02-53-02 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-0916 High 2012-01-24 Not applicable No public exploit Heap-based buffer overflow in RenRen Talk 2.9 allows remote attackers to execute arbitrary code via a crafted image in a chat message, as demonstrated using a PNG file.
CVE-2012-0915 High 2012-01-24 Not applicable No public exploit Integer signedness error in RenRen Talk 2.9 allows remote attackers to execute arbitrary code via crafted dimensions of a skin file, leading to a heap-based buffer overflow, as demonstrated using a BMP image.
CVE-2012-0914 Medium 2012-01-24 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in display_renderers/panels_renderer_editor.class.php in the admin view in the Panels module 6.x-2.x before 6.x-3.10 and 7.x-3.x before 7.x-3.0 for Drupal allows remote authenticated users with certain privileges to inject arbitrary web script or HTML via the Region title.
CVE-2012-0912 High 2012-01-24 Not applicable No public exploit SQL injection vulnerability in Stoneware webNetwork before 6.0.8.0 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2012-0909 Medium 2012-01-24 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in Horde_Form in Horde Groupware Webmail Edition before 4.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to email verification. NOTE: Some of these details are obtained from third party information.
CVE-2012-0908 Medium 2012-01-24 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in logout.php in SimpleSAMLphp 1.8.1 and possibly other versions before 1.8.2 allows remote attackers to inject arbitrary web script or HTML via the link_href parameter.
CVE-2012-0790 Medium 2012-01-24 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in smokeping_cgi in Smokeping 2.4.2, 2.6.6, and other versions before 2.6.7 allows remote attackers to inject arbitrary web script or HTML via the displaymode parameter.
CVE-2012-0313 Medium 2012-01-24 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in glucose 2 before stage 6.2 allows remote attackers to inject arbitrary web script or HTML via an RSS feed.
CVE-2012-0069 High 2012-01-24 Not applicable No public exploit SQL injection vulnerability in ajax.php in Batavi before 1.2.1 allows remote attackers to execute arbitrary SQL commands via the boxToReload parameter.
CVE-2012-0040 Medium 2012-01-24 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in modules/core/www/no_cookie.php in SimpleSAMLphp 1.8.1 and possibly other versions before 1.8.2 allows remote attackers to inject arbitrary web script or HTML via the retryURL parameter.
CVE-2011-3928 High 2012-01-24 Not applicable No public exploit Use-after-free vulnerability in Google Chrome before 16.0.912.77 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to DOM handling.
CVE-2011-3927 High 2012-01-24 Not applicable No public exploit Skia, as used in Google Chrome before 16.0.912.77, does not perform all required initialization of values, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVE-2011-3926 High 2012-01-24 Not applicable No public exploit Heap-based buffer overflow in the tree builder in Google Chrome before 16.0.912.77 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVE-2011-3925 High 2012-01-24 Not applicable No public exploit Use-after-free vulnerability in the Safe Browsing feature in Google Chrome before 16.0.912.75 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via vectors related to a navigation entry and an interstitial page.
CVE-2011-3924 High 2012-01-24 Not applicable No public exploit Use-after-free vulnerability in Google Chrome before 16.0.912.77 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to DOM selections.
CVE-2012-0192 High 2012-01-23 Not applicable No public exploit Multiple integer overflows in vclmi.dll in the visual class library module in IBM Lotus Symphony before 3.0.1 might allow remote attackers to execute arbitrary code via an embedded (1) JPEG or (2) PNG image object in a Symphony document that triggers a heap-based buffer overflow, as demonstrated by a .doc file.
CVE-2012-0907 Medium 2012-01-20 Not applicable No public exploit Directory traversal vulnerability in the web player in NeoAxis NeoAxis web player 1.4 and earlier allows user-assisted remote attackers to write arbitrary files via a .. (dot dot) in a filename in the neoaxis_web_application_win32.zip ZIP archive.
CVE-2012-0903 Medium 2012-01-20 Not applicable No public exploit Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Desktop 7.1.2 b10978 allow remote attackers to inject arbitrary web script or HTML via the (1) Username or (2) MailBox Name.
CVE-2012-0898 Medium 2012-01-20 Not applicable No public exploit Directory traversal vulnerability in meb_download.php in the myEASYbackup plugin 1.0.8.1 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the dwn_file parameter.
CVE-2012-0193 Medium 2012-01-20 No exploit published No public exploit IBM WebSphere Application Server (WAS) 6.0 through 6.0.2.43, 6.1 before 6.1.0.43, 7.0 before 7.0.0.23, and 8.0 before 8.0.0.3 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
CVE-2012-0329 High 2012-01-19 Not applicable No public exploit Cisco Digital Media Manager 5.2.2 and earlier, and 5.2.3, allows remote authenticated users to execute arbitrary code via vectors involving a URL and an administrative resource, aka Bug ID CSCts63878.
CVE-2012-0268 Medium 2012-01-19 Not applicable No public exploit Integer overflow in the CYImage::LoadJPG method in YImage.dll in Yahoo! Messenger before 11.5.0.155, when photo sharing is enabled, might allow remote attackers to execute arbitrary code via a crafted JPG image that triggers a heap-based buffer overflow.
CVE-2012-0050 Medium 2012-01-19 Not applicable No public exploit OpenSSL 0.9.8s and 1.0.0f does not properly support DTLS applications, which allows remote attackers to cause a denial of service (crash) via unspecified vectors related to an out-of-bounds read. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-4108.
CVE-2012-0035 High 2012-01-19 Not applicable No public exploit Untrusted search path vulnerability in EDE in CEDET before 1.0.1, as used in GNU Emacs before 23.4 and other products, allows local users to gain privileges via a crafted Lisp expression in a Project.ede file in the directory, or a parent directory, of an opened file.
CVE-2012-0022 Medium 2012-01-19 No exploit published No public exploit Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach for handling parameters, which allows remote attackers to cause a denial of service (CPU consumption) via a request that contains many parameters and parameter values, a different vulnerability than CVE-2011-4858.
CVE-2011-4873 Medium 2012-01-19 Not applicable No public exploit Unspecified vulnerability in the server in Certec EDV atvise before 2.1 allows remote attackers to cause a denial of service (daemon crash) via crafted requests to TCP port 4840.
CVE-2011-4659 High 2012-01-19 Not applicable No public exploit Cisco TelePresence Software before TE 4.1.1 on the Cisco IP Video Phone E20 has a default password for the root account after an upgrade to TE 4.1.0, which makes it easier for remote attackers to modify the configuration via an SSH session, aka Bug ID CSCtw69889, a different vulnerability than CVE-2011-2555.
CVE-2011-4374 High 2012-01-19 Not applicable No public exploit Integer overflow in Adobe Reader 9.x before 9.4.6 on Linux allows attackers to execute arbitrary code via unspecified vectors.
CVE-2011-4142 Low 2012-01-19 Not applicable No public exploit The Web Search feature in EMC SourceOne Email Management 6.5 before 6.5.2.4033, 6.6 before 6.6.1.2194, and 6.7 before 6.7.2.2033 places cleartext credentials in log files, which allows local users to obtain sensitive information by reading these files.
CVE-2011-4134 High 2012-01-19 Not applicable No public exploit Heap-based buffer overflow in lmadmin in Flexera FlexNet Publisher 11.10 (aka FlexNet License Server Manager) allows remote attackers to execute arbitrary code via a crafted 0x2f packet.
CVE-2011-4053 High 2012-01-19 Not applicable No public exploit Untrusted search path vulnerability in 7-Technologies (7T) Interactive Graphical SCADA System (IGSS) before 9.0.0.11291 allows local users to gain privileges via a Trojan horse DLL in the current working directory.
CVE-2011-3375 Medium 2012-01-19 No exploit published No public exploit Apache Tomcat 6.0.30 through 6.0.33 and 7.x before 7.0.22 does not properly perform certain caching and recycling operations involving request objects, which allows remote attackers to obtain unintended read access to IP address and HTTP header information in opportunistic circumstances by reading TCP data.
CVE-2011-1389 High 2012-01-19 Not applicable No public exploit Multiple directory traversal vulnerabilities in the vendor daemon in Rational Common Licensing in Telelogic License Server 2.0, Rational License Server 7.x, and ibmratl in IBM Rational License Key Server (RLKS) 8.0 through 8.1.2 allow remote attackers to execute arbitrary code via vectors related to save, rename, and load operations on log files. NOTE: this might overlap CVE-2011-4135.
CVE-2011-1376 Medium 2012-01-19 No exploit published No public exploit iscdeploy in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.43, 7.0 before 7.0.0.21, and 8.0 before 8.0.0.2 on the IBM i platform sets weak permissions under systemapps/isclite.ear/ and bin/client_ffdc/, which allows local users to read or modify files via standard filesystem operations.
CVE-2007-6744 Low 2012-01-19 Not applicable No public exploit Flexera Macrovision InstallShield before 2008 sends a digital-signature password to an unintended application during certain signature operations involving .spc and .pvk files, which might allow local users to obtain sensitive information via unspecified vectors, related to an incorrect interaction between InstallShield and Signcode.exe.
CVE-2012-0496 Medium 2012-01-18 Not applicable No public exploit Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.x allows remote authenticated users to affect confidentiality and integrity via unknown vectors.
CVE-2012-0495 Medium 2012-01-18 Not applicable No public exploit Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0117, CVE-2012-0486, CVE-2012-0487, CVE-2012-0488, CVE-2012-0489, CVE-2012-0491, and CVE-2012-0493.
CVE-2012-0494 Low 2012-01-18 Not applicable No public exploit Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.x allows local users to affect availability via unknown vectors.
‹ prev page 1 of 323 next ›