Overview 50,347 matches · 1,277 in Waratek scope · 57 protected · 425 exploited · 65 CISA KEV · 17,016 public PoC · 945 EPSS ≥ 0.5
50,347matches
1,277in Waratek scope2.5%
57protected0.1%
425exploited0.8%
65CISA KEV0.1%
17,016public PoC33.8%
945EPSS ≥ 0.51.9%
Protected by Waratek
57
0.1%
Rule in development
0
0.0%
Mitigation candidate
91
0.2%
No exploit published
1,129
2.2%
Outside Waratek scope
564
1.1%
Not applicable
48,058
95.5%
Withdrawn CVE
448
0.9%
blocked by ARMR today
57
0.1%
partly blocked
0
0.0%
not blocked
50,290
99.9%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 6,659 / year
19882
Not applicable2
High2
not blocked2
Working exploit published1
No public exploit1
19893
Not applicable3
High2
Medium1
not blocked3
No public exploit3
199011
Not applicable11
High8
Medium2
Low1
not blocked11
Working exploit published1
No public exploit10
199115
Not applicable15
High11
Medium4
not blocked15
Working exploit published2
No public exploit13
199214
Not applicable13
Withdrawn CVE1
High12
Low1
Unknown1
not blocked14
No public exploit14
199313
Not applicable13
High8
Medium3
Low2
not blocked13
No public exploit13
199426
Not applicable25
Withdrawn CVE1
High14
Medium10
Low1
Unknown1
not blocked26
Working exploit published6
No public exploit20
199525
Not applicable25
Critical1
High17
Medium6
Low1
not blocked25
Working exploit published5
No public exploit20
199675
No exploit published1
Not applicable73
Withdrawn CVE1
Critical1
High43
Medium21
Low9
Unknown1
not blocked75
Working exploit published18
Forecast only1
No public exploit56
1997253
Not applicable252
Withdrawn CVE1
Critical1
High143
Medium89
Low19
Unknown1
not blocked253
Exploited2
Working exploit published73
Forecast only2
No public exploit176
1998247
Not applicable246
Withdrawn CVE1
Critical1
High137
Medium85
Low23
Unknown1
not blocked247
Exploited1
Working exploit published50
No public exploit196
1999923
No exploit published2
Outside Waratek scope1
Not applicable891
Withdrawn CVE29
Critical3
High423
Medium357
Low111
Unknown29
not blocked923
Exploited2
Working exploit published282
No public exploit639
20001,020
Mitigation candidate6
No exploit published6
Outside Waratek scope2
Not applicable1,005
Withdrawn CVE1
Critical2
High454
Medium467
Low96
Unknown1
not blocked1,020
Exploited5
Working exploit published427
Forecast only1
No public exploit587
20011,679
Protected by Waratek1
Mitigation candidate2
No exploit published10
Outside Waratek scope14
Not applicable1,649
Withdrawn CVE3
Critical12
High776
Medium706
Low182
Unknown3
blocked by ARMR today1
not blocked1,678
Exploited14
Working exploit published480
Forecast only2
No public exploit1,183
20022,170
Protected by Waratek3
Mitigation candidate8
No exploit published26
Outside Waratek scope12
Not applicable2,107
Withdrawn CVE14
Critical10
High1,023
Medium980
Low143
Unknown14
blocked by ARMR today3
not blocked2,167
Exploited12
Working exploit published545
Forecast only9
No public exploit1,604
20031,548
Protected by Waratek2
Mitigation candidate7
No exploit published30
Outside Waratek scope6
Not applicable1,482
Withdrawn CVE21
Critical9
High674
Medium747
Low97
Unknown21
blocked by ARMR today2
not blocked1,546
Exploited10
Working exploit published499
Forecast only1
No public exploit1,038
20042,479
Protected by Waratek2
Mitigation candidate1
No exploit published24
Outside Waratek scope8
Not applicable2,416
Withdrawn CVE28
Critical10
High973
Medium1,265
Low203
Unknown28
blocked by ARMR today2
not blocked2,477
Exploited21
Working exploit published755
Forecast only1
No public exploit1,702
20055,010
Protected by Waratek3
Mitigation candidate4
No exploit published75
Outside Waratek scope17
Not applicable4,833
Withdrawn CVE78
Critical13
High2,048
Medium2,430
Low441
Unknown78
blocked by ARMR today3
not blocked5,007
Exploited22
Working exploit published1,341
Forecast only11
No public exploit3,636
20066,659
Protected by Waratek8
Mitigation candidate4
No exploit published121
Outside Waratek scope67
Not applicable6,408
Withdrawn CVE51
Critical12
High2,763
Medium3,324
Low509
Unknown51
blocked by ARMR today8
not blocked6,651
Exploited37
Working exploit published2,440
Proof of concept only1
Forecast only6
No public exploit4,175
20076,596
Protected by Waratek6
Mitigation candidate10
No exploit published134
Outside Waratek scope83
Not applicable6,283
Withdrawn CVE80
Critical21
High3,162
Medium3,101
Low232
Unknown80
blocked by ARMR today6
not blocked6,590
Exploited47
Working exploit published2,495
Proof of concept only5
Forecast only5
No public exploit4,044
20085,664
Protected by Waratek7
Mitigation candidate9
No exploit published120
Outside Waratek scope74
Not applicable5,422
Withdrawn CVE32
Critical19
High2,846
Medium2,582
Low185
Unknown32
blocked by ARMR today7
not blocked5,657
Exploited42
Working exploit published2,518
Proof of concept only4
Forecast only9
No public exploit3,091
20095,778
Protected by Waratek9
Mitigation candidate13
No exploit published181
Outside Waratek scope62
Not applicable5,467
Withdrawn CVE46
Critical15
High2,734
Medium2,786
Low197
Unknown46
blocked by ARMR today9
not blocked5,769
Exploited73
Working exploit published2,591
Proof of concept only2
Forecast only3
No public exploit3,109
20104,667
Protected by Waratek9
Mitigation candidate12
No exploit published162
Outside Waratek scope86
Not applicable4,370
Withdrawn CVE28
Critical28
High2,093
Medium2,241
Low277
Unknown28
blocked by ARMR today9
not blocked4,658
Exploited73
Working exploit published1,313
Proof of concept only1
Forecast only9
No public exploit3,271
20114,172
Protected by Waratek6
Mitigation candidate9
No exploit published178
Outside Waratek scope116
Not applicable3,841
Withdrawn CVE22
Critical5
High1,784
Medium2,101
Low260
Unknown22
blocked by ARMR today6
not blocked4,166
Exploited50
Working exploit published691
Proof of concept only5
Forecast only4
No public exploit3,422
20121,298
Protected by Waratek1
Mitigation candidate6
No exploit published59
Outside Waratek scope16
Not applicable1,206
Withdrawn CVE10
Critical4
High510
Medium700
Low74
Unknown10
blocked by ARMR today1
not blocked1,297
Exploited14
Working exploit published200
Proof of concept only2
Forecast only42
No public exploit1,040
1988199019921994199619982000200220042006200820102012
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2012-2267 | Medium | 2012-04-17 | Not applicable | No public exploit | master.exe in the SNMP Master Agent in RealNetworks Helix Server and Helix Mobile Server 14.x before 14.3.x allows remote attackers to cause a denial of service (daemon crash) by establishing and closing a port-705 TCP connection, a different vulnerability than CVE-2012-1923. |
| CVE-2012-2089 | Medium | 2012-04-17 | Not applicable | No public exploit | Buffer overflow in ngx_http_mp4_module.c in the ngx_http_mp4_module module in nginx 1.0.7 through 1.0.14 and 1.1.3 through 1.1.18, when the mp4 directive is used, allows remote attackers to cause a denial of service (memory overwrite) or possibly execute arbitrary code via a crafted MP4 file. |
| CVE-2012-1985 | Medium | 2012-04-17 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in RealNetworks Helix Server and Helix Mobile Server 14.x before 14.3.x allows remote attackers to hijack the authentication of administrators for requests that cause a denial of service (stack consumption and daemon crash) via a malformed URL. |
| CVE-2012-1984 | Medium | 2012-04-17 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in RealNetworks Helix Server and Helix Mobile Server 14.x before 14.3.x allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2012-1979 | Low | 2012-04-17 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in starnet/index.php in SyndeoCMS 3.0.01 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the email parameter (aka Email address field) in an edit_user configuration action. |
| CVE-2012-1923 | Low | 2012-04-17 | Not applicable | No public exploit | RealNetworks Helix Server and Helix Mobile Server 14.x before 14.3.x store passwords in cleartext under adm_b_db\users\, which allows local users to obtain sensitive information by reading a database. |
| CVE-2012-1518 | High | 2012-04-17 | Not applicable | No public exploit | VMware Workstation 8.x before 8.0.2, VMware Player 4.x before 4.0.2, VMware Fusion 4.x before 4.1.2, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 use an incorrect ACL for the VMware Tools folder, which allows guest OS users to gain guest OS privileges via unspecified vectors. |
| CVE-2012-1180 | Medium | 2012-04-17 | Not applicable | No public exploit | Use-after-free vulnerability in nginx before 1.0.14 and 1.1.x before 1.1.17 allows remote HTTP servers to obtain sensitive information from process memory via a crafted backend response, in conjunction with a client request. |
| CVE-2012-0942 | High | 2012-04-17 | Not applicable | No public exploit | Buffer overflow in rn5auth.dll in RealNetworks Helix Server and Helix Mobile Server 14.x before 14.3.x allows remote attackers to execute arbitrary code via crafted authentication credentials. |
| CVE-2011-2478 | High | 2012-04-17 | Not applicable | No public exploit | Google SketchUp before 8 does not properly handle edge geometry in SketchUp (aka .SKP) files, which allows remote attackers to execute arbitrary code via a crafted file. |
| CVE-2012-1241 | High | 2012-04-16 | Not applicable | No public exploit | GRScript18.dll before 1.2.2.0 in ActiveScriptRuby (ASR) before 1.8.7 does not properly restrict interaction with an Internet Explorer ActiveX environment, which allows remote attackers to execute arbitrary Ruby code via a crafted HTML document. |
| CVE-2012-1240 | Medium | 2012-04-16 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the RECRUIT Dokodemo Rikunabi 2013 extension before 1.0.1 for Google Chrome allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2012-1809 | Medium | 2012-04-13 | Not applicable | No public exploit | The web server in the ECOM Ethernet module in Koyo H0-ECOM, H0-ECOM100, H2-ECOM, H2-ECOM-F, H2-ECOM100, H4-ECOM, H4-ECOM-F, and H4-ECOM100 allows remote attackers to cause a denial of service (resource consumption) via unspecified vectors. |
| CVE-2012-1808 | High | 2012-04-13 | Not applicable | No public exploit | The web server in the ECOM Ethernet module in Koyo H0-ECOM, H0-ECOM100, H2-ECOM, H2-ECOM-F, H2-ECOM100, H4-ECOM, H4-ECOM-F, and H4-ECOM100 does not require authentication, which allows remote attackers to perform unspecified functions via unknown vectors. |
| CVE-2012-1807 | Medium | 2012-04-13 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the web server in the ECOM Ethernet module in Koyo H0-ECOM, H0-ECOM100, H2-ECOM, H2-ECOM-F, H2-ECOM100, H4-ECOM, H4-ECOM-F, and H4-ECOM100 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2012-1806 | High | 2012-04-13 | Not applicable | No public exploit | The ECOM Ethernet module in Koyo H0-ECOM, H0-ECOM100, H2-ECOM, H2-ECOM-F, H2-ECOM100, H4-ECOM, H4-ECOM-F, and H4-ECOM100 supports a maximum password length of 8 bytes, which makes it easier for remote attackers to obtain access via a brute-force attack. |
| CVE-2012-1805 | High | 2012-04-13 | Not applicable | No public exploit | Buffer overflow in the ECOM Ethernet module in Koyo H0-ECOM, H0-ECOM100, H2-ECOM, H2-ECOM-F, H2-ECOM100, H4-ECOM, H4-ECOM-F, and H4-ECOM100 allows remote attackers to execute arbitrary code via long strings in unspecified parameters. |
| CVE-2012-0036 | High | 2012-04-13 | Not applicable | No public exploit | curl and libcurl 7.2x before 7.24.0 do not properly consider special characters during extraction of a pathname from a URL, which allows remote attackers to conduct data-injection attacks via a crafted URL, as demonstrated by a CRLF injection attack on the (1) IMAP, (2) POP3, or (3) SMTP protocol. |
| CVE-2011-4883 | Medium | 2012-04-13 | Not applicable | Working exploit published | The web server in Certec atvise webMI2ADS (aka webMI) before 2.0.2 does not properly validate values in HTTP requests, which allows remote attackers to cause a denial of service (resource consumption) via a crafted request. |
| CVE-2011-4882 | Medium | 2012-04-13 | Not applicable | Working exploit published | The web server in Certec atvise webMI2ADS (aka webMI) before 2.0.2 allows remote attackers to cause a denial of service (application exit) via an unspecified command in an HTTP request. |
| CVE-2011-4881 | Medium | 2012-04-13 | Not applicable | Working exploit published | The web server in Certec atvise webMI2ADS (aka webMI) before 2.0.2 does not properly check return values from functions, which allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted HTTP request. |
| CVE-2011-4880 | Medium | 2012-04-13 | Not applicable | Working exploit published | Directory traversal vulnerability in the web server in Certec atvise webMI2ADS (aka webMI) before 2.0.2 allows remote attackers to read arbitrary files via a crafted HTTP request. |
| CVE-2011-4874 | High | 2012-04-13 | Not applicable | No public exploit | Use-after-free vulnerability in MICROSYS PROMOTIC before 8.1.7 allows user-assisted remote attackers to execute arbitrary code or cause a denial of service (data corruption and application crash) via a crafted project (aka .pra) file. |
| CVE-2011-1779 | High | 2012-04-13 | Not applicable | No public exploit | Multiple use-after-free vulnerabilities in libarchive 2.8.4 and 2.8.5 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted (1) TAR archive or (2) ISO9660 image. |
| CVE-2011-1778 | Medium | 2012-04-13 | Not applicable | No public exploit | Buffer overflow in libarchive through 2.8.5 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted TAR archive. |
| CVE-2011-1777 | Medium | 2012-04-13 | Not applicable | No public exploit | Multiple buffer overflows in the (1) heap_add_entry and (2) relocate_dir functions in archive_read_support_format_iso9660.c in libarchive through 2.8.5 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted ISO9660 image. |
| CVE-2010-4666 | High | 2012-04-13 | Not applicable | No public exploit | Buffer overflow in libarchive 3.0 pre-release code allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted CAB file, which is not properly handled during the reading of Huffman code data within LZX compressed data. |
| CVE-2012-2230 | Medium | 2012-04-12 | Not applicable | No public exploit | Cloudera Manager 3.7.x before 3.7.5 and Service and Configuration Manager 3.5, when Kerberos is not enabled, does not properly install taskcontroller.cfg, which allows remote authenticated users to impersonate arbitrary user accounts via unspecified vectors, a different vulnerability than CVE-2012-1574. |
| CVE-2012-1574 | Medium | 2012-04-12 | No exploit published | No public exploit | The Kerberos/MapReduce security functionality in Apache Hadoop 0.20.203.0 through 0.20.205.0, 0.23.x before 0.23.2, and 1.0.x before 1.0.2, as used in Cloudera CDH CDH3u0 through CDH3u2, Cloudera hadoop-0.20-sbin before 0.20.2+923.197, and other products, allows remote authenticated users to impersonate arbitrary cluster user accounts via unspecified vectors. |
| CVE-2012-0133 | Low | 2012-04-12 | Not applicable | No public exploit | HP ProCurve 5400 zl switches with certain serial numbers include a compact flash card that contains an unspecified virus, which might allow user-assisted remote attackers to execute arbitrary code on a PC by leveraging manual transfer of this card. |
| CVE-2011-3846 | Medium | 2012-04-12 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in HP System Management Homepage (SMH) 6.2.2.7 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts. |
| CVE-2012-2225 | High | 2012-04-11 | Not applicable | No public exploit | 360zip 1.93beta allows remote attackers to execute arbitrary code via vectors related to file browsing and file extraction. |
| CVE-2012-2224 | High | 2012-04-11 | Not applicable | No public exploit | Xunlei Thunder before 7.2.6 allows remote attackers to execute arbitrary code via a crafted file, related to a "DLL injection vulnerability." |
| CVE-2012-2223 | Medium | 2012-04-11 | Not applicable | No public exploit | The xplat agent in Novell ZENworks Configuration Management (ZCM) 10.3.x before 10.3.4 and 11.x before 11.2 enables the HTTP TRACE method, which might make it easier for remote attackers to conduct cross-site tracing (XST) attacks via unspecified vectors. |
| CVE-2012-2210 | High | 2012-04-11 | Not applicable | Working exploit published | The Sony Bravia TV KDL-32CX525 allows remote attackers to cause a denial of service (configuration outage or device crash) via a flood of TCP SYN packets, as demonstrated by hping, a related issue to CVE-1999-0116. |
| CVE-2012-2156 | Medium | 2012-04-11 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in Plume CMS 1.2.4 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the u_email parameter (aka Authors Email field) to manager/users.php, (2) the u_realname parameter (aka Authors Name field) to manager/users.php, or (3) the c_author parameter (aka Author field) in an ADD A COMMENT section. |
| CVE-2012-1992 | Medium | 2012-04-11 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in admin/edituser.php in CMS Made Simple 1.10.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the email parameter (aka the Email Address field in the Edit User template). |
| CVE-2012-1673 | High | 2012-04-11 | Not applicable | Working exploit published | SQL injection vulnerability in loginscript.php in e-ticketing allows remote attackers to execute arbitrary SQL commands via the password parameter. |
| CVE-2012-1672 | High | 2012-04-11 | Not applicable | Working exploit published | SQL injection vulnerability in getcity.php in Hotel Booking Portal 0.1 allows remote attackers to execute arbitrary SQL commands via the country parameter. |
| CVE-2012-1596 | Medium | 2012-04-11 | Not applicable | No public exploit | The mp2t_process_fragmented_payload function in epan/dissectors/packet-mp2t.c in the MP2T dissector in Wireshark 1.4.x before 1.4.12 and 1.6.x before 1.6.6 allows remote attackers to cause a denial of service (application crash) via a packet containing an invalid pointer value that triggers an incorrect memory-allocation attempt. |
| CVE-2012-1595 | Medium | 2012-04-11 | Not applicable | No public exploit | The pcap_process_pseudo_header function in wiretap/pcap-common.c in Wireshark 1.4.x before 1.4.12 and 1.6.x before 1.6.6 allows remote attackers to cause a denial of service (application crash) via a WTAP_ENCAP_ERF file containing an Extension or Multi-Channel header with an invalid pseudoheader size, related to the pcap and pcap-ng file parsers. |
| CVE-2012-1594 | Low | 2012-04-11 | Not applicable | No public exploit | epan/dissectors/packet-ieee80211.c in the IEEE 802.11 dissector in Wireshark 1.6.x before 1.6.6 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet. |
| CVE-2012-1593 | Low | 2012-04-11 | Not applicable | Working exploit published | epan/dissectors/packet-ansi_a.c in the ANSI A dissector in Wireshark 1.4.x before 1.4.12 and 1.6.x before 1.6.6 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a malformed packet. |
| CVE-2012-1499 | High | 2012-04-11 | Not applicable | No public exploit | The JPEG 2000 codec (jp2.c) in OpenJPEG before 1.5 allows remote attackers to execute arbitrary code via a crafted palette index in a CMAP record of a JPEG image, which triggers memory corruption, aka "out-of heap-based buffer write." |
| CVE-2012-1036 | Medium | 2012-04-11 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the telerik HTML editor in DotNetNuke before 5.6.4 and 6.x before 6.1.0 allows remote attackers to inject arbitrary web script or HTML via a message. |
| CVE-2012-1030 | Medium | 2012-04-11 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in DotNetNuke 6.x through 6.0.2 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted URL containing text that is used within a modal popup. |
| CVE-2012-0068 | Medium | 2012-04-11 | Not applicable | No public exploit | The lanalyzer_read function in wiretap/lanalyzer.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a Novell capture file containing a record that is too small. |
| CVE-2012-0067 | Medium | 2012-04-11 | Not applicable | Working exploit published | wiretap/iptrace.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a long packet in an AIX iptrace file. |
| CVE-2012-0066 | Medium | 2012-04-11 | Not applicable | No public exploit | Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a long packet in a (1) Accellent 5Views (aka .5vw) file, (2) I4B trace file, or (3) NETMON 2 capture file. |
| CVE-2012-0043 | Medium | 2012-04-11 | Not applicable | No public exploit | Buffer overflow in the reassemble_message function in epan/dissectors/packet-rlc.c in the RLC dissector in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a series of fragmented RLC packets. |
| CVE-2012-0042 | Low | 2012-04-11 | Not applicable | No public exploit | Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 does not properly perform certain string conversions, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted packet, related to epan/to_str.c. |
| CVE-2012-0041 | Medium | 2012-04-11 | Not applicable | No public exploit | The dissect_packet function in epan/packet.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a long packet in a capture file, as demonstrated by an airopeek file. |
| CVE-2012-1182 | High | 2012-04-10 | Not applicable | Working exploit published | The RPC code generator in Samba 3.x before 3.4.16, 3.5.x before 3.5.14, and 3.6.x before 3.6.4 does not implement validation of an array length in a manner consistent with validation of array memory allocation, which allows remote attackers to execute arbitrary code via a crafted RPC call. |
| CVE-2012-0777 | Medium | 2012-04-10 | Not applicable | No public exploit | The JavaScript API in Adobe Reader and Acrobat 9.x before 9.5.1 and 10.x before 10.1.3 on Mac OS X and Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors. |
| CVE-2012-0776 | High | 2012-04-10 | Not applicable | No public exploit | The installer in Adobe Reader 9.x before 9.5.1 and 10.x before 10.1.3 allows attackers to bypass intended access restrictions and execute arbitrary code via unspecified vectors. |
| CVE-2012-0775 | High | 2012-04-10 | Not applicable | No public exploit | The JavaScript implementation in Adobe Reader and Acrobat 9.x before 9.5.1 and 10.x before 10.1.3 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors. |
| CVE-2012-0774 | High | 2012-04-10 | Not applicable | No public exploit | Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.1 and 10.x before 10.1.3 allows attackers to execute arbitrary code via a crafted TrueType font. |
| CVE-2012-0177 | High | 2012-04-10 | Not applicable | No public exploit | Heap-based buffer overflow in the Office Works File Converter in Microsoft Office 2007 SP2, Works 9, and Works 6-9 File Converter allows remote attackers to execute arbitrary code via a crafted Works (aka .wps) file, aka "Office WPS Converter Heap Overflow Vulnerability." |
| CVE-2012-0172 | High | 2012-04-10 | Not applicable | No public exploit | Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "VML Style Remote Code Execution Vulnerability." |
| CVE-2012-0171 | High | 2012-04-10 | Not applicable | No public exploit | Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "SelectAll Remote Code Execution Vulnerability." |
| CVE-2012-0170 | High | 2012-04-10 | Not applicable | No public exploit | Microsoft Internet Explorer 6 and 7 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "OnReadyStateChange Remote Code Execution Vulnerability." |
| CVE-2012-0169 | High | 2012-04-10 | Not applicable | No public exploit | Microsoft Internet Explorer 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "JScript9 Remote Code Execution Vulnerability." |
| CVE-2012-0168 | High | 2012-04-10 | Not applicable | No public exploit | Microsoft Internet Explorer 6 through 9 allows user-assisted remote attackers to execute arbitrary code via a crafted HTML document that is not properly handled during a "Print table of links" print operation, aka "Print Feature Remote Code Execution Vulnerability." |
| CVE-2012-0163 | High | 2012-04-10 | Not applicable | Working exploit published | Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly validate function parameters, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET Framework application, aka ".NET Framework Parameter Validation Vulnerability." |
| CVE-2012-0158 | High | 2012-04-10 | Not applicable | Exploited | The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2003 Web Components SP3; SQL Server 2000 SP4, 2005 SP4, and 2008 SP2, SP3, and R2; BizTalk Server 2002 SP1; Commerce Server 2002 SP4, 2007 SP2, and 2009 Gold and R2; Visual FoxPro 8.0 SP1 and 9.0 SP2; and Visual Basic 6.0 Runtime allow remote attackers to execute arbitrary code via a crafted (a) web site, (b) Office document, or (c) .rtf file that triggers "system state" corruption, as exploited in the wild in April 2012, aka "MSCOMCTL.OCX RCE Vulnerability." |
| CVE-2012-0151 | High | 2012-04-10 | Not applicable | Exploited | The Authenticode Signature Verification function in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, and Windows 8 Consumer Preview does not properly validate the digest of a signed portable executable (PE) file, which allows user-assisted remote attackers to execute arbitrary code via a modified file with additional content, aka "WinVerifyTrust Signature Validation Vulnerability." |
| CVE-2012-0147 | Medium | 2012-04-10 | Not applicable | No public exploit | Microsoft Forefront Unified Access Gateway (UAG) 2010 SP1 and SP1 Update 1 does not properly configure the default web site, which allows remote attackers to obtain sensitive information via a crafted HTTPS request, aka "Unfiltered Access to UAG Default Website Vulnerability." |
| CVE-2012-0146 | Medium | 2012-04-10 | Not applicable | No public exploit | Open redirect vulnerability in Microsoft Forefront Unified Access Gateway (UAG) 2010 SP1 and SP1 Update 1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL, aka "UAG Blind HTTP Redirect Vulnerability." |
| CVE-2012-2215 | Medium | 2012-04-09 | Not applicable | Working exploit published | Directory traversal vulnerability in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allows remote attackers to read arbitrary files via an opcode 0x21 request. |
| CVE-2012-0742 | Low | 2012-04-09 | Not applicable | No public exploit | IBM Tivoli Event Pump 4.2.2, when the LOG_REQUESTS and VALIDATE_SOAP_USERS options are enabled, places credentials into the AOPSCLOG (aka AOPLOG) data set, which allows local users to obtain sensitive information by reading the data. |
| CVE-2011-4188 | Medium | 2012-04-09 | Not applicable | No public exploit | Buffer overflow in the Create Attribute function in jclient in Novell iManager 2.7.4 before patch 4 allows remote authenticated users to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted EnteredAttrName parameter, a related issue to CVE-2010-1929. |
| CVE-2011-3176 | High | 2012-04-09 | Not applicable | Working exploit published | Stack-based buffer overflow in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allows remote attackers to execute arbitrary code via an opcode 0x4c request. |
| CVE-2011-3175 | High | 2012-04-09 | Not applicable | Working exploit published | Stack-based buffer overflow in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allows remote attackers to execute arbitrary code via an opcode 0x6c request. |
| CVE-2012-1902 | Medium | 2012-04-06 | Not applicable | No public exploit | show_config_errors.php in phpMyAdmin 3.4.x before 3.4.10.2, when a configuration file does not exist, allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message about this missing file. |
| CVE-2012-1239 | High | 2012-04-06 | Not applicable | Working exploit published | The TopAccess web-based management interface on TOSHIBA TEC e-Studio multi-function peripheral (MFP) devices with firmware 30x through 302, 35x through 354, and 4xx through 421 allows remote attackers to bypass authentication and obtain administrative privileges via unspecified vectors. |
| CVE-2012-1238 | Medium | 2012-04-06 | Not applicable | No public exploit | Session fixation vulnerability in SENCHA SNS before 1.0.2 allows remote attackers to hijack web sessions via unspecified vectors. |
| CVE-2012-1237 | Medium | 2012-04-06 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in SENCHA SNS before 1.0.2 allows remote attackers to hijack the authentication of arbitrary users. |
| CVE-2012-0725 | High | 2012-04-06 | Not applicable | No public exploit | Adobe Flash Player before 11.2.202.229 in Google Chrome before 18.0.1025.151 allow attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2012-0724. |
| CVE-2012-0724 | High | 2012-04-06 | Not applicable | No public exploit | Adobe Flash Player before 11.2.202.229 in Google Chrome before 18.0.1025.151 allow attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2012-0725. |
| CVE-2012-2055 | High | 2012-04-05 | Not applicable | No public exploit | GitHub Enterprise before 20120304 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the public_key[user_id] value via a modified URL for the public-key update form, related to a "mass assignment" vulnerability. |
| CVE-2012-2054 | Medium | 2012-04-05 | Not applicable | No public exploit | Redmine before 1.3.2 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set attributes in the (1) Comment, (2) Document, (3) IssueCategory, (4) MembersController, (5) Message, (6) News, (7) TimeEntry, (8) Version, (9) Wiki, (10) UserPreference, or (11) Board model via a modified URL, related to a "mass assignment" vulnerability, a different vulnerability than CVE-2012-0327. |
| CVE-2012-2053 | High | 2012-04-05 | Not applicable | No public exploit | The sudoers file in the Linux system configuration in F5 FirePass 6.0.0 through 6.1.0 and 7.0.0 does not require a password for executing commands as root, which allows local users to gain privileges via the sudo program, as demonstrated by the user account that executes PHP scripts, a different vulnerability than CVE-2012-1777. |
| CVE-2012-1982 | Low | 2012-04-05 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in my_admin/admin1_list_pages.php in SocialCMS 1.0.2 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the TR_title parameter in an edit action. |
| CVE-2012-1777 | High | 2012-04-05 | Not applicable | No public exploit | SQL injection vulnerability in my.activation.php3 in F5 FirePass 6.0.0 through 6.1.0 and 7.0.0 allows remote attackers to execute arbitrary SQL commands via the state parameter. |
| CVE-2012-1337 | High | 2012-04-05 | Not applicable | No public exploit | Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 L through SP11 EP26, T27 LB through SP21 EP10, T27 LC before SP25 EP10, and T27 LD before SP32 CP1 allows remote attackers to execute arbitrary code via a crafted WRF file, a different vulnerability than CVE-2012-1335 and CVE-2012-1336. |
| CVE-2012-1336 | High | 2012-04-05 | Not applicable | No public exploit | Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 L through SP11 EP26, T27 LB through SP21 EP10, T27 LC before SP25 EP10, and T27 LD before SP32 CP1 allows remote attackers to execute arbitrary code via a crafted WRF file, a different vulnerability than CVE-2012-1335 and CVE-2012-1337. |
| CVE-2012-1335 | High | 2012-04-05 | Not applicable | No public exploit | Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 L through SP11 EP26, T27 LB through SP21 EP10, T27 LC before SP25 EP10, and T27 LD before SP32 CP1 allows remote attackers to execute arbitrary code via a crafted WRF file, a different vulnerability than CVE-2012-1336 and CVE-2012-1337. |
| CVE-2012-0327 | Medium | 2012-04-05 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Redmine before 1.3.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2012-0255 | Medium | 2012-04-05 | Not applicable | No public exploit | The BGP implementation in bgpd in Quagga before 0.99.20.1 does not properly use message buffers for OPEN messages, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a message associated with a malformed Four-octet AS Number Capability (aka AS4 capability). |
| CVE-2012-0250 | Low | 2012-04-05 | Not applicable | No public exploit | Buffer overflow in the OSPFv2 implementation in ospfd in Quagga before 0.99.20.1 allows remote attackers to cause a denial of service (daemon crash) via a Link State Update (aka LS Update) packet containing a network-LSA link-state advertisement for which the data-structure length is smaller than the value in the Length header field. |
| CVE-2012-0249 | Low | 2012-04-05 | Not applicable | No public exploit | Buffer overflow in the ospf_ls_upd_list_lsa function in ospf_packet.c in the OSPFv2 implementation in ospfd in Quagga before 0.99.20.1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a Link State Update (aka LS Update) packet that is smaller than the length specified in its header. |
| CVE-2012-0132 | Medium | 2012-04-05 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in HP Business Availability Center (BAC) 9.01 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2012-0131 | High | 2012-04-05 | Not applicable | No public exploit | Distributed Computing Environment (DCE) 1.8 and 1.9 on HP HP-UX B.11.11 and B.11.23 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. |
| CVE-2012-0130 | Medium | 2012-04-05 | Not applicable | No public exploit | HP Onboard Administrator (OA) before 3.50 allows remote attackers to obtain sensitive information via unspecified vectors. |
| CVE-2012-0129 | High | 2012-04-05 | Not applicable | No public exploit | HP Onboard Administrator (OA) before 3.50 allows remote attackers to bypass intended access restrictions and execute arbitrary code via unspecified vectors. |
| CVE-2012-0128 | Medium | 2012-04-05 | Not applicable | No public exploit | HP Onboard Administrator (OA) before 3.50 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. |
| CVE-2011-5000 | Low | 2012-04-05 | Not applicable | No public exploit | The ssh_gssapi_parse_ename function in gss-serv.c in OpenSSH 5.8 and earlier, when gssapi-with-mic authentication is enabled, allows remote authenticated users to cause a denial of service (memory consumption) via a large value in a certain length field. NOTE: there may be limited scenarios in which this issue is relevant. |
| CVE-2011-3077 | Medium | 2012-04-05 | Not applicable | No public exploit | Use-after-free vulnerability in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving the script bindings, related to a "read-after-free" issue. |
| CVE-2011-3076 | Medium | 2012-04-05 | Not applicable | No public exploit | Use-after-free vulnerability in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to focus handling. |
| CVE-2011-3075 | Medium | 2012-04-05 | Not applicable | No public exploit | Use-after-free vulnerability in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to style-application commands. |