Overview 23,694 matches · 782 in Waratek scope · 33 protected · 99 exploited · 6 CISA KEV · 7,371 public PoC · 195 EPSS ≥ 0.5
23,694matches
782in Waratek scope3.3%
33protected0.1%
99exploited0.4%
6CISA KEV0.0%
7,371public PoC31.1%
195EPSS ≥ 0.50.8%
Protected by Waratek
33
0.1%
Rule in development
0
0.0%
Mitigation candidate
69
0.3%
No exploit published
680
2.9%
Outside Waratek scope
235
1.0%
Not applicable
22,677
95.7%
Withdrawn CVE
0
0.0%
blocked by ARMR today
33
0.1%
partly blocked
0
0.0%
not blocked
23,661
99.9%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 3,324 / year
19891
Not applicable1
Medium1
not blocked1
No public exploit1
19902
Not applicable2
Medium2
not blocked2
Working exploit published1
No public exploit1
19914
Not applicable4
Medium4
not blocked4
No public exploit4
19920
19933
Not applicable3
Medium3
not blocked3
No public exploit3
199410
Not applicable10
Medium10
not blocked10
Working exploit published2
No public exploit8
19956
Not applicable6
Medium6
not blocked6
Working exploit published2
No public exploit4
199621
Not applicable21
Medium21
not blocked21
Working exploit published5
No public exploit16
199789
Not applicable89
Medium89
not blocked89
Working exploit published18
No public exploit71
199885
Not applicable85
Medium85
not blocked85
Working exploit published11
No public exploit74
1999357
Outside Waratek scope1
Not applicable356
Medium357
not blocked357
Working exploit published119
No public exploit238
2000467
Mitigation candidate4
No exploit published3
Not applicable460
Medium467
not blocked467
Exploited2
Working exploit published195
No public exploit270
2001706
Mitigation candidate2
No exploit published4
Outside Waratek scope7
Not applicable693
Medium706
not blocked706
Exploited3
Working exploit published219
Forecast only2
No public exploit482
2002980
Protected by Waratek2
Mitigation candidate6
No exploit published15
Outside Waratek scope4
Not applicable953
Medium980
blocked by ARMR today2
not blocked978
Exploited3
Working exploit published246
Forecast only3
No public exploit728
2003747
Protected by Waratek2
Mitigation candidate4
No exploit published18
Outside Waratek scope1
Not applicable722
Medium747
blocked by ARMR today2
not blocked745
Working exploit published243
No public exploit504
20041,265
Protected by Waratek1
Mitigation candidate1
No exploit published16
Outside Waratek scope4
Not applicable1,243
Medium1,265
blocked by ARMR today1
not blocked1,264
Exploited10
Working exploit published414
Forecast only1
No public exploit840
20052,430
Protected by Waratek3
Mitigation candidate4
No exploit published39
Outside Waratek scope6
Not applicable2,378
Medium2,430
blocked by ARMR today3
not blocked2,427
Exploited8
Working exploit published622
Forecast only6
No public exploit1,794
20063,324
Protected by Waratek4
Mitigation candidate4
No exploit published48
Outside Waratek scope3
Not applicable3,265
Medium3,324
blocked by ARMR today4
not blocked3,320
Exploited10
Working exploit published1,137
Forecast only2
No public exploit2,175
20073,101
Protected by Waratek2
Mitigation candidate9
No exploit published60
Outside Waratek scope53
Not applicable2,977
Medium3,101
blocked by ARMR today2
not blocked3,099
Exploited14
Working exploit published1,052
Forecast only1
No public exploit2,034
20082,582
Protected by Waratek4
Mitigation candidate8
No exploit published71
Outside Waratek scope26
Not applicable2,473
Medium2,582
blocked by ARMR today4
not blocked2,578
Exploited7
Working exploit published987
Proof of concept only2
Forecast only1
No public exploit1,585
20092,786
Protected by Waratek5
Mitigation candidate9
No exploit published115
Outside Waratek scope31
Not applicable2,626
Medium2,786
blocked by ARMR today5
not blocked2,781
Exploited16
Working exploit published1,123
Proof of concept only2
Forecast only3
No public exploit1,642
20102,241
Protected by Waratek6
Mitigation candidate9
No exploit published118
Outside Waratek scope34
Not applicable2,074
Medium2,241
blocked by ARMR today6
not blocked2,235
Exploited14
Working exploit published547
Proof of concept only1
Forecast only2
No public exploit1,677
20112,101
Protected by Waratek4
Mitigation candidate3
No exploit published132
Outside Waratek scope58
Not applicable1,904
Medium2,101
blocked by ARMR today4
not blocked2,097
Exploited9
Working exploit published294
Proof of concept only3
Forecast only1
No public exploit1,794
2012386
Mitigation candidate6
No exploit published41
Outside Waratek scope7
Not applicable332
Medium386
not blocked386
Exploited3
Working exploit published80
Proof of concept only1
No public exploit302
199019921994199619982000200220042006200820102012
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2012-1410 | Medium | 2012-02-29 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in the History Window implementation in Kadu 0.9.0 through 0.11.0 allow remote attackers to inject arbitrary web script or HTML via a crafted (1) SMS message, (2) presence message, or (3) status description. |
| CVE-2006-7250 | Medium | 2012-02-29 | Not applicable | No public exploit | The mime_hdr_cmp function in crypto/asn1/asn_mime.c in OpenSSL 0.9.8t and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted S/MIME message. |
| CVE-2012-0453 | Medium | 2012-02-25 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in xmlrpc.cgi in Bugzilla 4.0.2 through 4.0.4 and 4.1.1 through 4.2rc2, when mod_perl is used, allows remote attackers to hijack the authentication of arbitrary users for requests that modify the product's installation via the XML-RPC API. |
| CVE-2012-1213 | Medium | 2012-02-24 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in zimbra/h/calendar in Zimbra Web Client in Zimbra Collaboration Suite (ZCS) 6.x before 6.0.15 and 7.x before 7.1.3 allows remote attackers to inject arbitrary web script or HTML via the view parameter. |
| CVE-2012-1212 | Medium | 2012-02-24 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the smwfOnSfSetTargetName function in extensions/SMWHalo/includes/SMW_Initialize.php in Semantic Enterprise Wiki (SMW+) 1.5.6, 1.6.0_2 and earlier allows remote attackers to inject arbitrary web script or HTML via the target parameter to index.php/Special:FormEdit. NOTE: some of these details are obtained from third party information. |
| CVE-2012-1211 | Medium | 2012-02-24 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in pfile/kommentar.php in Powie pFile 1.02 allows remote attackers to inject arbitrary web script or HTML via the filecat parameter. |
| CVE-2012-1209 | Medium | 2012-02-24 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in backend/core/engine/base.php in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allows remote attackers to inject arbitrary web script or HTML via the highlight parameter. |
| CVE-2012-1208 | Medium | 2012-02-24 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in backend/core/engine/base.php in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allow remote attackers to inject arbitrary web script or HTML via the (1) report parameter to blog/settings or (2) error parameter to users/index. |
| CVE-2012-1207 | Medium | 2012-02-24 | Not applicable | No public exploit | Directory traversal vulnerability in frontend/core/engine/javascript.php in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the module parameter to frontend/js.php. |
| CVE-2012-1000 | Medium | 2012-02-24 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in LEPTON 1.1.3 and other versions before 1.1.4 allow remote attackers to inject arbitrary web script or HTML via the (1) message parameter to admins/login/forgot/index.php, or the (2) display_name or (3) email parameter to account/preferences.php. |
| CVE-2012-0997 | Medium | 2012-02-24 | Not applicable | Working exploit published | Cross-site request forgery (CSRF) vulnerability in admin/index.php in 11in1 1.2.1 stable 12-31-2011 allows remote attackers to hijack the authentication of administrators for requests that add new topics via an addTopic action. |
| CVE-2012-0996 | Medium | 2012-02-24 | Not applicable | Working exploit published | Multiple directory traversal vulnerabilities in 11in1 1.2.1 stable 12-31-2011 allow remote attackers to read arbitrary files via a .. (dot dot) in the class parameter to (1) index.php or (2) admin/index.php. |
| CVE-2012-1292 | Medium | 2012-02-23 | Not applicable | No public exploit | Unspecified vulnerability in the MessagingSystem servlet in SAP NetWeaver 7.0 allows remote attackers to obtain sensitive information about the MessagingSystem Performance Data via unspecified vectors. |
| CVE-2012-1291 | Medium | 2012-02-23 | Not applicable | No public exploit | Unspecified vulnerability in the com.sap.aii.mdt.amt.web.AMTPageProcessor servlet in SAP NetWeaver 7.0 allows remote attackers to obtain sensitive information about the Adapter Monitor via unspecified vectors, possibly related to the EnableInvokerServletGlobally property in the servlet_jsp service. |
| CVE-2012-1290 | Medium | 2012-02-23 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in b2b/auction/container.jsp in the Internet Sales (crm.b2b) module in SAP NetWeaver 7.0 allows remote attackers to inject arbitrary web script or HTML via the _loadPage parameter. |
| CVE-2012-1289 | Medium | 2012-02-23 | Not applicable | No public exploit | Multiple directory traversal vulnerabilities in SAP NetWeaver 7.0 allow remote authenticated users to read arbitrary files via a .. (dot dot) in the logfilename parameter to (1) b2b/admin/log.jsp or (2) b2b/admin/log_view.jsp in the Internet Sales (crm.b2b) component, or (3) ipc/admin/log.jsp or (4) ipc/admin/log_view.jsp in the Application Administration (com.sap.ipc.webapp.ipc) component. |
| CVE-2012-0873 | Medium | 2012-02-23 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in Boonex Dolphin before 7.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) explain parameter to explanation.php or the (2) photos_only, (3) online_only, or (4) mode parameters to viewFriends.php. |
| CVE-2012-0823 | Medium | 2012-02-23 | Not applicable | No public exploit | VP8 Codec SDK (libvpx) before 1.0.0 "Duclair" allows remote attackers to cause a denial of service (application crash) via (1) unspecified "corrupt input" or (2) by "starting decoding from a P-frame," which triggers an out-of-bounds read, related to "the clamping of motion vectors in SPLITMV blocks". |
| CVE-2012-0707 | Medium | 2012-02-23 | No exploit published | No public exploit | Cross-site scripting (XSS) vulnerability in IBM WebSphere Lombardi Edition 7.2 allows remote attackers to inject arbitrary web script or HTML via crafted text input to a coach that is configured with a document attachment control section. |
| CVE-2012-1256 | Medium | 2012-02-22 | Not applicable | No public exploit | The single sign-on (SSO) implementation in EasyVista before 2010.1.1.89 allows remote attackers to bypass authentication via a modified url_account parameter, in conjunction with a valid login name in the SSPI_HEADER parameter, to index.php. |
| CVE-2012-0291 | Medium | 2012-02-22 | Not applicable | No public exploit | Symantec pcAnywhere through 12.5.3, Altiris IT Management Suite pcAnywhere Solution 7.0 (aka 12.5.x) and 7.1 (aka 12.6.x), Altiris Client Management Suite pcAnywhere Solution 7.0 (aka 12.5.x) and 7.1 (aka 12.6.x), and Altiris Deployment Solution Remote pcAnywhere Solution 7.1 (aka 12.5.x and 12.6.x) allow remote attackers to cause a denial of service (application crash or hang) via (1) malformed data from a client, (2) malformed data from a server, or (3) an invalid response. |
| CVE-2012-1235 | Medium | 2012-02-21 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in Advantech/BroadWin WebAccess 7.0 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0235. |
| CVE-2012-1234 | Medium | 2012-02-21 | Not applicable | No public exploit | SQL injection vulnerability in Advantech/BroadWin WebAccess 7.0 allows remote authenticated users to execute arbitrary SQL commands via a malformed URL. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0234. |
| CVE-2012-1227 | Medium | 2012-02-21 | Not applicable | No public exploit | Multiple cross-site request forgery (CSRF) vulnerabilities in admin.php in pluck 4.7 allow remote attackers to hijack the authentication of admins for requests that (1) modify the admin email address or (2) modify the blog title via a settings action; (3) add a page via an editpage action, or (4) add a categorie via the blog module. |
| CVE-2012-1224 | Medium | 2012-02-21 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in system/classes/login.php in ContentLion Alpha 1.3 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO. |
| CVE-2012-1223 | Medium | 2012-02-21 | Not applicable | No public exploit | RabidHamster R2/Extreme 1.65 and earlier uses a small search space of values for the PIN number, which allows remote attackers to obtain the PIN number via a brute force attack. |
| CVE-2012-1221 | Medium | 2012-02-21 | Not applicable | Working exploit published | Directory traversal vulnerability in the telnet server in RabidHamster R2/Extreme 1.65 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the File command. |
| CVE-2012-1220 | Medium | 2012-02-21 | Not applicable | Working exploit published | Cross-site request forgery (CSRF) vulnerability in modules/config/admin_utente.php in GAzie 5.20 and earlier allows remote attackers to hijack the authentication of administrators for requests that change account information via an update action, as demonstrated by changing the password. |
| CVE-2012-1219 | Medium | 2012-02-21 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in freelancerKit 2.35 allow remote attackers to inject arbitrary web script or HTML via the (1) ticket parameter to tickets.php, (2) title parameter to notes.php, or (3) task parameter to todo.php. NOTE: some of these details are obtained from third party information. |
| CVE-2012-1217 | Medium | 2012-02-21 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in STHS v2 Web Portal 2.2 allow remote attackers to inject arbitrary web script or HTML via the team parameter to (1) prospects.php, (2) prospect.php, or (3) team.php. |
| CVE-2012-1216 | Medium | 2012-02-21 | Not applicable | No public exploit | Multiple cross-site request forgery (CSRF) vulnerabilities in admin.php in PBBoard 2.1.4 allow remote attackers to hijack the authentication of administrators for requests that (1) upload a file via an add action or (2) change the contents of a file via a dit action. |
| CVE-2012-1215 | Medium | 2012-02-21 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Add friends module in the Yoono extension before 7.7.8 for Firefox allows remote attackers to inject arbitrary web script or HTML via the create field in a "Create a group" action. |
| CVE-2012-1214 | Medium | 2012-02-21 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Add friends module in Yoono Desktop Application before 1.8.21 allows remote attackers to inject arbitrary web script or HTML via the create field in a "Create a group" action. |
| CVE-2012-0995 | Medium | 2012-02-21 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in ZENphoto 1.4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) msg parameter in an external action to zp-core/admin.php, (2) PATH_INTO to an unspecified URL, as demonstrated using /1/, (3) PATH_INFO to zp-core/admin.php, or (4) album parameter to zp-core/admin-edit.php. |
| CVE-2012-0994 | Medium | 2012-02-21 | Not applicable | No public exploit | SQL injection vulnerability in the Manage Albums feature in zp-core/admin-albumsort.php in ZENphoto 1.4.2 allows remote authenticated users to execute arbitrary SQL commands via the sortableList parameter. |
| CVE-2012-0993 | Medium | 2012-02-21 | Not applicable | No public exploit | Eval injection vulnerability in zp-core/zp-extensions/viewer_size_image.php in ZENphoto 1.4.2, when the viewer_size_image plugin is enabled, allows remote attackers to execute arbitrary PHP code via the viewer_size_image_saved cookie. |
| CVE-2012-0865 | Medium | 2012-02-21 | Not applicable | Working exploit published | Multiple open redirect vulnerabilities in CubeCart 3.0.20 and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) r parameter to switch.php or (2) goto parameter to admin/login.php. |
| CVE-2012-0241 | Medium | 2012-02-21 | Not applicable | Working exploit published | Advantech/BroadWin WebAccess before 7.0 allows remote attackers to cause a denial of service (memory corruption) via a modified stream identifier to a function. |
| CVE-2012-0239 | Medium | 2012-02-21 | Not applicable | No public exploit | uaddUpAdmin.asp in Advantech/BroadWin WebAccess before 7.0 does not properly perform authentication, which allows remote attackers to modify an administrative password via a password-change request. |
| CVE-2012-0237 | Medium | 2012-02-21 | Not applicable | No public exploit | Advantech/BroadWin WebAccess before 7.0 allows remote attackers to (1) enable date and time syncing or (2) disable date and time syncing via a crafted URL. |
| CVE-2012-0236 | Medium | 2012-02-21 | Not applicable | No public exploit | Advantech/BroadWin WebAccess 7.0 and earlier allows remote attackers to obtain sensitive information via a direct request to a URL. NOTE: the vendor reportedly "does not consider it to be a security risk." |
| CVE-2012-0235 | Medium | 2012-02-21 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. |
| CVE-2012-0233 | Medium | 2012-02-21 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to inject arbitrary web script or HTML via a malformed URL. |
| CVE-2012-0200 | Medium | 2012-02-21 | Not applicable | Working exploit published | The server in IBM solidDB 6.5 before Interim Fix 6 does not properly initialize data structures, which allows remote authenticated users to cause a denial of service (daemon crash) via a SELECT statement with a redundant WHERE condition. |
| CVE-2011-4890 | Medium | 2012-02-21 | Not applicable | No public exploit | The server in IBM solidDB 6.5 before FP9 and 7.0 before FP1 allows remote authenticated users to cause a denial of service (daemon crash) via a SELECT statement with a ROWNUM condition involving a subquery. |
| CVE-2011-4523 | Medium | 2012-02-21 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in bwview.asp in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters. |
| CVE-2011-4522 | Medium | 2012-02-21 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in bwerrdn.asp in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters. |
| CVE-2012-1196 | Medium | 2012-02-18 | Not applicable | Working exploit published | Directory traversal vulnerability in the VulCore web service (WSVulnerabilityCore/VulCore.asmx) in Lenovo ThinkManagement Console 9.0.3 allows remote attackers to delete arbitrary files via a .. (dot dot) in the filename parameter in a SetTaskLogByFile SOAP request. |
| CVE-2011-5081 | Medium | 2012-02-18 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in RestoreFile.pm in BackupPC 3.1.0, 3.2.1, and possibly other earlier versions allows remote attackers to inject arbitrary web script or HTML via the share parameter in a RestoreFile action to index.cgi. |
| CVE-2011-4923 | Medium | 2012-02-18 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in View.pm in BackupPC 3.0.0, 3.1.0, 3.2.0, 3.2.1, and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the num parameter in a view action to index.cgi, related to the log file viewer, a different vulnerability than CVE-2011-3361. |
| CVE-2011-4614 | Medium | 2012-02-18 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in Classes/Controller/AbstractController.php in the workspaces system extension in TYPO3 4.5.x before 4.5.9, 4.6.x before 4.6.2, and development versions of 4.7 allows remote attackers to execute arbitrary PHP code via a URL in the BACK_PATH parameter. |
| CVE-2011-4320 | Medium | 2012-02-18 | Not applicable | No public exploit | The mod_pubsub module (mod_pubsub.erl) in ejabberd 2.1.8 and 3.0.0-alpha-3 allows remote authenticated users to cause a denial of service (infinite loop) via a stanza with a publish tag that lacks a node attribute. |
| CVE-2011-3361 | Medium | 2012-02-18 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in CGI/Browse.pm in BackupPC 3.2.0 and possibly other versions before 3.2.1 allows remote attackers to inject arbitrary web script or HTML via the num parameter in a browse action to index.cgi. |
| CVE-2012-1194 | Medium | 2012-02-17 | Not applicable | No public exploit | The resolver in the DNS Server service in Microsoft Windows Server 2008 before R2 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack. |
| CVE-2012-1193 | Medium | 2012-02-17 | Not applicable | No public exploit | The resolver in PowerDNS Recursor (aka pdns_recursor) 3.3 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack. |
| CVE-2012-1192 | Medium | 2012-02-17 | Not applicable | No public exploit | The resolver in Unbound before 1.4.11 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack. |
| CVE-2012-1191 | Medium | 2012-02-17 | Not applicable | No public exploit | The resolver in dnscache in Daniel J. Bernstein djbdns 1.05 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack. |
| CVE-2012-0206 | Medium | 2012-02-17 | Not applicable | No public exploit | common_startup.cc in PowerDNS (aka pdns) Authoritative Server before 2.9.22.5 and 3.x before 3.0.1 allows remote attackers to cause a denial of service (packet loop) via a crafted UDP DNS response. |
| CVE-2012-0767 | Medium | 2012-02-16 | Not applicable | Exploited | Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)," as exploited in the wild in February 2012. |
| CVE-2011-3027 | Medium | 2012-02-16 | Not applicable | No public exploit | Google Chrome before 17.0.963.56 does not properly perform a cast of an unspecified variable during handling of columns, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted document. |
| CVE-2011-3026 | Medium | 2012-02-16 | Not applicable | Proof of concept only | Integer overflow in libpng, as used in Google Chrome before 17.0.963.56, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger an integer truncation. |
| CVE-2011-3025 | Medium | 2012-02-16 | Not applicable | No public exploit | Google Chrome before 17.0.963.56 does not properly parse H.264 data, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors. |
| CVE-2011-3024 | Medium | 2012-02-16 | Not applicable | No public exploit | Google Chrome before 17.0.963.56 allows remote attackers to cause a denial of service (application crash) via an empty X.509 certificate. |
| CVE-2011-3023 | Medium | 2012-02-16 | Not applicable | No public exploit | Use-after-free vulnerability in Google Chrome before 17.0.963.56 allows user-assisted remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to drag-and-drop operations. |
| CVE-2011-3022 | Medium | 2012-02-16 | Not applicable | No public exploit | translate/translate_manager.cc in Google Chrome before 17.0.963.56 and 19.x before 19.0.1036.7 uses an HTTP session to exchange data for translation, which allows remote attackers to obtain sensitive information by sniffing the network. |
| CVE-2011-3020 | Medium | 2012-02-16 | Not applicable | No public exploit | Unspecified vulnerability in the Native Client validator implementation in Google Chrome before 17.0.963.56 has unknown impact and remote attack vectors. |
| CVE-2011-3019 | Medium | 2012-02-16 | Not applicable | No public exploit | Heap-based buffer overflow in Google Chrome before 17.0.963.56 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted Matroska video (aka MKV) file. |
| CVE-2011-3017 | Medium | 2012-02-16 | Not applicable | No public exploit | Use-after-free vulnerability in Google Chrome before 17.0.963.56 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to database handling. |
| CVE-2011-3016 | Medium | 2012-02-16 | Not applicable | No public exploit | Use-after-free vulnerability in Google Chrome before 17.0.963.56 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving counter nodes, related to a "read-after-free" issue. |
| CVE-2011-3015 | Medium | 2012-02-16 | Not applicable | No public exploit | Multiple integer overflows in the PDF codecs in Google Chrome before 17.0.963.56 allow remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. |
| CVE-2012-0765 | Medium | 2012-02-15 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in Adobe RoboHelp 8 and 9 for Word allow remote attackers to inject arbitrary web script or HTML via a crafted URL, related to certain .htm files in (1) template_stock and (2) template_csh directories. |
| CVE-2012-0506 | Medium | 2012-02-15 | Outside Waratek scope | No public exploit | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, 5.0 Update 33 and earlier, and 1.4.2_35 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect integrity via unknown vectors related to CORBA. |
| CVE-2012-0502 | Medium | 2012-02-15 | Outside Waratek scope | No public exploit | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, 5.0 Update 33 and earlier, and 1.4.2_35 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality and availability, related to AWT. |
| CVE-2012-0501 | Medium | 2012-02-15 | No exploit published | No public exploit | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect availability via unknown vectors. |
| CVE-2011-3563 | Medium | 2012-02-15 | No exploit published | No public exploit | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, 5.0 Update 33 and earlier, and 1.4.2_35 and earlier allows remote attackers to affect confidentiality and availability via unknown vectors related to Sound. |
| CVE-2012-1087 | Medium | 2012-02-14 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Post data records to facebook (bc_post2facebook) extension before 0.2.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2012-1086 | Medium | 2012-02-14 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the UrlTool (aeurltool) extension 0.1.0 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2012-1085 | Medium | 2012-02-14 | Not applicable | No public exploit | Unspecified vulnerability in the BE User Switch (beuserswitch) extension 0.0.1 for TYPO3 allows remote attackers to obtain sensitive information via unknown vectors. |
| CVE-2012-1084 | Medium | 2012-02-14 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the BE User Switch (beuserswitch) extension 0.0.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2012-1083 | Medium | 2012-02-14 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in the Terminal PHP Shell (terminal) extension 0.3.2 and earlier for TYPO3 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. |
| CVE-2012-1081 | Medium | 2012-02-14 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Yet another Google search (ya_googlesearch) extension before 0.3.10 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2012-1080 | Medium | 2012-02-14 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Euro Calculator (skt_eurocalc) extension 0.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2012-1079 | Medium | 2012-02-14 | Not applicable | No public exploit | Unspecified vulnerability in the Webservices for TYPO3 (typo3_webservice) extension before 0.3.8 for TYPO3 allows remote authenticated users to execute arbitrary code via unknown vectors. |
| CVE-2012-1078 | Medium | 2012-02-14 | Not applicable | No public exploit | The System Utilities (sysutils) extension 1.0.3 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unspecified vectors related to improper "protection" of the "backup output directory." |
| CVE-2012-1076 | Medium | 2012-02-14 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Documents download (rtg_files) extension before 1.5.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2012-1073 | Medium | 2012-02-14 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Category-System (toi_category) extension 0.6.0 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2012-1070 | Medium | 2012-02-14 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Modern FAQ (irfaq) extension 1.1.2 and other versions before 1.1.4 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to the "return url parameter." |
| CVE-2012-1069 | Medium | 2012-02-14 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in module/kb/search_word in the search module in lknSupport allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO. |
| CVE-2012-1068 | Medium | 2012-02-14 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the rc_ajax function in core.php in the WP-RecentComments plugin before 2.0.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter, related to AJAX paging. |
| CVE-2012-1066 | Medium | 2012-02-14 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the template module in SmartyCMS 0.9.4 allows remote attackers to inject arbitrary web script or HTML via the title bar. |
| CVE-2012-1065 | Medium | 2012-02-14 | Not applicable | Working exploit published | Insecure method vulnerability in TuxScripting.dll in the TuxSystem ActiveX control in 2X ApplicationServer 10.1 Build 1224 allows remote attackers to create or overwrite arbitrary files via the ExportSettings method. |
| CVE-2012-1062 | Medium | 2012-02-14 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Applications Manager 9.x and 10.x allow remote attackers to inject arbitrary web script or HTML via the (1) period parameter to showHistoryData.do; (2) selectedNetwork, (3) network, or (4) group parameters to showresource.do; (5) header parameter to AlarmView.do; or (6) attName parameter to jsp/PopUp_Graph.jsp. NOTE: the Search.do/query vector is already covered by CVE-2008-1566, and the jsp/ThresholdActionConfiguration.jsp redirectto vector is already covered by CVE-2008-0474. |
| CVE-2012-1059 | Medium | 2012-02-14 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in osCommerce/OM/Core/Site/Shop/Application/Cart/pages/main.php in OSCommerce Online Merchant 3.0.2 allows remote attackers to inject arbitrary web script or HTML via the value_title parameter, as demonstrated using the "Front" field in the shirt module. |
| CVE-2012-1058 | Medium | 2012-02-14 | Not applicable | Working exploit published | Cross-site request forgery (CSRF) vulnerability in Flyspray 0.9.9.6 allows remote attackers to hijack the authentication of admins for requests that add admin accounts via an admin.newuser action to index.php. |
| CVE-2012-1057 | Medium | 2012-02-14 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in the clickthrough tracking functionality in the Forward module 6.x-1.x before 6.x-1.21 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of administrators for requests that increase node rankings via the tracking code, possibly related to improper "flood control." |
| CVE-2012-1056 | Medium | 2012-02-14 | Not applicable | No public exploit | The Forward module 6.x-1.x before 6.x-1.21 and 7.x-1.x before 7.x-1.3 for Drupal does not properly enforce permissions for (1) Recent forwards, (2) Most forwarded, or (3) Dynamic blocks, which allows remote attackers to obtain node titles via unspecified vectors. |
| CVE-2012-1055 | Medium | 2012-02-14 | Not applicable | No public exploit | Heap-based buffer overflow in PhotoLine 17.01 and possibly other versions before 17.02 allows remote attackers to execute arbitrary code via a JPEG2000 (JP2) file with a crafted Quantization Default (QCD) marker segment. |
| CVE-2012-1009 | Medium | 2012-02-14 | Not applicable | Working exploit published | NetSarang Xlpd 4 Build 0100 and NetSarang Xmanager Enterprise 4 Build 0186 allow remote attackers to cause a denial of service (daemon crash) via a malformed LPD request. |
| CVE-2012-0829 | Medium | 2012-02-14 | Not applicable | No public exploit | Multiple cross-site request forgery (CSRF) vulnerabilities in Mibew Messenger 1.6.4 and earlier allow remote attackers to hijack the authentication of operators for requests that insert cross-site scripting (XSS) sequences via the (1) address or (2) threadid parameters to operator/ban.php; or (3) geolinkparams, (4) title, or (5) chattitle parameters to operator/settings.php. |
| CVE-2012-0789 | Medium | 2012-02-14 | Not applicable | Working exploit published | Memory leak in the timezone functionality in PHP before 5.3.9 allows remote attackers to cause a denial of service (memory consumption) by triggering many strtotime function calls, which are not properly handled by the php_date_parse_tzfile cache. |