Overview 24,008 matches · 785 in Waratek scope · 33 protected · 101 exploited · 6 CISA KEV · 7,404 public PoC · 238 EPSS ≥ 0.5
24,008matches
785in Waratek scope3.3%
33protected0.1%
101exploited0.4%
6CISA KEV0.0%
7,404public PoC30.8%
238EPSS ≥ 0.51.0%
Protected by Waratek
33
0.1%
Rule in development
0
0.0%
Mitigation candidate
69
0.3%
No exploit published
683
2.8%
Outside Waratek scope
236
1.0%
Not applicable
22,987
95.7%
Withdrawn CVE
0
0.0%
blocked by ARMR today
33
0.1%
partly blocked
0
0.0%
not blocked
23,975
99.9%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 3,324 / year
19891
Not applicable1
Medium1
not blocked1
No public exploit1
19902
Not applicable2
Medium2
not blocked2
Working exploit published1
No public exploit1
19914
Not applicable4
Medium4
not blocked4
No public exploit4
19920
19933
Not applicable3
Medium3
not blocked3
No public exploit3
199410
Not applicable10
Medium10
not blocked10
Working exploit published2
No public exploit8
19956
Not applicable6
Medium6
not blocked6
Working exploit published2
No public exploit4
199621
Not applicable21
Medium21
not blocked21
Working exploit published5
No public exploit16
199789
Not applicable89
Medium89
not blocked89
Working exploit published18
No public exploit71
199885
Not applicable85
Medium85
not blocked85
Working exploit published11
No public exploit74
1999357
Outside Waratek scope1
Not applicable356
Medium357
not blocked357
Working exploit published119
No public exploit238
2000467
Mitigation candidate4
No exploit published3
Not applicable460
Medium467
not blocked467
Exploited2
Working exploit published195
No public exploit270
2001706
Mitigation candidate2
No exploit published4
Outside Waratek scope7
Not applicable693
Medium706
not blocked706
Exploited3
Working exploit published219
Forecast only2
No public exploit482
2002980
Protected by Waratek2
Mitigation candidate6
No exploit published15
Outside Waratek scope4
Not applicable953
Medium980
blocked by ARMR today2
not blocked978
Exploited3
Working exploit published246
Forecast only3
No public exploit728
2003747
Protected by Waratek2
Mitigation candidate4
No exploit published18
Outside Waratek scope1
Not applicable722
Medium747
blocked by ARMR today2
not blocked745
Working exploit published243
No public exploit504
20041,265
Protected by Waratek1
Mitigation candidate1
No exploit published16
Outside Waratek scope4
Not applicable1,243
Medium1,265
blocked by ARMR today1
not blocked1,264
Exploited10
Working exploit published414
Forecast only1
No public exploit840
20052,430
Protected by Waratek3
Mitigation candidate4
No exploit published39
Outside Waratek scope6
Not applicable2,378
Medium2,430
blocked by ARMR today3
not blocked2,427
Exploited8
Working exploit published622
Forecast only6
No public exploit1,794
20063,324
Protected by Waratek4
Mitigation candidate4
No exploit published48
Outside Waratek scope3
Not applicable3,265
Medium3,324
blocked by ARMR today4
not blocked3,320
Exploited10
Working exploit published1,137
Forecast only2
No public exploit2,175
20073,101
Protected by Waratek2
Mitigation candidate9
No exploit published60
Outside Waratek scope53
Not applicable2,977
Medium3,101
blocked by ARMR today2
not blocked3,099
Exploited14
Working exploit published1,052
Forecast only1
No public exploit2,034
20082,582
Protected by Waratek4
Mitigation candidate8
No exploit published71
Outside Waratek scope26
Not applicable2,473
Medium2,582
blocked by ARMR today4
not blocked2,578
Exploited7
Working exploit published987
Proof of concept only2
Forecast only1
No public exploit1,585
20092,786
Protected by Waratek5
Mitigation candidate9
No exploit published115
Outside Waratek scope31
Not applicable2,626
Medium2,786
blocked by ARMR today5
not blocked2,781
Exploited16
Working exploit published1,123
Proof of concept only2
Forecast only3
No public exploit1,642
20102,241
Protected by Waratek6
Mitigation candidate9
No exploit published118
Outside Waratek scope34
Not applicable2,074
Medium2,241
blocked by ARMR today6
not blocked2,235
Exploited14
Working exploit published547
Proof of concept only1
Forecast only2
No public exploit1,677
20112,101
Protected by Waratek4
Mitigation candidate3
No exploit published132
Outside Waratek scope58
Not applicable1,904
Medium2,101
blocked by ARMR today4
not blocked2,097
Exploited9
Working exploit published294
Proof of concept only3
Forecast only1
No public exploit1,794
2012700
Mitigation candidate6
No exploit published44
Outside Waratek scope8
Not applicable642
Medium700
not blocked700
Exploited5
Working exploit published113
Proof of concept only1
Forecast only41
No public exploit540
199019921994199619982000200220042006200820102012
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2012-2416 | Medium | 2012-04-30 | Not applicable | No public exploit | chan_sip.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.11.1 and 10.x before 10.3.1 and Asterisk Business Edition C.3.x before C.3.7.4, when the trustrpid option is enabled, allows remote authenticated users to cause a denial of service (daemon crash) by sending a SIP UPDATE message that triggers a connected-line update attempt without an associated channel. |
| CVE-2012-2415 | Medium | 2012-04-30 | Not applicable | No public exploit | Heap-based buffer overflow in chan_skinny.c in the Skinny channel driver in Asterisk Open Source 1.6.2.x before 1.6.2.24, 1.8.x before 1.8.11.1, and 10.x before 10.3.1 allows remote authenticated users to cause a denial of service or possibly have unspecified other impact via a series of KEYPAD_BUTTON_MESSAGE events. |
| CVE-2012-2414 | Medium | 2012-04-30 | Not applicable | No public exploit | main/manager.c in the Manager Interface in Asterisk Open Source 1.6.2.x before 1.6.2.24, 1.8.x before 1.8.11.1, and 10.x before 10.3.1 and Asterisk Business Edition C.3.x before C.3.7.4 does not properly enforce System class authorization requirements, which allows remote authenticated users to execute arbitrary commands via (1) the originate action in the MixMonitor application, (2) the SHELL and EVAL functions in the GetVar manager action, or (3) the SHELL and EVAL functions in the Status manager action. |
| CVE-2012-2111 | Medium | 2012-04-30 | Not applicable | No public exploit | The (1) CreateAccount, (2) OpenAccount, (3) AddAccountRights, and (4) RemoveAccountRights LSA RPC procedures in smbd in Samba 3.4.x before 3.4.17, 3.5.x before 3.5.15, and 3.6.x before 3.6.5 do not properly restrict modifications to the privileges database, which allows remote authenticated users to obtain the "take ownership" privilege via an LSA connection. |
| CVE-2012-2213 | Medium | 2012-04-28 | Not applicable | No public exploit | Squid 3.1.9 allows remote attackers to bypass the access configuration for the CONNECT method by providing an arbitrary allowed hostname in the Host HTTP header. NOTE: this issue might not be reproducible, because the researcher is unable to provide a squid.conf file for a vulnerable system, and the observed behavior is consistent with a squid.conf file that was (perhaps inadvertently) designed to allow access based on a "req_header Host" acl regex that matches www.uol.com.br |
| CVE-2012-2212 | Medium | 2012-04-28 | Not applicable | No public exploit | McAfee Web Gateway 7.0 allows remote attackers to bypass the access configuration for the CONNECT method by providing an arbitrary allowed hostname in the Host HTTP header. NOTE: this issue might not be reproducible, because the researcher did not provide configuration details for the vulnerable system, and the observed behavior might be consistent with a configuration that was (perhaps inadvertently) designed to allow access based on Host HTTP headers |
| CVE-2012-1245 | Medium | 2012-04-27 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the cleanup_urls function in forum/utils/html.py in OSQA before 1234, and 0.9.0 Beta 3 and earlier, allows remote attackers to inject arbitrary web script or HTML via vectors related to a crafted URI. |
| CVE-2012-1244 | Medium | 2012-04-27 | Not applicable | No public exploit | The NTT DOCOMO sp mode mail application 5400 and earlier for Android does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. |
| CVE-2012-1242 | Medium | 2012-04-27 | Not applicable | No public exploit | Untrusted search path vulnerability in JustSystems Ichitaro 2011 Sou, Ichitaro 2006 through 2011, Ichitaro Government 2006 through 2010, Ichitaro Portable with oreplug, Ichitaro Viewer, JUST School, JUST School 2009 and 2010, JUST Jump 4, JUST Frontier, and oreplug allows local users to gain privileges via a Trojan horse DLL in the current working directory. |
| CVE-2012-0466 | Medium | 2012-04-27 | Not applicable | No public exploit | template/en/default/list/list.js.tmpl in Bugzilla 2.x and 3.x before 3.6.9, 3.7.x and 4.0.x before 4.0.6, and 4.1.x and 4.2.x before 4.2.1 does not properly handle multiple logins, which allows remote attackers to conduct cross-site scripting (XSS) attacks and obtain sensitive bug information via a crafted web page. |
| CVE-2012-0465 | Medium | 2012-04-27 | Not applicable | No public exploit | Bugzilla 3.5.x and 3.6.x before 3.6.9, 3.7.x and 4.0.x before 4.0.6, and 4.1.x and 4.2.x before 4.2.1, when the inbound_proxies option is enabled, does not properly validate the X-Forwarded-For HTTP header, which allows remote attackers to bypass the lockout policy via a series of authentication requests with (1) different IP address strings in this header or (2) a long string in this header. |
| CVE-2012-2418 | Medium | 2012-04-25 | Not applicable | No public exploit | Heap-based buffer overflow in the intu-help-qb (aka Intuit Help System Async Pluggable Protocol) handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012, when Internet Explorer is used, allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a URI with a % (percent) character as its (1) last or (2) second-to-last character. |
| CVE-2012-1143 | Medium | 2012-04-25 | Not applicable | No public exploit | FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted font. |
| CVE-2012-0479 | Medium | 2012-04-25 | Not applicable | No public exploit | Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allow remote attackers to spoof the address bar via an https URL for invalid (1) RSS or (2) Atom XML content. |
| CVE-2012-0477 | Medium | 2012-04-25 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allow remote attackers to inject arbitrary web script or HTML via the (1) ISO-2022-KR or (2) ISO-2022-CN character set. |
| CVE-2012-0474 | Medium | 2012-04-25 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the docshell implementation in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allows remote attackers to inject arbitrary web script or HTML via vectors related to short-circuited page loads, aka "Universal XSS (UXSS)." |
| CVE-2012-0473 | Medium | 2012-04-25 | Not applicable | No public exploit | The WebGLBuffer::FindMaxUshortElement function in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 calls the FindMaxElementInSubArray function with incorrect template arguments, which allows remote attackers to obtain sensitive information from video memory via a crafted WebGL.drawElements call. |
| CVE-2012-0471 | Medium | 2012-04-25 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allows remote attackers to inject arbitrary web script or HTML via a multibyte character set. |
| CVE-2012-2234 | Medium | 2012-04-22 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in sources/users.queries.php in TeamPass before 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the login parameter in an add_new_user action. |
| CVE-2012-1575 | Medium | 2012-04-22 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in Cumin before r5238 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) widgets or (2) pages. |
| CVE-2012-1243 | Medium | 2012-04-22 | Not applicable | No public exploit | The TwitRocker2 application before 1.0.23 for Android does not properly implement the WebView class, which allows remote attackers to obtain sensitive information via a crafted application. |
| CVE-2012-1113 | Medium | 2012-04-22 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in the administration subsystem in Gallery 2 before 2.3.2 and 3 before 3.0.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2012-0946 | Medium | 2012-04-22 | Not applicable | Working exploit published | The NVIDIA UNIX driver before 295.40 allows local users to access arbitrary memory locations by leveraging GPU device-node read/write privileges. |
| CVE-2012-0743 | Medium | 2012-04-22 | Not applicable | No public exploit | IBM Tivoli Directory Server (TDS) 6.3 and earlier allows remote attackers to cause a denial of service (daemon crash) via a malformed LDAP paged search request. |
| CVE-2012-0740 | Medium | 2012-04-22 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Web Admin Tool in IBM Tivoli Directory Server (TDS) 6.2 before 6.2.0.22 and 6.3 before 6.3.0.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2012-0726 | Medium | 2012-04-22 | Not applicable | No public exploit | The default configuration of TLS in IBM Tivoli Directory Server (TDS) 6.3 and earlier supports the (1) NULL-MD5 and (2) NULL-SHA ciphers, which allows remote attackers to trigger unencrypted communication via the TLS Handshake Protocol. |
| CVE-2012-0216 | Medium | 2012-04-22 | Not applicable | No public exploit | The default configuration of the apache2 package in Debian GNU/Linux squeeze before 2.2.16-6+squeeze7, wheezy before 2.2.22-4, and sid before 2.2.22-4, when mod_php or mod_rivet is used, provides example scripts under the doc/ URI, which might allow local users to conduct cross-site scripting (XSS) attacks, gain privileges, or obtain sensitive information via vectors involving localhost HTTP requests to the Apache HTTP Server. |
| CVE-2012-2404 | Medium | 2012-04-21 | Not applicable | No public exploit | wp-comments-post.php in WordPress before 3.3.2 supports offsite redirects, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors. |
| CVE-2012-2403 | Medium | 2012-04-21 | Not applicable | No public exploit | wp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickable links inside attributes, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors. |
| CVE-2012-2402 | Medium | 2012-04-21 | Not applicable | No public exploit | wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and deactivate network-wide plugins via unspecified vectors. |
| CVE-2012-2401 | Medium | 2012-04-21 | Not applicable | No public exploit | Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which the SWF content was loaded, which allows remote attackers to bypass the Same Origin Policy via crafted content. |
| CVE-2012-2398 | Medium | 2012-04-20 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in files/ajax/download.php in ownCloud before 3.0.3 allows remote attackers to inject arbitrary web script or HTML via the files parameter, a different vulnerability than CVE-2012-2269.4. |
| CVE-2012-2397 | Medium | 2012-04-20 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in ownCloud before 3.0.3 allows remote attackers to hijack the authentication of arbitrary users for requests that insert cross-site scripting (XSS) sequences via vectors involving contacts. |
| CVE-2012-2273 | Medium | 2012-04-20 | Not applicable | No public exploit | Comodo Internet Security before 5.10.228257.2253 on Windows 7 x64 allows local users to cause a denial of service (system crash) via a crafted 32-bit Portable Executable (PE) file with a kernel ImageBase value. |
| CVE-2012-2270 | Medium | 2012-04-20 | Not applicable | Working exploit published | Open redirect vulnerability in index.php (aka the Login Page) in ownCloud before 3.0.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect_url parameter. |
| CVE-2012-2269 | Medium | 2012-04-20 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 3.0.3 allow remote attackers to inject arbitrary web script or HTML via (1) an arbitrary field to apps/contacts/ajax/addcard.php, (2) the parameter parameter to apps/contacts/ajax/addproperty.php, (3) the name parameter to apps/contacts/ajax/createaddressbook, (4) the file parameter to files/download.php, or the (5) name, (6) user, or (7) redirect_url parameter to files/index.php. |
| CVE-2012-2236 | Medium | 2012-04-20 | Not applicable | Working exploit published | SQL injection vulnerability in users.php in PHP Gift Registry 1.5.5 allows remote authenticated users to execute arbitrary SQL commands via the userid parameter in an edit action. |
| CVE-2012-0407 | Medium | 2012-04-20 | Not applicable | Working exploit published | Integer overflow in the DPA_Utilities library in EMC Data Protection Advisor (DPA) 5.5 through 5.8 SP1 allows remote attackers to cause a denial of service (infinite loop) via a negative 64-bit value in a certain size field. |
| CVE-2012-2396 | Medium | 2012-04-19 | Not applicable | Working exploit published | VideoLAN VLC media player 2.0.1 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted MP4 file. |
| CVE-2012-0134 | Medium | 2012-04-19 | Not applicable | No public exploit | Unspecified vulnerability in HP OpenVMS 7.3-2 on the Alpha platform, 8.3 and 8.4 on the Alpha and IA64 platforms, and 8.3-1h1 on the IA64 platform allows local users to cause a denial of service via unknown vectors. |
| CVE-2012-1800 | Medium | 2012-04-18 | Not applicable | No public exploit | Stack-based buffer overflow in the Profinet DCP protocol implementation on the Siemens Scalance S Security Module firewall S602 V2, S612 V2, and S613 V2 with firmware before 2.3.0.3 allows remote attackers to cause a denial of service (device outage) or possibly execute arbitrary code via a crafted DCP frame. |
| CVE-2012-0883 | Medium | 2012-04-18 | Not applicable | No public exploit | envvars (aka envvars-std) in the Apache HTTP Server before 2.4.2 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse DSO in the current working directory during execution of apachectl. |
| CVE-2012-0253 | Medium | 2012-04-18 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in Demand Media Pluck SiteLife before 5.0.13 allow remote attackers to inject arbitrary web script or HTML via (1) the jsonRequest parameter to Direct/Process, the (2) r or (3) cb parameter to Direct/jsonp.htm, or (4) the cb parameter to sys/jsonp.app/.htm. |
| CVE-2011-5087 | Medium | 2012-04-18 | Not applicable | No public exploit | Unspecified vulnerability in AdAstrA TRACE MODE Data Center allows remote attackers to read arbitrary files via unknown vectors, as demonstrated by the GLEG Agora SCADA+ Exploit Pack for Immunity CANVAS. |
| CVE-2011-5086 | Medium | 2012-04-18 | Not applicable | No public exploit | https50.ocx in IP*Works! SSL in the server in Unitronics UniOPC before 2.0.0 does not properly implement an unspecified function, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted web site. |
| CVE-2011-4871 | Medium | 2012-04-18 | Not applicable | Working exploit published | Open Automation Software OPC Systems.NET before 5.0 allows remote attackers to cause a denial of service via a malformed .NET RPC packet on TCP port 58723. |
| CVE-2012-2268 | Medium | 2012-04-17 | Not applicable | No public exploit | master.exe in the SNMP Master Agent in RealNetworks Helix Server and Helix Mobile Server 14.x before 14.3.x allows remote attackers to cause a denial of service (unhandled exception and daemon crash) via a crafted Open-PDU request that triggers incorrect DisplayString processing, a different vulnerability than CVE-2012-1923. |
| CVE-2012-2267 | Medium | 2012-04-17 | Not applicable | No public exploit | master.exe in the SNMP Master Agent in RealNetworks Helix Server and Helix Mobile Server 14.x before 14.3.x allows remote attackers to cause a denial of service (daemon crash) by establishing and closing a port-705 TCP connection, a different vulnerability than CVE-2012-1923. |
| CVE-2012-2089 | Medium | 2012-04-17 | Not applicable | No public exploit | Buffer overflow in ngx_http_mp4_module.c in the ngx_http_mp4_module module in nginx 1.0.7 through 1.0.14 and 1.1.3 through 1.1.18, when the mp4 directive is used, allows remote attackers to cause a denial of service (memory overwrite) or possibly execute arbitrary code via a crafted MP4 file. |
| CVE-2012-1985 | Medium | 2012-04-17 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in RealNetworks Helix Server and Helix Mobile Server 14.x before 14.3.x allows remote attackers to hijack the authentication of administrators for requests that cause a denial of service (stack consumption and daemon crash) via a malformed URL. |
| CVE-2012-1984 | Medium | 2012-04-17 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in RealNetworks Helix Server and Helix Mobile Server 14.x before 14.3.x allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2012-1180 | Medium | 2012-04-17 | Not applicable | No public exploit | Use-after-free vulnerability in nginx before 1.0.14 and 1.1.x before 1.1.17 allows remote HTTP servers to obtain sensitive information from process memory via a crafted backend response, in conjunction with a client request. |
| CVE-2012-1240 | Medium | 2012-04-16 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the RECRUIT Dokodemo Rikunabi 2013 extension before 1.0.1 for Google Chrome allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2012-1809 | Medium | 2012-04-13 | Not applicable | No public exploit | The web server in the ECOM Ethernet module in Koyo H0-ECOM, H0-ECOM100, H2-ECOM, H2-ECOM-F, H2-ECOM100, H4-ECOM, H4-ECOM-F, and H4-ECOM100 allows remote attackers to cause a denial of service (resource consumption) via unspecified vectors. |
| CVE-2012-1807 | Medium | 2012-04-13 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the web server in the ECOM Ethernet module in Koyo H0-ECOM, H0-ECOM100, H2-ECOM, H2-ECOM-F, H2-ECOM100, H4-ECOM, H4-ECOM-F, and H4-ECOM100 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2011-4883 | Medium | 2012-04-13 | Not applicable | Working exploit published | The web server in Certec atvise webMI2ADS (aka webMI) before 2.0.2 does not properly validate values in HTTP requests, which allows remote attackers to cause a denial of service (resource consumption) via a crafted request. |
| CVE-2011-4882 | Medium | 2012-04-13 | Not applicable | Working exploit published | The web server in Certec atvise webMI2ADS (aka webMI) before 2.0.2 allows remote attackers to cause a denial of service (application exit) via an unspecified command in an HTTP request. |
| CVE-2011-4881 | Medium | 2012-04-13 | Not applicable | Working exploit published | The web server in Certec atvise webMI2ADS (aka webMI) before 2.0.2 does not properly check return values from functions, which allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted HTTP request. |
| CVE-2011-4880 | Medium | 2012-04-13 | Not applicable | Working exploit published | Directory traversal vulnerability in the web server in Certec atvise webMI2ADS (aka webMI) before 2.0.2 allows remote attackers to read arbitrary files via a crafted HTTP request. |
| CVE-2011-1778 | Medium | 2012-04-13 | Not applicable | No public exploit | Buffer overflow in libarchive through 2.8.5 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted TAR archive. |
| CVE-2011-1777 | Medium | 2012-04-13 | Not applicable | No public exploit | Multiple buffer overflows in the (1) heap_add_entry and (2) relocate_dir functions in archive_read_support_format_iso9660.c in libarchive through 2.8.5 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted ISO9660 image. |
| CVE-2012-2230 | Medium | 2012-04-12 | Not applicable | No public exploit | Cloudera Manager 3.7.x before 3.7.5 and Service and Configuration Manager 3.5, when Kerberos is not enabled, does not properly install taskcontroller.cfg, which allows remote authenticated users to impersonate arbitrary user accounts via unspecified vectors, a different vulnerability than CVE-2012-1574. |
| CVE-2012-1574 | Medium | 2012-04-12 | No exploit published | No public exploit | The Kerberos/MapReduce security functionality in Apache Hadoop 0.20.203.0 through 0.20.205.0, 0.23.x before 0.23.2, and 1.0.x before 1.0.2, as used in Cloudera CDH CDH3u0 through CDH3u2, Cloudera hadoop-0.20-sbin before 0.20.2+923.197, and other products, allows remote authenticated users to impersonate arbitrary cluster user accounts via unspecified vectors. |
| CVE-2011-3846 | Medium | 2012-04-12 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in HP System Management Homepage (SMH) 6.2.2.7 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts. |
| CVE-2012-2223 | Medium | 2012-04-11 | Not applicable | No public exploit | The xplat agent in Novell ZENworks Configuration Management (ZCM) 10.3.x before 10.3.4 and 11.x before 11.2 enables the HTTP TRACE method, which might make it easier for remote attackers to conduct cross-site tracing (XST) attacks via unspecified vectors. |
| CVE-2012-2156 | Medium | 2012-04-11 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in Plume CMS 1.2.4 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the u_email parameter (aka Authors Email field) to manager/users.php, (2) the u_realname parameter (aka Authors Name field) to manager/users.php, or (3) the c_author parameter (aka Author field) in an ADD A COMMENT section. |
| CVE-2012-1992 | Medium | 2012-04-11 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in admin/edituser.php in CMS Made Simple 1.10.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the email parameter (aka the Email Address field in the Edit User template). |
| CVE-2012-1596 | Medium | 2012-04-11 | Not applicable | No public exploit | The mp2t_process_fragmented_payload function in epan/dissectors/packet-mp2t.c in the MP2T dissector in Wireshark 1.4.x before 1.4.12 and 1.6.x before 1.6.6 allows remote attackers to cause a denial of service (application crash) via a packet containing an invalid pointer value that triggers an incorrect memory-allocation attempt. |
| CVE-2012-1595 | Medium | 2012-04-11 | Not applicable | No public exploit | The pcap_process_pseudo_header function in wiretap/pcap-common.c in Wireshark 1.4.x before 1.4.12 and 1.6.x before 1.6.6 allows remote attackers to cause a denial of service (application crash) via a WTAP_ENCAP_ERF file containing an Extension or Multi-Channel header with an invalid pseudoheader size, related to the pcap and pcap-ng file parsers. |
| CVE-2012-1036 | Medium | 2012-04-11 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the telerik HTML editor in DotNetNuke before 5.6.4 and 6.x before 6.1.0 allows remote attackers to inject arbitrary web script or HTML via a message. |
| CVE-2012-1030 | Medium | 2012-04-11 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in DotNetNuke 6.x through 6.0.2 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted URL containing text that is used within a modal popup. |
| CVE-2012-0068 | Medium | 2012-04-11 | Not applicable | No public exploit | The lanalyzer_read function in wiretap/lanalyzer.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a Novell capture file containing a record that is too small. |
| CVE-2012-0067 | Medium | 2012-04-11 | Not applicable | Working exploit published | wiretap/iptrace.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a long packet in an AIX iptrace file. |
| CVE-2012-0066 | Medium | 2012-04-11 | Not applicable | No public exploit | Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a long packet in a (1) Accellent 5Views (aka .5vw) file, (2) I4B trace file, or (3) NETMON 2 capture file. |
| CVE-2012-0043 | Medium | 2012-04-11 | Not applicable | No public exploit | Buffer overflow in the reassemble_message function in epan/dissectors/packet-rlc.c in the RLC dissector in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a series of fragmented RLC packets. |
| CVE-2012-0041 | Medium | 2012-04-11 | Not applicable | No public exploit | The dissect_packet function in epan/packet.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a long packet in a capture file, as demonstrated by an airopeek file. |
| CVE-2012-0777 | Medium | 2012-04-10 | Not applicable | No public exploit | The JavaScript API in Adobe Reader and Acrobat 9.x before 9.5.1 and 10.x before 10.1.3 on Mac OS X and Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors. |
| CVE-2012-0147 | Medium | 2012-04-10 | Not applicable | No public exploit | Microsoft Forefront Unified Access Gateway (UAG) 2010 SP1 and SP1 Update 1 does not properly configure the default web site, which allows remote attackers to obtain sensitive information via a crafted HTTPS request, aka "Unfiltered Access to UAG Default Website Vulnerability." |
| CVE-2012-0146 | Medium | 2012-04-10 | Not applicable | No public exploit | Open redirect vulnerability in Microsoft Forefront Unified Access Gateway (UAG) 2010 SP1 and SP1 Update 1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL, aka "UAG Blind HTTP Redirect Vulnerability." |
| CVE-2012-2215 | Medium | 2012-04-09 | Not applicable | Working exploit published | Directory traversal vulnerability in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allows remote attackers to read arbitrary files via an opcode 0x21 request. |
| CVE-2011-4188 | Medium | 2012-04-09 | Not applicable | No public exploit | Buffer overflow in the Create Attribute function in jclient in Novell iManager 2.7.4 before patch 4 allows remote authenticated users to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted EnteredAttrName parameter, a related issue to CVE-2010-1929. |
| CVE-2012-1902 | Medium | 2012-04-06 | Not applicable | No public exploit | show_config_errors.php in phpMyAdmin 3.4.x before 3.4.10.2, when a configuration file does not exist, allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message about this missing file. |
| CVE-2012-1238 | Medium | 2012-04-06 | Not applicable | No public exploit | Session fixation vulnerability in SENCHA SNS before 1.0.2 allows remote attackers to hijack web sessions via unspecified vectors. |
| CVE-2012-1237 | Medium | 2012-04-06 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in SENCHA SNS before 1.0.2 allows remote attackers to hijack the authentication of arbitrary users. |
| CVE-2012-2054 | Medium | 2012-04-05 | Not applicable | No public exploit | Redmine before 1.3.2 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set attributes in the (1) Comment, (2) Document, (3) IssueCategory, (4) MembersController, (5) Message, (6) News, (7) TimeEntry, (8) Version, (9) Wiki, (10) UserPreference, or (11) Board model via a modified URL, related to a "mass assignment" vulnerability, a different vulnerability than CVE-2012-0327. |
| CVE-2012-0327 | Medium | 2012-04-05 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Redmine before 1.3.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2012-0255 | Medium | 2012-04-05 | Not applicable | No public exploit | The BGP implementation in bgpd in Quagga before 0.99.20.1 does not properly use message buffers for OPEN messages, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a message associated with a malformed Four-octet AS Number Capability (aka AS4 capability). |
| CVE-2012-0132 | Medium | 2012-04-05 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in HP Business Availability Center (BAC) 9.01 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2012-0130 | Medium | 2012-04-05 | Not applicable | No public exploit | HP Onboard Administrator (OA) before 3.50 allows remote attackers to obtain sensitive information via unspecified vectors. |
| CVE-2012-0128 | Medium | 2012-04-05 | Not applicable | No public exploit | HP Onboard Administrator (OA) before 3.50 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. |
| CVE-2011-3077 | Medium | 2012-04-05 | Not applicable | No public exploit | Use-after-free vulnerability in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving the script bindings, related to a "read-after-free" issue. |
| CVE-2011-3076 | Medium | 2012-04-05 | Not applicable | No public exploit | Use-after-free vulnerability in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to focus handling. |
| CVE-2011-3075 | Medium | 2012-04-05 | Not applicable | No public exploit | Use-after-free vulnerability in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to style-application commands. |
| CVE-2011-3074 | Medium | 2012-04-05 | Not applicable | No public exploit | Use-after-free vulnerability in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of media. |
| CVE-2011-3073 | Medium | 2012-04-05 | Not applicable | No public exploit | Use-after-free vulnerability in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of SVG resources. |
| CVE-2011-3072 | Medium | 2012-04-05 | Not applicable | No public exploit | Google Chrome before 18.0.1025.151 allows remote attackers to bypass the Same Origin Policy via vectors related to pop-up windows. |
| CVE-2011-3071 | Medium | 2012-04-05 | Not applicable | No public exploit | Use-after-free vulnerability in the HTMLMediaElement implementation in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. |
| CVE-2011-3070 | Medium | 2012-04-05 | Not applicable | No public exploit | Use-after-free vulnerability in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the Google V8 bindings. |
| CVE-2011-3069 | Medium | 2012-04-05 | Not applicable | No public exploit | Use-after-free vulnerability in the Cascading Style Sheets (CSS) implementation in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to line boxes. |
| CVE-2011-3068 | Medium | 2012-04-05 | Not applicable | No public exploit | Use-after-free vulnerability in the Cascading Style Sheets (CSS) implementation in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to run-in boxes. |