Overview 3,163 matches · 152 in Waratek scope · 3 protected · 5 exploited · 0 CISA KEV · 480 public PoC · 13 EPSS ≥ 0.5
3,163matches
152in Waratek scope4.8%
3protected0.1%
5exploited0.2%
0CISA KEV0.0%
480public PoC15.2%
13EPSS ≥ 0.50.4%
Protected by Waratek
3
0.1%
Rule in development
0
0.0%
Mitigation candidate
5
0.2%
No exploit published
144
4.6%
Outside Waratek scope
41
1.3%
Not applicable
2,970
93.9%
Withdrawn CVE
0
0.0%
blocked by ARMR today
3
0.1%
partly blocked
0
0.0%
not blocked
3,160
99.9%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 509 / year
19901
Not applicable1
Low1
not blocked1
No public exploit1
19910
19921
Not applicable1
Low1
not blocked1
No public exploit1
19932
Not applicable2
Low2
not blocked2
No public exploit2
19941
Not applicable1
Low1
not blocked1
Working exploit published1
19951
Not applicable1
Low1
not blocked1
No public exploit1
19969
Not applicable9
Low9
not blocked9
No public exploit9
199719
Not applicable19
Low19
not blocked19
Working exploit published4
Forecast only2
No public exploit13
199823
Not applicable23
Low23
not blocked23
Working exploit published5
No public exploit18
1999111
Not applicable111
Low111
not blocked111
Working exploit published28
No public exploit83
200096
Not applicable96
Low96
not blocked96
Working exploit published34
No public exploit62
2001182
Outside Waratek scope2
Not applicable180
Low182
not blocked182
Working exploit published38
No public exploit144
2002143
No exploit published3
Not applicable140
Low143
not blocked143
Working exploit published18
Forecast only2
No public exploit123
200397
Mitigation candidate1
No exploit published5
Outside Waratek scope1
Not applicable90
Low97
not blocked97
Working exploit published16
No public exploit81
2004203
No exploit published3
Not applicable200
Low203
not blocked203
Working exploit published36
No public exploit167
2005441
No exploit published5
Outside Waratek scope1
Not applicable435
Low441
not blocked441
Exploited2
Working exploit published52
No public exploit387
2006509
No exploit published11
Outside Waratek scope1
Not applicable497
Low509
not blocked509
Exploited1
Working exploit published99
No public exploit409
2007232
Protected by Waratek1
No exploit published10
Outside Waratek scope4
Not applicable217
Low232
blocked by ARMR today1
not blocked231
Working exploit published29
Proof of concept only1
No public exploit202
2008185
No exploit published7
Outside Waratek scope3
Not applicable175
Low185
not blocked185
Working exploit published30
No public exploit155
2009197
Protected by Waratek1
No exploit published21
Outside Waratek scope5
Not applicable170
Low197
blocked by ARMR today1
not blocked196
Exploited1
Working exploit published33
No public exploit163
2010277
Mitigation candidate2
No exploit published20
Outside Waratek scope10
Not applicable245
Low277
not blocked277
Exploited1
Working exploit published28
No public exploit248
2011260
Protected by Waratek1
Mitigation candidate2
No exploit published31
Outside Waratek scope13
Not applicable213
Low260
blocked by ARMR today1
not blocked259
Working exploit published13
Proof of concept only1
No public exploit246
2012173
No exploit published28
Outside Waratek scope1
Not applicable144
Low173
not blocked173
Working exploit published12
No public exploit161
199019921994199619982000200220042006200820102012
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2012-3826 | Low | 2012-06-30 | Not applicable | Working exploit published | Multiple integer underflows in Wireshark 1.4.x before 1.4.13 and 1.6.x before 1.6.8 allow remote attackers to cause a denial of service (loop) via vectors related to the R3 dissector, a different vulnerability than CVE-2012-2392. |
| CVE-2012-3825 | Low | 2012-06-30 | Not applicable | Working exploit published | Multiple integer overflows in Wireshark 1.4.x before 1.4.13 and 1.6.x before 1.6.8 allow remote attackers to cause a denial of service (infinite loop) via vectors related to the (1) BACapp and (2) Bluetooth HCI dissectors, a different vulnerability than CVE-2012-2392. |
| CVE-2012-2394 | Low | 2012-06-30 | Not applicable | Working exploit published | Wireshark 1.4.x before 1.4.13 and 1.6.x before 1.6.8 on the SPARC and Itanium platforms does not properly perform data alignment for a certain structure member, which allows remote attackers to cause a denial of service (application crash) via a (1) ICMP or (2) ICMPv6 Echo Request packet. |
| CVE-2012-2393 | Low | 2012-06-30 | Not applicable | Working exploit published | epan/dissectors/packet-diameter.c in the DIAMETER dissector in Wireshark 1.4.x before 1.4.13 and 1.6.x before 1.6.8 does not properly construct certain array data structures, which allows remote attackers to cause a denial of service (application crash) via a crafted packet that triggers incorrect memory allocation. |
| CVE-2012-2392 | Low | 2012-06-30 | Not applicable | Working exploit published | Wireshark 1.4.x before 1.4.13 and 1.6.x before 1.6.8 allows remote attackers to cause a denial of service (infinite loop) via vectors related to the (1) ANSI MAP, (2) ASF, (3) IEEE 802.11, (4) IEEE 802.3, and (5) LTP dissectors. |
| CVE-2012-3818 | Low | 2012-06-29 | Not applicable | No public exploit | The fpm exporter in Revelation 0.4.13-2 and earlier encrypts the version number but not the password when exporting a file, which might allow local users to obtain sensitive information. |
| CVE-2012-2690 | Low | 2012-06-29 | Not applicable | No public exploit | virt-edit in libguestfs before 1.18.0 does not preserve the permissions from the original file and saves the new file with world-readable permissions when editing, which might allow local guest users to obtain sensitive information. |
| CVE-2012-1164 | Low | 2012-06-29 | Not applicable | No public exploit | slapd in OpenLDAP before 2.4.30 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via an LDAP search query with attrsOnly set to true, which causes empty attributes to be returned. |
| CVE-2012-1122 | Low | 2012-06-29 | Not applicable | No public exploit | bug_actiongroup.php in MantisBT before 1.2.9 does not properly check the report_bug_threshold permission of the receiving project when moving a bug report, which allows remote authenticated users with the report_bug_threshold and move_bug_threshold privileges for a project to bypass intended access restrictions and move bug reports to a different project. |
| CVE-2012-1120 | Low | 2012-06-29 | Not applicable | No public exploit | The SOAP API in MantisBT before 1.2.9 does not properly enforce the bugnote_allow_user_edit_delete and delete_bug_threshold permissions, which allows remote authenticated users with read and write SOAP API privileges to delete arbitrary bug reports and bug notes. |
| CVE-2012-0813 | Low | 2012-06-29 | Not applicable | No public exploit | Wicd before 1.7.1 saves sensitive information in log files in /var/log/wicd, which allows context-dependent attackers to obtain passwords and other sensitive information. |
| CVE-2012-3800 | Low | 2012-06-27 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in og.js in the Organic Groups (OG) module 6.x-2.x before 6.x-2.4 for Drupal, when used with the Vertical Tabs module, allows remote authenticated users to inject arbitrary web script or HTML via vectors related the group title. |
| CVE-2012-2731 | Low | 2012-06-27 | Not applicable | No public exploit | The Ubercart AJAX Cart 6.x-2.x before 6.x-2.1 for Drupal stores the PHP session id in the JavaScript settings array in page loads, which might allow remote attackers to obtain sensitive information by sniffing or reading the cache of the HTML of a webpage. |
| CVE-2012-2726 | Low | 2012-06-27 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Protest module 6.x-1.x before 6.x-1.2 or 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the "administer protest" permission to inject arbitrary web script or HTML via the protest_body parameter. |
| CVE-2012-2725 | Low | 2012-06-27 | Not applicable | No public exploit | classes/Filter/WhitelistedExternalFilter.php in the Authoring HTML module 6.x-1.x before 6.x-1.1 for Drupal does not properly validate sources with the host white list, which allows remote authenticated users to bypass intended access restrictions and conduct cross-site scripting (XSS) attacks. |
| CVE-2012-2723 | Low | 2012-06-27 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Maestro module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with maestro admin permissions to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2012-2712 | Low | 2012-06-27 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in the Search API module 7.x-1.x before 7.x-1.1 for Drupal, when supporting manual entry of field identifiers, allow remote attackers to inject arbitrary web script or HTML via vectors related to thrown exceptions and logging errors. |
| CVE-2012-2711 | Low | 2012-06-27 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in the Taxonomy List module 6.x-1.x before 6.x-1.4 for Drupal allow remote authenticated users with create or edit taxonomy terms permissions to inject arbitrary web script or HTML via vectors related to taxonomy information. |
| CVE-2012-2710 | Low | 2012-06-27 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Zen module 6.x-1.x before 6.x-1.1 for Drupal, when "Append the content title to the end of the breadcrumb" is enabled, allows remote attackers to inject arbitrary web script or HTML via the content title in a breadcrumb. |
| CVE-2012-2708 | Low | 2012-06-27 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the _hosting_task_log_table function in modules/hosting/task/hosting_task.module in the Hostmaster (Aegir) module 6.x-1.x before 6.x-1.9 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a Drush log message in a provision task log. |
| CVE-2012-2705 | Low | 2012-06-27 | Not applicable | No public exploit | The filter_titles function in the Smart Breadcrumb module 6.x-1.x before 6.x-1.3 for Drupal does not properly convert a title to plain-text, which allows remote authenticated users with create or edit node permissions to conduct cross-site scripting (XSS) attacks via the title parameter. |
| CVE-2012-2703 | Low | 2012-06-27 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Advertisement module 6.x-2.x before 6.x-2.3 for Drupal, when debug mode is enabled, allows remote attackers to inject arbitrary web script or HTML via vectors related to the "$conf variable in settings.php." |
| CVE-2012-2451 | Low | 2012-06-27 | Not applicable | No public exploit | The Config::IniFiles module before 2.71 for Perl creates temporary files with predictable names, which allows local users to overwrite arbitrary files via a symlink attack. NOTE: some of these details are obtained from third party information. NOTE: it has been reported that this might only be exploitable by writing in the same directory as the .ini file. If this is the case, then this issue might not cross privilege boundaries. |
| CVE-2012-1989 | Low | 2012-06-27 | Not applicable | No public exploit | telnet.rb in Puppet 2.7.x before 2.7.13 and Puppet Enterprise (PE) 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows local users to overwrite arbitrary files via a symlink attack on the NET::Telnet connection log (/tmp/out.log). |
| CVE-2011-4940 | Low | 2012-06-27 | Not applicable | No public exploit | The list_directory function in Lib/SimpleHTTPServer.py in SimpleHTTPServer in Python before 2.5.6c1, 2.6.x before 2.6.7 rc2, and 2.7.x before 2.7.2 does not place a charset parameter in the Content-Type HTTP header, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks against Internet Explorer 7 via UTF-7 encoding. |
| CVE-2012-2381 | Low | 2012-06-26 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in Apache Roller before 5.0.1 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the blogger role. |
| CVE-2012-2389 | Low | 2012-06-21 | Not applicable | No public exploit | hostapd 0.7.3, and possibly other versions before 1.0, uses 0644 permissions for /etc/hostapd/hostapd.conf, which might allow local users to obtain sensitive information such as credentials. |
| CVE-2011-2527 | Low | 2012-06-21 | Not applicable | No public exploit | The change_process_uid function in os-posix.c in Qemu 0.14.0 and earlier does not properly drop group privileges when the -runas option is used, which allows local guest users to access restricted files on the host. |
| CVE-2011-1160 | Low | 2012-06-21 | Not applicable | No public exploit | The tpm_open function in drivers/char/tpm/tpm.c in the Linux kernel before 2.6.39 does not initialize a certain buffer, which allows local users to obtain potentially sensitive information from kernel memory via unspecified vectors. |
| CVE-2011-1080 | Low | 2012-06-21 | Not applicable | No public exploit | The do_replace function in net/bridge/netfilter/ebtables.c in the Linux kernel before 2.6.39 does not ensure that a certain name field ends with a '\0' character, which allows local users to obtain potentially sensitive information from kernel stack memory by leveraging the CAP_NET_ADMIN capability to replace a table, and then reading a modprobe command line. |
| CVE-2011-1078 | Low | 2012-06-21 | Not applicable | No public exploit | The sco_sock_getsockopt_old function in net/bluetooth/sco.c in the Linux kernel before 2.6.39 does not initialize a certain structure, which allows local users to obtain potentially sensitive information from kernel stack memory via the SCO_CONNINFO option. |
| CVE-2011-1021 | Low | 2012-06-21 | Not applicable | Working exploit published | drivers/acpi/debugfs.c in the Linux kernel before 3.0 allows local users to modify arbitrary kernel memory locations by leveraging root privileges to write to the /sys/kernel/debug/acpi/custom_method file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-4347. |
| CVE-2011-0006 | Low | 2012-06-21 | Not applicable | No public exploit | The ima_lsm_rule_init function in security/integrity/ima/ima_policy.c in the Linux kernel before 2.6.37, when the Linux Security Modules (LSM) framework is disabled, allows local users to bypass Integrity Measurement Architecture (IMA) rules in opportunistic circumstances by leveraging an administrator's addition of an IMA rule for LSM. |
| CVE-2010-4648 | Low | 2012-06-21 | Not applicable | No public exploit | The orinoco_ioctl_set_auth function in drivers/net/wireless/orinoco/wext.c in the Linux kernel before 2.6.37 does not properly implement a TKIP protection mechanism, which makes it easier for remote attackers to obtain access to a Wi-Fi network by reading Wi-Fi frames. |
| CVE-2012-0717 | Low | 2012-06-20 | No exploit published | No public exploit | IBM WebSphere Application Server 7.0 before 7.0.0.23, when a certain SSLv2 configuration with client authentication is used, allows remote attackers to bypass X.509 client-certificate authentication via unspecified vectors. |
| CVE-2012-3587 | Low | 2012-06-19 | Not applicable | No public exploit | APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-update to import keyrings, relies on GnuPG argument order and does not check GPG subkeys, which might allow remote attackers to install Trojan horse packages via a man-in-the-middle (MITM) attack. |
| CVE-2012-0954 | Low | 2012-06-19 | Not applicable | No public exploit | APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-update to import keyrings, relies on GnuPG argument order and does not check GPG subkeys, which might allow remote attackers to install altered packages via a man-in-the-middle (MITM) attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3587. |
| CVE-2012-2693 | Low | 2012-06-17 | Not applicable | No public exploit | libvirt, possibly before 0.9.12, does not properly assign USB devices to virtual machines when multiple devices have the same vendor and product ID, which might cause the wrong device to be associated with a guest and might allow local users to access unintended USB devices. |
| CVE-2012-2692 | Low | 2012-06-17 | Not applicable | No public exploit | MantisBT before 1.2.11 does not check the delete_attachments_threshold permission when form_security_validation is set to OFF, which allows remote authenticated users with certain privileges to bypass intended access restrictions and delete arbitrary attachments. |
| CVE-2012-2672 | Low | 2012-06-17 | No exploit published | No public exploit | Oracle Mojarra 2.1.7 does not properly "clean up" the FacesContext reference during startup, which allows local users to obtain context information an access resources from another WAR file by calling the FacesContext.getCurrentInstance function. |
| CVE-2012-1720 | Low | 2012-06-16 | Outside Waratek scope | No public exploit | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier, when running on Solaris, allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Networking. |
| CVE-2012-1717 | Low | 2012-06-16 | No exploit published | No public exploit | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows local users to affect confidentiality via unknown vectors related to printing on Solaris or Linux. |
| CVE-2012-2634 | Low | 2012-06-15 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in FeedDemon before 4.0, when the feed preview option is enabled, allows remote attackers to inject arbitrary web script or HTML via a feed. |
| CVE-2012-2632 | Low | 2012-06-15 | Not applicable | No public exploit | SEIL routers with firmware SEIL/x86 1.00 through 2.35, SEIL/X1 2.30 through 3.75, SEIL/X2 2.30 through 3.75, and SEIL/B1 2.30 through 3.75, when the http-proxy and application-gateway features are enabled, do not properly handle the CONNECT command, which allows remote attackers to bypass intended URL restrictions via a TCP session. |
| CVE-2012-3558 | Low | 2012-06-14 | Not applicable | No public exploit | Opera before 11.65 does not ensure that the address field corresponds to the displayed web page during unusually timed changes to this field, which makes it easier for user-assisted remote attackers to conduct spoofing attacks via vectors involving navigation, reloads, and redirects. |
| CVE-2012-2604 | Low | 2012-06-13 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in GuestAccess.jsp in the Guest/Contractor access component in the administrative interface in Bradford Network Sentry before 5.3.3 allow remote authenticated users to inject arbitrary web script or HTML via unspecified fields. |
| CVE-2012-2313 | Low | 2012-06-13 | Not applicable | No public exploit | The rio_ioctl function in drivers/net/ethernet/dlink/dl2k.c in the Linux kernel before 3.3.7 does not restrict access to the SIOCSMIIREG command, which allows local users to write data to an Ethernet adapter via an ioctl call. |
| CVE-2012-1829 | Low | 2012-06-13 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in AutoFORM PDM Archive before 6.920 allow remote authenticated users to inject arbitrary web script or HTML via unspecified fields. |
| CVE-2012-1820 | Low | 2012-06-13 | Not applicable | No public exploit | The bgp_capability_orf function in bgpd in Quagga 0.99.20.1 and earlier allows remote attackers to cause a denial of service (assertion failure and daemon exit) by leveraging a BGP peering relationship and sending a malformed Outbound Route Filtering (ORF) capability TLV in an OPEN message. |
| CVE-2011-2495 | Low | 2012-06-13 | Not applicable | No public exploit | fs/proc/base.c in the Linux kernel before 2.6.39.4 does not properly restrict access to /proc/#####/io files, which allows local users to obtain sensitive I/O statistics by polling a file, as demonstrated by discovering the length of another user's password. |
| CVE-2011-2494 | Low | 2012-06-13 | Not applicable | No public exploit | kernel/taskstats.c in the Linux kernel before 3.1 allows local users to obtain sensitive I/O statistics by sending taskstats commands to a netlink socket, as demonstrated by discovering the length of another user's password. |
| CVE-2011-2493 | Low | 2012-06-13 | Not applicable | No public exploit | The ext4_fill_super function in fs/ext4/super.c in the Linux kernel before 2.6.39 does not properly initialize a certain error-report data structure, which allows local users to cause a denial of service (OOPS) by attempting to mount a crafted ext4 filesystem. |
| CVE-2011-2210 | Low | 2012-06-13 | Not applicable | No public exploit | The osf_getsysinfo function in arch/alpha/kernel/osf_sys.c in the Linux kernel before 2.6.39.4 on the Alpha platform does not properly restrict the data size for GSI_GET_HWRPB operations, which allows local users to obtain sensitive information from kernel memory via a crafted call. |
| CVE-2011-2209 | Low | 2012-06-13 | Not applicable | No public exploit | Integer signedness error in the osf_sysinfo function in arch/alpha/kernel/osf_sys.c in the Linux kernel before 2.6.39.4 on the Alpha platform allows local users to obtain sensitive information from kernel memory via a crafted call. |
| CVE-2011-2208 | Low | 2012-06-13 | Not applicable | No public exploit | Integer signedness error in the osf_getdomainname function in arch/alpha/kernel/osf_sys.c in the Linux kernel before 2.6.39.4 on the Alpha platform allows local users to obtain sensitive information from kernel memory via a crafted call. |
| CVE-2012-2101 | Low | 2012-06-07 | Not applicable | No public exploit | Openstack Compute (Nova) Folsom, 2012.1, and 2011.3 does not limit the number of security group rules, which allows remote authenticated users with certain permissions to cause a denial of service (CPU and hard drive consumption) via a network request that triggers a large number of iptables rules. |
| CVE-2012-0948 | Low | 2012-06-07 | Not applicable | No public exploit | DistUpgrade/DistUpgradeMain.py in Update Manager, as used by Ubuntu 12.04 LTS, 11.10, and 11.04, uses weak permissions for (1) apt-clone_system_state.tar.gz and (2) system_state.tar.gz, which allows local users to obtain repository credentials. |
| CVE-2012-1945 | Low | 2012-06-05 | Not applicable | No public exploit | Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10 allow local users to obtain sensitive information via an HTML document that loads a shortcut (aka .lnk) file for display within an IFRAME element, as demonstrated by a network share implemented by (1) Microsoft Windows or (2) Samba. |
| CVE-2012-1253 | Low | 2012-06-04 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 0.7, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via vectors involving an embedded image attachment. |
| CVE-2011-4459 | Low | 2012-06-04 | Not applicable | No public exploit | Best Practical Solutions RT 3.x before 3.8.12 and 4.x before 4.0.6 does not properly disable groups, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by leveraging a group membership. |
| CVE-2012-2947 | Low | 2012-06-02 | Not applicable | No public exploit | chan_iax2.c in the IAX2 channel driver in Certified Asterisk 1.8.11-cert before 1.8.11-cert2 and Asterisk Open Source 1.8.x before 1.8.12.1 and 10.x before 10.4.1, when a certain mohinterpret setting is enabled, allows remote attackers to cause a denial of service (daemon crash) by placing a call on hold. |
| CVE-2012-1987 | Low | 2012-05-29 | Not applicable | No public exploit | Unspecified vulnerability in Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys to (1) cause a denial of service (memory consumption) via a REST request to a stream that triggers a thread block, as demonstrated using CVE-2012-1986 and /dev/random; or (2) cause a denial of service (filesystem consumption) via crafted REST requests that use "a marshaled form of a Puppet::FileBucket::File object" to write to arbitrary file locations. |
| CVE-2012-1986 | Low | 2012-05-29 | Not applicable | No public exploit | Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with an authorized SSL key and certain permissions on the puppet master to read arbitrary files via a symlink attack in conjunction with a crafted REST request for a file in a filebucket. |
| CVE-2012-1906 | Low | 2012-05-29 | Not applicable | No public exploit | Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp. |
| CVE-2012-1792 | Low | 2012-05-27 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in osCommerce/OM/Core/Site/Setup/Application/Install/RPC/DBCheck.php in OSCommerce Online Merchant 3.0.2, when the software is being installed, allows remote attackers to inject arbitrary web script or HTML via the name parameter to oscommerce/index.php, which is not properly handled in an error message. NOTE: this might not be a vulnerability, since the ability to access oscommerce/index.php during installation may already imply administrator privileges. |
| CVE-2012-1413 | Low | 2012-05-27 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in zc_install/includes/modules/pages/database_setup/header_php.php in Zen Cart 1.5.0 and earlier, when the software is being installed, allows remote attackers to inject arbitrary web script or HTML via the db_username parameter to zc_install/index.php. |
| CVE-2011-2722 | Low | 2012-05-25 | Not applicable | No public exploit | The send_data_to_stdout function in prnt/hpijs/hpcupsfax.cpp in HP Linux Imaging and Printing (HPLIP) 3.x before 3.11.10 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/hpcupsfax.out temporary file. |
| CVE-2012-2567 | Low | 2012-05-22 | Not applicable | No public exploit | The Xelex MobileTrack application 2.3.7 and earlier for Android uses hardcoded credentials, which allows remote attackers to obtain sensitive information via an unencrypted (1) FTP or (2) HTTP session. |
| CVE-2012-2907 | Low | 2012-05-21 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the aberdeen_breadcrumb function in template.php in the Aberdeen theme 6.x-1.x before 6.x-1.11 for Drupal, when set to append the content title to the breadcrumb, allows remote attackers to inject arbitrary web script or HTML via the content title in a breadcrumb. |
| CVE-2012-2340 | Low | 2012-05-21 | Not applicable | No public exploit | The Contact Forms module 7.x-1.x before 7.x-1.2 for Drupal does not specify sufficiently restrictive permissions, which allows remote authenticated users with the "access the site-wide contact form" permission to modify the module settings via unspecified vectors. |
| CVE-2010-5100 | Low | 2012-05-21 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in the Install Tool in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2010-5098 | Low | 2012-05-21 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the FORM content object in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2010-5097 | Low | 2012-05-21 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the click enlarge functionality in TYPO3 4.3.x before 4.3.9 and 4.4.x before 4.4.5 when the caching framework is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2012-2120 | Low | 2012-05-18 | Not applicable | No public exploit | latex2man in texlive-extra-utils 2011.20120322, and possibly other versions or packages, when used with the H or T option, allows local users to overwrite arbitrary files via a symlink attack on a temporary file. |
| CVE-2012-2093 | Low | 2012-05-18 | Not applicable | No public exploit | src/common/latex.py in Gajim 0.15 allows local users to overwrite arbitrary files via a symlink attack on a temporary latex file, related to the get_tmpfile_name function. |
| CVE-2012-1247 | Low | 2012-05-15 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in KENT-WEB WEB MART 1.7 and earlier, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML by leveraging support for Cascading Style Sheets (CSS) expressions. |
| CVE-2012-0657 | Low | 2012-05-11 | Not applicable | No public exploit | Quartz Composer in Apple Mac OS X before 10.7.4, when the RSS Visualizer screensaver is enabled, allows physically proximate attackers to bypass screen locking and launch a Safari process via unspecified vectors. |
| CVE-2012-0174 | Low | 2012-05-09 | Not applicable | No public exploit | Windows Firewall in tcpip.sys in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly enforce firewall rules for outbound broadcast packets, which allows remote attackers to obtain potentially sensitive information by observing broadcast traffic on a local network, aka "Windows Firewall Bypass Vulnerability." |
| CVE-2012-1704 | Low | 2012-05-03 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 5.0.2, 5.3.0 through 5.3.4, 6.0.1, and 6.2.0 allows remote authenticated users to affect confidentiality via unknown vectors related to Core-Base, a different vulnerability than CVE-2012-1707. |
| CVE-2012-1698 | Low | 2012-05-03 | Not applicable | No public exploit | Unspecified vulnerability in Oracle Sun Solaris 11 allows remote authenticated users to affect confidentiality, related to Kernel/GLD. |
| CVE-2012-1693 | Low | 2012-05-03 | Not applicable | No public exploit | Unspecified vulnerability in Oracle SPARC Enterprise M Series Servers XCP 1110 allows remote attackers to affect availability, related to XSCF Control Package (XCP). |
| CVE-2012-1679 | Low | 2012-05-03 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 5.0.2, 5.3.0 through 5.3.4, 6.0.1, and 6.2.0 allows remote authenticated users to affect integrity via unknown vectors related to Core-Base. |
| CVE-2012-1676 | Low | 2012-05-03 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 5.0.2, 5.3.0 through 5.3.4, 6.0.1, and 6.2.0 allows remote authenticated users to affect confidentiality via unknown vectors related to Virtual Banking. |
| CVE-2012-0737 | Low | 2012-05-03 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2012-0579 | Low | 2012-05-03 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Software 10.0.0 through 10.5.0 and 11.0.0 through 11.4.0 allows remote authenticated users to affect confidentiality via unknown vectors related to Core. |
| CVE-2012-0577 | Low | 2012-05-03 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Software 10.0.0 through 10.5.0 and 11.0.0 through 11.4.0 allows remote authenticated users to affect availability via unknown vectors related to Core. |
| CVE-2012-0561 | Low | 2012-05-03 | No exploit published | No public exploit | Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.50, 8.51, and 8.52 allows remote authenticated users to affect integrity, related to PIA Core Technology. |
| CVE-2012-0548 | Low | 2012-05-03 | Not applicable | No public exploit | Unspecified vulnerability in Oracle SPARC Enterprise M Series Servers XCP 1110 and earlier allows local users to affect confidentiality, related to XSCF Control Package (XCP). |
| CVE-2012-0546 | Low | 2012-05-03 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Software 10.0.0 through 10.5.0 and 11.0.0 through 11.2.0 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Core, a different vulnerability than CVE-2012-0545 and CVE-2012-0567. |
| CVE-2012-0545 | Low | 2012-05-03 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Software 10.0.0 through 10.5.0 and 11.0.0 through 11.2.0 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Core, a different vulnerability than CVE-2012-0546 and CVE-2012-0567. |
| CVE-2012-0544 | Low | 2012-05-03 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Software 10.0.0 through 10.5.0 and 11.0.0 through 11.4.0 allows remote authenticated users to affect integrity via unknown vectors related to Core, a different vulnerability than CVE-2012-0571. |
| CVE-2012-0542 | Low | 2012-05-03 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle iStore component in Oracle E-Business Suite 11.5.10.2, 12.0.4, 12.0.6, 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect integrity via unknown vectors related to Runtime Catalog. |
| CVE-2012-0541 | Low | 2012-05-03 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 5.0.2, 5.3.0 through 5.3.4, 6.0.1, and 6.2.0 allows remote authenticated users to affect confidentiality via unknown vectors related to Core-My Services. |
| CVE-2012-0531 | Low | 2012-05-03 | No exploit published | No public exploit | Unspecified vulnerability in the PeopleSoft Enterprise Portal component in Oracle PeopleSoft Products 9.1 allows remote authenticated users to affect integrity via unknown vectors related to Enterprise Portal. |
| CVE-2012-0529 | Low | 2012-05-03 | No exploit published | No public exploit | Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.51 allows remote authenticated users to affect integrity via unknown vectors related to core. |
| CVE-2012-0524 | Low | 2012-05-03 | No exploit published | No public exploit | Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.50, 8.51, and 8.52 allows local users to affect confidentiality and integrity via unknown vectors related to File Processing. |
| CVE-2012-0513 | Low | 2012-05-03 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 12.0.6 and 12.1.3 allows remote attackers to affect integrity, related to REST Services. |
| CVE-2012-0509 | Low | 2012-05-03 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 5.0.2 and 5.3.0 through 5.3.4 allows remote authenticated users to affect integrity via unknown vectors related to Core-Base. |
| CVE-2011-3289 | Low | 2012-05-02 | Not applicable | No public exploit | Cisco IOS 12.4 and 15.0 through 15.2 allows physically proximate attackers to bypass the No Service Password-Recovery feature and read the start-up configuration via unspecified vectors, aka Bug ID CSCtr97640. |
| CVE-2012-0863 | Low | 2012-04-30 | Not applicable | No public exploit | Mumble 1.2.3 and earlier uses world-readable permissions for .local/share/data/Mumble/.mumble.sqlite files in home directories, which might allow local users to obtain a cleartext password and configuration data by reading a file. |