Overview 25,637 matches · 861 in Waratek scope · 34 protected · 108 exploited · 6 CISA KEV · 7,636 public PoC · 245 EPSS ≥ 0.5
25,637matches
861in Waratek scope3.4%
34protected0.1%
108exploited0.4%
6CISA KEV0.0%
7,636public PoC29.8%
245EPSS ≥ 0.51.0%
Protected by Waratek
34
0.1%
Rule in development
0
0.0%
Mitigation candidate
72
0.3%
No exploit published
755
2.9%
Outside Waratek scope
265
1.0%
Not applicable
24,511
95.6%
Withdrawn CVE
0
0.0%
blocked by ARMR today
34
0.1%
partly blocked
0
0.0%
not blocked
25,603
99.9%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 3,324 / year
19891
Not applicable1
Medium1
not blocked1
No public exploit1
19902
Not applicable2
Medium2
not blocked2
Working exploit published1
No public exploit1
19914
Not applicable4
Medium4
not blocked4
No public exploit4
19920
19933
Not applicable3
Medium3
not blocked3
No public exploit3
199410
Not applicable10
Medium10
not blocked10
Working exploit published2
No public exploit8
19956
Not applicable6
Medium6
not blocked6
Working exploit published2
No public exploit4
199621
Not applicable21
Medium21
not blocked21
Working exploit published5
No public exploit16
199789
Not applicable89
Medium89
not blocked89
Working exploit published18
No public exploit71
199885
Not applicable85
Medium85
not blocked85
Working exploit published11
No public exploit74
1999357
Outside Waratek scope1
Not applicable356
Medium357
not blocked357
Working exploit published119
No public exploit238
2000467
Mitigation candidate4
No exploit published3
Not applicable460
Medium467
not blocked467
Exploited2
Working exploit published195
No public exploit270
2001706
Mitigation candidate2
No exploit published4
Outside Waratek scope7
Not applicable693
Medium706
not blocked706
Exploited3
Working exploit published219
Forecast only2
No public exploit482
2002980
Protected by Waratek2
Mitigation candidate6
No exploit published15
Outside Waratek scope4
Not applicable953
Medium980
blocked by ARMR today2
not blocked978
Exploited3
Working exploit published246
Forecast only3
No public exploit728
2003747
Protected by Waratek2
Mitigation candidate4
No exploit published18
Outside Waratek scope1
Not applicable722
Medium747
blocked by ARMR today2
not blocked745
Working exploit published243
No public exploit504
20041,265
Protected by Waratek1
Mitigation candidate1
No exploit published16
Outside Waratek scope4
Not applicable1,243
Medium1,265
blocked by ARMR today1
not blocked1,264
Exploited10
Working exploit published414
Forecast only1
No public exploit840
20052,430
Protected by Waratek3
Mitigation candidate4
No exploit published39
Outside Waratek scope6
Not applicable2,378
Medium2,430
blocked by ARMR today3
not blocked2,427
Exploited8
Working exploit published622
Forecast only6
No public exploit1,794
20063,324
Protected by Waratek4
Mitigation candidate4
No exploit published48
Outside Waratek scope3
Not applicable3,265
Medium3,324
blocked by ARMR today4
not blocked3,320
Exploited10
Working exploit published1,137
Forecast only2
No public exploit2,175
20073,101
Protected by Waratek2
Mitigation candidate9
No exploit published60
Outside Waratek scope53
Not applicable2,977
Medium3,101
blocked by ARMR today2
not blocked3,099
Exploited14
Working exploit published1,052
Forecast only1
No public exploit2,034
20082,582
Protected by Waratek4
Mitigation candidate8
No exploit published71
Outside Waratek scope26
Not applicable2,473
Medium2,582
blocked by ARMR today4
not blocked2,578
Exploited7
Working exploit published987
Proof of concept only2
Forecast only1
No public exploit1,585
20092,786
Protected by Waratek5
Mitigation candidate9
No exploit published115
Outside Waratek scope31
Not applicable2,626
Medium2,786
blocked by ARMR today5
not blocked2,781
Exploited16
Working exploit published1,123
Proof of concept only2
Forecast only3
No public exploit1,642
20102,241
Protected by Waratek6
Mitigation candidate9
No exploit published118
Outside Waratek scope34
Not applicable2,074
Medium2,241
blocked by ARMR today6
not blocked2,235
Exploited14
Working exploit published547
Proof of concept only1
Forecast only2
No public exploit1,677
20112,101
Protected by Waratek4
Mitigation candidate3
No exploit published132
Outside Waratek scope58
Not applicable1,904
Medium2,101
blocked by ARMR today4
not blocked2,097
Exploited9
Working exploit published294
Proof of concept only3
Forecast only1
No public exploit1,794
20122,329
Protected by Waratek1
Mitigation candidate9
No exploit published116
Outside Waratek scope37
Not applicable2,166
Medium2,329
blocked by ARMR today1
not blocked2,328
Exploited12
Working exploit published340
Proof of concept only1
Forecast only42
No public exploit1,934
199019921994199619982000200220042006200820102012
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2012-4912 | Medium | 2012-09-28 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the WebAccess component in Novell GroupWise 8.0 before Support Pack 3 and 2012 before Support Pack 1 allows remote attackers to inject arbitrary web script or HTML via a crafted signature in an HTML e-mail message. |
| CVE-2012-4448 | Medium | 2012-09-28 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in wp-admin/index.php in WordPress 3.4.2 allows remote attackers to hijack the authentication of administrators for requests that modify an RSS URL via a dashboard_incoming_links edit action. |
| CVE-2012-4051 | Medium | 2012-09-28 | Not applicable | Working exploit published | Multiple cross-site request forgery (CSRF) vulnerabilities in editAccount.html in the JAMF Software Server (JSS) interface in JAMF Casper Suite before 8.61 allow remote attackers to hijack the authentication of administrators for requests that (1) create user accounts or (2) change passwords via a Save action. |
| CVE-2012-4017 | Medium | 2012-09-28 | Not applicable | No public exploit | The jigbrowser+ application before 1.5.0 for Android does not properly implement the WebView class, which allows remote attackers to obtain sensitive information via a crafted application. |
| CVE-2012-4016 | Medium | 2012-09-28 | Not applicable | No public exploit | The ATOK application before 1.0.4 for Android allows remote attackers to read the learning information file, and obtain sensitive input-string information, via a crafted application. |
| CVE-2012-3493 | Medium | 2012-09-28 | Not applicable | No public exploit | The command_give_request_ad function in condor_startd.V6/command.cpp Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 allows remote attackers to obtain sensitive information, and possibly control or start arbitrary jobs, via a ClassAd request to the condor_startd port, which leaks the ClaimId. |
| CVE-2012-3492 | Medium | 2012-09-28 | Not applicable | No public exploit | The filesystem authentication (condor_io/condor_auth_fs.cpp) in Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 uses authentication directories even when they have weak permissions, which allows remote attackers to impersonate users by renaming a user's authentication directory. |
| CVE-2012-3491 | Medium | 2012-09-28 | Not applicable | No public exploit | src/condor_schedd.V6/schedd.cpp in Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 does not properly check the permissions of jobs, which allows remote authenticated users to remove arbitrary idle jobs via unspecified vectors. |
| CVE-2012-3459 | Medium | 2012-09-28 | Not applicable | No public exploit | Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allows remote authenticated users to modify Condor attributes and possibly gain privileges via crafted additional parameters in an HTTP POST request, which triggers a job attribute change request to Condor. |
| CVE-2012-2735 | Medium | 2012-09-28 | Not applicable | No public exploit | Session fixation vulnerability in Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allows remote attackers to hijack web sessions via a crafted session cookie. |
| CVE-2012-2734 | Medium | 2012-09-28 | Not applicable | No public exploit | Multiple cross-site request forgery (CSRF) vulnerabilities in Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allow remote attackers to hijack the authentication of arbitrary users for requests that execute commands via unspecified vectors. |
| CVE-2012-2685 | Medium | 2012-09-28 | Not applicable | No public exploit | Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allows remote authenticated users to cause a denial of service (memory consumption) via a large size in an image request. |
| CVE-2012-2683 | Medium | 2012-09-28 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to (1) "error message displays" or (2) "in source HTML on certain pages." |
| CVE-2012-2681 | Medium | 2012-09-28 | Not applicable | No public exploit | Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, uses predictable random numbers to generate session keys, which makes it easier for remote attackers to guess the session key. |
| CVE-2012-2680 | Medium | 2012-09-28 | Not applicable | No public exploit | Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, does not properly restrict access to resources, which allows remote attackers to obtain sensitive information via unspecified vectors related to (1) "web pages," (2) "export functionality," and (3) "image viewing." |
| CVE-2012-2145 | Medium | 2012-09-28 | Not applicable | No public exploit | Apache Qpid 0.17 and earlier does not properly restrict incoming client connections, which allows remote attackers to cause a denial of service (file descriptor consumption) via a large number of incomplete connections. |
| CVE-2012-1833 | Medium | 2012-09-28 | Not applicable | No public exploit | VMware SpringSource Grails before 1.3.8, and 2.x before 2.0.2, does not properly restrict data binding, which might allow remote attackers to bypass intended access restrictions and modify arbitrary object properties via a crafted request parameter to an application. |
| CVE-2012-0956 | Medium | 2012-09-28 | Not applicable | No public exploit | ubiquity-slideshow-ubuntu before 58.2, during installation, allows remote man-in-the-middle attackers to execute arbitrary web script or HTML and read arbitrary files via a crafted attribute in the <a> tag of a Twitter feed. |
| CVE-2012-0419 | Medium | 2012-09-28 | Not applicable | No public exploit | Directory traversal vulnerability in the agent HTTP interfaces in Novell GroupWise 8.0 before Support Pack 3 and 2012 before Support Pack 1 allows remote attackers to read arbitrary files via directory traversal sequences in a request. |
| CVE-2012-5164 | Medium | 2012-09-26 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in Fork CMS before 3.2.7 allow remote attackers to inject arbitrary web script or HTML via the term parameter to (1) autocomplete.php, (2) search/ajax/autosuggest.php, (3) livesuggest.php, or (4) save.php in frontend/modules/search/ajax. |
| CVE-2012-5163 | Medium | 2012-09-26 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in oc-admin/ajax/ajax.php in OSClass before 2.3.5 allows remote attackers to inject arbitrary web script or HTML via the id parameter in an enable_category action to index.php. |
| CVE-2012-5162 | Medium | 2012-09-26 | Not applicable | No public exploit | Multiple SQL injection vulnerabilities in oc-admin/ajax/ajax.php in OSClass before 2.3.5 allow remote attackers to execute arbitrary SQL commands via the id parameter in a (1) edit_category_post or (2) enable_category action to index.php. |
| CVE-2012-2895 | Medium | 2012-09-26 | Not applicable | No public exploit | The PDF functionality in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger out-of-bounds write operations. |
| CVE-2012-2894 | Medium | 2012-09-26 | Not applicable | No public exploit | Google Chrome before 22.0.1229.79 does not properly handle graphics-context data structures, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via unknown vectors. |
| CVE-2012-2893 | Medium | 2012-09-26 | Not applicable | No public exploit | Double free vulnerability in libxslt, as used in Google Chrome before 22.0.1229.79, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to XSL transforms. |
| CVE-2012-2892 | Medium | 2012-09-26 | Not applicable | No public exploit | Unspecified vulnerability in Google Chrome before 22.0.1229.79 allows remote attackers to bypass the pop-up blocker via unknown vectors. |
| CVE-2012-2891 | Medium | 2012-09-26 | Not applicable | No public exploit | The IPC implementation in Google Chrome before 22.0.1229.79 allows attackers to obtain potentially sensitive information about memory addresses via unspecified vectors. |
| CVE-2012-2890 | Medium | 2012-09-26 | Not applicable | No public exploit | Use-after-free vulnerability in the PDF functionality in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document. |
| CVE-2012-2889 | Medium | 2012-09-26 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Google Chrome before 22.0.1229.79 allows remote attackers to inject arbitrary web script or HTML via vectors involving frames, aka "Universal XSS (UXSS)." |
| CVE-2012-2886 | Medium | 2012-09-26 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Google Chrome before 22.0.1229.79 allows remote attackers to inject arbitrary web script or HTML via vectors related to the Google V8 bindings, aka "Universal XSS (UXSS)." |
| CVE-2012-2884 | Medium | 2012-09-26 | Not applicable | No public exploit | Skia, as used in Google Chrome before 22.0.1229.79, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors. |
| CVE-2012-2882 | Medium | 2012-09-26 | Not applicable | No public exploit | FFmpeg, as used in Google Chrome before 22.0.1229.79, does not properly handle OGG containers, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors, related to a "wild pointer" issue. |
| CVE-2012-2879 | Medium | 2012-09-26 | Not applicable | No public exploit | Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service (DOM topology corruption) via a crafted document. |
| CVE-2012-2877 | Medium | 2012-09-26 | Not applicable | No public exploit | The extension system in Google Chrome before 22.0.1229.79 does not properly handle modal dialogs, which allows remote attackers to cause a denial of service (application crash) via unspecified vectors. |
| CVE-2012-2875 | Medium | 2012-09-26 | Not applicable | No public exploit | Multiple unspecified vulnerabilities in the PDF functionality in Google Chrome before 22.0.1229.79 allow remote attackers to have an unknown impact via a crafted document. |
| CVE-2012-1617 | Medium | 2012-09-26 | Not applicable | Working exploit published | Directory traversal vulnerability in combine.php in OSClass before 2.3.6 allows remote attackers to read and write arbitrary files via a .. (dot dot) in the type parameter. NOTE: this vulnerability can be leveraged to upload arbitrary files. |
| CVE-2012-1188 | Medium | 2012-09-26 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in Fork CMS before 3.2.7 allow remote attackers to inject arbitrary web script or HTML via the (1) type or (2) querystring parameters to private/en/error or (3) name parameter to private/en/locale/index. |
| CVE-2012-1117 | Medium | 2012-09-26 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Joomla! 2.5.0 and 2.5.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2012-4015 | Medium | 2012-09-25 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the management screen in myLittleTools myLittleAdmin for SQL Server 2000 allows remote attackers to inject arbitrary web script or HTML via vectors that trigger a crafted database entry. |
| CVE-2012-3306 | Medium | 2012-09-25 | No exploit published | No public exploit | IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.45, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1, when multi-domain support is configured, does not purge password data from the authentication cache, which has unspecified impact and remote attack vectors. |
| CVE-2012-3305 | Medium | 2012-09-25 | Protected by Waratek | No public exploit | Directory traversal vulnerability in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1 allows remote attackers to overwrite arbitrary files via a crafted application file. |
| CVE-2012-3304 | Medium | 2012-09-25 | No exploit published | No public exploit | The Administrative Console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.45, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1 allows remote attackers to hijack sessions via unspecified vectors. |
| CVE-2012-3037 | Medium | 2012-09-25 | Not applicable | No public exploit | The Siemens SIMATIC S7-1200 2.x PLC does not properly protect the private key of the SIMATIC CONTROLLER Certification Authority certificate, which allows remote attackers to spoof the S7-1200 web server by using this key to create a forged certificate. |
| CVE-2012-2199 | Medium | 2012-09-25 | Not applicable | No public exploit | The server message channel agent in the queue manager in the server in IBM WebSphere MQ 7.0.1 before 7.0.1.9, 7.1, and 7.5 on Solaris allows remote attackers to cause a denial of service (invalid address alignment exception and daemon crash) via vectors involving a multiplexed channel. |
| CVE-2012-2187 | Medium | 2012-09-25 | Not applicable | No public exploit | IBM Remote Supervisor Adapter II firmware for System x3650, x3850 M2, and x3950 M2 1.13 and earlier generates weak RSA keys, which makes it easier for attackers to defeat cryptographic protection mechanisms via unspecified vectors. |
| CVE-2012-1646 | Medium | 2012-09-25 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in the FAQ module 6.x-1.x before 6.x-1.13 and 7.x-1.x-rc1 for Drupal allow remote authenticated users to inject arbitrary web script or HTML via the (1) title parameter in faq.admin.inc or (2) detailed_question parameter in faq.module. |
| CVE-2012-1293 | Medium | 2012-09-25 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in fup in Frams' Fast File EXchange (F*EX, aka fex) before 20111129-2 allow remote attackers to inject arbitrary web script or HTML via the (1) to or (2) from parameters. |
| CVE-2012-1103 | Medium | 2012-09-25 | Not applicable | No public exploit | emacs/notmuch-mua.el in Notmuch before 0.11.1, when using the Emacs interface, allows user-assisted remote attackers to read arbitrary files via crafted MML tags, which are not properly quoted in an email reply cna cause the files to be attached to the message. |
| CVE-2012-0974 | Medium | 2012-09-25 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in the getParam function in oc-includes/osclass/core/Params.php in OSClass before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via the (1) sCity, (2) sPattern, (3) sPriceMax, and (4) sPriceMin parameters in a search action to index.php. |
| CVE-2012-0869 | Medium | 2012-09-25 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in fup in Frams' Fast File EXchange (F*EX, aka fex) before 20120215 allows remote attackers to inject arbitrary web script or HTML via the id parameter. |
| CVE-2012-3451 | Medium | 2012-09-24 | No exploit published | No public exploit | Apache CXF before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to execute unintended web-service operations by sending a header with a SOAP Action String that is inconsistent with the message body. |
| CVE-2012-5105 | Medium | 2012-09-23 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in SQLiteManager 1.2.4 allow remote attackers to inject arbitrary web script or HTML via the dbsel parameter to (1) main.php or (2) index.php; or (3) nsextt parameter to index.php. |
| CVE-2012-5104 | Medium | 2012-09-23 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in forums/ubbthreads.php in UBB.threads 7.5.6 and earlier allows remote attackers to inject arbitrary web script or HTML via the Loginname parameter. |
| CVE-2012-5103 | Medium | 2012-09-23 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in action/add-submit.php in Ggb Guestbook 0.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) url or (2) message parameter. |
| CVE-2012-5102 | Medium | 2012-09-23 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in inc/extensions.php in VertrigoServ 2.25 allows remote attackers to inject arbitrary web script or HTML via the ext parameter. |
| CVE-2012-5100 | Medium | 2012-09-23 | Not applicable | Working exploit published | Directory traversal vulnerability in HServer 0.1.1 allows remote attackers to read arbitrary files via a (1) ..%5c (dot dot encoded backslash) or (2) %2e%2e%5c (encoded dot dot backslash) in the PATH_INFO. |
| CVE-2012-5099 | Medium | 2012-09-23 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in list.php in PHPB2B 4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the q parameter in a search action. |
| CVE-2011-5199 | Medium | 2012-09-23 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in sign.php in tinyguestbook allows remote attackers to inject arbitrary web script or HTML via the msg parameter. |
| CVE-2011-5197 | Medium | 2012-09-23 | Not applicable | Working exploit published | Cross-site request forgery (CSRF) vulnerability in index/manager/fileUpload in Public Knowledge Project Open Harvester Systems 2.3.1 and earlier allows remote attackers to hijack the authentication of administrators for requests that upload PHP files. |
| CVE-2011-5196 | Medium | 2012-09-23 | Not applicable | Working exploit published | Cross-site request forgery (CSRF) vulnerability in index/manager/fileUpload in Public Knowledge Project Open Journal Systems 2.3.6 and earlier allows remote attackers to hijack the authentication of administrators for requests that upload PHP files. |
| CVE-2011-5195 | Medium | 2012-09-23 | Not applicable | Working exploit published | Cross-site request forgery (CSRF) vulnerability in index/manager/fileUpload in Public Knowledge Project Open Conference Systems 2.3.4 and earlier allows remote attackers to hijack the authentication of administrators for requests that upload a PHP file. |
| CVE-2011-5194 | Medium | 2012-09-23 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search plugin before 1.4.2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the domain parameter, a different vulnerability than CVE-2011-5193. |
| CVE-2011-5192 | Medium | 2012-09-23 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in pretty-bar.php in Pretty Link Lite plugin before 1.5.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the slug parameter, a different vulnerability than CVE-2011-5191. |
| CVE-2011-5191 | Medium | 2012-09-23 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in pretty-bar.php in Pretty Link Lite plugin before 1.5.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the slug parameter, a different vulnerability than CVE-2011-5192. |
| CVE-2012-3137 | Medium | 2012-09-21 | Outside Waratek scope | Working exploit published | The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote attackers to obtain the session key and salt for arbitrary users, which leaks information about the cryptographic hash and makes it easier to conduct brute force password guessing attacks, aka "stealth password cracking vulnerability." |
| CVE-2012-5007 | Medium | 2012-09-20 | Not applicable | No public exploit | The Fill PDF module 7.x-1.x before 7.x-1.2 for Drupal allows remote attackers to write to arbitrary PDF files via unspecified vectors related to the fillpdf_merge_pdf function and incorrect arguments, a different vulnerability than CVE-2012-1625. NOTE: some of these details are obtained from third party information. |
| CVE-2012-3747 | Medium | 2012-09-20 | Not applicable | No public exploit | WebKit, as used in Apple iOS before 6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. |
| CVE-2012-3746 | Medium | 2012-09-20 | Not applicable | No public exploit | UIWebView in UIKit in Apple iOS before 6 does not properly use the Data Protection feature, which allows context-dependent attackers to obtain cleartext file content by leveraging direct access to a device's filesystem. |
| CVE-2012-3745 | Medium | 2012-09-20 | Not applicable | No public exploit | Off-by-one error in Telephony in Apple iOS before 6 allows remote attackers to cause a denial of service (buffer overflow and connectivity outage) via a crafted user-data header in an SMS message. |
| CVE-2012-3744 | Medium | 2012-09-20 | Not applicable | No public exploit | Telephony in Apple iOS before 6 uses an SMS message's return address as the displayed sender address, which allows remote attackers to spoof text communication via a message in which the return address does not match the originating address. |
| CVE-2012-3743 | Medium | 2012-09-20 | Not applicable | No public exploit | The System Logs implementation in Apple iOS before 6 does not restrict /var/log access by sandboxed apps, which allows remote attackers to obtain sensitive information via a crafted app that reads log files. |
| CVE-2012-3742 | Medium | 2012-09-20 | Not applicable | No public exploit | Safari in Apple iOS before 6 does not properly restrict use of an unspecified Unicode character that looks similar to the https lock indicator, which allows remote attackers to spoof https connections by placing this character in the TITLE element of a web page. |
| CVE-2012-3736 | Medium | 2012-09-20 | Not applicable | No public exploit | The Passcode Lock implementation in Apple iOS before 6 allows physically proximate attackers to bypass an intended passcode requirement via vectors related to ending a FaceTime call. |
| CVE-2012-3733 | Medium | 2012-09-20 | Not applicable | No public exploit | Messages in Apple iOS before 6, when multiple iMessage e-mail addresses are configured, does not ensure that a reply's sender address matches the recipient address of the original message, which allows remote attackers to obtain potentially sensitive information about alternate e-mail addresses in opportunistic circumstances by reading a reply. |
| CVE-2012-3732 | Medium | 2012-09-20 | Not applicable | No public exploit | Mail in Apple iOS before 6 uses an S/MIME message's From address as the displayed sender address, which allows remote attackers to spoof signed content via an e-mail message in which the From field does not match the signer's identity. |
| CVE-2012-3730 | Medium | 2012-09-20 | Not applicable | No public exploit | Mail in Apple iOS before 6 does not properly handle reuse of Content-ID header values, which allows remote attackers to spoof attachments via a header value that was also used in a previous e-mail message, as demonstrated by a message from a different sender. |
| CVE-2012-3728 | Medium | 2012-09-20 | Not applicable | No public exploit | The kernel in Apple iOS before 6 dereferences invalid pointers during the handling of packet-filter data structures, which allows local users to gain privileges via a crafted program that makes packet-filter ioctl calls. |
| CVE-2012-3727 | Medium | 2012-09-20 | Not applicable | No public exploit | Buffer overflow in the IPsec component in Apple iOS before 6 allows remote attackers to execute arbitrary code via a crafted racoon configuration file. |
| CVE-2012-3726 | Medium | 2012-09-20 | Not applicable | No public exploit | Double free vulnerability in ImageIO in Apple iOS before 6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted JPEG image. |
| CVE-2012-3724 | Medium | 2012-09-20 | Not applicable | No public exploit | CFNetwork in Apple iOS before 6 does not properly identify the host portion of a URL, which allows remote attackers to obtain sensitive information by leveraging the construction of an HTTP request with an incorrect hostname derived from a malformed URL. |
| CVE-2012-3723 | Medium | 2012-09-20 | Not applicable | No public exploit | Apple Mac OS X before 10.7.5 does not properly handle the bNbrPorts field of a USB hub descriptor, which allows physically proximate attackers to execute arbitrary code or cause a denial of service (memory corruption and system crash) by attaching a USB device. |
| CVE-2012-3722 | Medium | 2012-09-20 | Not applicable | No public exploit | The Sorenson codec in QuickTime in Apple Mac OS X before 10.7.5, and in CoreMedia in iOS before 6, accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with Sorenson encoding. |
| CVE-2012-3721 | Medium | 2012-09-20 | Not applicable | No public exploit | Profile Manager in Apple Mac OS X before 10.7.5 does not properly perform authentication for the Device Management private interface, which allows attackers to enumerate managed devices via unspecified vectors. |
| CVE-2012-3720 | Medium | 2012-09-20 | Not applicable | No public exploit | Mobile Accounts in Apple Mac OS X before 10.7.5 and 10.8.x before 10.8.2 saves password hashes for external-account use even if external accounts are not enabled, which might allow remote attackers to determine passwords via unspecified access to a mobile account. |
| CVE-2012-3719 | Medium | 2012-09-20 | Not applicable | No public exploit | Mail in Apple Mac OS X before 10.7.5 does not properly handle embedded web plugins, which allows remote attackers to execute arbitrary plugin code via an e-mail message that triggers the loading of a third-party plugin. |
| CVE-2012-3715 | Medium | 2012-09-20 | Not applicable | No public exploit | Apple Safari before 6.0.1 makes http requests for https URIs in certain circumstances involving a paste into the address bar, which allows user-assisted remote attackers to obtain sensitive information by sniffing the network. |
| CVE-2012-3714 | Medium | 2012-09-20 | Not applicable | No public exploit | The Form Autofill feature in Apple Safari before 6.0.1 does not restrict the filled fields to the set of fields contained in an Autofill popover, which allows remote attackers to obtain the Me card from an Address Book via a crafted web site. |
| CVE-2012-3713 | Medium | 2012-09-20 | Not applicable | No public exploit | Apple Safari before 6.0.1 does not properly handle the Quarantine attribute of HTML documents, which allows user-assisted remote attackers to read arbitrary files by leveraging the presence of a downloaded document. |
| CVE-2012-1633 | Medium | 2012-09-20 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in the Password Policy module before 6.x-1.4 and 7.x-1.0 beta3 for Drupal allows remote attackers to hijack the authentication of administrative users for requests that unblock a user. |
| CVE-2012-1631 | Medium | 2012-09-20 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in the Admin:hover module for Drupal allows remote attackers to hijack the authentication of administrators for requests that unpublish all nodes, and possibly other actions, via unspecified vectors. |
| CVE-2012-1626 | Medium | 2012-09-20 | Not applicable | No public exploit | SQL injection vulnerability in the conversion form for Events in the Date module 6.x-2.x before 6.x-2.8 for Drupal allows remote authenticated users with the "administer Date Tools" privilege to execute arbitrary SQL commands via unspecified vectors. |
| CVE-2012-1625 | Medium | 2012-09-20 | Not applicable | No public exploit | Eval injection vulnerability in the fillpdf_form_export_decode function in fillpdf.admin.inc in the Fill PDF module 6.x-1.x before 6.x-1.16 and 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with administer PDFs privileges to execute arbitrary PHP code via unspecified vectors. NOTE: Some of these details are obtained from third party information. |
| CVE-2012-0988 | Medium | 2012-09-20 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in config/dmsDefaults.php in KnowledgeTree 3.7.0.2 and possibly earlier allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) login.php, (2) admin.php, or (3) preferences.php. |
| CVE-2011-5190 | Medium | 2012-09-20 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in Social Book Facebook Clone 2010 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO parameter to (1) signup.php, (2) lostpass.php, (3) login.php, (4) index.php, (5) help_tos.php, (6) help_contact.php, or (7) help.php. |
| CVE-2011-5186 | Medium | 2012-09-20 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in jbshop.php in the jbShop plugin for e107 7 allows remote attackers to inject arbitrary web script or HTML via the item_id parameter. |
| CVE-2011-5185 | Medium | 2012-09-20 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in video_comments.php in Online Subtitles Workshop before 2.0 rev 131 allows remote attackers to inject arbitrary web script or HTML via the comment parameter. |
| CVE-2011-5184 | Medium | 2012-09-20 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in HP Network Node Manager i 9.10 allow remote attackers to inject arbitrary web script or HTML via the (1) node parameter to nnm/mibdiscover; (2) nodename parameter to nnm/protected/configurationpoll.jsp, (3) nnm/protected/ping.jsp, (4) nnm/protected/statuspoll.jsp, or (5) nnm/protected/traceroute.jsp; or (6) field parameter to nmm/validate. NOTE: this might be a duplicate of CVE-2011-4155 or CVE-2011-4156. |
| CVE-2011-5182 | Medium | 2012-09-20 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in lanoba-social-plugin/index.php in the Lanoba Social plugin 1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter. NOTE: the vendor disputes this issue, stating "Lanoba's plug in does sanitize user input, and because that input is never sent to the browser, an attacker has no way of executing script or code on a user's behalf. |
| CVE-2011-5181 | Medium | 2012-09-20 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in clickdesk.php in ClickDesk Live Support - Live Chat plugin 2.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cdwidgetid parameter. NOTE: some of these details are obtained from third party information. |
| CVE-2011-5180 | Medium | 2012-09-20 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in wp-1pluginjquery.php in the ZooEffect plugin 1.01 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter. NOTE: some of these details are obtained from third party information. NOTE: this has been disputed by a third party. |