Overview 23,662 matches · 373 in Waratek scope · 20 protected · 322 exploited · 54 CISA KEV · 9,259 public PoC · 709 EPSS ≥ 0.5
23,662matches
373in Waratek scope1.6%
20protected0.1%
322exploited1.4%
54CISA KEV0.2%
9,259public PoC39.1%
709EPSS ≥ 0.53.0%
Protected by Waratek
20
0.1%
Rule in development
0
0.0%
Mitigation candidate
19
0.1%
No exploit published
334
1.4%
Outside Waratek scope
310
1.3%
Not applicable
22,979
97.1%
Withdrawn CVE
0
0.0%
blocked by ARMR today
20
0.1%
partly blocked
0
0.0%
not blocked
23,642
99.9%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 3,162 / year
19882
Not applicable2
High2
not blocked2
Working exploit published1
No public exploit1
19892
Not applicable2
High2
not blocked2
No public exploit2
19908
Not applicable8
High8
not blocked8
No public exploit8
199111
Not applicable11
High11
not blocked11
Working exploit published2
No public exploit9
199212
Not applicable12
High12
not blocked12
No public exploit12
19938
Not applicable8
High8
not blocked8
No public exploit8
199414
Not applicable14
High14
not blocked14
Working exploit published3
No public exploit11
199517
Not applicable17
High17
not blocked17
Working exploit published2
No public exploit15
199643
No exploit published1
Not applicable42
High43
not blocked43
Working exploit published12
Forecast only1
No public exploit30
1997143
Not applicable143
High143
not blocked143
Exploited2
Working exploit published51
No public exploit90
1998137
Not applicable137
High137
not blocked137
Exploited1
Working exploit published33
No public exploit103
1999423
No exploit published2
Not applicable421
High423
not blocked423
Exploited2
Working exploit published132
No public exploit289
2000454
Mitigation candidate2
No exploit published3
Outside Waratek scope2
Not applicable447
High454
not blocked454
Exploited3
Working exploit published197
Forecast only1
No public exploit253
2001776
Protected by Waratek1
No exploit published6
Outside Waratek scope5
Not applicable764
High776
blocked by ARMR today1
not blocked775
Exploited11
Working exploit published219
No public exploit546
20021,023
Protected by Waratek1
Mitigation candidate2
No exploit published8
Outside Waratek scope8
Not applicable1,004
High1,023
blocked by ARMR today1
not blocked1,022
Exploited9
Working exploit published276
Forecast only3
No public exploit735
2003674
Mitigation candidate2
No exploit published7
Outside Waratek scope4
Not applicable661
High674
not blocked674
Exploited10
Working exploit published236
No public exploit428
2004973
Protected by Waratek1
No exploit published5
Outside Waratek scope4
Not applicable963
High973
blocked by ARMR today1
not blocked972
Exploited10
Working exploit published302
No public exploit661
20052,048
No exploit published30
Outside Waratek scope10
Not applicable2,008
High2,048
not blocked2,048
Exploited11
Working exploit published658
Forecast only5
No public exploit1,374
20062,763
Protected by Waratek4
No exploit published62
Outside Waratek scope63
Not applicable2,634
High2,763
blocked by ARMR today4
not blocked2,759
Exploited26
Working exploit published1,197
Proof of concept only1
Forecast only4
No public exploit1,535
20073,162
Protected by Waratek3
Mitigation candidate1
No exploit published64
Outside Waratek scope26
Not applicable3,068
High3,162
blocked by ARMR today3
not blocked3,159
Exploited32
Working exploit published1,405
Proof of concept only1
Forecast only4
No public exploit1,720
20082,846
Protected by Waratek3
Mitigation candidate1
No exploit published42
Outside Waratek scope44
Not applicable2,756
High2,846
blocked by ARMR today3
not blocked2,843
Exploited33
Working exploit published1,492
Proof of concept only2
Forecast only8
No public exploit1,311
20092,734
Protected by Waratek3
Mitigation candidate4
No exploit published45
Outside Waratek scope26
Not applicable2,656
High2,734
blocked by ARMR today3
not blocked2,731
Exploited54
Working exploit published1,424
No public exploit1,256
20102,093
Protected by Waratek2
Mitigation candidate1
No exploit published24
Outside Waratek scope41
Not applicable2,025
High2,093
blocked by ARMR today2
not blocked2,091
Exploited53
Working exploit published730
Forecast only6
No public exploit1,304
20111,784
Protected by Waratek1
Mitigation candidate4
No exploit published15
Outside Waratek scope44
Not applicable1,720
High1,784
blocked by ARMR today1
not blocked1,783
Exploited38
Working exploit published380
Proof of concept only1
Forecast only2
No public exploit1,363
20121,512
Protected by Waratek1
Mitigation candidate2
No exploit published20
Outside Waratek scope33
Not applicable1,456
High1,512
blocked by ARMR today1
not blocked1,511
Exploited27
Working exploit published285
Proof of concept only3
Forecast only4
No public exploit1,193
1988199019921994199619982000200220042006200820102012
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2012-5692 | High | 2012-10-31 | Not applicable | Working exploit published | Unspecified vulnerability in admin/sources/base/core.php in Invision Power Board (aka IPB or IP.Board) 3.1.x through 3.3.x has unknown impact and remote attack vectors. |
| CVE-2012-0023 | High | 2012-10-30 | Not applicable | No public exploit | Double free vulnerability in the get_chunk_header function in modules/demux/ty.c in VideoLAN VLC media player 0.9.0 through 1.1.12 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TiVo (TY) file. |
| CVE-2012-4663 | High | 2012-10-29 | Not applicable | No public exploit | The DCERPC inspection engine on Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services Module (ASASM) in Cisco Catalyst 6500 series devices, with software 8.3 before 8.3(2.25), 8.4 before 8.4(2.5), and 8.5 before 8.5(1.13) and the Firewall Services Module (FWSM) 4.1 before 4.1(7) in Cisco Catalyst 6500 series switches and 7600 series routers allows remote attackers to cause a denial of service (device reload) via a crafted DCERPC packet, aka Bug IDs CSCtr21346 and CSCtr27521. |
| CVE-2012-4662 | High | 2012-10-29 | Not applicable | No public exploit | The DCERPC inspection engine on Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services Module (ASASM) in Cisco Catalyst 6500 series devices, with software 8.3 before 8.3(2.25), 8.4 before 8.4(2.5), and 8.5 before 8.5(1.13) and the Firewall Services Module (FWSM) 4.1 before 4.1(7) in Cisco Catalyst 6500 series switches and 7600 series routers allows remote attackers to cause a denial of service (device reload) via a crafted DCERPC packet, aka Bug IDs CSCtr21376 and CSCtr27524. |
| CVE-2012-4661 | High | 2012-10-29 | Not applicable | No public exploit | Stack-based buffer overflow in the DCERPC inspection engine on Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services Module (ASASM) in Cisco Catalyst 6500 series devices, with software 8.3 before 8.3(2.34), 8.4 before 8.4(4.4), 8.5 before 8.5(1.13), and 8.6 before 8.6(1.3) and the Firewall Services Module (FWSM) 4.1 before 4.1(9) in Cisco Catalyst 6500 series switches and 7600 series routers might allow remote attackers to execute arbitrary code via a crafted DCERPC packet, aka Bug IDs CSCtr21359 and CSCtr27522. |
| CVE-2012-4660 | High | 2012-10-29 | Not applicable | No public exploit | The SIP inspection engine on Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services Module (ASASM) in Cisco Catalyst 6500 series devices, with software 8.2 before 8.2(5.17), 8.3 before 8.3(2.28), 8.4 before 8.4(2.13), 8.5 before 8.5(1.4), and 8.6 before 8.6(1.5) allows remote attackers to cause a denial of service (device reload) via a crafted SIP media-update packet, aka Bug ID CSCtr63728. |
| CVE-2012-4659 | High | 2012-10-29 | Not applicable | No public exploit | The AAA functionality in the IPv4 SSL VPN implementations on Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services Module (ASASM) in Cisco Catalyst 6500 series devices, with software 8.2 before 8.2(5.30) and 8.3 before 8.3(2.34) allows remote attackers to cause a denial of service (device reload) via a crafted authentication response, aka Bug ID CSCtz04566. |
| CVE-2012-4643 | High | 2012-10-29 | Not applicable | No public exploit | The DHCP server on Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services Module (ASASM) in Cisco Catalyst 6500 series devices, with software 7.0 before 7.2(5.8), 7.1 before 7.2(5.8), 7.2 before 7.2(5.8), 8.0 before 8.0(5.28), 8.1 before 8.1(2.56), 8.2 before 8.2(5.27), 8.3 before 8.3(2.31), 8.4 before 8.4(3.10), 8.5 before 8.5(1.9), and 8.6 before 8.6(1.5) does not properly allocate memory for DHCP packets, which allows remote attackers to cause a denial of service (device reload) via a series of crafted IPv4 packets, aka Bug ID CSCtw84068. |
| CVE-2012-4501 | High | 2012-10-26 | Not applicable | No public exploit | Citrix Cloud.com CloudStack, and Apache CloudStack pre-release, allows remote attackers to make arbitrary API calls by leveraging the system user account, as demonstrated by API calls to delete VMs. |
| CVE-2012-3941 | High | 2012-10-25 | Not applicable | No public exploit | Heap-based buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 before LD SP32 EP10 and T28 before T28.4 allows remote attackers to execute arbitrary code via a crafted WRF file, aka Bug ID CSCtz72850. |
| CVE-2012-3940 | High | 2012-10-25 | Not applicable | No public exploit | Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 before LD SP32 EP10 and T28 before T28.4 allows remote attackers to execute arbitrary code via a crafted WRF file, aka Bug ID CSCtz72958. |
| CVE-2012-3939 | High | 2012-10-25 | Not applicable | No public exploit | Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 before LD SP32 EP10 and T28 before T28.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted WRF file, aka Bug ID CSCua61331. |
| CVE-2012-3938 | High | 2012-10-25 | Not applicable | No public exploit | Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 before LD SP32 EP10 and T28 before T28.4 allows remote attackers to execute arbitrary code via a crafted WRF file, aka Bug ID CSCtz73583. |
| CVE-2012-3937 | High | 2012-10-25 | Not applicable | No public exploit | Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 before LD SP32 EP10 and T28 before T28.4 allows remote attackers to execute arbitrary code via a crafted WRF file, aka Bug ID CSCtz72967. |
| CVE-2012-3936 | High | 2012-10-25 | Not applicable | No public exploit | Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 before LD SP32 EP10 and T28 before T28.4 allows remote attackers to execute arbitrary code via a crafted WRF file, aka Bug ID CSCua40962. |
| CVE-2012-3506 | High | 2012-10-25 | Not applicable | No public exploit | Unspecified vulnerability in the Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.03 has unknown impact and attack vectors. |
| CVE-2011-5235 | High | 2012-10-25 | Not applicable | No public exploit | SQL injection vulnerability in mnoGoSearch before 3.3.12 allows remote attackers to execute arbitrary SQL commands via the hostname in a hypertext link. |
| CVE-2011-5234 | High | 2012-10-25 | Not applicable | No public exploit | SQL injection vulnerability in user.php in Social Network Community 2 allows remote attackers to execute arbitrary SQL commands via the userId parameter. |
| CVE-2011-5230 | High | 2012-10-25 | Not applicable | Working exploit published | Multiple SQL injection vulnerabilities in the selectUserIdByLoginPass function in seotoaster_core/application/models/LoginModel.php in Seotoaster 1.9 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) login parameter to sys/login/index or (2) memberLoginName parameter to sys/login/member. |
| CVE-2011-5229 | High | 2012-10-25 | Not applicable | Working exploit published | SQL injection vulnerability in quickstart/profile/index.php in the Forum module in appRain CMF 0.1.5 allows remote attackers to execute arbitrary SQL commands via the PATH_INFO. |
| CVE-2011-5227 | High | 2012-10-25 | Not applicable | Working exploit published | Stack-based buffer overflow in the Syslog service (nssyslogd.exe) in Enterasys Network Management Suite (NMS) before 4.1.0.80 allows remote attackers to execute arbitrary code via a long PRIO field in a message to UDP port 514. |
| CVE-2011-5224 | High | 2012-10-25 | Not applicable | No public exploit | SQL injection vulnerability in the Sentinel plugin 1.0.0 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors. |
| CVE-2011-5222 | High | 2012-10-25 | Not applicable | Working exploit published | SQL injection vulnerability in rub2_w.php in PHP Flirt-Projekt 4.8 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the rub parameter. |
| CVE-2011-5218 | High | 2012-10-25 | Not applicable | Working exploit published | SQL injection vulnerability in DotA OpenStats 1.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php. |
| CVE-2011-5216 | High | 2012-10-25 | Not applicable | No public exploit | SQL injection vulnerability in ajax.php in SCORM Cloud For WordPress plugin before 1.0.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the active parameter. NOTE: some of these details are obtained from third party information. |
| CVE-2011-5215 | High | 2012-10-25 | Not applicable | No public exploit | SQL injection vulnerability in index.php in Video Community Portal allows remote attackers to execute arbitrary SQL commands via the id parameter. |
| CVE-2011-5213 | High | 2012-10-25 | Not applicable | Working exploit published | Multiple SQL injection vulnerabilities in BrowserCRM 5.100.01 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) login[username] parameter to index.php, (2) parent_id parameter to modules/Documents/version_list.php, or (3) contact_id parameter to modules/Documents/index.php. |
| CVE-2012-5302 | High | 2012-10-24 | Not applicable | No public exploit | The server in TIBCO Formvine 3.1.x and 3.2.x before 3.2.1 does not properly implement access control, which allows remote attackers to obtain sensitive information or modify data via unspecified vectors. |
| CVE-2012-5273 | High | 2012-10-23 | Not applicable | No public exploit | Buffer overflow in Adobe Shockwave Player before 11.6.8.638 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2012-4172, CVE-2012-4173, CVE-2012-4174, and CVE-2012-4175. |
| CVE-2012-4176 | High | 2012-10-23 | Not applicable | No public exploit | Array index error in Adobe Shockwave Player before 11.6.8.638 allows attackers to execute arbitrary code via unspecified vectors. |
| CVE-2012-4175 | High | 2012-10-23 | Not applicable | No public exploit | Buffer overflow in Adobe Shockwave Player before 11.6.8.638 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2012-4172, CVE-2012-4173, CVE-2012-4174, and CVE-2012-5273. |
| CVE-2012-4174 | High | 2012-10-23 | Not applicable | No public exploit | Buffer overflow in Adobe Shockwave Player before 11.6.8.638 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2012-4172, CVE-2012-4173, CVE-2012-4175, and CVE-2012-5273. |
| CVE-2012-4173 | High | 2012-10-23 | Not applicable | No public exploit | Buffer overflow in Adobe Shockwave Player before 11.6.8.638 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2012-4172, CVE-2012-4174, CVE-2012-4175, and CVE-2012-5273. |
| CVE-2012-4172 | High | 2012-10-23 | Not applicable | No public exploit | Buffer overflow in Adobe Shockwave Player before 11.6.8.638 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2012-4173, CVE-2012-4174, CVE-2012-4175, and CVE-2012-5273. |
| CVE-2012-5168 | High | 2012-10-22 | Not applicable | No public exploit | ATutor AContent before 1.2-1 allows remote attackers to modify arbitrary user passwords or category names via a direct request to (1) user/index_inline_editor_submit.php or (2) course_category/index_inline_editor_submit.php. |
| CVE-2012-5167 | High | 2012-10-22 | Not applicable | Working exploit published | Multiple SQL injection vulnerabilities in ATutor AContent before 1.2-1 allow remote attackers to execute arbitrary SQL commands via the (1) field parameter to course_category/index_inline_editor_submit.php or (2) user/index_inline_editor_submit.php; or (3) id parameter to user/user_password.php. |
| CVE-2012-4990 | High | 2012-10-22 | Not applicable | No public exploit | SQL injection vulnerability in admin/campaign-zone-link.php in OpenX 2.8.10 before revision 81823 allows remote attackers to execute arbitrary SQL commands via the ids[] parameter in a link action. |
| CVE-2012-4772 | High | 2012-10-22 | Not applicable | Working exploit published | SQL injection vulnerability in register/ in Subrion CMS before 2.2.3 allows remote attackers to execute arbitrary SQL commands via the plan_id parameter. |
| CVE-2012-4232 | High | 2012-10-22 | Not applicable | No public exploit | SQL injection vulnerability in admin/index.php in jCore before 1.0pre2 allows remote attackers to execute arbitrary SQL commands via the memberloginid cookie. |
| CVE-2012-3001 | High | 2012-10-22 | Not applicable | Working exploit published | Mutiny Standard before 4.5-1.12 allows remote attackers to execute arbitrary commands via the network-interface menu, related to a "command injection vulnerability." |
| CVE-2011-5212 | High | 2012-10-22 | Not applicable | Working exploit published | SQL injection vulnerability in admin/index.php in Subrion CMS 2.0.4 allows remote attackers to execute arbitrary SQL commands via the (1) user name or (2) password field. |
| CVE-2012-4933 | High | 2012-10-20 | Not applicable | No public exploit | The rtrlet web application in the Web Console in Novell ZENworks Asset Management (ZAM) 7.5 uses a hard-coded username of Ivanhoe and a hard-coded password of Scott for the (1) GetFile_Password and (2) GetConfigInfo_Password operations, which allows remote attackers to obtain sensitive information via a crafted rtrlet/rtr request for the HandleMaintenanceCalls function. |
| CVE-2012-4826 | High | 2012-10-20 | Not applicable | No public exploit | Stack-based buffer overflow in the SQL/PSM (aka SQL Persistent Stored Module) Stored Procedure (SP) infrastructure in IBM DB2 9.1, 9.5, 9.7 before FP7, 9.8, and 10.1 might allow remote authenticated users to execute arbitrary code by debugging a stored procedure. |
| CVE-2012-2971 | High | 2012-10-20 | Not applicable | No public exploit | The server in CA ARCserve Backup r12.5, r15, and r16 on Windows does not properly process RPC requests, which allows remote attackers to execute arbitrary code or cause a denial of service via a crafted request. |
| CVE-2012-2167 | High | 2012-10-20 | Not applicable | No public exploit | The IBM XIV Storage System Gen3 before 11.1.0.a allows remote attackers to cause a denial of service (device outage) via TCP packets to unspecified ports. |
| CVE-2012-2290 | High | 2012-10-18 | Not applicable | No public exploit | The client in EMC NetWorker Module for Microsoft Applications (NMM) 2.2.1, 2.3 before build 122, and 2.4 before build 375 allows remote attackers to execute arbitrary code by sending a crafted message over a TCP communication channel. |
| CVE-2012-3210 | High | 2012-10-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle Sun Solaris 11 allows remote attackers to affect availability via unknown vectors related to Kernel. |
| CVE-2012-3204 | High | 2012-10-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Power Management. |
| CVE-2012-3202 | High | 2012-10-17 | No exploit published | No public exploit | Multiple unspecified vulnerabilities in the Oracle JRockit component in Oracle Fusion Middleware 28.2.4 and earlier, and 27.7.3 and earlier, when using JDK/JRE 5 or 6, allow remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: this overlaps CVE-2012-5083, CVE-2012-1531, CVE-2012-5081, and CVE-2012-5085. |
| CVE-2012-3199 | High | 2012-10-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle Sun Solaris 10 and 11 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Gnome Trusted Extension. |
| CVE-2012-3189 | High | 2012-10-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle Sun Solaris 11 allows remote attackers to affect availability, related to COMSTAR. |
| CVE-2012-3163 | High | 2012-10-17 | Not applicable | No public exploit | Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.64 and earlier, and 5.5.26 and earlier, allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Information Schema. |
| CVE-2012-5089 | High | 2012-10-16 | Outside Waratek scope | No public exploit | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, and 5.0 Update 36 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to JMX, a different vulnerability than CVE-2012-3143. |
| CVE-2012-5088 | High | 2012-10-16 | Outside Waratek scope | Working exploit published | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. |
| CVE-2012-5087 | High | 2012-10-16 | Outside Waratek scope | No public exploit | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Beans. |
| CVE-2012-5086 | High | 2012-10-16 | Outside Waratek scope | No public exploit | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Beans. |
| CVE-2012-5084 | High | 2012-10-16 | Outside Waratek scope | No public exploit | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Swing. |
| CVE-2012-5083 | High | 2012-10-16 | Outside Waratek scope | No public exploit | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, 1.4.2_38 and earlier, and JavaFX 2.2 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. |
| CVE-2012-5080 | High | 2012-10-16 | Outside Waratek scope | No public exploit | Unspecified vulnerability in the JavaFX component in Oracle Java SE JavaFX 2.2 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2012-5078. |
| CVE-2012-5078 | High | 2012-10-16 | Outside Waratek scope | No public exploit | Unspecified vulnerability in the JavaFX component in Oracle Java SE JavaFX 2.2 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2012-5080. |
| CVE-2012-5068 | High | 2012-10-16 | Outside Waratek scope | No public exploit | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. |
| CVE-2012-3159 | High | 2012-10-16 | Outside Waratek scope | No public exploit | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2012-1533. |
| CVE-2012-3158 | High | 2012-10-16 | Not applicable | No public exploit | Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.64 and earlier, and 5.5.26 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Protocol. |
| CVE-2012-3143 | High | 2012-10-16 | Outside Waratek scope | No public exploit | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, and 5.0 Update 36 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to JMX, a different vulnerability than CVE-2012-5089. |
| CVE-2012-1533 | High | 2012-10-16 | Outside Waratek scope | Working exploit published | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2012-3159. |
| CVE-2012-1532 | High | 2012-10-16 | Outside Waratek scope | No public exploit | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier and 6 Update 35 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. |
| CVE-2012-1531 | High | 2012-10-16 | Outside Waratek scope | No public exploit | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier; and JavaFX 2.2 and earlier; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. |
| CVE-2012-4191 | High | 2012-10-12 | Not applicable | No public exploit | The mozilla::net::FailDelayManager::Lookup function in the WebSockets implementation in Mozilla Firefox before 16.0.1, Thunderbird before 16.0.1, and SeaMonkey before 2.13.1 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors. |
| CVE-2012-4190 | High | 2012-10-12 | Not applicable | No public exploit | The FT2FontEntry::CreateFontEntry function in FreeType, as used in the Android build of Mozilla Firefox before 16.0.1 on CyanogenMod 10, allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors. |
| CVE-2012-0227 | High | 2012-10-12 | Not applicable | No public exploit | Buffer overflow in the VSFlex7.VSFlexGrid ActiveX control in ComponentOne FlexGrid 7.1, as used in Open Automation Software OPC Systems.NET, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long archive file name argument to the Archive method. |
| CVE-2012-5385 | High | 2012-10-11 | Not applicable | No public exploit | install/index.php in Craig Knudsen WebCalendar before 1.2.5 allows remote attackers to modify settings.php and possibly execute arbitrary code via vectors related to the user theme preference. |
| CVE-2012-5379 | High | 2012-10-11 | Not applicable | Working exploit published | Untrusted search path vulnerability in the installation functionality in ActivePython 3.2.2.3, when installed in the top-level C:\ directory, might allow local users to gain privileges via a Trojan horse DLL in the C:\Python27 or C:\Python27\Scripts directory, which may be added to the PATH system environment variable by an administrator, as demonstrated by a Trojan horse wlbsctrl.dll file used by the "IKE and AuthIP IPsec Keying Modules" system service in Windows Vista SP1, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8 Release Preview. NOTE: CVE disputes this issue because the unsafe PATH is established only by a separate administrative action that is not a default part of the ActivePython installation |
| CVE-2012-5112 | High | 2012-10-11 | Not applicable | No public exploit | Use-after-free vulnerability in the SVG implementation in WebKit, as used in Google Chrome before 22.0.1229.94, allows remote attackers to execute arbitrary code via unspecified vectors. |
| CVE-2012-5166 | High | 2012-10-10 | Not applicable | No public exploit | ISC BIND 9.x before 9.7.6-P4, 9.8.x before 9.8.3-P4, 9.9.x before 9.9.1-P4, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P4 allows remote attackers to cause a denial of service (named daemon hang) via unspecified combinations of resource records. |
| CVE-2012-4188 | High | 2012-10-10 | Not applicable | No public exploit | Heap-based buffer overflow in the Convolve3x3 function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors. |
| CVE-2012-4187 | High | 2012-10-10 | Not applicable | No public exploit | Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 do not properly manage a certain insPos variable, which allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption and assertion failure) via unspecified vectors. |
| CVE-2012-4186 | High | 2012-10-10 | Not applicable | No public exploit | Heap-based buffer overflow in the nsWaveReader::DecodeAudioData function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors. |
| CVE-2012-4185 | High | 2012-10-10 | Not applicable | No public exploit | Buffer overflow in the nsCharTraits::length function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors. |
| CVE-2012-4183 | High | 2012-10-10 | Not applicable | No public exploit | Use-after-free vulnerability in the DOMSVGTests::GetRequiredFeatures function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors. |
| CVE-2012-4182 | High | 2012-10-10 | Not applicable | No public exploit | Use-after-free vulnerability in the nsTextEditRules::WillInsert function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors. |
| CVE-2012-4181 | High | 2012-10-10 | Not applicable | No public exploit | Use-after-free vulnerability in the nsSMILAnimationController::DoSample function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors. |
| CVE-2012-4180 | High | 2012-10-10 | Not applicable | No public exploit | Heap-based buffer overflow in the nsHTMLEditor::IsPrevCharInNodeWhitespace function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors. |
| CVE-2012-4179 | High | 2012-10-10 | Not applicable | No public exploit | Use-after-free vulnerability in the nsHTMLCSSUtils::CreateCSSPropertyTxn function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors. |
| CVE-2012-3995 | High | 2012-10-10 | Not applicable | No public exploit | The IsCSSWordSpacingSpace function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via unspecified vectors. |
| CVE-2012-3993 | High | 2012-10-10 | Not applicable | Working exploit published | The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 does not properly interact with failures of InstallTrigger methods, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site, related to an "XrayWrapper pollution" issue. |
| CVE-2012-3991 | High | 2012-10-10 | Not applicable | No public exploit | Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 do not properly restrict JSAPI access to the GetProperty function, which allows remote attackers to bypass the Same Origin Policy and possibly have unspecified other impact via a crafted web site. |
| CVE-2012-3990 | High | 2012-10-10 | Not applicable | No public exploit | Use-after-free vulnerability in the IME State Manager implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors, related to the nsIContent::GetNameSpaceID function. |
| CVE-2012-3989 | High | 2012-10-10 | Not applicable | No public exploit | Mozilla Firefox before 16.0, Thunderbird before 16.0, and SeaMonkey before 2.13 do not properly perform a cast of an unspecified variable during use of the instanceof operator on a JavaScript object, which allows remote attackers to execute arbitrary code or cause a denial of service (assertion failure) via a crafted web site. |
| CVE-2012-3988 | High | 2012-10-10 | Not applicable | No public exploit | Use-after-free vulnerability in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 might allow user-assisted remote attackers to execute arbitrary code via vectors involving use of mozRequestFullScreen to enter full-screen mode, and use of the history.back method for backwards history navigation. |
| CVE-2012-3983 | High | 2012-10-10 | Not applicable | No public exploit | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 16.0, Thunderbird before 16.0, and SeaMonkey before 2.13 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. |
| CVE-2012-3982 | High | 2012-10-10 | Not applicable | No public exploit | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. |
| CVE-2012-5347 | High | 2012-10-09 | Not applicable | Working exploit published | TinyWebGallery 1.8.3 allows remote attackers to execute arbitrary code via shell metacharacters in the command parameter to (1) inc/filefunctions.inc or (2) info.php. |
| CVE-2012-5342 | High | 2012-10-09 | Not applicable | Working exploit published | Multiple SQL injection vulnerabilities in SenseSites CommonSense CMS allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) special.php, (2) article.php, or (3) cat2.php. |
| CVE-2012-5272 | High | 2012-10-09 | Not applicable | No public exploit | Adobe Flash Player before 10.3.183.29 and 11.x before 11.4.402.287 on Windows and Mac OS X, before 10.3.183.29 and 11.x before 11.2.202.243 on Linux, before 11.1.111.19 on Android 2.x and 3.x, and before 11.1.115.20 on Android 4.x; Adobe AIR before 3.4.0.2710; and Adobe AIR SDK before 3.4.0.2710 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than other Flash Player memory corruption CVEs listed in APSB12-22. |
| CVE-2012-5271 | High | 2012-10-09 | Not applicable | No public exploit | Adobe Flash Player before 10.3.183.29 and 11.x before 11.4.402.287 on Windows and Mac OS X, before 10.3.183.29 and 11.x before 11.2.202.243 on Linux, before 11.1.111.19 on Android 2.x and 3.x, and before 11.1.115.20 on Android 4.x; Adobe AIR before 3.4.0.2710; and Adobe AIR SDK before 3.4.0.2710 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than other Flash Player memory corruption CVEs listed in APSB12-22. |
| CVE-2012-5270 | High | 2012-10-09 | Not applicable | No public exploit | Adobe Flash Player before 10.3.183.29 and 11.x before 11.4.402.287 on Windows and Mac OS X, before 10.3.183.29 and 11.x before 11.2.202.243 on Linux, before 11.1.111.19 on Android 2.x and 3.x, and before 11.1.115.20 on Android 4.x; Adobe AIR before 3.4.0.2710; and Adobe AIR SDK before 3.4.0.2710 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than other Flash Player memory corruption CVEs listed in APSB12-22. |
| CVE-2012-5269 | High | 2012-10-09 | Not applicable | No public exploit | Adobe Flash Player before 10.3.183.29 and 11.x before 11.4.402.287 on Windows and Mac OS X, before 10.3.183.29 and 11.x before 11.2.202.243 on Linux, before 11.1.111.19 on Android 2.x and 3.x, and before 11.1.115.20 on Android 4.x; Adobe AIR before 3.4.0.2710; and Adobe AIR SDK before 3.4.0.2710 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than other Flash Player memory corruption CVEs listed in APSB12-22. |
| CVE-2012-5268 | High | 2012-10-09 | Not applicable | No public exploit | Adobe Flash Player before 10.3.183.29 and 11.x before 11.4.402.287 on Windows and Mac OS X, before 10.3.183.29 and 11.x before 11.2.202.243 on Linux, before 11.1.111.19 on Android 2.x and 3.x, and before 11.1.115.20 on Android 4.x; Adobe AIR before 3.4.0.2710; and Adobe AIR SDK before 3.4.0.2710 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than other Flash Player memory corruption CVEs listed in APSB12-22. |
| CVE-2012-5267 | High | 2012-10-09 | Not applicable | No public exploit | Adobe Flash Player before 10.3.183.29 and 11.x before 11.4.402.287 on Windows and Mac OS X, before 10.3.183.29 and 11.x before 11.2.202.243 on Linux, before 11.1.111.19 on Android 2.x and 3.x, and before 11.1.115.20 on Android 4.x; Adobe AIR before 3.4.0.2710; and Adobe AIR SDK before 3.4.0.2710 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than other Flash Player memory corruption CVEs listed in APSB12-22. |
| CVE-2012-5266 | High | 2012-10-09 | Not applicable | No public exploit | Buffer overflow in Adobe Flash Player before 10.3.183.29 and 11.x before 11.4.402.287 on Windows and Mac OS X, before 10.3.183.29 and 11.x before 11.2.202.243 on Linux, before 11.1.111.19 on Android 2.x and 3.x, and before 11.1.115.20 on Android 4.x; Adobe AIR before 3.4.0.2710; and Adobe AIR SDK before 3.4.0.2710 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than other Flash Player buffer overflow CVEs listed in APSB12-22. |