Overview 3,430 matches · 202 in Waratek scope · 3 protected · 5 exploited · 0 CISA KEV · 501 public PoC · 13 EPSS ≥ 0.5
3,430matches
202in Waratek scope5.9%
3protected0.1%
5exploited0.1%
0CISA KEV0.0%
501public PoC14.6%
13EPSS ≥ 0.50.4%
Protected by Waratek
3
0.1%
Rule in development
0
0.0%
Mitigation candidate
9
0.3%
No exploit published
190
5.5%
Outside Waratek scope
45
1.3%
Not applicable
3,183
92.8%
Withdrawn CVE
0
0.0%
blocked by ARMR today
3
0.1%
partly blocked
0
0.0%
not blocked
3,427
99.9%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 509 / year
19901
Not applicable1
Low1
not blocked1
No public exploit1
19910
19921
Not applicable1
Low1
not blocked1
No public exploit1
19932
Not applicable2
Low2
not blocked2
No public exploit2
19941
Not applicable1
Low1
not blocked1
Working exploit published1
19951
Not applicable1
Low1
not blocked1
No public exploit1
19969
Not applicable9
Low9
not blocked9
No public exploit9
199719
Not applicable19
Low19
not blocked19
Working exploit published4
Forecast only2
No public exploit13
199823
Not applicable23
Low23
not blocked23
Working exploit published5
No public exploit18
1999111
Not applicable111
Low111
not blocked111
Working exploit published28
No public exploit83
200096
Not applicable96
Low96
not blocked96
Working exploit published34
No public exploit62
2001182
Outside Waratek scope2
Not applicable180
Low182
not blocked182
Working exploit published38
No public exploit144
2002143
No exploit published3
Not applicable140
Low143
not blocked143
Working exploit published18
Forecast only2
No public exploit123
200397
Mitigation candidate1
No exploit published5
Outside Waratek scope1
Not applicable90
Low97
not blocked97
Working exploit published16
No public exploit81
2004203
No exploit published3
Not applicable200
Low203
not blocked203
Working exploit published36
No public exploit167
2005441
No exploit published5
Outside Waratek scope1
Not applicable435
Low441
not blocked441
Exploited2
Working exploit published52
No public exploit387
2006509
No exploit published11
Outside Waratek scope1
Not applicable497
Low509
not blocked509
Exploited1
Working exploit published99
No public exploit409
2007232
Protected by Waratek1
No exploit published10
Outside Waratek scope4
Not applicable217
Low232
blocked by ARMR today1
not blocked231
Working exploit published29
Proof of concept only1
No public exploit202
2008185
No exploit published7
Outside Waratek scope3
Not applicable175
Low185
not blocked185
Working exploit published30
No public exploit155
2009197
Protected by Waratek1
No exploit published21
Outside Waratek scope5
Not applicable170
Low197
blocked by ARMR today1
not blocked196
Exploited1
Working exploit published33
No public exploit163
2010277
Mitigation candidate2
No exploit published20
Outside Waratek scope10
Not applicable245
Low277
not blocked277
Exploited1
Working exploit published28
No public exploit248
2011260
Protected by Waratek1
Mitigation candidate2
No exploit published31
Outside Waratek scope13
Not applicable213
Low260
blocked by ARMR today1
not blocked259
Working exploit published13
Proof of concept only1
No public exploit246
2012440
Mitigation candidate4
No exploit published74
Outside Waratek scope5
Not applicable357
Low440
not blocked440
Working exploit published32
Proof of concept only1
No public exploit407
199019921994199619982000200220042006200820102012
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2012-4934 | Low | 2012-10-31 | Not applicable | No public exploit | TomatoCart 1.1.7, when the PayPal Express Checkout module is enabled in sandbox mode, allows remote authenticated users to bypass intended payment requirements by modifying a certain redirection URL. |
| CVE-2012-4610 | Low | 2012-10-31 | Not applicable | No public exploit | EMC Avamar Client for VMware 6.1 stores the cleartext server root password on the proxy client, which might allow remote attackers to obtain sensitive information by leveraging "network access" to the proxy client. |
| CVE-2012-4544 | Low | 2012-10-31 | Not applicable | No public exploit | The PV domain builder in Xen 4.2 and earlier does not validate the size of the kernel or ramdisk (1) before or (2) after decompression, which allows local guest administrators to cause a denial of service (domain 0 memory consumption) via a crafted (a) kernel or (b) ramdisk. |
| CVE-2012-4500 | Low | 2012-10-31 | Not applicable | No public exploit | The Announcements module 6.x-1.x before 6.x-1.5 for Drupal allows remote authenticated users with the "access announcements" permission to bypass node access restrictions and possibly have other unspecified impact. |
| CVE-2012-4496 | Low | 2012-10-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Custom Publishing Options module 6.x-1.x before 6.x-1.4 for Drupal allows remote authenticated users with the "administer nodes" permission to inject arbitrary web script or HTML via the status labels parameter. |
| CVE-2012-4492 | Low | 2012-10-31 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in the Shorten URLs module 6.x-1.x before 6.x-1.13 and 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors to the (1) report or (2) Custom Services List page. |
| CVE-2012-2625 | Low | 2012-10-31 | Not applicable | No public exploit | The PyGrub boot loader in Xen unstable before changeset 25589:60f09d1ab1fe, 4.2.x, and 4.1.x allows local para-virtualized guest users to cause a denial of service (memory consumption) via a large (1) bzip2 or (2) lzma compressed kernel image. |
| CVE-2012-5339 | Low | 2012-10-25 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.3 allow remote authenticated users to inject arbitrary web script or HTML via a crafted name of (1) an event, (2) a procedure, or (3) a trigger. |
| CVE-2012-5388 | Low | 2012-10-24 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in wlcms-plugin.php in the White Label CMS plugin 1.5 for WordPress allows remote authenticated administrators to inject arbitrary web script or HTML via the wlcms_o_developer_name parameter in a save action to wp-admin/admin.php, a related issue to CVE-2012-5387. |
| CVE-2012-4518 | Low | 2012-10-22 | Not applicable | No public exploit | ibacm 1.0.7 creates files with world-writable permissions, which allows local users to overwrite the ib_acm daemon log or ibacm.port file. |
| CVE-2012-2679 | Low | 2012-10-22 | Not applicable | No public exploit | Red Hat Network (RHN) Configuration Client (rhncfg-client) in rhncfg before 5.10.27-8 uses weak permissions (world-readable) for /var/log/rhncfg-actions, which allows local users to obtain sensitive information about the rhncfg-client actions by reading the file. |
| CVE-2012-2284 | Low | 2012-10-18 | Not applicable | No public exploit | The (1) install and (2) upgrade processes in EMC NetWorker Module for Microsoft Applications (NMM) 2.2.1, 2.3 before build 122, and 2.4 before build 375, when Exchange Server is used, allow local users to read cleartext administrator credentials via unspecified vectors. |
| CVE-2012-5065 | Low | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle WebCenter Sites component in Oracle Fusion Middleware 6.1, 6.2, 6.3.x, 7, 7.0.1, 7.0.2, 7.0.3, 7.5, 7.6.1, 7.6.2, and 11.1.1.6.0 allows local users to affect integrity via unknown vectors related to ImagePicker. |
| CVE-2012-5064 | Low | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Software 10.0.0, 10.0.2, 10.1.0, 10.2.0, 10.2.2, 10.3.0, 10.5.0, and 11.0.0 through 11.2.0 allows remote authenticated users to affect confidentiality, related to BASE. |
| CVE-2012-3227 | Low | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Software 10.0.0, 10.0.2, 10.1.0, 10.2.0, 10.2.2, 10.3.0, 10.5.0, and 11.0.0 through 11.2.0 allows remote authenticated users to affect integrity, related to BASE, a different vulnerability than CVE-2012-3141. |
| CVE-2012-3225 | Low | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 5.3.0 through 5.3.4 allows remote authenticated users to affect confidentiality and integrity, related to BASE. |
| CVE-2012-3224 | Low | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 5.1.0, 5.2.0, and 5.3.0 through 5.3.4 allows remote authenticated users to affect confidentiality, related to BASE. |
| CVE-2012-3223 | Low | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 5.0.2, 5.0.5, 5.1.0, 5.2.0, 5.3.0 through 5.3.4, and 6.0.1 allows remote authenticated users to affect confidentiality, related to BASE. |
| CVE-2012-3221 | Low | 2012-10-17 | Not applicable | Working exploit published | Unspecified vulnerability in the Oracle VM Virtual Box component in Oracle Virtualization 3.2, 4.0, and 4.1 allows local users to affect availability via unknown vectors related to VirtualBox Core. NOTE: The previous information was obtained from the October 2012 CPU. Oracle has not commented on claims from another vendor that this issue is related to "incorrect interrupt handling." |
| CVE-2012-3217 | Low | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.7.0 allows context-dependent attackers to affect availability, related to Outside In HTML Export SDK. |
| CVE-2012-3215 | Low | 2012-10-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle Sun Solaris 10 and 11, when running on SPARC, allows local users to affect confidentiality via unknown vectors related to Kernel. |
| CVE-2012-3214 | Low | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.7.0 allows context-dependent attackers to affect availability via unknown vectors related to Outside In Filters. |
| CVE-2012-3206 | Low | 2012-10-17 | Not applicable | No public exploit | Unspecified vulnerability in the Integrated Lights Out Manager CLI in Oracle Sun Products Suite SysFW 8.2.0.a for SPARC and Netra SPARC T3 and T4-based servers, and other versions and servers, allows local users to affect confidentiality via unknown vectors. |
| CVE-2012-3205 | Low | 2012-10-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect integrity via unknown vectors related to Vino server. |
| CVE-2012-3203 | Low | 2012-10-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect availability, related to Gnome Display Manager GDM. |
| CVE-2012-3197 | Low | 2012-10-17 | Not applicable | No public exploit | Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.64 and earlier, and 5.5.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Replication. |
| CVE-2012-3193 | Low | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle BI Publisher component in Oracle Fusion Middleware 10.3.4.2, 11.1.1.5.0, 11.1.1.6.0, and 11.1.1.6.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Administration. |
| CVE-2012-3191 | Low | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.50, 8.51, and 8.52 allows remote authenticated users to affect availability via unknown vectors related to Data Mover. |
| CVE-2012-3188 | Low | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.50 and 8.51 allows remote authenticated users to affect integrity, related to PIA Core Technology. |
| CVE-2012-3179 | Low | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.50, 8.51, and 8.52 allows remote authenticated users to affect integrity via unknown vectors related to Tree Manager. |
| CVE-2012-3176 | Low | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 allows remote authenticated users to affect integrity via unknown vectors related to Panel Processor. |
| CVE-2012-3167 | Low | 2012-10-17 | Not applicable | No public exploit | Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.63 and earlier, and 5.5.25 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Full Text Search. |
| CVE-2012-3165 | Low | 2012-10-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle Sun Solaris 8, 9, 10, and 11 allows local users to affect confidentiality and integrity via unknown vectors related to mailx. |
| CVE-2012-3164 | Low | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Marketing component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.1, 12.1.2, and 12.1.3 allows remote authenticated users to affect integrity via unknown vectors related to Publish Item. |
| CVE-2012-5085 | Low | 2012-10-16 | No exploit published | No public exploit | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote authenticated users to have an unspecified impact via unknown vectors related to Networking. NOTE: the Oracle CPU states that this issue has a 0.0 CVSS score. If so, then this is not a vulnerability and this issue should not be included in CVE. |
| CVE-2012-5077 | Low | 2012-10-16 | Outside Waratek scope | No public exploit | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote attackers to affect confidentiality via unknown vectors related to Security. |
| CVE-2012-3216 | Low | 2012-10-16 | Outside Waratek scope | No public exploit | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote attackers to affect confidentiality via unknown vectors related to Libraries. |
| CVE-2012-3162 | Low | 2012-10-16 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.3 allows local users to affect confidentiality, related to MDS loading. |
| CVE-2012-3160 | Low | 2012-10-16 | Not applicable | No public exploit | Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.65 and earlier, and 5.5.27 and earlier, allows local users to affect confidentiality via unknown vectors related to Server Installation. |
| CVE-2012-3157 | Low | 2012-10-16 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 5.0.2, 5.0.5, 5.1.0, 5.2.0, 5.3.0 through 5.3.4, 6.0.1, 6.2.0, and 12 allows remote authenticated users to affect integrity, related to BASE. |
| CVE-2012-3156 | Low | 2012-10-16 | Not applicable | No public exploit | Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.25 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server. |
| CVE-2012-3151 | Low | 2012-10-16 | Outside Waratek scope | No public exploit | Unspecified vulnerability in the Core RDBMS component in Oracle Database Server 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3, when running on Unix and Linux platforms, allows local users to affect integrity and availability via unknown vectors. |
| CVE-2012-3149 | Low | 2012-10-16 | Not applicable | No public exploit | Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.26 and earlier allows remote authenticated users to affect confidentiality, related to MySQL Client. |
| CVE-2012-3148 | Low | 2012-10-16 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Field Service component in Oracle E-Business Suite 12.1.3 allows remote authenticated users to affect integrity, related to Wireless/WAP upload. |
| CVE-2012-3146 | Low | 2012-10-16 | Outside Waratek scope | No public exploit | Unspecified vulnerability in the Core RDBMS component in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote authenticated users to affect integrity via unknown vectors. |
| CVE-2012-3145 | Low | 2012-10-16 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 5.0.2, 5.0.5, 5.1.0, 5.2.0, 5.3.0 through 5.3.4, and 6.2.0 allows local users to affect confidentiality, related to BASE. |
| CVE-2012-3142 | Low | 2012-10-16 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 5.0.5, 5.1.0, 5.2.0, and 5.3.0 through 5.3.4 allows remote authenticated users to affect confidentiality, related to BASE. |
| CVE-2012-0108 | Low | 2012-10-16 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Imaging and Process Management component in Oracle Fusion Middleware 10.1.3.6.0 allows remote authenticated users to affect confidentiality via unknown vectors related to Web, a different vulnerability than CVE-2012-0086 and CVE-2012-0095. |
| CVE-2012-0095 | Low | 2012-10-16 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Imaging and Process Management component in Oracle Fusion Middleware 10.1.3.6.0 allows remote authenticated users to affect confidentiality via unknown vectors related to Web, a different vulnerability than CVE-2012-0086 and CVE-2012-0108. |
| CVE-2012-0092 | Low | 2012-10-16 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Imaging and Process Management component in Oracle Fusion Middleware 10.1.3.6.0 allows remote authenticated users to affect integrity via unknown vectors related to Web, a different vulnerability than CVE-2012-0090. |
| CVE-2012-0090 | Low | 2012-10-16 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Imaging and Process Management component in Oracle Fusion Middleware 10.1.3.6.0 allows remote authenticated users to affect integrity via unknown vectors related to Web, a different vulnerability than CVE-2012-0092. |
| CVE-2012-0086 | Low | 2012-10-16 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Imaging and Process Management component in Oracle Fusion Middleware 10.1.3.6.0 allows remote authenticated users to affect confidentiality via unknown vectors related to Web, a different vulnerability than CVE-2012-0095 and CVE-2012-0108. |
| CVE-2012-5355 | Low | 2012-10-10 | Not applicable | No public exploit | welcome.py in xdiagnose before 2.5.2ubuntu0.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp. |
| CVE-2012-4899 | Low | 2012-10-10 | Not applicable | No public exploit | WellinTech KingView 6.5.3 and earlier uses a weak password-hashing algorithm, which makes it easier for local users to discover credentials by reading an unspecified file. |
| CVE-2012-4454 | Low | 2012-10-10 | Not applicable | No public exploit | openCryptoki before 2.4.1, when using spinlocks, allows local users to create or set world-writable permissions on arbitrary files via a symlink attack on the (1) .pkapi_xpk or (2) .pkcs11spinloc file in /tmp. |
| CVE-2012-3504 | Low | 2012-10-10 | Not applicable | No public exploit | The nssconfigFound function in genkey.pl in crypto-utils 2.4.1-34 allows local users to overwrite arbitrary files via a symlink attack on the "list" file in the current working directory. |
| CVE-2012-2286 | Low | 2012-10-10 | Not applicable | No public exploit | Unspecified vulnerability in EMC RSA Adaptive Authentication On-Premise (AAOP) 6.0.2.1 before SP3 P3 allows remote attackers to obtain sensitive information via unknown vectors. |
| CVE-2012-5349 | Low | 2012-10-09 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in pay.php in the Pay With Tweet plugin before 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) link, (2) title, or (3) dl parameter. |
| CVE-2012-4453 | Low | 2012-10-09 | Not applicable | No public exploit | dracut.sh in dracut, as used in Red Hat Enterprise Linux 6, Fedora 16 and 17, and possibly other products, creates initramfs images with world-readable permissions, which might allow local users to obtain sensitive information. |
| CVE-2012-4452 | Low | 2012-10-09 | Not applicable | No public exploit | MySQL 5.0.88, and possibly other versions and platforms, allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL data home directory, related to incorrect calculation of the mysql_unpacked_real_data_home value. NOTE: this vulnerability exists because of a CVE-2009-4030 regression, which was not omitted in other packages and versions such as MySQL 5.0.95 in Red Hat Enterprise Linux 6. |
| CVE-2012-5325 | Low | 2012-10-08 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in the scr_do_redirect function in scr.php in the Shortcode Redirect plugin 1.0.01 and earlier for WordPress allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via the (1) url or (2) sec attributes in a redirect tag. |
| CVE-2012-5316 | Low | 2012-10-08 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in Barracuda Spam & Virus Firewall 600 Firmware 4.0.1.009 and earlier allow remote authenticated users to inject arbitrary web script or HTML via (1) Troubleshooting in the Trace route Device module or (2) LDAP Username in the LDAP Configuration module. |
| CVE-2012-5307 | Low | 2012-10-08 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in servlet/traveler in IBM Lotus Notes Traveler before 8.5.3.3 Interim Fix 1, when Firefox is used, allows remote attackers to inject arbitrary web script or HTML via the redirectURL parameter, a different vulnerability than CVE-2012-4824 and CVE-2012-4825. |
| CVE-2011-4363 | Low | 2012-10-07 | Not applicable | No public exploit | ProcessTable.pm in the Proc::ProcessTable module 0.45 for Perl, when TTY information caching is enabled, allows local users to overwrite arbitrary files via a symlink attack on /tmp/TTYDEVS. |
| CVE-2012-1624 | Low | 2012-10-06 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in the Lingotek module 6.x-1.x before 6.x-1.40 for Drupal allow remote authenticated users to inject arbitrary web script or HTML when (1) creating or (2) editing page content. |
| CVE-2012-5238 | Low | 2012-10-04 | Not applicable | No public exploit | epan/dissectors/packet-ppp.c in the PPP dissector in Wireshark 1.8.x before 1.8.3 uses incorrect OUI data structures during the decoding of (1) PPP and (2) LCP data, which allows remote attackers to cause a denial of service (assertion failure and application exit) via a malformed packet. |
| CVE-2012-5237 | Low | 2012-10-04 | Not applicable | No public exploit | The dissect_hsrp function in epan/dissectors/packet-hsrp.c in the HSRP dissector in Wireshark 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (infinite loop) via a malformed packet. |
| CVE-2011-5204 | Low | 2012-10-04 | Not applicable | Working exploit published | Akiva WebBoard 8.x stores passwords in plaintext, which allows local users to obtain sensitive information by reading from the database. |
| CVE-2012-3520 | Low | 2012-10-03 | Not applicable | No public exploit | The Netlink implementation in the Linux kernel before 3.2.30 does not properly handle messages that lack SCM_CREDENTIALS data, which might allow local users to spoof Netlink communication via a crafted message, as demonstrated by a message to (1) Avahi or (2) NetworkManager. |
| CVE-2012-3430 | Low | 2012-10-03 | Not applicable | Working exploit published | The rds_recvmsg function in net/rds/recv.c in the Linux kernel before 3.0.44 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a (1) recvfrom or (2) recvmsg system call on an RDS socket. |
| CVE-2011-1833 | Low | 2012-10-03 | Not applicable | No public exploit | Race condition in the ecryptfs_mount function in fs/ecryptfs/main.c in the eCryptfs subsystem in the Linux kernel before 3.1 allows local users to bypass intended file permissions via a mount.ecryptfs_private mount with a mismatched uid. |
| CVE-2012-5233 | Low | 2012-10-01 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the stickynote module before 7.x-1.1 for Drupal allows remote authenticated users with edit stickynotes privileges to inject arbitrary web script or HTML via unspecified vecotrs. |
| CVE-2012-4833 | Low | 2012-10-01 | Not applicable | No public exploit | fuser in IBM AIX 6.1 and 7.1, and VIOS 2.2.1.4-FP-25 SP-02, does not properly restrict the -k option, which allows local users to kill arbitrary processes via a crafted command line. |
| CVE-2012-4065 | Low | 2012-10-01 | Not applicable | No public exploit | Eucalyptus before 3.1.1 does not properly restrict the binding of external SOAP web-services messages, which allows remote authenticated users to bypass unspecified authorization checks and obtain direct access to a (1) Cloud Controller or (2) Walrus service via a crafted message, as demonstrated by changes to a volume, snapshot, or cloud configuration setting. |
| CVE-2012-3500 | Low | 2012-10-01 | Not applicable | No public exploit | scripts/annotate-output.sh in devscripts before 2.12.2, as used in rpmdevtools before 8.3, allows local users to modify arbitrary files via a symlink attack on the temporary (1) standard output or (2) standard error output file. |
| CVE-2012-1639 | Low | 2012-10-01 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in product/commerce_product.module in the Drupal Commerce module for Drupal before 7.x-1.2 allow remote authenticated users to inject arbitrary web script or HTML via the (1) sku or (2) title parameters. |
| CVE-2012-1588 | Low | 2012-10-01 | Not applicable | No public exploit | Algorithmic complexity vulnerability in the _filter_url function in the text filtering system (modules/filter/filter.module) in Drupal 7.x before 7.14 allows remote authenticated users with certain roles to cause a denial of service (CPU consumption) via a long email address. |
| CVE-2011-5202 | Low | 2012-10-01 | Not applicable | No public exploit | BazisVirtualCDBus.sys in WinCDEmu 3.6 allows local users to cause a denial of service (system crash) via the unmount command to batchmnt.exe. |
| CVE-2012-3311 | Low | 2012-09-25 | No exploit published | No public exploit | IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.45, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1 on z/OS, in certain configurations involving Federated Repositories for IIOP connections and Optimized Local Adapters, does not perform CBIND checks, which allows local users to bypass intended access restrictions, and read or modify application data, via unspecified vectors. |
| CVE-2012-3300 | Low | 2012-09-25 | Not applicable | No public exploit | IBM WebSphere Commerce 7.0 before 7.0.0.6, when persistent sessions and personalization IDs are enabled, allows remote attackers to cause a denial of service (resource consumption) via unspecified vectors. |
| CVE-2011-4623 | Low | 2012-09-25 | Not applicable | No public exploit | Integer overflow in the rsCStrExtendBuf function in runtime/stringbuf.c in the imfile module in rsyslog 4.x before 4.6.6, 5.x before 5.7.4, and 6.x before 6.1.4 allows local users to cause a denial of service (daemon hang) via a large file, which triggers a heap-based buffer overflow. |
| CVE-2011-5193 | Low | 2012-09-23 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search plugin 1.4.2.3 for WordPress, when the WHOIS widget is enabled, allows remote attackers to inject arbitrary web script or HTML via the domain parameter to index.php, a different vulnerability than CVE-2011-5194. |
| CVE-2012-3741 | Low | 2012-09-20 | Not applicable | No public exploit | The Restrictions (aka Parental Controls) implementation in Apple iOS before 6 does not properly handle purchase attempts after a Disable Restrictions action, which allows local users to bypass an intended Apple ID authentication step via an app that performs purchase transactions. |
| CVE-2012-3740 | Low | 2012-09-20 | Not applicable | No public exploit | The Passcode Lock implementation in Apple iOS before 6 does not properly manage the lock state, which allows physically proximate attackers to bypass an intended passcode requirement via unspecified vectors. |
| CVE-2012-3739 | Low | 2012-09-20 | Not applicable | No public exploit | The Passcode Lock implementation in Apple iOS before 6 allows physically proximate attackers to bypass an intended passcode requirement via vectors involving use of the camera. |
| CVE-2012-3738 | Low | 2012-09-20 | Not applicable | No public exploit | The Emergency Dialer screen in the Passcode Lock implementation in Apple iOS before 6 does not properly limit the dialing methods, which allows physically proximate attackers to bypass intended access restrictions and make FaceTime calls through Voice Dialing, or obtain sensitive contact information by attempting to make a FaceTime call and reading the contact suggestions. |
| CVE-2012-3737 | Low | 2012-09-20 | Not applicable | No public exploit | The Passcode Lock implementation in Apple iOS before 6 does not properly restrict photo viewing, which allows physically proximate attackers to view arbitrary stored photos by spoofing a time value. |
| CVE-2012-3735 | Low | 2012-09-20 | Not applicable | No public exploit | The Passcode Lock implementation in Apple iOS before 6 does not properly interact with the "Slide to Power Off" feature, which allows physically proximate attackers to see the most recently used third-party app by watching the device's screen. |
| CVE-2012-3734 | Low | 2012-09-20 | Not applicable | No public exploit | Office Viewer in Apple iOS before 6 writes cleartext document data to a temporary file, which might allow local users to bypass a document's intended (1) Data Protection level or (2) encryption state by reading the temporary content. |
| CVE-2012-3731 | Low | 2012-09-20 | Not applicable | No public exploit | Mail in Apple iOS before 6 does not properly implement the Data Protection feature for e-mail attachments, which allows physically proximate attackers to bypass an intended passcode requirement via unspecified vectors. |
| CVE-2012-3729 | Low | 2012-09-20 | Not applicable | No public exploit | The Berkeley Packet Filter (BPF) interpreter implementation in the kernel in Apple iOS before 6 accesses uninitialized memory locations, which allows local users to obtain sensitive information about the layout of kernel memory via a crafted program that uses a BPF interface. |
| CVE-2012-3725 | Low | 2012-09-20 | Not applicable | No public exploit | The DNAv4 protocol implementation in the DHCP component in Apple iOS before 6 sends Wi-Fi packets containing a MAC address of a host on a previously used network, which might allow remote attackers to obtain sensitive information about previous device locations by sniffing an unencrypted Wi-Fi network for these packets. |
| CVE-2012-3718 | Low | 2012-09-20 | Not applicable | No public exploit | Apple Mac OS X before 10.7.5 and 10.8.x before 10.8.2 allows local users to read passwords entered into Login Window (aka LoginWindow) or Screen Saver Unlock by installing an input method that intercepts keystrokes. |
| CVE-2012-1632 | Low | 2012-09-20 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in password_policy.admin.inc in the Password Policy module before 6.x-1.4 and 7.x-1.0 beta3 for Drupal allows remote authenticated users with administer policies permissions to inject arbitrary web script or HTML via the name parameter. |
| CVE-2012-1630 | Low | 2012-09-20 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Taxonomy Navigator module for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2012-1629 | Low | 2012-09-20 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Taxotouch module for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2012-1628 | Low | 2012-09-20 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the SuperCron module for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2012-1627 | Low | 2012-09-20 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in vud_term.module in the Vote Up/Down module 6.x-2.x before 6.x-2.8 and 6.x-3.x before 6.x-3.1 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via taxonomy terms. |
| CVE-2011-5189 | Low | 2012-09-20 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Webform Validation module 6.x-1.x before 6.x-1.5 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with permissions to "update Webform nodes" to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2011-5188 | Low | 2012-09-20 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Support Timer module 6.x-1.x before 6.x-1.4 for Drupal allows remote authenticated users with the "track time spent" permission to inject arbitrary web script or HTML via unspecified vectors. |