Overview 25,934 matches · 906 in Waratek scope · 35 protected · 114 exploited · 7 CISA KEV · 7,714 public PoC · 248 EPSS ≥ 0.5
25,934matches
906in Waratek scope3.5%
35protected0.1%
114exploited0.4%
7CISA KEV0.0%
7,714public PoC29.7%
248EPSS ≥ 0.51.0%
Protected by Waratek
35
0.1%
Rule in development
0
0.0%
Mitigation candidate
77
0.3%
No exploit published
794
3.1%
Outside Waratek scope
278
1.1%
Not applicable
24,750
95.4%
Withdrawn CVE
0
0.0%
blocked by ARMR today
35
0.1%
partly blocked
0
0.0%
not blocked
25,898
99.9%
not established
1
0.0%
unrecorded
0
0.0%
split by
peak 3,324 / year
19891
Not applicable1
Medium1
not blocked1
No public exploit1
19902
Not applicable2
Medium2
not blocked2
Working exploit published1
No public exploit1
19914
Not applicable4
Medium4
not blocked4
No public exploit4
19920
19933
Not applicable3
Medium3
not blocked3
No public exploit3
199410
Not applicable10
Medium10
not blocked10
Working exploit published2
No public exploit8
19956
Not applicable6
Medium6
not blocked6
Working exploit published2
No public exploit4
199621
Not applicable21
Medium21
not blocked21
Working exploit published5
No public exploit16
199789
Not applicable89
Medium89
not blocked89
Working exploit published18
No public exploit71
199885
Not applicable85
Medium85
not blocked85
Working exploit published11
No public exploit74
1999357
Outside Waratek scope1
Not applicable356
Medium357
not blocked357
Working exploit published119
No public exploit238
2000467
Mitigation candidate4
No exploit published3
Not applicable460
Medium467
not blocked467
Exploited2
Working exploit published195
No public exploit270
2001706
Mitigation candidate2
No exploit published4
Outside Waratek scope7
Not applicable693
Medium706
not blocked706
Exploited3
Working exploit published219
Forecast only2
No public exploit482
2002980
Protected by Waratek2
Mitigation candidate6
No exploit published15
Outside Waratek scope4
Not applicable953
Medium980
blocked by ARMR today2
not blocked978
Exploited3
Working exploit published246
Forecast only3
No public exploit728
2003747
Protected by Waratek2
Mitigation candidate4
No exploit published18
Outside Waratek scope1
Not applicable722
Medium747
blocked by ARMR today2
not blocked745
Working exploit published243
No public exploit504
20041,265
Protected by Waratek1
Mitigation candidate1
No exploit published16
Outside Waratek scope4
Not applicable1,243
Medium1,265
blocked by ARMR today1
not blocked1,264
Exploited10
Working exploit published414
Forecast only1
No public exploit840
20052,430
Protected by Waratek3
Mitigation candidate4
No exploit published39
Outside Waratek scope6
Not applicable2,378
Medium2,430
blocked by ARMR today3
not blocked2,427
Exploited8
Working exploit published622
Forecast only6
No public exploit1,794
20063,324
Protected by Waratek4
Mitigation candidate4
No exploit published48
Outside Waratek scope3
Not applicable3,265
Medium3,324
blocked by ARMR today4
not blocked3,320
Exploited10
Working exploit published1,137
Forecast only2
No public exploit2,175
20073,101
Protected by Waratek2
Mitigation candidate9
No exploit published60
Outside Waratek scope53
Not applicable2,977
Medium3,101
blocked by ARMR today2
not blocked3,099
Exploited14
Working exploit published1,052
Forecast only1
No public exploit2,034
20082,582
Protected by Waratek4
Mitigation candidate8
No exploit published71
Outside Waratek scope26
Not applicable2,473
Medium2,582
blocked by ARMR today4
not blocked2,578
Exploited7
Working exploit published987
Proof of concept only2
Forecast only1
No public exploit1,585
20092,786
Protected by Waratek5
Mitigation candidate9
No exploit published115
Outside Waratek scope31
Not applicable2,626
Medium2,786
blocked by ARMR today5
not blocked2,781
Exploited16
Working exploit published1,123
Proof of concept only2
Forecast only3
No public exploit1,642
20102,241
Protected by Waratek6
Mitigation candidate9
No exploit published118
Outside Waratek scope34
Not applicable2,074
Medium2,241
blocked by ARMR today6
not blocked2,235
Exploited14
Working exploit published547
Proof of concept only1
Forecast only2
No public exploit1,677
20112,101
Protected by Waratek4
Mitigation candidate3
No exploit published132
Outside Waratek scope58
Not applicable1,904
Medium2,101
blocked by ARMR today4
not blocked2,097
Exploited9
Working exploit published294
Proof of concept only3
Forecast only1
No public exploit1,794
20122,626
Protected by Waratek2
Mitigation candidate14
No exploit published155
Outside Waratek scope50
Not applicable2,405
Medium2,626
blocked by ARMR today2
not blocked2,623
not established1
Exploited18
Working exploit published416
Proof of concept only1
Forecast only42
No public exploit2,149
199019921994199619982000200220042006200820102012
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2012-5671 | Medium | 2012-10-31 | Not applicable | Exploited | Heap-based buffer overflow in the dkim_exim_query_dns_txt function in dkim.c in Exim 4.70 through 4.80, when DKIM support is enabled and acl_smtp_connect and acl_smtp_rcpt are not set to "warn control = dkim_disable_verify," allows remote attackers to execute arbitrary code via an email from a malicious DNS server. |
| CVE-2012-4940 | Medium | 2012-10-31 | Not applicable | Exploited | Multiple directory traversal vulnerabilities in the View Log Files component in Axigen Free Mail Server allow remote attackers to read or delete arbitrary files via a .. (dot dot) in (1) the fileName parameter in a download action to source/loggin/page_log_dwn_file.hsp, or the fileName parameter in (2) an edit action or (3) a delete action to the default URI. |
| CVE-2012-4939 | Medium | 2012-10-31 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in IPAMSummaryView.aspx in the IPAM web interface before 3.0-HotFix1 in SolarWinds Orion Network Performance Monitor might allow remote attackers to inject arbitrary web script or HTML via the "Search for an IP address" field. |
| CVE-2012-4547 | Medium | 2012-10-31 | Not applicable | Working exploit published | Unspecified vulnerability in awredir.pl in AWStats before 7.1 has unknown impact and attack vectors. |
| CVE-2012-4532 | Medium | 2012-10-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in modules/mod_languages/tmpl/default.php in the Language Switcher module for Joomla! 2.5.x before 2.5.7 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php. NOTE: some of these details are obtained from third party information. |
| CVE-2012-4531 | Medium | 2012-10-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Joomla! 2.5.x before 2.5.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2012-4499 | Medium | 2012-10-31 | Not applicable | No public exploit | The contact formatter page in the Email Field module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers to email the stored address in the entity via unspecified vectors. |
| CVE-2012-4495 | Medium | 2012-10-31 | Not applicable | No public exploit | The Mime Mail module 6.x-1.x before 6.x-1.1 for Drupal does not properly restrict access to files outside Drupal's publish files directory, which allows remote authenticated users to send arbitrary files as attachments. |
| CVE-2012-4494 | Medium | 2012-10-31 | Not applicable | No public exploit | The Shibboleth authentication module 7.x-4.0 for Drupal does not properly check the active status of users, which allows remote blocked users to access bypass intended access restrictions and possibly have other impacts by logging in. |
| CVE-2012-4491 | Medium | 2012-10-31 | Not applicable | No public exploit | The Monthly Archive by Node Type module 6.x for Drupal does not properly check permissions defined by node_access modules, which allows remote attackers to access restricted nodes via unspecified vectors. |
| CVE-2012-4490 | Medium | 2012-10-31 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in the Excluded Users module 6.x-1.x before 6.x-1.1 for Drupal allow remote attackers to inject arbitrary web script or HTML via a (1) user name or (2) email address. |
| CVE-2012-4489 | Medium | 2012-10-31 | Not applicable | No public exploit | Open redirect vulnerability in the securelogin_secure_redirect function in the Secure Login module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the q parameter. |
| CVE-2012-4488 | Medium | 2012-10-31 | Not applicable | No public exploit | The Location module 6.x before 6.x-3.2 and 7.x before 7.x-3.0-alpha1 for Drupal does not properly check user or node access permissions, which allows remote attackers to read node or user results via the location search page. |
| CVE-2012-4485 | Medium | 2012-10-31 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in the galleryformatter_field_formatter_view functiuon in galleryformatter.tpl.php the Gallery formatter module before 7.x-1.2 for Drupal allow remote authenticated users with permissions to create a node or entity to inject arbitrary web script or HTML via the (1) title or (2) alt parameter. |
| CVE-2012-4484 | Medium | 2012-10-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the administrative interface in the Campaign Monitor module before 6.x-2.5 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: this refers to an issue in an independently developed Drupal module, and NOT an issue in the Campaign Monitor software itself (described on the campaignmonitor.com web site). |
| CVE-2012-4483 | Medium | 2012-10-31 | Not applicable | No public exploit | The commons_discussion_views_default_views function in modules/features/commons_discussion/commons_discussion.views_default.inc in the Drupal Commons module 6.x-2.x before 6.x-2.8 for Drupal does not properly enforce intended node access restrictions, which might allow remote attackers to obtain sensitive information via the recent comments listing. |
| CVE-2012-4482 | Medium | 2012-10-31 | Not applicable | No public exploit | The Ubercart SecureTrading Payment Method module 6.x for Drupal does not properly verify payment notification information, which allows remote attackers to purchase an item without paying via unspecified vectors. |
| CVE-2012-4196 | Medium | 2012-10-29 | Not applicable | No public exploit | Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.10, Thunderbird before 16.0.2, Thunderbird ESR 10.x before 10.0.10, and SeaMonkey before 2.13.2 allow remote attackers to bypass the Same Origin Policy and read the Location object via a prototype property-injection attack that defeats certain protection mechanisms for this object. |
| CVE-2012-4195 | Medium | 2012-10-29 | Not applicable | No public exploit | The nsLocation::CheckURL function in Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.10, Thunderbird before 16.0.2, Thunderbird ESR 10.x before 10.0.10, and SeaMonkey before 2.13.2 does not properly determine the calling document and principal in its return value, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site, and makes it easier for remote attackers to execute arbitrary JavaScript code by leveraging certain add-on behavior. |
| CVE-2012-4194 | Medium | 2012-10-29 | Not applicable | No public exploit | Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.10, Thunderbird before 16.0.2, Thunderbird ESR 10.x before 10.0.10, and SeaMonkey before 2.13.2 do not prevent use of the valueOf method to shadow the location object (aka window.location), which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via vectors involving a plugin. |
| CVE-2012-4447 | Medium | 2012-10-28 | Not applicable | No public exploit | Heap-based buffer overflow in tif_pixarlog.c in LibTIFF before 4.0.3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted TIFF image using the PixarLog Compression format. |
| CVE-2012-5470 | Medium | 2012-10-26 | Not applicable | Working exploit published | libpng_plugin in VideoLAN VLC media player 2.0.3 allows remote attackers to cause a denial of service (application crash) via a crafted PNG file. |
| CVE-2012-4729 | Medium | 2012-10-26 | Not applicable | No public exploit | Wing FTP Server before 4.1.1 allows remote authenticated users to cause a denial of service (daemon crash) via two zip commands. |
| CVE-2012-4019 | Medium | 2012-10-26 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in tokyo_bbs.cgi in Come on Girls Interface (CGI) Tokyo BBS allows remote attackers to inject arbitrary web script or HTML via vectors related to the error page. |
| CVE-2012-5672 | Medium | 2012-10-25 | Not applicable | Working exploit published | Microsoft Excel Viewer (aka Xlview.exe) and Excel in Microsoft Office 2007 (aka Office 12) allow remote attackers to cause a denial of service (read access violation and application crash) via a crafted spreadsheet file, as demonstrated by a .xls file with battery voltage data. |
| CVE-2012-5368 | Medium | 2012-10-25 | Not applicable | No public exploit | phpMyAdmin 3.5.x before 3.5.3 uses JavaScript code that is obtained through an HTTP session to phpmyadmin.net without SSL, which allows man-in-the-middle attackers to conduct cross-site scripting (XSS) attacks by modifying this code. |
| CVE-2011-5233 | Medium | 2012-10-25 | Not applicable | Working exploit published | Heap-based buffer overflow in IrfanView before 4.32 allows remote attackers to execute arbitrary code via crafted "Rows Per Strip" and "Samples Per Pixel" values in a TIFF image file. |
| CVE-2011-5228 | Medium | 2012-10-25 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in the Search module (quickstart/search) in appRain CMF 0.1.5 allows remote attackers to inject arbitrary web script or HTML via the ss parameter. |
| CVE-2011-5226 | Medium | 2012-10-25 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in wordpress_sentinel.php in the Sentinel plugin 1.0.0 for WordPress allows remote attackers to hijack the authentication of an administrator for requests that trigger snapshots. |
| CVE-2011-5225 | Medium | 2012-10-25 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in wordpress_sentinel.php in the Sentinel plugin 1.0.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via unknown vectors. |
| CVE-2011-5223 | Medium | 2012-10-25 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in logout.php in Cacti before 0.8.7i allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. |
| CVE-2011-5221 | Medium | 2012-10-25 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the getLog function in svnlook.php in WebSVN before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via the path parameter to (1) comp.php, (2) diff.php, or (3) revision.php. |
| CVE-2011-5220 | Medium | 2012-10-25 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in templates/default/Admin/Login.html in PHP-SCMS 1.6.8 and earlier allows remote attackers to inject arbitrary web script or HTML via the lang parameter to index.php. |
| CVE-2011-5219 | Medium | 2012-10-25 | Not applicable | Working exploit published | Directory traversal vulnerability in examples/show_code.php in mPDF 5.3 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter. |
| CVE-2011-5217 | Medium | 2012-10-25 | Not applicable | No public exploit | Directory traversal vulnerability in the PXE Mtftp service in Hitachi JP1/ServerConductor/DeploymentManager before 08-55 Japanese and before 08-51 English allows remote attackers to read arbitrary files via unknown vectors. |
| CVE-2011-5214 | Medium | 2012-10-25 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in BrowserCRM 5.100.01 and earlier allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) index.php, (2) modules/admin/admin_module_index.php, or (3) modules/calendar/customise_calendar_times.php; login[] parameter to (4) index.php or (5) pub/clients.php; or framed parameter to (6) licence/index.php or (7) licence/view.php. |
| CVE-2012-5456 | Medium | 2012-10-24 | Not applicable | No public exploit | The Zoner AntiVirus Free application for Android does not verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, as demonstrated by a server used for updating virus signature files. |
| CVE-2012-5387 | Medium | 2012-10-24 | Not applicable | Working exploit published | Cross-site request forgery (CSRF) vulnerability in wlcms-plugin.php in the White Label CMS plugin before 1.5.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that modify the developer name via the wlcms_o_developer_name parameter in a save action to wp-admin/admin.php, as demonstrated by a developer name containing XSS sequences. |
| CVE-2012-5455 | Medium | 2012-10-22 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the language search component in Joomla! before 3.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to a "typographical error." |
| CVE-2012-5454 | Medium | 2012-10-22 | Not applicable | No public exploit | user/index_inline_editor_submit.php in ATutor AContent 1.2-1 does not properly restrict access, which allows remote authenticated users to modify arbitrary user passwords via a crafted request. NOTE: this might be due to an incomplete fix for CVE-2012-5168. |
| CVE-2012-5453 | Medium | 2012-10-22 | Not applicable | Working exploit published | SQL injection vulnerability in user/index_inline_editor_submit.php in ATutor AContent 1.2-1 allows remote authenticated users to execute arbitrary SQL commands via the field parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-5167. |
| CVE-2012-5452 | Medium | 2012-10-22 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in Subrion CMS 2.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) multi_title parameter to blocks/add/; (2) cost, (3) days, or (4) title[en] parameter to plans/add/; (5) name or (6) title[en] parameter to fields/group/add/ in admin/manage/; or (7) f[accounts][fullname] or (8) f[accounts][username] parameter to advsearch/. NOTE: This might overlap CVE-2011-5211. NOTE: it was later reported that the f[accounts][fullname] and f[accounts][username] vectors might also affect 2.2.2. |
| CVE-2012-5169 | Medium | 2012-10-22 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in file_manager/preview_top.php in ATutor AContent before 1.2-2 allow remote attackers to inject arbitrary web script or HTML via the (1) pathext, (2) popup, (3) framed, or (4) file parameter. |
| CVE-2012-4989 | Medium | 2012-10-22 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in admin/plugin-index.php in OpenX 2.8.10 before revision 81823 allows remote attackers to inject arbitrary web script or HTML via the parent parameter in an info action. |
| CVE-2012-4773 | Medium | 2012-10-22 | Not applicable | Working exploit published | Multiple cross-site request forgery (CSRF) vulnerabilities in Subrion CMS before 2.2.3 allow remote attackers to hijack the authentication of administrators for requests that add, delete, or modify sensitive information, as demonstrated by adding an administrator account via an add action to admin/accounts/add/. |
| CVE-2012-4771 | Medium | 2012-10-22 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in Subrion CMS before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the id parameter to (1) admin/accounts/, (2) admin/manage/, or (3) admin/manage/blocks/edit/; or (4) group parameter to admin/configuration/. NOTE: The f[accounts][fullname] and f[accounts][username] vectors are covered in CVE-2012-5452. |
| CVE-2012-4751 | Medium | 2012-10-22 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.15, 3.0.x before 3.0.17, and 3.1.x before 3.1.11 allows remote attackers to inject arbitrary web script or HTML via an e-mail message body with whitespace before a javascript: URL in the SRC attribute of an element, as demonstrated by an IFRAME element. |
| CVE-2012-4517 | Medium | 2012-10-22 | Not applicable | No public exploit | ibacm before 1.0.6 does not properly manage reference counts for multicast connections, which allows remote attackers to cause a denial of service (ibacm service crash) via a crafted join response. |
| CVE-2012-4516 | Medium | 2012-10-22 | Not applicable | No public exploit | librdmacm 1.0.16, when ibacm.port is not specified, connects to port 6125, which allows remote attackers to specify the address resolution information for the application via a malicious ib_acm service. |
| CVE-2012-4511 | Medium | 2012-10-22 | Not applicable | No public exploit | services/flickr/flickr.c in libsocialweb before 0.25.21 automatically connects to Flickr when no Flickr account is set, which might allow remote attackers to obtain sensitive information via a man-in-the-middle (MITM) attack. |
| CVE-2012-4507 | Medium | 2012-10-22 | Not applicable | No public exploit | The strchr function in procmime.c in Claws Mail (aka claws-mail) 3.8.1 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted email. |
| CVE-2012-4506 | Medium | 2012-10-22 | Not applicable | No public exploit | Directory traversal vulnerability in gitolite 3.x before 3.1, when wild card repositories and a pattern matching "../" are enabled, allows remote authenticated users to create arbitrary repositories and possibly perform other actions via a .. (dot dot) in a repository name. |
| CVE-2012-4436 | Medium | 2012-10-22 | Not applicable | No public exploit | Buffer overflow in the run_last_args function in client/fwknop.c in fwknop before 2.0.3, when processing --last, might allow local users to cause a denial of service (client crash) and possibly execute arbitrary code via many .fwknop.run arguments. |
| CVE-2012-4435 | Medium | 2012-10-22 | Not applicable | No public exploit | fwknop before 2.0.3 does not properly validate IP addresses, which allows remote authenticated users to cause a denial of service (server crash) via a long IP address. |
| CVE-2012-4231 | Medium | 2012-10-22 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in admin/index.php in jCore before 1.0pre2 allows remote attackers to inject arbitrary web script or HTML via the path parameter. |
| CVE-2012-3466 | Medium | 2012-10-22 | Not applicable | No public exploit | GNOME gnome-keyring 3.4.0 through 3.4.1, when gpg-cache-method is set to "idle" or "timeout," does not properly limit the amount of time a passphrase is cached, which allows attackers to have an unspecified impact via unknown attack vectors. |
| CVE-2012-1900 | Medium | 2012-10-22 | Not applicable | Working exploit published | Cross-site request forgery (CSRF) vulnerability in admin/index.php in RazorCMS 1.2.1 and earlier allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary web pages via a showcats action. |
| CVE-2012-1154 | Medium | 2012-10-22 | No exploit published | No public exploit | mod_cluster 1.0.10 before 1.0.10 CP03 and 1.1.x before 1.1.4, as used in JBoss Enterprise Application Platform 5.1.2, when "ROOT" is set to excludedContexts, exposes the root context of the server, which allows remote attackers to bypass access restrictions and gain access to applications deployed on the root context via unspecified vectors. |
| CVE-2011-5211 | Medium | 2012-10-22 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in the poll module in Subrion CMS 2.0.4 allows remote attackers to inject arbitrary web script or HTML via the title field. NOTE: some of these details are obtained from third party information. NOTE: this might overlap CVE-2012-5452. |
| CVE-2011-4129 | Medium | 2012-10-22 | Not applicable | No public exploit | (1) services/twitter/twitter-contact-view.c and (2) services/twitter/twitter-item-view.c in libsocialweb before 0.25.20 automatically connect to Twitter when no Twitter account is set, which might allow remote attackers to obtain sensitive information via a man-in-the-middle (MITM) attack. |
| CVE-2010-4821 | Medium | 2012-10-22 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in phpMyFAQ before 2.6.9 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php. |
| CVE-2012-4845 | Medium | 2012-10-20 | Not applicable | No public exploit | The FTP client in IBM AIX 6.1 and 7.1, and VIOS 2.2.1.4-FP-25 SP-02, does not properly manage privileges in an RBAC environment, which allows attackers to bypass intended file-read restrictions by leveraging the setuid installation of the ftp executable file. |
| CVE-2012-2972 | Medium | 2012-10-20 | Not applicable | No public exploit | The (1) server and (2) agent components in CA ARCserve Backup r12.5, r15, and r16 on Windows do not properly validate RPC requests, which allows remote attackers to cause a denial of service (service crash) via a crafted request. |
| CVE-2012-0306 | Medium | 2012-10-18 | Not applicable | No public exploit | Symantec Ghost Solution Suite 2.x through 2.5.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted backup file. |
| CVE-2012-5095 | Medium | 2012-10-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle Sun Solaris 10 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to inetd. |
| CVE-2012-5094 | Medium | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Agile PLM for Process component in Oracle Supply Chain Products Suite 5.2.2 and 6.1.0.0 allows remote attackers to affect confidentiality via unknown vectors related to User Group Management. |
| CVE-2012-5093 | Medium | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Agile PLM for Process component in Oracle Supply Chain Products Suite 5.2.2 and 6.1.0.0 allows remote attackers to affect integrity via unknown vectors related to Global Spec Management. |
| CVE-2012-5092 | Medium | 2012-10-17 | Not applicable | No public exploit | Unspecified vulnerability in the Oracle Agile PLM for Process component in Oracle Supply Chain Products Suite 5.2.2 and 6.1.0.0 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Supply Chain Relationship Management. |
| CVE-2012-5091 | Medium | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Agile Product Supplier Collaboration for Process component in Oracle Supply Chain Products Suite 5.2.2 and 6.1.0.0 allows remote attackers to affect confidentiality via unknown vectors related to Supplier Portal. |
| CVE-2012-5090 | Medium | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Agile PLM for Process component in Oracle Supply Chain Products Suite 5.2.2 and 6.1.0.0 allows remote authenticated users to affect confidentiality via unknown vectors related to Document Reference Library. |
| CVE-2012-5066 | Medium | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Central Designer component in Oracle Industry Applications 1.3, 1.4, and 1.4.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. |
| CVE-2012-5063 | Medium | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Software 10.0.0, 10.0.2, 10.1.0, 10.2.0, 10.2.2, 10.3.0, 10.5.0, 11.0.0 through 11.4.0, and 12.0.0 allows remote attackers to affect integrity, related to BASE. |
| CVE-2012-5061 | Medium | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Software 10.0.0, 10.0.2, 10.1.0, 10.2.0, 10.2.2, 10.3.0, 10.5.0, 11.0.0 through 11.4.0, and 12.0.0 allows remote authenticated users to affect confidentiality, related to BASE. |
| CVE-2012-5058 | Medium | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle iStore component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect integrity via unknown vectors related to the Web interface. |
| CVE-2012-3230 | Medium | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 allows remote attackers to affect confidentiality via unknown vectors related to Portal Framework. |
| CVE-2012-3229 | Medium | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 allows remote authenticated users to affect confidentiality via unknown vectors related to Siebel Documentation. |
| CVE-2012-3228 | Medium | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 5.0.2, 5.0.5, 5.1.0, 5.2.0, 5.3.0 through 5.3.4, 6.0.1, and 6.2.0 allows remote authenticated users to affect integrity and availability, related to BASE. |
| CVE-2012-3226 | Medium | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Software 10.0.0, 10.0.2, 10.1.0, 10.2.0, 10.2.2, 10.3.0, 10.5.0, 11.0.0 through 11.4.0, and 12.0.0 allows remote authenticated users to affect confidentiality and integrity, related to BASE. |
| CVE-2012-3222 | Medium | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle iRecruitment component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect availability via unknown vectors related to Signon. |
| CVE-2012-3212 | Medium | 2012-10-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle Sun Solaris 10 and 11, when running on SPARC T4 servers, allows local users to affect availability via unknown vectors related to Kernel. |
| CVE-2012-3211 | Medium | 2012-10-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle Sun Solaris 10 and 11 allows local users to affect availability via unknown vectors related to Kernel/System Call. |
| CVE-2012-3209 | Medium | 2012-10-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle Sun Solaris 10 and 11, when running on SPARC, allows local users to affect integrity and availability via unknown vectors related to Logical Domain (LDOM). |
| CVE-2012-3208 | Medium | 2012-10-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle Sun Solaris 10 and 11 allows local users to affect availability, related to Kernel/RCTL. |
| CVE-2012-3207 | Medium | 2012-10-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle Sun Solaris 9, 10, and 11 allows local users to affect availability via unknown vectors related to Kernel. |
| CVE-2012-3201 | Medium | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the PeopleSoft Enterprise Campus Solutions component in Oracle PeopleSoft Products 9.0 allows remote authenticated users to affect confidentiality via unknown vectors related to Self-Service (Student Records). |
| CVE-2012-3200 | Medium | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Agile PLM Framework component in Oracle Supply Chain Products Suite 9.3.1.1 allows remote authenticated users to affect confidentiality, related to ROLESPRV. |
| CVE-2012-3198 | Medium | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.51 and 8.52 allows remote authenticated users to affect availability via unknown vectors related to Query. |
| CVE-2012-3196 | Medium | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Human Resources component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality and availability, related to PDF generation. |
| CVE-2012-3195 | Medium | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.50, 8.51, and 8.52 allows remote authenticated users to affect confidentiality via unknown vectors related to Portal. |
| CVE-2012-3194 | Medium | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle BI Publisher component in Oracle Fusion Middleware 10.1.3.4.2, 11.1.1.5.0, 11.1.1.6.0, and 11.1.1.6.2 allows remote attackers to affect integrity via unknown vectors related to Administration. |
| CVE-2012-3187 | Medium | 2012-10-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle Sun Solaris 10 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Kernel. |
| CVE-2012-3186 | Medium | 2012-10-17 | Mitigation candidate | Working exploit published | Unspecified vulnerability in the Oracle WebCenter Sites component in Oracle Fusion Middleware 6.1, 6.2, 6.3.x, 7, 7.0.1, 7.0.2, 7.0.3, 7.5, 7.6.1, 7.6.2, and 11.1.1.6.0 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Advanced UI, a different vulnerability than CVE-2012-3183 and CVE-2012-3185. |
| CVE-2012-3185 | Medium | 2012-10-17 | Mitigation candidate | Working exploit published | Unspecified vulnerability in the Oracle WebCenter Sites component in Oracle Fusion Middleware 6.1, 6.2, 6.3.x, 7, 7.0.1, 7.0.2, 7.0.3, 7.5, 7.6.1, 7.6.2, and 11.1.1.6.0 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Advanced UI, a different vulnerability than CVE-2012-3183 and CVE-2012-3186. |
| CVE-2012-3184 | Medium | 2012-10-17 | Mitigation candidate | Working exploit published | Unspecified vulnerability in the Oracle WebCenter Sites component in Oracle Fusion Middleware 6.1, 6.2, 6.3.x, 7, 7.0.1, 7.0.2, 7.0.3, 7.5, 7.6.1, 7.6.2, and 11.1.1.6.0 allows remote attackers to affect integrity via unknown vectors related to Advanced UI. |
| CVE-2012-3183 | Medium | 2012-10-17 | Mitigation candidate | Working exploit published | Unspecified vulnerability in the Oracle WebCenter Sites component in Oracle Fusion Middleware 6.1, 6.2, 6.3.x, 7, 7.0.1, 7.0.2, 7.0.3, 7.5, 7.6.1, 7.6.2, and 11.1.1.6.0 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Advanced UI, a different vulnerability than CVE-2012-3185 and CVE-2012-3186. |
| CVE-2012-3182 | Medium | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 allows remote attackers to affect integrity, related to PIA Core Technology. |
| CVE-2012-3181 | Medium | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.50, 8.51, and 8.52 allows remote authenticated users to affect availability via unknown vectors related to Security. |
| CVE-2012-3180 | Medium | 2012-10-17 | Not applicable | No public exploit | Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.65 and earlier, and 5.5.27 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer. |
| CVE-2012-3177 | Medium | 2012-10-17 | Not applicable | No public exploit | Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.65 and earlier, and 5.5.27 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server. |
| CVE-2012-3175 | Medium | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3.0 allows remote attackers to affect integrity via unknown vectors related to Redirects, a different vulnerability than CVE-2012-0518. |