Overview 3,498 matches · 204 in Waratek scope · 3 protected · 5 exploited · 0 CISA KEV · 502 public PoC · 13 EPSS ≥ 0.5
3,498matches
204in Waratek scope5.8%
3protected0.1%
5exploited0.1%
0CISA KEV0.0%
502public PoC14.4%
13EPSS ≥ 0.50.4%
Protected by Waratek
3
0.1%
Rule in development
0
0.0%
Mitigation candidate
9
0.3%
No exploit published
192
5.5%
Outside Waratek scope
46
1.3%
Not applicable
3,248
92.9%
Withdrawn CVE
0
0.0%
blocked by ARMR today
3
0.1%
partly blocked
0
0.0%
not blocked
3,495
99.9%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 509 / year
19901
Not applicable1
Low1
not blocked1
No public exploit1
19910
19921
Not applicable1
Low1
not blocked1
No public exploit1
19932
Not applicable2
Low2
not blocked2
No public exploit2
19941
Not applicable1
Low1
not blocked1
Working exploit published1
19951
Not applicable1
Low1
not blocked1
No public exploit1
19969
Not applicable9
Low9
not blocked9
No public exploit9
199719
Not applicable19
Low19
not blocked19
Working exploit published4
Forecast only2
No public exploit13
199823
Not applicable23
Low23
not blocked23
Working exploit published5
No public exploit18
1999111
Not applicable111
Low111
not blocked111
Working exploit published28
No public exploit83
200096
Not applicable96
Low96
not blocked96
Working exploit published34
No public exploit62
2001182
Outside Waratek scope2
Not applicable180
Low182
not blocked182
Working exploit published38
No public exploit144
2002143
No exploit published3
Not applicable140
Low143
not blocked143
Working exploit published18
Forecast only2
No public exploit123
200397
Mitigation candidate1
No exploit published5
Outside Waratek scope1
Not applicable90
Low97
not blocked97
Working exploit published16
No public exploit81
2004203
No exploit published3
Not applicable200
Low203
not blocked203
Working exploit published36
No public exploit167
2005441
No exploit published5
Outside Waratek scope1
Not applicable435
Low441
not blocked441
Exploited2
Working exploit published52
No public exploit387
2006509
No exploit published11
Outside Waratek scope1
Not applicable497
Low509
not blocked509
Exploited1
Working exploit published99
No public exploit409
2007232
Protected by Waratek1
No exploit published10
Outside Waratek scope4
Not applicable217
Low232
blocked by ARMR today1
not blocked231
Working exploit published29
Proof of concept only1
No public exploit202
2008185
No exploit published7
Outside Waratek scope3
Not applicable175
Low185
not blocked185
Working exploit published30
No public exploit155
2009197
Protected by Waratek1
No exploit published21
Outside Waratek scope5
Not applicable170
Low197
blocked by ARMR today1
not blocked196
Exploited1
Working exploit published33
No public exploit163
2010277
Mitigation candidate2
No exploit published20
Outside Waratek scope10
Not applicable245
Low277
not blocked277
Exploited1
Working exploit published28
No public exploit248
2011260
Protected by Waratek1
Mitigation candidate2
No exploit published31
Outside Waratek scope13
Not applicable213
Low260
blocked by ARMR today1
not blocked259
Working exploit published13
Proof of concept only1
No public exploit246
2012508
Mitigation candidate4
No exploit published76
Outside Waratek scope6
Not applicable422
Low508
not blocked508
Working exploit published33
Proof of concept only1
No public exploit474
199019921994199619982000200220042006200820102012
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2012-6371 | Low | 2012-12-31 | Not applicable | No public exploit | The WPA2 implementation on the Belkin N900 F9K1104v1 router establishes a WPS PIN based on 6 digits of the LAN/WLAN MAC address, which makes it easier for remote attackers to obtain access to a Wi-Fi network by reading broadcast packets, a different vulnerability than CVE-2012-4366. |
| CVE-2012-6337 | Low | 2012-12-31 | Not applicable | No public exploit | The Track My Mobile feature in the SamsungDive subsystem for Android on Samsung Galaxy devices shows the activation of remote tracking, which might allow physically proximate attackers to defeat a product-recovery effort by tampering with this feature or its location data. |
| CVE-2012-6336 | Low | 2012-12-31 | Not applicable | No public exploit | The Missing Device feature in Lookout allows physically proximate attackers to provide arbitrary location data via a "commonly available simple GPS location spoofer." |
| CVE-2012-6335 | Low | 2012-12-31 | Not applicable | No public exploit | The Anti-theft service in AVG AntiVirus for Android allows physically proximate attackers to provide arbitrary location data via a "commonly available simple GPS location spoofer." |
| CVE-2012-6334 | Low | 2012-12-31 | Not applicable | No public exploit | The Track My Mobile feature in the SamsungDive subsystem for Android on Samsung Galaxy devices does not properly implement Location APIs, which allows physically proximate attackers to provide arbitrary location data via a "commonly available simple GPS location spoofer." |
| CVE-2012-3871 | Low | 2012-12-28 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in data/hybrid/i_hybrid.php in Open Constructor 3.12.0 allows remote authenticated users to inject arbitrary web script or HTML via the header parameter. |
| CVE-2012-3870 | Low | 2012-12-28 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in objects/createobject.php in Open Constructor 3.12.0 allow remote authenticated users to inject arbitrary web script or HTML via the (1) name or (2) description parameter. |
| CVE-2012-5868 | Low | 2012-12-27 | Not applicable | No public exploit | WordPress 3.4.2 does not invalidate a wordpress_sec session cookie upon an administrator's logout action, which makes it easier for remote attackers to discover valid session identifiers via a brute-force attack, or modify data via a replay attack. |
| CVE-2012-2669 | Low | 2012-12-27 | Not applicable | No public exploit | The main function in tools/hv/hv_kvp_daemon.c in hypervkvpd, as distributed in the Linux kernel before 3.4.5, does not validate the origin of Netlink messages, which allows local users to spoof Netlink communication via a crafted connector message. |
| CVE-2012-5589 | Low | 2012-12-26 | Not applicable | No public exploit | The MultiLink module 6.x-2.x before 6.x-2.7 and 7.x-2.x before 7.x-2.7 for Drupal does not properly check node permissions when generating an in-content link, which allows remote authenticated users with text-editing permissions to read arbitrary node titles via a generated link. |
| CVE-2012-5588 | Low | 2012-12-26 | Not applicable | No public exploit | The Email Field module 6.x-1.x before 6.x-1.3 for Drupal, when using a field permission module and the field contact field formatter is set to the full or teaser display mode, does not properly check permissions, which allows remote attackers to email the stored address via unspecified vectors. |
| CVE-2012-5586 | Low | 2012-12-26 | Not applicable | No public exploit | The Services module 6.x-3.x before 6.x-3.3 and 7.x-3.x before 7.x-3.3 for Drupal allows remote authenticated users with the "access user profiles" permission to access arbitrary users' emails via vectors related to the "user index method" and "the path to the user resource." |
| CVE-2012-5585 | Low | 2012-12-26 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Mixpanel module 6.x-1.x before 6.x-1.1 in Drupal allows remote authenticated users with the "access administration pages" permission to inject arbitrary web script or HTML via the Maxpanel token. |
| CVE-2012-5483 | Low | 2012-12-26 | Not applicable | No public exploit | tools/sample_data.sh in OpenStack Keystone 2012.1.3, when access to Amazon Elastic Compute Cloud (Amazon EC2) is configured, uses world-readable permissions for /etc/keystone/ec2rc, which allows local users to obtain access to EC2 services by reading administrative access and secret values from this file. |
| CVE-2012-5183 | Low | 2012-12-26 | Not applicable | No public exploit | The Loctouch application 3.4.6 and earlier for Android allows attackers to obtain sensitive information about logged locations via a crafted application that leverages read permission for system log files. |
| CVE-2012-5179 | Low | 2012-12-26 | Not applicable | No public exploit | The Boat Browser application before 4.2 and Boat Browser Mini application before 3.9 for Android do not properly implement the WebView class, which allows attackers to obtain sensitive information via a crafted application. |
| CVE-2012-0961 | Low | 2012-12-26 | Not applicable | No public exploit | Apt 0.8.16~exp5ubuntu13.x before 0.8.16~exp5ubuntu13.6, 0.8.16~exp12ubuntu10.x before 0.8.16~exp12ubuntu10.7, and 0.9.7.5ubuntu5.x before 0.9.7.5ubuntu5.2, as used in Ubuntu, uses world-readable permissions for /var/log/apt/term.log, which allows local users to obtain sensitive shell information by reading the log file. |
| CVE-2012-4046 | Low | 2012-12-24 | Not applicable | No public exploit | The D-Link DCS-932L camera with firmware 1.02 allows remote attackers to discover the password via a UDP broadcast packet, as demonstrated by running the D-Link Setup Wizard and reading the _paramR["P"] value. |
| CVE-2012-4508 | Low | 2012-12-21 | Not applicable | No public exploit | Race condition in fs/ext4/extents.c in the Linux kernel before 3.4.16 allows local users to obtain sensitive information from a deleted file by reading an extent that was not properly marked as uninitialized. |
| CVE-2012-1699 | Low | 2012-12-21 | Not applicable | No public exploit | The ProcSetEventMask function in difs/events.c in the xfs font server for X.Org X11R6 through X11R6.6 and XFree86 before 3.3.3 calls the SendErrToClient function with a mask value instead of a pointer, which allows local users to cause a denial of service (memory corruption and crash) or obtain potentially sensitive information from memory via a SetEventMask request that triggers an invalid pointer dereference. |
| CVE-2010-2387 | Low | 2012-12-21 | Not applicable | No public exploit | vicious-extensions/ve-misc.c in GNOME Display Manager (gdm) 2.20.x before 2.20.11, when GDM debug is enabled, logs the user password when it contains invalid UTF8 encoded characters, which might allow local users to gain privileges by reading the information from syslog logs. |
| CVE-2012-5638 | Low | 2012-12-20 | Not applicable | No public exploit | The setup_logging function in log.h in SANLock uses world-writable permissions for /var/log/sanlock.log, which allows local users to overwrite the file content or bypass intended disk-quota restrictions via standard filesystem write operations. |
| CVE-2012-4848 | Low | 2012-12-19 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in IBM Lotus Foundations Start before 1.2.2c allow remote authenticated users to inject arbitrary web script or HTML via a Webconfig Users user-attribute field, as demonstrated by the (1) First Name or (2) Last Name field. |
| CVE-2012-4534 | Low | 2012-12-19 | No exploit published | No public exploit | org/apache/tomcat/util/net/NioEndpoint.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28, when the NIO connector is used in conjunction with sendfile and HTTPS, allows remote attackers to cause a denial of service (infinite loop) by terminating the connection during the reading of a response. |
| CVE-2012-3329 | Low | 2012-12-19 | Not applicable | No public exploit | IBM Advanced Settings Utility (ASU) through 3.62 and 3.70 through 9.21 and Bootable Media Creator (BoMC) through 2.30 and 3.00 through 9.21 on Linux allow local users to overwrite arbitrary files via a symlink attack on a (1) temporary file or (2) log file. |
| CVE-2012-4693 | Low | 2012-12-18 | Not applicable | No public exploit | Invensys Wonderware InTouch 2012 R2 and earlier and Siemens ProcessSuite use a weak encryption algorithm for data in Ps_security.ini, which makes it easier for local users to discover passwords by reading this file. |
| CVE-2012-4691 | Low | 2012-12-18 | Not applicable | No public exploit | Memory leak in Siemens Automation License Manager (ALM) 4.x and 5.x before 5.2 allows remote attackers to cause a denial of service (memory consumption) via crafted packets. |
| CVE-2012-5512 | Low | 2012-12-13 | Not applicable | No public exploit | Array index error in the HVMOP_set_mem_access handler in Xen 4.1 allows local HVM guest OS administrators to cause a denial of service (crash) or obtain sensitive information via unspecified vectors. |
| CVE-2012-3276 | Low | 2012-12-13 | Not applicable | No public exploit | HP OpenVMS 8.3, 8.3-1H1, and 8.4 on the Itanium platform and 7.3-2, 8.2, 8.3, and 8.4 on the Alpha platform does not properly implement the LOGIN and ACME_SERVER ACMELOGIN programs, which allows local users to cause a denial of service via unspecified vectors. |
| CVE-2012-4791 | Low | 2012-12-12 | Not applicable | No public exploit | Microsoft Exchange Server 2007 SP3 and 2010 SP1 and SP2 allows remote authenticated users to cause a denial of service (Information Store service hang) by subscribing to a crafted RSS feed, aka "RSS Feed May Cause Exchange DoS Vulnerability." |
| CVE-2012-4838 | Low | 2012-12-08 | Not applicable | No public exploit | IBM Flex System Chassis Management Module (CMM) and Integrated Management Module 2 (IMM2) allow local users to obtain sensitive information about (1) local accounts, (2) SSH private keys, (3) SSL/TLS private keys, (4) SNMPv3 communities, and (5) LDAP credentials by leveraging unspecified side effects of service or maintenance activity. |
| CVE-2012-4862 | Low | 2012-12-05 | Not applicable | No public exploit | The Host Connect emulator in IBM Rational Developer for System z 7.1 through 8.5.1 does not properly store the SSL certificate password, which allows local users to obtain sensitive information via unspecified vectors. |
| CVE-2009-2899 | Low | 2012-12-05 | Outside Waratek scope | No public exploit | The monitor perl script in the Sybase database plug-in in SpringSource Hyperic HQ before 4.3 allows local users to obtain the database password by listing the process and its arguments. |
| CVE-2012-6064 | Low | 2012-12-03 | Not applicable | No public exploit | Directory traversal vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple (CMSMS) before 1.11.2.1 allows remote authenticated administrators to delete arbitrary files via a .. (dot dot) in the deld parameter. NOTE: this can be leveraged using CSRF (CVE-2012-5450) to allow remote attackers to delete arbitrary files. |
| CVE-2012-5559 | Low | 2012-12-03 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the page manager node view task in the Chaos tool suite (ctools) module 6.x-1.x before 6.x-1.10 for Drupal allows remote authenticated users with permissions to submit or edit nodes to inject arbitrary web script or HTML via the page title. |
| CVE-2012-5557 | Low | 2012-12-03 | Not applicable | No public exploit | The User Read-Only module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.4 for Drupal, does not properly assign roles when there are more than three roles on the site and certain unspecified configurations, which might allow remote authenticated users to gain privileges by performing certain operations, as demonstrated by changing a password. |
| CVE-2012-5553 | Low | 2012-12-03 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in the OM Maximenu module 6.x-1.x before 6.x-1.44 and 7.x-1.x before 7.x-1.44 for Drupal allow remote authenticated users with the "administer OM Maximenu" permission to inject arbitrary web script or HTML via the (1) Menu Title (2) Link Title, (3) Path Query, (4) Anchor, or (5) vocabulary names. |
| CVE-2012-5545 | Low | 2012-12-03 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in the ShareThis module 7.x-2.x before 7.x-2.5 for Drupal allow remote authenticated users with the "administer sharethis" permission to inject arbitrary web script or HTML via unspecified vectors related to "JavaScript settings." |
| CVE-2012-5539 | Low | 2012-12-03 | Not applicable | No public exploit | The Organic Groups (OG) module 7.x-1.x before 7.x-1.5 for Drupal does not properly maintain pending group memberships, which allows remote authenticated users to post to arbitrary groups by modifying their own account while a pending membership is waiting to be approved. |
| CVE-2012-5538 | Low | 2012-12-03 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the FileField Sources module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.6 for Drupal, when the field has "Reference existing" source enabled, allows remote authenticated users to inject arbitrary web script or HTML via the filename of an uploaded file. |
| CVE-2012-3432 | Low | 2012-12-03 | Not applicable | No public exploit | The handle_mmio function in arch/x86/hvm/io.c in the MMIO operations emulator for Xen 3.3 and 4.x, when running an HVM guest, does not properly reset certain state information between emulation cycles, which allows local guest OS users to cause a denial of service (guest OS crash) via unspecified operations on MMIO regions. |
| CVE-2012-2934 | Low | 2012-12-03 | Not applicable | No public exploit | Xen 4.0, and 4.1, when running a 64-bit PV guest on "older" AMD CPUs, does not properly protect against a certain AMD processor bug, which allows local guest OS users to cause a denial of service (host hang) via sequential execution of instructions across a non-canonical boundary, a different vulnerability than CVE-2012-0217. |
| CVE-2012-0218 | Low | 2012-12-03 | Not applicable | No public exploit | Xen 3.4, 4.0, and 4.1, when the guest OS has not registered a handler for a syscall or sysenter instruction, does not properly clear a flag for exception injection when injecting a General Protection Fault, which allows local PV guest OS users to cause a denial of service (guest crash) by later triggering an exception that would normally be handled within Xen. |
| CVE-2012-4571 | Low | 2012-11-30 | Not applicable | No public exploit | Python Keyring 0.9.1 does not securely initialize the cipher when encrypting passwords for CryptedFileKeyring files, which makes it easier for local users to obtain passwords via a brute-force attack. |
| CVE-2012-4473 | Low | 2012-11-30 | Not applicable | No public exploit | The Restrict node page view module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the "view any node page" or "view any node {type} page" permission to access unpublished nodes via a direct request. |
| CVE-2012-4469 | Low | 2012-11-30 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Hashcash module 6.x-2.x before 6.x-2.6 and 7.x-2.x before 7.x-2.2 for Drupal, when "Log failed hashcash" is enabled, allows remote attackers to inject arbitrary web script or HTML via an invalid token, which is not properly handled when administrators use the Database logging module. |
| CVE-2012-5530 | Low | 2012-11-29 | Not applicable | No public exploit | The (1) pcmd and (2) pmlogger init scripts in Performance Co-Pilot (PCP) before 3.6.10 allow local users to overwrite arbitrary files via a symlink attack on a /var/tmp/##### temporary file. |
| CVE-2012-4615 | Low | 2012-11-27 | Not applicable | No public exploit | EMC Smarts Network Configuration Manager (NCM) before 9.1 uses a hardcoded encryption key for the storage of credentials, which allows local users to obtain sensitive information via unspecified vectors. |
| CVE-2012-0959 | Low | 2012-11-24 | Not applicable | No public exploit | Remote Login Service (RLS) 1.0.0 does not properly clear account information when switching users, which might allow physically proximate users to obtain login credentials. |
| CVE-2012-3494 | Low | 2012-11-23 | Not applicable | No public exploit | The set_debugreg hypercall in include/asm-x86/debugreg.h in Xen 4.0, 4.1, and 4.2, and Citrix XenServer 6.0.2 and earlier, when running on x86-64 systems, allows local OS guest users to cause a denial of service (host crash) by writing to the reserved bits of the DR7 debug control register. |
| CVE-2012-2377 | Low | 2012-11-23 | No exploit published | No public exploit | JGroups diagnostics service in JBoss Enterprise Portal Platform before 5.2.2, SOA Platform before 5.3.0, and BRMS Platform before 5.3.0, is enabled without authentication when started by the JGroups channel, which allows remote attackers in adjacent networks to read diagnostics information via a crafted IP multicast. |
| CVE-2012-4539 | Low | 2012-11-21 | Not applicable | No public exploit | Xen 4.0 through 4.2, when running 32-bit x86 PV guests on 64-bit hypervisors, allows local guest OS administrators to cause a denial of service (infinite loop and hang or crash) via invalid arguments to GNTTABOP_get_status_frames, aka "Grant table hypercall infinite loop DoS vulnerability." |
| CVE-2012-4537 | Low | 2012-11-21 | Not applicable | No public exploit | Xen 3.4 through 4.2, and possibly earlier versions, does not properly synchronize the p2m and m2p tables when the set_p2m_entry function fails, which allows local HVM guest OS administrators to cause a denial of service (memory consumption and assertion failure), aka "Memory mapping failure DoS vulnerability." |
| CVE-2012-4536 | Low | 2012-11-21 | Not applicable | No public exploit | The (1) domain_pirq_to_emuirq and (2) physdev_unmap_pirq functions in Xen 2.2 allows local guest OS administrators to cause a denial of service (Xen crash) via a crafted pirq value that triggers an out-of-bounds read. |
| CVE-2012-4535 | Low | 2012-11-21 | Not applicable | No public exploit | Xen 3.4 through 4.2, and possibly earlier versions, allows local guest OS administrators to cause a denial of service (Xen infinite loop and physical CPU consumption) by setting a VCPU with an "inappropriate deadline." |
| CVE-2012-5529 | Low | 2012-11-20 | Not applicable | No public exploit | TraceManager in Firebird 2.5.0 and 2.5.1, when trace is enabled, allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) by preparing an empty dynamic SQL query. |
| CVE-2012-4366 | Low | 2012-11-20 | Not applicable | Working exploit published | Belkin wireless routers Surf N150 Model F7D1301v1, N900 Model F9K1104v1, N450 Model F9K1105V2, and N300 Model F7D2301v1 generate a predictable default WPA2-PSK passphrase based on eight digits of the WAN MAC address, which allows remote attackers to access the network by sniffing the beacon frames. |
| CVE-2012-4938 | Low | 2012-11-18 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the web interface in Pattern Insight 2.3 allows remote authenticated administrators to inject arbitrary web script or HTML via the banner message. |
| CVE-2012-4417 | Low | 2012-11-18 | Not applicable | No public exploit | GlusterFS 3.3.0, as used in Red Hat Storage server 2.0, allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names. |
| CVE-2012-5914 | Low | 2012-11-17 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in the sed_import function in system/functions.php in Neocrome Seditio build 160 and 161 allow remote attackers to inject arbitrary web script or HTML via the (1) newmsg or (2) rtext parameter. NOTE: some of these details are obtained from third party information. |
| CVE-2012-4954 | Low | 2012-11-15 | Not applicable | No public exploit | The edit-profile page in Vanilla Forums before 2.1a32 allows remote authenticated users to modify arbitrary profile settings by replacing the UserID value during a man-in-the-middle attack, related to a "parameter manipulation" issue. |
| CVE-2012-2531 | Low | 2012-11-14 | Not applicable | No public exploit | Microsoft Internet Information Services (IIS) 7.5 uses weak permissions for the Operational log, which allows local users to discover credentials by reading this file, aka "Password Disclosure Vulnerability." |
| CVE-2012-4730 | Low | 2012-11-11 | Not applicable | No public exploit | Request Tracker (RT) 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote authenticated users with ModifySelf or AdminUser privileges to inject arbitrary email headers and conduct phishing attacks or obtain sensitive information via unknown vectors. |
| CVE-2012-3750 | Low | 2012-11-03 | Not applicable | No public exploit | The Passcode Lock implementation in Apple iOS before 6.0.1 does not properly manage the lock state, which allows physically proximate attackers to bypass an intended passcode requirement and access Passbook passes via unspecified vectors. |
| CVE-2012-4497 | Low | 2012-11-02 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the "3 slide gallery" in the Elegant Theme module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via a slide URL. |
| CVE-2012-4493 | Low | 2012-11-02 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the administrative interface in the Better Revisions module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer better revisions" permission to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2012-5705 | Low | 2012-11-01 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the settings page (admin/settings/hotblocks) in the Hotblocks module 6.x-1.x before 6.x-1.8 for Drupal allows remote authenticated users with the "administer hotblocks" permission to inject arbitrary web script or HTML via the "block names." |
| CVE-2012-5704 | Low | 2012-11-01 | Not applicable | No public exploit | The Hotblocks module 6.x-1.x before 6.x-1.8 for Drupal allows remote authenticated users with the "administer hotblocks" permission to cause a denial of service (infinite loop and time out) via a block that references itself. |
| CVE-2012-4934 | Low | 2012-10-31 | Not applicable | No public exploit | TomatoCart 1.1.7, when the PayPal Express Checkout module is enabled in sandbox mode, allows remote authenticated users to bypass intended payment requirements by modifying a certain redirection URL. |
| CVE-2012-4610 | Low | 2012-10-31 | Not applicable | No public exploit | EMC Avamar Client for VMware 6.1 stores the cleartext server root password on the proxy client, which might allow remote attackers to obtain sensitive information by leveraging "network access" to the proxy client. |
| CVE-2012-4544 | Low | 2012-10-31 | Not applicable | No public exploit | The PV domain builder in Xen 4.2 and earlier does not validate the size of the kernel or ramdisk (1) before or (2) after decompression, which allows local guest administrators to cause a denial of service (domain 0 memory consumption) via a crafted (a) kernel or (b) ramdisk. |
| CVE-2012-4500 | Low | 2012-10-31 | Not applicable | No public exploit | The Announcements module 6.x-1.x before 6.x-1.5 for Drupal allows remote authenticated users with the "access announcements" permission to bypass node access restrictions and possibly have other unspecified impact. |
| CVE-2012-4496 | Low | 2012-10-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Custom Publishing Options module 6.x-1.x before 6.x-1.4 for Drupal allows remote authenticated users with the "administer nodes" permission to inject arbitrary web script or HTML via the status labels parameter. |
| CVE-2012-4492 | Low | 2012-10-31 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in the Shorten URLs module 6.x-1.x before 6.x-1.13 and 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors to the (1) report or (2) Custom Services List page. |
| CVE-2012-2625 | Low | 2012-10-31 | Not applicable | No public exploit | The PyGrub boot loader in Xen unstable before changeset 25589:60f09d1ab1fe, 4.2.x, and 4.1.x allows local para-virtualized guest users to cause a denial of service (memory consumption) via a large (1) bzip2 or (2) lzma compressed kernel image. |
| CVE-2012-5339 | Low | 2012-10-25 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.3 allow remote authenticated users to inject arbitrary web script or HTML via a crafted name of (1) an event, (2) a procedure, or (3) a trigger. |
| CVE-2012-5388 | Low | 2012-10-24 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in wlcms-plugin.php in the White Label CMS plugin 1.5 for WordPress allows remote authenticated administrators to inject arbitrary web script or HTML via the wlcms_o_developer_name parameter in a save action to wp-admin/admin.php, a related issue to CVE-2012-5387. |
| CVE-2012-4518 | Low | 2012-10-22 | Not applicable | No public exploit | ibacm 1.0.7 creates files with world-writable permissions, which allows local users to overwrite the ib_acm daemon log or ibacm.port file. |
| CVE-2012-2679 | Low | 2012-10-22 | Not applicable | No public exploit | Red Hat Network (RHN) Configuration Client (rhncfg-client) in rhncfg before 5.10.27-8 uses weak permissions (world-readable) for /var/log/rhncfg-actions, which allows local users to obtain sensitive information about the rhncfg-client actions by reading the file. |
| CVE-2012-2284 | Low | 2012-10-18 | Not applicable | No public exploit | The (1) install and (2) upgrade processes in EMC NetWorker Module for Microsoft Applications (NMM) 2.2.1, 2.3 before build 122, and 2.4 before build 375, when Exchange Server is used, allow local users to read cleartext administrator credentials via unspecified vectors. |
| CVE-2012-5065 | Low | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle WebCenter Sites component in Oracle Fusion Middleware 6.1, 6.2, 6.3.x, 7, 7.0.1, 7.0.2, 7.0.3, 7.5, 7.6.1, 7.6.2, and 11.1.1.6.0 allows local users to affect integrity via unknown vectors related to ImagePicker. |
| CVE-2012-5064 | Low | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Software 10.0.0, 10.0.2, 10.1.0, 10.2.0, 10.2.2, 10.3.0, 10.5.0, and 11.0.0 through 11.2.0 allows remote authenticated users to affect confidentiality, related to BASE. |
| CVE-2012-3227 | Low | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Software 10.0.0, 10.0.2, 10.1.0, 10.2.0, 10.2.2, 10.3.0, 10.5.0, and 11.0.0 through 11.2.0 allows remote authenticated users to affect integrity, related to BASE, a different vulnerability than CVE-2012-3141. |
| CVE-2012-3225 | Low | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 5.3.0 through 5.3.4 allows remote authenticated users to affect confidentiality and integrity, related to BASE. |
| CVE-2012-3224 | Low | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 5.1.0, 5.2.0, and 5.3.0 through 5.3.4 allows remote authenticated users to affect confidentiality, related to BASE. |
| CVE-2012-3223 | Low | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 5.0.2, 5.0.5, 5.1.0, 5.2.0, 5.3.0 through 5.3.4, and 6.0.1 allows remote authenticated users to affect confidentiality, related to BASE. |
| CVE-2012-3221 | Low | 2012-10-17 | Not applicable | Working exploit published | Unspecified vulnerability in the Oracle VM Virtual Box component in Oracle Virtualization 3.2, 4.0, and 4.1 allows local users to affect availability via unknown vectors related to VirtualBox Core. NOTE: The previous information was obtained from the October 2012 CPU. Oracle has not commented on claims from another vendor that this issue is related to "incorrect interrupt handling." |
| CVE-2012-3217 | Low | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.7.0 allows context-dependent attackers to affect availability, related to Outside In HTML Export SDK. |
| CVE-2012-3215 | Low | 2012-10-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle Sun Solaris 10 and 11, when running on SPARC, allows local users to affect confidentiality via unknown vectors related to Kernel. |
| CVE-2012-3214 | Low | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.7.0 allows context-dependent attackers to affect availability via unknown vectors related to Outside In Filters. |
| CVE-2012-3206 | Low | 2012-10-17 | Not applicable | No public exploit | Unspecified vulnerability in the Integrated Lights Out Manager CLI in Oracle Sun Products Suite SysFW 8.2.0.a for SPARC and Netra SPARC T3 and T4-based servers, and other versions and servers, allows local users to affect confidentiality via unknown vectors. |
| CVE-2012-3205 | Low | 2012-10-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect integrity via unknown vectors related to Vino server. |
| CVE-2012-3203 | Low | 2012-10-17 | Not applicable | No public exploit | Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect availability, related to Gnome Display Manager GDM. |
| CVE-2012-3197 | Low | 2012-10-17 | Not applicable | No public exploit | Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.64 and earlier, and 5.5.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Replication. |
| CVE-2012-3193 | Low | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle BI Publisher component in Oracle Fusion Middleware 10.3.4.2, 11.1.1.5.0, 11.1.1.6.0, and 11.1.1.6.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Administration. |
| CVE-2012-3191 | Low | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.50, 8.51, and 8.52 allows remote authenticated users to affect availability via unknown vectors related to Data Mover. |
| CVE-2012-3188 | Low | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.50 and 8.51 allows remote authenticated users to affect integrity, related to PIA Core Technology. |
| CVE-2012-3179 | Low | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.50, 8.51, and 8.52 allows remote authenticated users to affect integrity via unknown vectors related to Tree Manager. |
| CVE-2012-3176 | Low | 2012-10-17 | No exploit published | No public exploit | Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 allows remote authenticated users to affect integrity via unknown vectors related to Panel Processor. |
| CVE-2012-3167 | Low | 2012-10-17 | Not applicable | No public exploit | Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.63 and earlier, and 5.5.25 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Full Text Search. |