WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Published to 2012-12-31✕
Overview 51,735 matches · 0 in Waratek scope · 0 protected · 441 exploited · 68 CISA KEV · 17,429 public PoC · 934 EPSS ≥ 0.5
51,735matches 0in Waratek scope0.0% 0protected0.0% 441exploited0.9% 68CISA KEV0.1% 17,429public PoC33.7% 934EPSS ≥ 0.51.8%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 51,735 100.0% Withdrawn CVE 0 0.0%
Critical 172 0.3% High 23,184 44.8% Medium 25,131 48.6% Low 3,248 6.3% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 51,735 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 441 0.9% Working exploit published 17,138 33.1% Proof of concept only 22 0.0% Forecast only 105 0.2% No public exploit 34,029 65.8%
split by peak 6,408 / year
Not applicable: 51,735 Low: 3,248Medium: 25,131High: 23,184Critical: 172 not blocked: 51,735 No public exploit: 34,029Forecast only: 105Proof of concept only: 22Working exploit published: 17,138Exploited: 441
19882 Not applicable2 High2 not blocked2 Working exploit published1 No public exploit1 19893 Not applicable3 High2 Medium1 not blocked3 No public exploit3 199011 Not applicable11 High8 Medium2 Low1 not blocked11 Working exploit published1 No public exploit10 199115 Not applicable15 High11 Medium4 not blocked15 Working exploit published2 No public exploit13 199213 Not applicable13 High12 Low1 not blocked13 No public exploit13 199313 Not applicable13 High8 Medium3 Low2 not blocked13 No public exploit13 199425 Not applicable25 High14 Medium10 Low1 not blocked25 Working exploit published6 No public exploit19 199525 Not applicable25 Critical1 High17 Medium6 Low1 not blocked25 Working exploit published5 No public exploit20 199673 Not applicable73 Critical1 High42 Medium21 Low9 not blocked73 Working exploit published17 Forecast only1 No public exploit55 1997252 Not applicable252 Critical1 High143 Medium89 Low19 not blocked252 Exploited2 Working exploit published73 Forecast only2 No public exploit175 1998246 Not applicable246 Critical1 High137 Medium85 Low23 not blocked246 Exploited1 Working exploit published50 No public exploit195 1999891 Not applicable891 Critical3 High421 Medium356 Low111 not blocked891 Exploited2 Working exploit published280 No public exploit609 20001,005 Not applicable1,005 Critical2 High447 Medium460 Low96 not blocked1,005 Exploited5 Working exploit published420 No public exploit580 20011,649 Not applicable1,649 Critical12 High764 Medium693 Low180 not blocked1,649 Exploited14 Working exploit published474 Forecast only2 No public exploit1,159 20022,107 Not applicable2,107 Critical10 High1,004 Medium953 Low140 not blocked2,107 Exploited12 Working exploit published531 Forecast only7 No public exploit1,557 20031,482 Not applicable1,482 Critical9 High661 Medium722 Low90 not blocked1,482 Exploited10 Working exploit published488 Forecast only1 No public exploit983 20042,416 Not applicable2,416 Critical10 High963 Medium1,243 Low200 not blocked2,416 Exploited21 Working exploit published753 Forecast only1 No public exploit1,641 20054,833 Not applicable4,833 Critical12 High2,008 Medium2,378 Low435 not blocked4,833 Exploited22 Working exploit published1,327 Forecast only11 No public exploit3,473 20066,408 Not applicable6,408 Critical12 High2,634 Medium3,265 Low497 not blocked6,408 Exploited36 Working exploit published2,425 Proof of concept only1 Forecast only6 No public exploit3,940 20076,283 Not applicable6,283 Critical21 High3,068 Medium2,977 Low217 not blocked6,283 Exploited47 Working exploit published2,470 Proof of concept only4 Forecast only5 No public exploit3,757 20085,422 Not applicable5,422 Critical18 High2,756 Medium2,473 Low175 not blocked5,422 Exploited40 Working exploit published2,495 Proof of concept only4 Forecast only8 No public exploit2,875 20095,467 Not applicable5,467 Critical15 High2,656 Medium2,626 Low170 not blocked5,467 Exploited72 Working exploit published2,560 Proof of concept only2 Forecast only3 No public exploit2,830 20104,370 Not applicable4,370 Critical26 High2,025 Medium2,074 Low245 not blocked4,370 Exploited64 Working exploit published1,290 Proof of concept only1 Forecast only8 No public exploit3,007 20113,841 Not applicable3,841 Critical4 High1,720 Medium1,904 Low213 not blocked3,841 Exploited47 Working exploit published672 Proof of concept only4 Forecast only4 No public exploit3,114 20124,883 Not applicable4,883 Critical14 High1,661 Medium2,786 Low422 not blocked4,883 Exploited46 Working exploit published798 Proof of concept only6 Forecast only46 No public exploit3,987
1988199019921994199619982000200220042006200820102012
51,735 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 518 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2012-6453 Medium 2012-12-31 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in the RSS Reader extension before 0.2.6 for MediaWiki allows remote attackers to inject arbitrary web script or HTML via a crafted feed.
CVE-2012-6371 Low 2012-12-31 Not applicable No public exploit The WPA2 implementation on the Belkin N900 F9K1104v1 router establishes a WPS PIN based on 6 digits of the LAN/WLAN MAC address, which makes it easier for remote attackers to obtain access to a Wi-Fi network by reading broadcast packets, a different vulnerability than CVE-2012-4366.
CVE-2012-6339 Medium 2012-12-31 Not applicable No public exploit Multiple cross-site scripting (XSS) vulnerabilities in the administrative web interface in Cerberus FTP Server before 5.0.6.0 allow (1) remote attackers to inject arbitrary web script or HTML via a log entry that is not properly handled within the Log Manager component, and might allow (2) remote authenticated administrators to inject arbitrary web script or HTML via a Messages field to the servermanager program.
CVE-2012-6337 Low 2012-12-31 Not applicable No public exploit The Track My Mobile feature in the SamsungDive subsystem for Android on Samsung Galaxy devices shows the activation of remote tracking, which might allow physically proximate attackers to defeat a product-recovery effort by tampering with this feature or its location data.
CVE-2012-6336 Low 2012-12-31 Not applicable No public exploit The Missing Device feature in Lookout allows physically proximate attackers to provide arbitrary location data via a "commonly available simple GPS location spoofer."
CVE-2012-6335 Low 2012-12-31 Not applicable No public exploit The Anti-theft service in AVG AntiVirus for Android allows physically proximate attackers to provide arbitrary location data via a "commonly available simple GPS location spoofer."
CVE-2012-6334 Low 2012-12-31 Not applicable No public exploit The Track My Mobile feature in the SamsungDive subsystem for Android on Samsung Galaxy devices does not properly implement Location APIs, which allows physically proximate attackers to provide arbitrary location data via a "commonly available simple GPS location spoofer."
CVE-2012-5642 High 2012-12-31 Not applicable No public exploit server/action.py in Fail2ban before 0.8.8 does not properly handle the content of the matches tag, which might allow remote attackers to trigger unsafe behavior in a custom action file via unspecified symbols in this content.
CVE-2012-4688 High 2012-12-31 Not applicable No public exploit The Central application in i-GEN opLYNX before 2.01.9 allows remote attackers to bypass authentication via vectors involving the disabling of browser JavaScript support.
CVE-2011-5251 Medium 2012-12-31 Not applicable No public exploit Open redirect vulnerability in forum/login.php in vBulletin 4.1.3 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the url parameter in a lostpw action.
CVE-2012-4792 High 2012-12-30 Not applicable Exploited Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo object, and exploited in the wild in December 2012.
CVE-2012-6369 Medium 2012-12-28 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in the Troubleshooting Reporting System feature in AgileBits 1Password 3.9.9 might allow remote attackers to inject arbitrary web script or HTML via a crafted User-Agent HTTP header that is not properly handled in a View Troubleshooting Report action.
CVE-2012-5445 Medium 2012-12-28 Not applicable No public exploit The kernel in Cisco Native Unix (CNU) on Cisco Unified IP Phone 7900 series devices (aka TNP phones) with software before 9.3.1-ES10 does not properly validate unspecified system calls, which allows attackers to execute arbitrary code or cause a denial of service (memory overwrite) via a crafted binary.
CVE-2012-4932 Medium 2012-12-28 Not applicable Working exploit published Multiple cross-site scripting (XSS) vulnerabilities in SimpleInvoices before stable-2012-1-CIS3000 allow remote attackers to inject arbitrary web script or HTML via (1) the having parameter in a manage action to index.php; (2) the Email field in an Add User action; (3) the Customer Name field in an Add Customer action; the (4) Street address, (5) Street address 2, (6) City, (7) Zip code, (8) State, (9) Country, (10) Mobile Phone, (11) Phone, (12) Fax, (13) Email, (14) PayPal business name, (15) PayPal notify url, (16) PayPal return url, (17) Eway customer ID, (18) Custom field 1, (19) Custom field 2, (20) Custom field 3, or (21) Custom field 4 field in an Add Biller action; (22) the Customer field in an Add Invoice action; the (23) Invoice or (24) Notes field in a Process Payment action; (25) the Payment type description field in a Payment Types action; (26) the Description field in an Invoice Preferences action; (27) the Description field in a Manage Products action; or (28) the Description field in a Tax Rates action.
CVE-2012-4528 Medium 2012-12-28 Not applicable Working exploit published The mod_security2 module before 2.7.0 for the Apache HTTP Server allows remote attackers to bypass rules, and deliver arbitrary POST data to a PHP application, via a multipart request in which an invalid part precedes the crafted data.
CVE-2012-3873 Medium 2012-12-28 Not applicable Working exploit published Multiple SQL injection vulnerabilities in Open Constructor 3.12.0 allow remote authenticated users to execute arbitrary SQL commands via the id parameter to (1) data/gallery/edit.php, (2) data/guestbook/edit.php, (3) data/file/edit.php, (4) data/htmltext/edit.php, (5) data/publication/edit.php, or (6) data/event/edit.php.
CVE-2012-3872 Medium 2012-12-28 Not applicable Working exploit published Multiple cross-site scripting (XSS) vulnerabilities in Open Constructor 3.12.0 allow remote attackers to inject arbitrary web script or HTML via (1) the result parameter to data/file/edit.php, (2) the q parameter to confirm.php, or (3) the keyword parameter to users/users.php.
CVE-2012-3871 Low 2012-12-28 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in data/hybrid/i_hybrid.php in Open Constructor 3.12.0 allows remote authenticated users to inject arbitrary web script or HTML via the header parameter.
CVE-2012-3870 Low 2012-12-28 Not applicable No public exploit Multiple cross-site scripting (XSS) vulnerabilities in objects/createobject.php in Open Constructor 3.12.0 allow remote authenticated users to inject arbitrary web script or HTML via the (1) name or (2) description parameter.
CVE-2012-0741 Medium 2012-12-28 Not applicable No public exploit IBM Security AppScan Enterprise before 8.6.0.2 and Rational Policy Tester before 8.5.0.3 do not validate X.509 certificates during use of the Manual Explore Proxy feature, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary certificate.
CVE-2012-0738 Medium 2012-12-28 Not applicable No public exploit IBM Security AppScan Enterprise before 8.6.0.2 and Rational Policy Tester before 8.5.0.3 do not validate X.509 certificates during scanning, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary certificate.
CVE-2012-6432 Medium 2012-12-27 Not applicable No public exploit Symfony 2.0.x before 2.0.20, 2.1.x before 2.1.5, and 2.2-dev, when the internal routes configuration is enabled, allows remote attackers to access arbitrary services via vectors involving a URI beginning with a /_internal substring.
CVE-2012-6431 Medium 2012-12-27 Not applicable No public exploit Symfony 2.0.x before 2.0.20 does not process URL encoded data consistently within the Routing and Security components, which allows remote attackers to bypass intended URI restrictions via a doubly encoded string.
CVE-2012-5868 Low 2012-12-27 Not applicable No public exploit WordPress 3.4.2 does not invalidate a wordpress_sec session cookie upon an administrator's logout action, which makes it easier for remote attackers to discover valid session identifiers via a brute-force attack, or modify data via a replay attack.
CVE-2012-5532 Medium 2012-12-27 Not applicable No public exploit The main function in tools/hv/hv_kvp_daemon.c in hypervkvpd, as distributed in the Linux kernel before 3.8-rc1, allows local users to cause a denial of service (daemon exit) via a crafted application that sends a Netlink message. NOTE: this vulnerability exists because of an incorrect fix for CVE-2012-2669.
CVE-2012-2669 Low 2012-12-27 Not applicable No public exploit The main function in tools/hv/hv_kvp_daemon.c in hypervkvpd, as distributed in the Linux kernel before 3.4.5, does not validate the origin of Netlink messages, which allows local users to spoof Netlink communication via a crafted connector message.
CVE-2012-6314 Medium 2012-12-26 Not applicable No public exploit Citrix XenDesktop Virtual Desktop Agent (VDA) 5.6.x before 5.6.200, when making changes to the server-side policy that control USB redirection, does not propagate changes to the VDA, which allows authenticated users to retain access to the USB device.
CVE-2012-6299 High 2012-12-26 Not applicable No public exploit Unspecified vulnerability in CA IdentityMinder r12.0 through CR16, r12.5 before SP15, and r12.6 GA allows remote attackers to bypass intended access restrictions via unknown vectors.
CVE-2012-6298 High 2012-12-26 Not applicable No public exploit Unspecified vulnerability in CA IdentityMinder r12.0 through CR16, r12.5 before SP15, and r12.6 GA allows remote attackers to execute arbitrary commands or modify data via unknown vectors.
CVE-2012-5951 High 2012-12-26 Not applicable No public exploit Unspecified vulnerability in IBM Tivoli NetView 1.4, 5.1 through 5.4, and 6.1 on z/OS allows local users to gain privileges by leveraging access to the normal Unix System Services (USS) security level.
CVE-2012-5625 Medium 2012-12-26 Not applicable No public exploit OpenStack Compute (Nova) Folsom before 2012.2.2 and Grizzly, when using libvirt and LVM backed instances, does not properly clear physical volume (PV) content when reallocating for instances, which allows attackers to obtain sensitive information by reading the memory of the previous logical volume (LV).
CVE-2012-5591 Medium 2012-12-26 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in the Zero Point module 6.x-1.x before 6.x-1.18 and 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to inject arbitrary web script or HTML via the path aliases.
CVE-2012-5590 High 2012-12-26 Not applicable No public exploit SQL injection vulnerability in the Webmail Plus module for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2012-5589 Low 2012-12-26 Not applicable No public exploit The MultiLink module 6.x-2.x before 6.x-2.7 and 7.x-2.x before 7.x-2.7 for Drupal does not properly check node permissions when generating an in-content link, which allows remote authenticated users with text-editing permissions to read arbitrary node titles via a generated link.
CVE-2012-5588 Low 2012-12-26 Not applicable No public exploit The Email Field module 6.x-1.x before 6.x-1.3 for Drupal, when using a field permission module and the field contact field formatter is set to the full or teaser display mode, does not properly check permissions, which allows remote attackers to email the stored address via unspecified vectors.
CVE-2012-5587 Medium 2012-12-26 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in the Email Field module 6.x-1.x before 6.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via the mailto link.
CVE-2012-5586 Low 2012-12-26 Not applicable No public exploit The Services module 6.x-3.x before 6.x-3.3 and 7.x-3.x before 7.x-3.3 for Drupal allows remote authenticated users with the "access user profiles" permission to access arbitrary users' emails via vectors related to the "user index method" and "the path to the user resource."
CVE-2012-5585 Low 2012-12-26 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in the Mixpanel module 6.x-1.x before 6.x-1.1 in Drupal allows remote authenticated users with the "access administration pages" permission to inject arbitrary web script or HTML via the Maxpanel token.
CVE-2012-5584 Medium 2012-12-26 Not applicable No public exploit The Table of Contents module 6.x-3.x before 6.x-3.8 for Drupal does not properly check node permissions, which allows remote attackers to read a node's headers by accessing a table of contents block.
CVE-2012-5483 Low 2012-12-26 Not applicable No public exploit tools/sample_data.sh in OpenStack Keystone 2012.1.3, when access to Amazon Elastic Compute Cloud (Amazon EC2) is configured, uses world-readable permissions for /etc/keystone/ec2rc, which allows local users to obtain access to EC2 services by reading administrative access and secret values from this file.
CVE-2012-5183 Low 2012-12-26 Not applicable No public exploit The Loctouch application 3.4.6 and earlier for Android allows attackers to obtain sensitive information about logged locations via a crafted application that leverages read permission for system log files.
CVE-2012-5182 Medium 2012-12-26 Not applicable No public exploit The Loctouch application 3.4.6 and earlier for Android does not properly handle implicit intents, which allows attackers to obtain sensitive information about logged locations via a crafted application.
CVE-2012-5180 Medium 2012-12-26 Not applicable No public exploit The Opera Mobile application before 12.1 and Opera Mini application before 7.5 for Android do not properly implement the WebView class, which allows attackers to obtain sensitive information via a crafted application.
CVE-2012-5179 Low 2012-12-26 Not applicable No public exploit The Boat Browser application before 4.2 and Boat Browser Mini application before 3.9 for Android do not properly implement the WebView class, which allows attackers to obtain sensitive information via a crafted application.
CVE-2012-5161 High 2012-12-26 Not applicable No public exploit The XML Service interface in Citrix XenApp 6.5 and 6.5 Feature Pack 1 allows remote attackers to execute arbitrary code via unspecified vectors.
CVE-2012-4816 High 2012-12-26 Not applicable No public exploit IBM Rational Automation Framework (RAF) 3.x through 3.0.0.5 allows remote attackers to bypass intended Env Gen Wizard (aka Environment Generation Wizard) access restrictions by visiting context roots in HTTP sessions on port 8080.
CVE-2012-4616 Medium 2012-12-26 Not applicable No public exploit Directory traversal vulnerability in the Web UI in EMC Data Protection Advisor (DPA) 5.6 through SP1, 5.7 through SP1, and 5.8 through SP4 allows remote attackers to read arbitrary files via unspecified vectors.
CVE-2012-0962 Medium 2012-12-26 Not applicable No public exploit Aptdaemon 0.43 in Ubuntu 11.10 and 12.04 LTS uses short IDs when importing PPA GPG keys from a keyserver, which allows remote attackers to install arbitrary package repository GPG keys via a man-in-the-middle (MITM) attack.
CVE-2012-0961 Low 2012-12-26 Not applicable No public exploit Apt 0.8.16~exp5ubuntu13.x before 0.8.16~exp5ubuntu13.6, 0.8.16~exp12ubuntu10.x before 0.8.16~exp12ubuntu10.7, and 0.9.7.5ubuntu5.x before 0.9.7.5ubuntu5.2, as used in Ubuntu, uses world-readable permissions for /var/log/apt/term.log, which allows local users to obtain sensitive shell information by reading the log file.
CVE-2012-0958 Medium 2012-12-26 Not applicable No public exploit content/unity-api.js in the unity-firefox-extension extension 2.4.1 for Firefox exposes the toDataURL function in an API call, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted webpage.
CVE-2012-0432 High 2012-12-25 Not applicable Exploited Stack-based buffer overflow in the Novell NCP implementation in NetIQ eDirectory 8.8.7.x before 8.8.7.2 allows remote attackers to have an unspecified impact via unknown vectors.
CVE-2012-0430 Medium 2012-12-25 Not applicable No public exploit Unspecified vulnerability in NetIQ eDirectory 8.8.6.x before 8.8.6.7 and 8.8.7.x before 8.8.7.2 on Windows allows remote attackers to obtain an administrator cookie and bypass authorization checks via unknown vectors.
CVE-2012-0429 Medium 2012-12-25 Not applicable No public exploit dhost in NetIQ eDirectory 8.8.6.x before 8.8.6.7 and 8.8.7.x before 8.8.7.2 on Windows allows remote authenticated users to cause a denial of service (daemon crash) via crafted characters in an HTTP request.
CVE-2012-0428 Medium 2012-12-25 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in NetIQ eDirectory 8.8.6.x before 8.8.6.7 and 8.8.7.x before 8.8.7.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-5932 High 2012-12-24 Not applicable Working exploit published Eval injection vulnerability in the ldapagnt_eval function in ldapagnt.dll in unifid.exe in NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2 allows remote attackers to execute arbitrary Perl code via a crafted application/x-amf request.
CVE-2012-5931 Medium 2012-12-24 Not applicable Working exploit published Directory traversal vulnerability in the set_log_config function in regclnt.dll in unifid.exe in NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2 allows remote authenticated users to create or overwrite arbitrary files via directory traversal sequences in a log pathname.
CVE-2012-5930 Medium 2012-12-24 Not applicable Working exploit published The pa_modify_accounts function in auth.dll in unifid.exe in NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2 does not require authentication for the modifyAccounts method, which allows remote attackers to change the passwords of administrative accounts via a crafted application/x-amf request.
CVE-2012-4046 Low 2012-12-24 Not applicable No public exploit The D-Link DCS-932L camera with firmware 1.02 allows remote attackers to discover the password via a UDP broadcast packet, as demonstrated by running the D-Link Setup Wizard and reading the _paramR["P"] value.
CVE-2012-0411 High 2012-12-24 Not applicable No public exploit Unspecified vulnerability in Novell iPrint Client before 5.82 allows remote attackers to execute arbitrary code via an op-client-interface-version action.
CVE-2012-6428 High 2012-12-23 Not applicable No public exploit The Carlo Gavazzi EOS-Box stores hard-coded passwords in the PHP file of the device. By using the hard-coded passwords, attackers can log into the device with administrative privileges. This could allow the attacker to have unauthorized access.
CVE-2012-6427 High 2012-12-23 Not applicable No public exploit The Carlo Gavazzi EOS-Box does not check the validity of the data before executing queries. By accessing the SQL table of certain pages that do not require authentication, attackers can leak information from the device. This could allow the attacker to compromise confidentiality.
CVE-2012-4698 Medium 2012-12-23 Not applicable No public exploit Siemens RuggedCom Rugged Operating System (ROS) before 3.12, ROX I OS through 1.14.5, ROX II OS through 2.3.0, and RuggedMax OS through 4.2.1.4621.22 use hardcoded private keys for SSL and SSH communication, which makes it easier for man-in-the-middle attackers to spoof servers and decrypt network traffic by leveraging the availability of these keys within ROS files at all customer installations.
CVE-2012-6325 Medium 2012-12-21 Not applicable No public exploit VMware vCenter Server Appliance (vCSA) 5.0 before Update 2 does not properly parse XML documents, which allows remote authenticated users to read arbitrary files via unspecified vectors.
CVE-2012-6324 Medium 2012-12-21 Not applicable No public exploit Directory traversal vulnerability in VMware vCenter Server Appliance (vCSA) 5.0 before Update 2 and 5.1 before Patch 1 allows remote authenticated users to read arbitrary files via unspecified vectors.
CVE-2012-5954 Medium 2012-12-21 Not applicable No public exploit Unspecified vulnerability in IBM Tivoli Storage Manager for Space Management (aka TSM HSM) before 6.2.5.0 and 6.3.x before 6.3.1.0 allows remote attackers to read or modify HSM-managed file system objects via unknown vectors.
CVE-2012-5517 Medium 2012-12-21 Not applicable No public exploit The online_pages function in mm/memory_hotplug.c in the Linux kernel before 3.6 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact in opportunistic circumstances by using memory that was hot-added by an administrator.
CVE-2012-5181 Medium 2012-12-21 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in concrete5 Japanese 5.5.1 through 5.5.2.1 and concrete5 English 5.5.0 through 5.6.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-4859 High 2012-12-21 Not applicable No public exploit Unspecified vulnerability in IBM Tivoli Storage Manager for Space Management (aka TSM HSM) before 6.2.5.0 and 6.3.x before 6.3.1.0 allows local users to read or modify file system objects via unknown vectors.
CVE-2012-4565 Medium 2012-12-21 Not applicable No public exploit The tcp_illinois_info function in net/ipv4/tcp_illinois.c in the Linux kernel before 3.4.19, when the net.ipv4.tcp_congestion_control illinois setting is enabled, allows local users to cause a denial of service (divide-by-zero error and OOPS) by reading TCP stats.
CVE-2012-4508 Low 2012-12-21 Not applicable No public exploit Race condition in fs/ext4/extents.c in the Linux kernel before 3.4.16 allows local users to obtain sensitive information from a deleted file by reading an extent that was not properly marked as uninitialized.
CVE-2012-4444 Medium 2012-12-21 Not applicable No public exploit The ip6_frag_queue function in net/ipv6/reassembly.c in the Linux kernel before 2.6.36 allows remote attackers to bypass intended network restrictions via overlapping IPv6 fragments.
CVE-2012-3482 Medium 2012-12-21 Not applicable No public exploit Fetchmail 5.0.8 through 6.3.21, when using NTLM authentication in debug mode, allows remote NTLM servers to (1) cause a denial of service (crash and delayed delivery of inbound mail) via a crafted NTLM response that triggers an out-of-bounds read in the base64 decoder, or (2) obtain sensitive information from memory via an NTLM Type 2 message with a crafted Target Name structure, which triggers an out-of-bounds read.
CVE-2012-3133 Medium 2012-12-21 Not applicable No public exploit Buffer overflow in the DataDirect ODBC driver, as used in Oracle Hyperion Interactive Reporting 11.1.2.1 and 11.1.2.2, Essbase Server 11.1.2.1 and 11.1.2.2, Production Reporting Server 11.1.2.1 and 11.1.2.2, and Integration Services Server 11.1.2.1 and 11.1.2.2 has unknown impact and attack vectors.
CVE-2012-3002 High 2012-12-21 Not applicable No public exploit The web interface on (1) Foscam and (2) Wansview IP cameras allows remote attackers to bypass authentication, and perform administrative functions or read the admin password, via a direct request to an unspecified URL.
CVE-2012-1714 High 2012-12-21 Not applicable No public exploit Unspecified vulnerability in a TList 6 ActiveX control in Oracle Hyperion Financial Management 11.1.1.4 and 11.1.2.1.104 allows remote attackers to execute arbitrary code via unknown vectors.
CVE-2012-1699 Low 2012-12-21 Not applicable No public exploit The ProcSetEventMask function in difs/events.c in the xfs font server for X.Org X11R6 through X11R6.6 and XFree86 before 3.3.3 calls the SendErrToClient function with a mask value instead of a pointer, which allows local users to cause a denial of service (memory corruption and crash) or obtain potentially sensitive information from memory via a SetEventMask request that triggers an invalid pointer dereference.
CVE-2012-0957 Medium 2012-12-21 Not applicable Working exploit published The override_release function in kernel/sys.c in the Linux kernel before 3.4.16 allows local users to obtain sensitive information from kernel stack memory via a uname system call in conjunction with a UNAME26 personality.
CVE-2012-0882 High 2012-12-21 Not applicable No public exploit Buffer overflow in yaSSL, as used in MySQL 5.5.20 and possibly other versions including 5.5.x before 5.5.22 and 5.1.x before 5.1.62, allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by VulnDisco Pack Professional 9.17. NOTE: as of 20120224, this disclosure has no actionable information. However, because the module author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes. NOTE: due to lack of details, it is not clear whether this issue is a duplicate of CVE-2012-0492 or another CVE.
CVE-2012-0841 Medium 2012-12-21 Not applicable No public exploit libxml2 before 2.8.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data.
CVE-2011-2728 Medium 2012-12-21 Not applicable No public exploit The bsd_glob function in the File::Glob module for Perl before 5.14.2 allows context-dependent attackers to cause a denial of service (crash) via a glob expression with the GLOB_ALTDIRFUNC flag, which triggers an uninitialized pointer dereference.
CVE-2010-2387 Low 2012-12-21 Not applicable No public exploit vicious-extensions/ve-misc.c in GNOME Display Manager (gdm) 2.20.x before 2.20.11, when GDM debug is enabled, logs the user password when it contains invalid UTF8 encoded characters, which might allow local users to gain privileges by reading the information from syslog logs.
CVE-2012-6271 High 2012-12-20 Not applicable No public exploit Adobe Shockwave Player through 11.6.8.638 allows remote attackers to trigger installation of arbitrary signed Xtras via a Shockwave movie that contains an Xtra URL, as demonstrated by a URL for an outdated Xtra.
CVE-2012-6270 High 2012-12-20 Not applicable No public exploit Adobe Shockwave Player through 11.6.8.638 allows remote attackers to trigger installation of a Shockwave Player 10.4.0.025 compatibility feature via a crafted HTML document that references Shockwave content with a certain compatibility parameter, related to a "downgrading" attack.
CVE-2012-5765 Medium 2012-12-20 Not applicable No public exploit The Web Client (aka CQ Web) in IBM Rational ClearQuest 7.1.2.x before 7.1.2.9 and 8.0.0.x before 8.0.0.5 allows remote attackers to obtain sensitive information via unspecified vectors that trigger a SQL error message.
CVE-2012-5643 Medium 2012-12-20 Not applicable No public exploit Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication credentials.
CVE-2012-5638 Low 2012-12-20 Not applicable No public exploit The setup_logging function in log.h in SANLock uses world-writable permissions for /var/log/sanlock.log, which allows local users to overwrite the file content or bypass intended disk-quota restrictions via standard filesystem write operations.
CVE-2012-5469 High 2012-12-20 Not applicable Exploited The Portable phpMyAdmin plugin before 1.3.1 for WordPress allows remote attackers to bypass authentication and obtain phpMyAdmin console access via a direct request to wp-content/plugins/portable-phpmyadmin/wp-pma-mod.
CVE-2012-4856 High 2012-12-20 Not applicable No public exploit The Service Processor in the IBM Power 5 91##-### and 940#-### before SF240_418_382 does not ensure that firewall code is executed, which allows remote attackers to execute arbitrary code via unspecified vectors.
CVE-2012-4839 Medium 2012-12-20 Not applicable No public exploit The OSLC interface in the Web Client (aka CQ Web) in IBM Rational ClearQuest 7.1.2.x before 7.1.2.9 and 8.0.0.x before 8.0.0.5 allows remote attackers to conduct phishing attacks via a FRAME element.
CVE-2012-6007 Medium 2012-12-19 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in screens/base/web_auth_custom.html on Cisco Wireless LAN Controller (WLC) devices with software 7.2.110.0 allows remote authenticated users to inject arbitrary web script or HTML via the headline parameter, aka Bug ID CSCud65187, a different vulnerability than CVE-2012-5992.
CVE-2012-5992 Medium 2012-12-19 Not applicable Working exploit published Multiple cross-site request forgery (CSRF) vulnerabilities on Cisco Wireless LAN Controller (WLC) devices with software 7.2.110.0 allow remote attackers to hijack the authentication of administrators for requests that (1) add administrative accounts via screens/aaa/mgmtuser_create.html or (2) insert XSS sequences via the headline parameter to screens/base/web_auth_custom.html, aka Bug ID CSCud50283.
CVE-2012-5991 Medium 2012-12-19 Not applicable Working exploit published screens/base/web_auth_custom.html on Cisco Wireless LAN Controller (WLC) devices with software 7.2.110.0 allows remote authenticated users to cause a denial of service (device reload) via a certain buttonClicked value in an internal webauth_type request, aka Bug ID CSCud50209.
CVE-2012-5978 Medium 2012-12-19 Not applicable No public exploit Multiple directory traversal vulnerabilities in the (1) View Connection Server and (2) View Security Server in VMware View 4.x before 4.6.2 and 5.x before 5.1.2 allow remote attackers to read arbitrary files via unspecified vectors.
CVE-2012-5970 Medium 2012-12-19 Not applicable No public exploit The Huawei E585 device allows remote attackers to cause a denial of service (NULL pointer dereference and device outage) via crafted HTTP requests, as demonstrated by unspecified vulnerability-scanning software.
CVE-2012-5969 Medium 2012-12-19 Not applicable No public exploit Multiple directory traversal vulnerabilities on the Huawei E585 device allow remote attackers to (1) read arbitrary files via a .. (dot dot) in the PATH_INFO of an sdcard/ request or (2) modify arbitrary files via a .. (dot dot) in the req_page parameter to en/sms.cgi.
CVE-2012-5968 Medium 2012-12-19 Not applicable No public exploit The Huawei E585 device does not validate the status of admin sessions, which allows remote attackers to obtain sensitive user information and the session ID, and modify data, by leveraging access to the LAN network.
CVE-2012-5967 Medium 2012-12-19 Not applicable Working exploit published SQL injection vulnerability in menuXML.php in Centreon 2.3.3 through 2.3.9-4 (fixed in Centreon web 2.6.0) allows remote authenticated users to execute arbitrary SQL commands via the menu parameter.
CVE-2012-5691 High 2012-12-19 Not applicable Working exploit published Buffer overflow in RealNetworks RealPlayer before 16.0.0.282 and RealPlayer SP 1.0 through 1.1.5 allows remote attackers to execute arbitrary code via a crafted RealMedia file.
CVE-2012-5690 High 2012-12-19 Not applicable No public exploit RealNetworks RealPlayer before 16.0.0.282 and RealPlayer SP 1.0 through 1.1.5 allow remote attackers to execute arbitrary code via a RealAudio file that triggers access to an invalid pointer.
CVE-2012-5178 Medium 2012-12-19 Not applicable No public exploit Cross-site request forgery (CSRF) vulnerability in the Welcart plugin before 1.2.2 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that complete a purchase.
‹ prev page 1 of 518 next ›