Skip to content
OpenAdvisories

Archive

21 May 2012

Vulnerabilities first published on this day (UTC), newest first.

← April 2012 2012 / May /21 June 2012 →
  1. 19
  2. 231
  3. 3111
  4. 48
  5. 5 
  6. 6 
  7. 7 
  8. 83
  9. 942
  10. 10 
  11. 1119
  12. 12 
  13. 13 
  14. 145
  15. 159
  16. 1630
  17. 1721
  18. 1812
  19. 19 
  20. 20 
  21. 2143
  22. 227
  23. 235
  24. 2433
  25. 258
  26. 26 
  27. 2714
  28. 28 
  29. 2911
  30. 301
  31. 313
All Critical High Medium Low Exploited only Public exploit

43 results · Feed

  • Unscored —
    CVE-2012-2920

    Cross-site scripting (XSS) vulnerability in the userphoto_options_page function in user-photo.php in the User Photo plu…

  • Unscored —
    CVE-2012-2922

    The request_path function in includes/bootstrap.inc in Drupal 7.14 and earlier allows remote attackers to obtain sensit…

  • Unscored —
    CVE-2012-2925 Public exploit

    SQL injection vulnerability in engine.php in Simple PHP Agenda 2.2.8 allows remote attackers to execute arbitrary SQL c…

  • Unscored —
    CVE-2012-2924 Public exploit

    PHP remote file inclusion vulnerability in admin/setup.inc.php in Hypermethod eLearning Server 4G allows remote attacke…

  • High 7.5
    CVE-2012-2921

    feedparser denial of service vulnerability

    Universal Feed Parser (aka feedparser or python-feedparser) before 5.1.2 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML ENTITY declaration in a non-ASCII encoded document.

    feedparser feedparser Debian PyPI
  • Unscored —
    CVE-2012-2918 Public exploit

    Cross-site scripting (XSS) vulnerability in Upload/engine.php in Chevereto 1.91 allows remote attackers to inject arbit…

  • Unscored —
    CVE-2012-2923 Public exploit

    SQL injection vulnerability in news.php4 in Hypermethod eLearning Server 4G allows remote attackers to execute arbitrar…

  • Unscored —
    CVE-2012-2919 Public exploit

    Directory traversal vulnerability in Upload/engine.php in Chevereto 1.9.1 allows remote attackers to determine the exis…

  • Unscored —
    CVE-2012-0296

    Multiple cross-site scripting (XSS) vulnerabilities in the management GUI in Symantec Web Gateway 5.0.x before 5.0.3 al…

  • Unscored —
    CVE-2012-0298 Public exploit

    The file-management scripts in the management GUI in Symantec Web Gateway 5.0.x before 5.0.3 allow remote attackers to …

  • Unscored —
    CVE-2012-0297 Public exploit EPSS 73%

    The management GUI in Symantec Web Gateway 5.0.x before 5.0.3 does not properly restrict access to application scripts,…

  • Unscored —
    CVE-2012-0299 Public exploit EPSS 64%

    The file-management scripts in the management GUI in Symantec Web Gateway 5.0.x before 5.0.3 allow remote attackers to …

  • Unscored —
    CVE-2012-1249

    The iLunascape application 1.0.4.0 and earlier for Android does not properly implement the WebView class, which allows …

  • Unscored —
    CVE-2012-2338 Public exploit

    SQL injection vulnerability in includes/picture.class.php in Galette 0.63, 0.63.1, 0.63.2, 0.63.3, and 0.64rc1 allows r…

  • Unscored —
    CVE-2012-2271 Public exploit

    Buffer overflow in the InitLicenKeys function in a certain ActiveX control in SkinCrafter3_vs2005.dll in SkinCrafter 3.…

  • Unscored —
    CVE-2012-2561

    HP Business Service Management (BSM) 9.12 does not properly restrict the uploading of .war files, which allows remote a…

  • Unscored —
    CVE-2012-2339

    Cross-site scripting (XSS) vulnerability in the Glossary module 6.x-1.x before 6.x-1.8 for Drupal allows remote attacke…

  • Unscored —
    CVE-2012-2340

    The Contact Forms module 7.x-1.x before 7.x-1.2 for Drupal does not specify sufficiently restrictive permissions, which…

  • Low —
    CVE-2010-5098

    TYPO3 Cross-site scripting (XSS) vulnerability in the FORM content object

    Cross-site scripting (XSS) vulnerability in the FORM content object in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

    typo3/cms-frontend Packagist
  • Medium —
    CVE-2010-5103

    TYPO3 SQL Injection vulnerability

    SQL injection vulnerability in the list module in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows remote authenticated users with certain permissions to execute arbitrary SQL commands via unspecified vectors.

    typo3/cms Packagist
  • Low —
    CVE-2010-5100

    TYPO3 Cross-Site Scripting vulnerability in the Install Tool

    Multiple cross-site scripting (XSS) vulnerabilities in the Install Tool in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

    typo3/cms-install Packagist
  • Unscored —
    CVE-2010-5102

    Directory traversal vulnerability in mod/tools/em/class.em_unzip.php in the unzip library in TYPO3 4.2.x before 4.2.16,…

  • Medium —
    CVE-2010-5104

    TYPO3 Sensitive Information Disclosure via escapeStrForLike method

    The escapeStrForLike method in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly escape input when the MySQL database is set to sql_mode NO_BACKSLASH_ESCAPES, which allows remote attackers to obtain sensitive information …

    typo3/cms-core Packagist
  • Low —
    CVE-2010-5097

    TYPO3 Cross-site scripting (XSS) vulnerability in the click enlarge functionality

    Cross-site scripting (XSS) vulnerability in the click enlarge functionality in TYPO3 4.3.x before 4.3.9 and 4.4.x before 4.4.5 when the caching framework is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    typo3/cms-frontend Packagist
  • Medium —
    CVE-2010-5101

    TYPO3 Directory Traversal vulnerability

    Directory traversal vulnerability in the TypoScript setup in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows remote authenticated administrators to read arbitrary files via unspecified vectors related to the "file inclusion functi…

    typo3/cms Packagist
  • Unscored —
    CVE-2012-2901

    Cross-site scripting (XSS) vulnerability in the Profile List in the Joomla Content Editor (JCE) component before 2.1 fo…

  • Unscored —
    CVE-2012-2911 Public exploit

    Cross-site scripting (XSS) vulnerability in backupDB.php in SiliSoftware backupDB() 1.2.7a allows remote attackers to i…

  • Unscored —
    CVE-2012-2904 Public exploit

    player.swf in LongTail JW Player 5.9 allows remote attackers to conduct cross-site scripting (XSS) attacks to inject ar…

  • Unscored —
    CVE-2012-2909 Public exploit

    Multiple cross-site scripting (XSS) vulnerabilities in Viscacha 0.8.1.1 allow remote attackers to inject arbitrary web …

  • Unscored —
    CVE-2012-2912

    Multiple cross-site scripting (XSS) vulnerabilities in the LeagueManager plugin 3.7 for WordPress allow remote attacker…

  • Unscored —
    CVE-2012-2915 Public exploit EPSS 29%

    Stack-based buffer overflow in Lattice Semiconductor PAC-Designer 6.2.1344 allows remote attackers to execute arbitrary…

  • Unscored —
    CVE-2012-2916

    Cross-site scripting (XSS) vulnerability in sabre_class_admin.php in the SABRE plugin before 2.1 for WordPress allows r…

  • Unscored —
    CVE-2012-2907

    Cross-site scripting (XSS) vulnerability in the aberdeen_breadcrumb function in template.php in the Aberdeen theme 6.x-…

  • Unscored —
    CVE-2012-2905 Public exploit

    Artiphp CMS 5.5.0 Neo (r422) stores database backups with predictable names under the web root with insufficient access…

  • Unscored —
    CVE-2012-2903 Public exploit

    Multiple cross-site scripting (XSS) vulnerabilities in PHP Address Book 7.0 and earlier allow remote attackers to injec…

  • Unscored —
    CVE-2012-2908 Public exploit

    Multiple SQL injection vulnerabilities in admin/bbcodes.php in Viscacha 0.8.1.1 allow remote attackers to execute arbit…

  • Unscored —
    CVE-2012-2910 Public exploit

    Multiple cross-site scripting (XSS) vulnerabilities in SiliSoftware phpThumb() 1.7.11 allow remote attackers to inject …

  • Unscored —
    CVE-2012-2902

    Unrestricted file upload vulnerability in editor/extensions/browser/file.php in the Joomla Content Editor (JCE) compone…

  • Unscored —
    CVE-2012-2914 Public exploit

    Cross-site scripting (XSS) vulnerability in captchademo.php in Unijimpe Captcha allows remote attackers to inject arbit…

  • Unscored —
    CVE-2012-2906 Public exploit

    Multiple cross-site scripting (XSS) vulnerabilities in artpublic/recommandation/index.php in Artiphp CMS 5.5.0 Neo (r42…