Skip to content
OpenAdvisories

Archive

May 2012

Vulnerabilities first published in this month (UTC), newest first.

← April 2012 2012 / May June 2012 →
  1. 19
  2. 231
  3. 3111
  4. 48
  5. 5 
  6. 6 
  7. 7 
  8. 83
  9. 942
  10. 10 
  11. 1119
  12. 12 
  13. 13 
  14. 145
  15. 159
  16. 1630
  17. 1721
  18. 1812
  19. 19 
  20. 20 
  21. 2143
  22. 227
  23. 235
  24. 2433
  25. 258
  26. 26 
  27. 2714
  28. 28 
  29. 2911
  30. 301
  31. 313
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Medium —
    CVE-2010-5099 Public exploit

    TYPO3 Path Traversal vulnerability

    The fileDenyPattern functionality in the PHP file inclusion protection API in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly filter file types, which allows remote attackers to bypass intended access restrictions and a…

    typo3/cms Packagist
  • Medium —
    CVE-2012-1053

    Puppet Privilege Escallation

    The change_user method in the SUIDManager (lib/puppet/util/suidmanager.rb) in Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3 does not properly manage group privileges, which allows loca…

    puppet puppet Debian RubyGems
  • Medium —
    CVE-2012-1906

    Puppet uses predictable filenames, allowing arbitrary file overwrite

    Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbit…

    puppet puppet Debian RubyGems
  • Medium —
    CVE-2012-1988

    Puppet Arbitrary Command Execution

    Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys and file-creation permissions on the puppet master to execute arbitrary c…

    puppet puppet Debian RubyGems
  • Medium —
    CVE-2010-5103

    TYPO3 SQL Injection vulnerability

    SQL injection vulnerability in the list module in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows remote authenticated users with certain permissions to execute arbitrary SQL commands via unspecified vectors.

    typo3/cms Packagist
  • Medium —
    CVE-2010-5104

    TYPO3 Sensitive Information Disclosure via escapeStrForLike method

    The escapeStrForLike method in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly escape input when the MySQL database is set to sql_mode NO_BACKSLASH_ESCAPES, which allows remote attackers to obtain sensitive information …

    typo3/cms-core Packagist
  • Medium —
    CVE-2010-5101

    TYPO3 Directory Traversal vulnerability

    Directory traversal vulnerability in the TypoScript setup in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows remote authenticated administrators to read arbitrary files via unspecified vectors related to the "file inclusion functi…

    typo3/cms Packagist
  • Medium —
    CVE-2012-1589

    Drupal Open Redirect

    Open redirect vulnerability in the Form API in Drupal 7.x before 7.13 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via crafted parameters in a destination URL.

    drupal/drupal Packagist
  • Medium 6.8
    CVE-2012-1695

    Unspecified vulnerability in the Oracle JRockit component in Oracle Fusion Middleware 28.2.2 and earlier, and JDK/JRE 5…

  • Medium 6.5
    CVE-2012-0878

    Paste Script has improper group memberships permissions

    Paste Script 1.7.5 and earlier does not properly set group memberships during execution with root privileges, which might allow remote attackers to bypass intended file-access restrictions by leveraging a web application that uses the local filesystem.

    paste pastescript pastescript Debian PyPI