Archive
May 2012
Vulnerabilities first published in this month (UTC), newest first.
425 results · Feed
-
Unscored —
The (1) IPv4 and (2) IPv6 implementations in the Linux kernel before 3.1 use a modified MD4 algorithm to generate seque…
-
Unscored —
Integer signedness error in the CIFSFindNext function in fs/cifs/cifssmb.c in the Linux kernel before 3.1 allows remote…
-
Unscored —
The setup_cifs_sb function in fs/cifs/connect.c in the Linux kernel before 2.6.39 does not properly handle DFS referral…
-
Unscored —
The dma_rx function in drivers/net/wireless/b43/dma.c in the Linux kernel before 2.6.39 does not properly allocate rece…
-
Unscored —
The ptrace_setxregs function in arch/xtensa/kernel/ptrace.c in the Linux kernel before 3.1 does not validate user-space…
-
Unscored —
The tomoyo_mount_acl function in security/tomoyo/mount.c in the Linux kernel before 2.6.39.2 calls the kern_path functi…
-
Unscored —
The x86_assign_hw_event function in arch/x86/kernel/cpu/perf_event.c in the Performance Events subsystem in the Linux k…
-
Unscored —
The IPv6 implementation in the Linux kernel before 3.1 does not generate Fragment Identification values separately for …
-
Unscored —
net/packet/af_packet.c in the Linux kernel before 2.6.39.3 does not properly restrict user-space access to certain pack…
-
Unscored —
Multiple buffer overflows in net/wireless/nl80211.c in the Linux kernel before 2.6.39.2 allow local users to gain privi…
-
Unscored —CVE-2011-2918 Public exploit
The Performance Events subsystem in the Linux kernel before 3.1 does not properly handle event overflows associated wit…
-
Unscored —
Google V8, as used in Google Chrome before 19.0.1084.52, does not properly perform garbage collection, which allows rem…
-
Unscored —
Google Chrome before 19.0.1084.52 does not properly implement JavaScript bindings for plug-ins, which allows remote att…
-
Unscored —
Google Chrome before 19.0.1084.52 on Linux does not properly perform a cast of an unspecified variable, which allows re…
-
Unscored —
The WebSockets implementation in Google Chrome before 19.0.1084.52 does not properly handle use of SSL, which allows re…
-
Unscored —
Skia, as used in Google Chrome before 19.0.1084.52, allows remote attackers to cause a denial of service (out-of-bounds…
-
Unscored —
Use-after-free vulnerability in the Cascading Style Sheets (CSS) implementation in Google Chrome before 19.0.1084.52 al…
-
Unscored —
The PDF functionality in Google Chrome before 19.0.1084.52 allows remote attackers to cause a denial of service or poss…
-
Unscored —
Google V8, as used in Google Chrome before 19.0.1084.52, allows remote attackers to cause a denial of service or possib…
-
Unscored —
Multiple buffer overflows in the PDF functionality in Google Chrome before 19.0.1084.52 allow remote attackers to cause…
-
Unscored —
Use-after-free vulnerability in the PDF functionality in Google Chrome before 19.0.1084.52 allows remote attackers to c…
-
Unscored —
The PDF functionality in Google Chrome before 19.0.1084.52 does not properly perform a cast of an unspecified variable …
-
Unscored —
Use-after-free vulnerability in Google Chrome before 19.0.1084.52 allows remote attackers to execute arbitrary code via…
-
Unscored —
Google V8, as used in Google Chrome before 19.0.1084.52, allows remote attackers to cause a denial of service (invalid …
-
Unscored —
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption…
-
Unscored —
Integer signedness error in the pmcraid_ioctl_passthrough function in drivers/scsi/pmcraid.c in the Linux kernel before…
-
Unscored —
GR Board (aka grboard) 1.8.6.5 Community Edition does not require authentication for certain database actions, which al…
-
Unscored —
Multiple SQL injection vulnerabilities in GR Board (aka grboard) 1.8.6.5 Community Edition allow remote attackers to ex…
-
Unscored —
The file-upload implementation in rfc1867.c in PHP before 5.4.0 does not properly handle invalid [ (open square bracket…
-
Unscored —
The Network Threat Protection module in the Manager component in Symantec Endpoint Protection (SEP) 11.0.600x through 1…
-
Unscored —
The Manager service in the management console in Symantec Endpoint Protection (SEP) 12.1 before 12.1 RU1-MP1 allows rem…
-
Unscored —
Directory traversal vulnerability in the Manager service in the management console in Symantec Endpoint Protection (SEP…
-
Unscored —CVE-2012-0289 Public exploit
Buffer overflow in Symantec Endpoint Protection (SEP) 11.0.600x through 11.0.710x and Symantec Network Access Control (…
-
Unscored —
Format string vulnerability in the log_message_cb function in otr-plugin.c in the Off-the-Record Messaging (OTR) pidgin…
-
High 7.5
Tornado CRLF injection vulnerability
CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input.
-
Unscored —CVE-2012-1990 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in Schneider Electric Kerweb before 3.0.1 and Kerwin before 6.0.1 a…
-
Unscored —
Cross-site scripting (XSS) vulnerability in login-with-ajax.php in the Login With Ajax (aka login-with-ajax) plugin bef…
-
Unscored —
Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible be…
-
Unscored —
The Xelex MobileTrack application 2.3.7 and earlier for Android does not verify the origin of SMS commands, which allow…
-
Unscored —
The Xelex MobileTrack application 2.3.7 and earlier for Android uses hardcoded credentials, which allows remote attacke…