Skip to content
OpenAdvisories

Archive

June 2012

Vulnerabilities first published in this month (UTC), newest first.

← May 2012 2012 / June July 2012 →
  1. 13
  2. 22
  3. 3 
  4. 422
  5. 526
  6. 6 
  7. 717
  8. 812
  9. 912
  10. 10 
  11. 112
  12. 1224
  13. 1332
  14. 1416
  15. 156
  16. 1630
  17. 1713
  18. 181
  19. 1914
  20. 2020
  21. 2137
  22. 2211
  23. 23 
  24. 24 
  25. 257
  26. 263
  27. 2763
  28. 28 
  29. 2926
  30. 306
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Medium —
    CVE-2012-2098 EPSS 13%

    Uncontrolled Resource Consumption in Apache Commons Compress

    Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream (BZip2CompressorOutputStream) in Apache Commons Compress before 1.4.1 allows remote attackers to cause a denial of service (CPU consumption) via a file with many repeat…

    org.apache.commons:commons-compress libcommons-compress-java Debian Maven
  • Medium —
    CVE-2012-2660

    Action Pack contains database-query restrictions bypass

    actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows rem…

    actionpack RubyGems
  • Medium —
    CVE-2012-2694

    actionpack allows remote attackers to bypass database-query restrictions, perform NULL checks via crafted request

    actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows rem…

    actionpack RubyGems
  • Medium —
    CVE-2012-2661 Public exploit

    Active Record vulnerable to SQL Injection via nested query parameters

    The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain S…

    activerecord RubyGems
  • Medium —
    CVE-2012-2654

    OpenStack Compute (Nova) Improper Input Validation

    The (1) EC2 and (2) OS APIs in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) do not properly check the protocol when security groups are created and the network protocol is not specified entirely in lowercase, which allows remo…

    nova nova Debian PyPI
  • Medium 5.3
    CVE-2012-2417

    PyCrypto makes Use of Insufficiently Random Values

    PyCrypto before 2.6 does not produce appropriate prime numbers when using an ElGamal scheme to generate a key, which reduces the signature space or public key space and makes it easier for attackers to conduct brute force attacks to obtain the private key.

    pycrypto PyPI
  • Medium —
    CVE-2012-2671

    Rack-Cache caches sensitive headers

    The Rack::Cache rubygem 0.3.0 through 1.1 caches Set-Cookie and other sensitive headers, which allows attackers to obtain sensitive cookie information, hijack web sessions, or have other unspecified impact by accessing the cache.

    rack-cache ruby-rack-cache Debian RubyGems
  • Medium 6.1
    CVE-2012-1872

    Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 6 through 9 allows remote attackers to inject a…

  • Medium —
    CVE-2012-2144

    OpenStack Horizon Session Fixation

    Session fixation vulnerability in OpenStack Dashboard (Horizon) folsom-1 and 2012.1 allows remote attackers to hijack web sessions via the sessionid cookie.

    horizon horizon Debian PyPI
  • Medium —
    CVE-2012-2094

    OpenStack Horizon Cross-site scripting (XSS) vulnerability

    Cross-site scripting (XSS) vulnerability in the refresh mechanism in the log viewer in horizon/static/horizon/js/horizon.js in OpenStack Dashboard (Horizon) folsom-1 and 2012.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the…

    horizon horizon Debian PyPI