Skip to content
OpenAdvisories

Archive

June 2012

Vulnerabilities first published in this month (UTC), newest first.

← May 2012 2012 / June July 2012 →
  1. 13
  2. 22
  3. 3 
  4. 422
  5. 526
  6. 6 
  7. 717
  8. 812
  9. 912
  10. 10 
  11. 112
  12. 1224
  13. 1332
  14. 1416
  15. 156
  16. 1630
  17. 1713
  18. 181
  19. 1914
  20. 2020
  21. 2137
  22. 2211
  23. 23 
  24. 24 
  25. 257
  26. 263
  27. 2763
  28. 28 
  29. 2926
  30. 306
All Critical High Medium Low Exploited only Public exploit

405 results · Feed

  • Unscored —
    CVE-2012-2725

    classes/Filter/WhitelistedExternalFilter.php in the Authoring HTML module 6.x-1.x before 6.x-1.1 for Drupal does not pr…

  • Unscored —
    CVE-2012-2703

    Cross-site scripting (XSS) vulnerability in the Advertisement module 6.x-2.x before 6.x-2.3 for Drupal, when debug mode…

  • Unscored —
    CVE-2012-2726

    Cross-site scripting (XSS) vulnerability in the Protest module 6.x-1.x before 6.x-1.2 or 7.x-1.x before 7.x-1.2 for Dru…

  • Unscored —
    CVE-2012-2722

    The node selection interface in the WYSIWYG editor (CKEditor) in the Node Embed module 6.x-1.x before 6.x-1.5 and 7.x-1…

  • Unscored —
    CVE-2012-2710

    Cross-site scripting (XSS) vulnerability in the Zen module 6.x-1.x before 6.x-1.1 for Drupal, when "Append the content …

  • Unscored —
    CVE-2012-2706

    Cross-site scripting (XSS) vulnerability in the Post Affiliate Pro (PAP) module for Drupal allows remote attackers to i…

    Web / CMS
  • Unscored —
    CVE-2012-2711

    Multiple cross-site scripting (XSS) vulnerabilities in the Taxonomy List module 6.x-1.x before 6.x-1.4 for Drupal allow…

  • Unscored —
    CVE-2012-2702

    The Ubercart Product Keys module 6.x-1.x before 6.x-1.1 for Drupal does not properly check access for product keys, whi…

  • Unscored —
    CVE-2012-2707

    The Hostmaster (Aegir) module 6.x-1.x before 6.x-1.9 for Drupal does not properly exit when users do not have access to…

  • Unscored —
    CVE-2012-2721

    The default views in the Organic Groups (OG) module 6.x-2.x before 6.x-2.4 for Drupal do not properly check permissions…

  • Unscored —
    CVE-2012-2727

    Open redirect vulnerability in the Janrain Capture module 6.x-1.0 and 7.x-1.0 for Drupal, when synchronizing user data,…

  • Unscored —
    CVE-2012-2715

    Cross-site scripting (XSS) vulnerability in the themes_links function in template.php in the Amadou theme module 6.x-1.…

  • Unscored —
    CVE-2012-2731

    The Ubercart AJAX Cart 6.x-2.x before 6.x-2.1 for Drupal stores the PHP session id in the JavaScript settings array in …

  • Unscored —
    CVE-2012-2720

    The Token Authentication (tokenauth) module 6.x-1.x before 6.x-1.7 for Drupal does not properly revert user sessions, w…

  • Unscored —
    CVE-2012-2708

    Cross-site scripting (XSS) vulnerability in the _hosting_task_log_table function in modules/hosting/task/hosting_task.m…

  • Unscored —
    CVE-2012-2122 Public exploit Scanner template EPSS 97%

    sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x befo…

  • Unscored —
    CVE-2012-2380

    Multiple cross-site request forgery (CSRF) vulnerabilities in the admin/editor console in Apache Roller before 5.0.1 al…

  • Unscored —
    CVE-2012-2381

    Multiple cross-site scripting (XSS) vulnerabilities in Apache Roller before 5.0.1 allow remote authenticated users to i…

  • Unscored —
    CVE-2010-2021

    Open redirect vulnerability in the Global Redirect module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.4 for Drupal,…

  • Unscored —
    CVE-2012-3792 Public exploit EPSS 11%

    Pro-face WinGP PC Runtime 3.1.00 and earlier, and ProServr.exe in Pro-face Pro-Server EX 1.30.000 and earlier, allows r…

  • Unscored —
    CVE-2012-3797 Public exploit EPSS 12%

    Pro-face WinGP PC Runtime 3.1.00 and earlier, and ProServr.exe in Pro-face Pro-Server EX 1.30.000 and earlier, does not…

  • Unscored —
    CVE-2012-3793 Public exploit EPSS 12%

    Integer overflow in Pro-face WinGP PC Runtime 3.1.00 and earlier, and ProServr.exe in Pro-face Pro-Server EX 1.30.000 a…

  • Unscored —
    CVE-2012-3796 Public exploit EPSS 10%

    Pro-face WinGP PC Runtime 3.1.00 and earlier, and ProServr.exe in Pro-face Pro-Server EX 1.30.000 and earlier, allows r…

  • Unscored —
    CVE-2012-3794 Public exploit EPSS 21%

    Pro-face WinGP PC Runtime 3.1.00 and earlier, and ProServr.exe in Pro-face Pro-Server EX 1.30.000 and earlier, allows r…

  • Unscored —
    CVE-2012-3795 Public exploit EPSS 11%

    Pro-face WinGP PC Runtime 3.1.00 and earlier, and ProServr.exe in Pro-face Pro-Server EX 1.30.000 and earlier, allows r…

  • Medium —
    CVE-2012-2660

    Action Pack contains database-query restrictions bypass

    actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows rem…

    actionpack RubyGems
  • High —
    CVE-2012-2695

    activerecord vulnerable to SQL Injection

    The Active Record component in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL inj…

    activerecord RubyGems
  • Medium —
    CVE-2012-2694

    actionpack allows remote attackers to bypass database-query restrictions, perform NULL checks via crafted request

    actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows rem…

    actionpack RubyGems
  • Medium —
    CVE-2012-2661 Public exploit

    Active Record vulnerable to SQL Injection via nested query parameters

    The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain S…

    activerecord RubyGems
  • Unscored —
    CVE-2012-0191

    The web container in IBM Lotus Expeditor 6.1.x and 6.2.x before 6.2 FP5+Security Pack does not properly perform access …

  • Unscored —
    CVE-2012-0304

    Symantec LiveUpdate Administrator before 2.3.1 uses weak permissions (Everyone: Full Control) for the installation dire…

  • Unscored —
    CVE-2012-0186

    Directory traversal vulnerability in the Eclipse Help component in IBM Lotus Expeditor 6.1.x and 6.2.x before 6.2 FP5+S…

  • Unscored —
    CVE-2012-0187

    Untrusted search path vulnerability in IBM Lotus Expeditor 6.1.x and 6.2.x before 6.2 FP5+Security Pack allows local us…

  • Unscored —
    CVE-2012-2172 Public exploit

    Cross-site scripting (XSS) vulnerability in SoftwareRegistration.do in the Storage Manager Profiler in IBM System Stora…

  • Unscored —
    CVE-2012-2171 Public exploit

    SQL injection vulnerability in ModuleServlet.do in the Storage Manager Profiler in IBM System Storage DS Storage Manage…

  • Unscored —
    CVE-2012-2179 Public exploit

    libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a tempora…

  • Unscored —
    CVE-2011-0716

    The br_multicast_add_group function in net/bridge/br_multicast.c in the Linux kernel before 2.6.38, when a certain Ethe…

  • Unscored —
    CVE-2011-0006

    The ima_lsm_rule_init function in security/integrity/ima/ima_policy.c in the Linux kernel before 2.6.37, when the Linux…

  • Unscored —
    CVE-2011-1023

    The Reliable Datagram Sockets (RDS) subsystem in the Linux kernel before 2.6.38 does not properly handle congestion map…

  • Unscored —
    CVE-2011-1021 Public exploit

    drivers/acpi/debugfs.c in the Linux kernel before 3.0 allows local users to modify arbitrary kernel memory locations by…