Skip to content
OpenAdvisories

Archive

July 2012

Vulnerabilities first published in this month (UTC), newest first.

← June 2012 2012 / July August 2012 →
  1. 1 
  2. 2 
  3. 345
  4. 4 
  5. 520
  6. 6 
  7. 75
  8. 8 
  9. 910
  10. 1014
  11. 1116
  12. 1234
  13. 1312
  14. 14 
  15. 15 
  16. 1628
  17. 1799
  18. 1829
  19. 194
  20. 2017
  21. 2115
  22. 2218
  23. 2319
  24. 243
  25. 25113
  26. 2616
  27. 272
  28. 282
  29. 29 
  30. 303
  31. 3112
All Critical High Medium Low Exploited only Public exploit

536 results · Feed

  • High 7.5
    CVE-2012-3444

    Django vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer

    The get_image_dimensions function in the image-handling functionality in Django before 1.3.2 and 1.4.x before 1.4.1 uses a constant chunk size in all attempts to determine dimensions, which allows remote attackers to cause a denial of service (process or thre…

    python-django django Debian PyPI
  • High 7.5
    CVE-2012-3443

    Django Image Field Vulnerable to Image Decompression Bombs

    The django.forms.ImageField class in the form system in Django before 1.3.2 and 1.4.x before 1.4.1 completely decompresses image data during image validation, which allows remote attackers to cause a denial of service (memory consumption) by uploading an imag…

    python-django django Debian PyPI
  • Medium 6.1
    CVE-2012-3442

    Django Allows Redirect via Data URL

    The (1) django.http.HttpResponseRedirect and (2) django.http.HttpResponsePermanentRedirect classes in Django before 1.3.2 and 1.4.x before 1.4.1 do not validate the scheme of a redirect target, which might allow remote attackers to conduct cross-site scriptin…

    python-django django Debian PyPI
  • Medium —
    CVE-2012-3426

    OpenStack Keystone token expiration issues

    OpenStack Keystone before 2012.1.1, as used in OpenStack Folsom before Folsom-1 and OpenStack Essex, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by (1) creating new tokens…

    keystone keystone Debian PyPI
  • Unscored —
    CVE-2012-3951 Public exploit EPSS 52%

    The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default passwo…

  • Unscored —
    CVE-2012-3016

    Siemens SIMATIC S7-400 PN CPU devices with firmware 6 before 6.0.3 allow remote attackers to cause a denial of service …

  • Unscored —
    CVE-2012-3017

    Siemens SIMATIC S7-400 PN CPU devices with firmware 5.x allow remote attackers to cause a denial of service (defect-mod…

  • Unscored —
    CVE-2012-3018

    The lockout-recovery feature in the Security Configurator component in ICONICS GENESIS32 9.22 and earlier and BizViz 9.…

  • Unscored —
    CVE-2012-3848 Public exploit

    Multiple cross-site scripting (XSS) vulnerabilities in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scruti…

  • Unscored —
    CVE-2012-2647

    Yahoo! Toolbar 1.0.0.5 and earlier for Chrome and Safari allows remote attackers to modify the configured search URL, a…

  • Unscored —
    CVE-2012-2627 Public exploit

    d4d/uploader.php in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 allows remote a…

  • Unscored —
    CVE-2012-2626 Public exploit EPSS 44%

    cgi-bin/admin.cgi in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 does not requi…

  • Unscored —
    CVE-2012-2962 Public exploit EPSS 67%

    SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2…

  • Unscored —
    CVE-2012-0723

    The kernel in IBM AIX 5.3, 6.1, and 7.1, and VIOS 2.2.1.4-FP-25 SP-02, does not properly implement the dupmsg system ca…

  • Unscored —
    CVE-2012-2163

    IBM Scale Out Network Attached Storage (SONAS) 1.1 through 1.3.1 allows remote authenticated administrators to execute …

  • Unscored —
    CVE-2012-1968

    Bugzilla 4.1.x and 4.2.x before 4.2.2 and 4.3.x before 4.3.2 uses bug-editor privileges instead of bugmail-recipient pr…

  • Unscored —
    CVE-2012-1969

    The get_attachment_link function in Template.pm in Bugzilla 2.x and 3.x before 3.6.10, 3.7.x and 4.0.x before 4.0.7, 4.…

  • Unscored —
    CVE-2012-2202 Public exploit

    Directory traversal vulnerability in javatester_init.php in IBM Lotus Protector for Mail Security 2.1, 2.5, 2.5.1, and …

  • Unscored —
    CVE-2012-2978

    query.c in NSD 3.0.x through 3.0.8, 3.1.x through 3.1.1, and 3.2.x before 3.2.12 allows remote attackers to cause a den…

  • Unscored —
    CVE-2011-3174

    Buffer overflow in the DoFindReplace function in the ISGrid.Grid2.1 ActiveX control in InstallShield/ISGrid2.dll in Adm…

  • Unscored —
    CVE-2011-2657 Public exploit EPSS 48%

    Directory traversal vulnerability in the LaunchProcess function in the LaunchHelp.HelpLauncher.1 ActiveX control in Lau…

  • Unscored —
    CVE-2011-2658

    The ISList.ISAvi ActiveX control in AdminStudio in Novell ZENworks Configuration Management (ZCM) 10.2, 10.3, and 11 SP…

  • Unscored —
    CVE-2012-3887

    AirDroid before 1.0.7 beta uses a cleartext base64 format for data transfer that is documented as an "Encrypted Transmi…

  • Unscored —
    CVE-2012-3885

    The default configuration of AirDroid 1.0.4 beta uses a four-character alphanumeric password, which makes it easier for…

  • Unscored —
    CVE-2012-3884

    AirDroid 1.0.4 beta implements authentication through direct transmission of a password hash over HTTP, which makes it …

  • Unscored —
    CVE-2012-3888

    The login implementation in AirDroid 1.0.4 beta allows remote attackers to bypass a multiple-login protection mechanism…

  • Unscored —
    CVE-2012-3886

    AirDroid 1.0.4 beta uses the MD5 algorithm for values in the checklogin key parameter and 7bb cookie, which makes it ea…

  • Unscored —
    CVE-2011-4963

    nginx/Windows 1.3.x before 1.3.1 and 1.2.x before 1.2.1 allows remote attackers to bypass intended access restrictions …

  • Unscored —
    CVE-2011-2503

    The insert_module function in runtime/staprun/staprun_funcs.c in the systemtap runtime tool (staprun) in SystemTap befo…

    systemtap Debian
  • Unscored —
    CVE-2011-2502

    runtime/staprun/staprun_funcs.c in the systemtap runtime tool (staprun) in SystemTap before 1.6 does not properly valid…

    systemtap Debian
  • Unscored —
    CVE-2012-4068

    Heap-based buffer overflow in the SoapServer service in Citrix Provisioning Services 5.0, 5.1, 5.6, 5.6 SP1, 6.0, and 6…

  • Unscored —
    CVE-2012-4043

    Cross-site scripting (XSS) vulnerability in global-protect/login.esp in Palo Alto Networks Global Protect Portal, Globa…

  • Unscored —
    CVE-2012-3698

    Apple Xcode before 4.4 does not properly compose a designated requirement (DR) during signing of programs that lack bun…

  • Unscored —
    CVE-2012-3005

    Untrusted search path vulnerability in Invensys Wonderware InTouch 2012 and earlier, as used in Wonderware Application …

  • Unscored —
    CVE-2012-3015

    Untrusted search path vulnerability in Siemens SIMATIC STEP7 before 5.5 SP1, as used in SIMATIC PCS7 7.1 SP3 and earlie…

  • Unscored —
    CVE-2012-4060 Public exploit

    Multiple SQL injection vulnerabilities in ASP-DEv XM Forums RC3 allow remote attackers to execute arbitrary SQL command…

  • Unscored —
    CVE-2012-4055 Public exploit

    SQL injection vulnerability in index2.php in Uiga Fan Club allows remote attackers to execute arbitrary SQL commands vi…

  • Unscored —
    CVE-2012-4057 Public exploit

    Buffer overflow in the Player in Remote-Anything 5.60.15 allows remote attackers to execute arbitrary code via a crafte…

  • Unscored —
    CVE-2012-4054 Public exploit

    Buffer overflow in the readfile function in CPE17 Autorun Killer 1.7.1 and earlier allows physically proximate attacker…

  • Unscored —
    CVE-2012-4056

    SQL injection vulnerability in index2.php in Uiga Personal Portal allows remote attackers to execute arbitrary SQL comm…