Skip to content
OpenAdvisories

Archive

August 2012

Vulnerabilities first published in this month (UTC), newest first.

← July 2012 2012 / August September 2012 →
  1. 1 
  2. 2 
  3. 3 
  4. 4 
  5. 5 
  6. 663
  7. 720
  8. 812
  9. 96
  10. 107
  11. 11 
  12. 1235
  13. 1356
  14. 1438
  15. 1552
  16. 1623
  17. 1720
  18. 18 
  19. 197
  20. 2037
  21. 2117
  22. 2235
  23. 2330
  24. 244
  25. 2555
  26. 2665
  27. 2719
  28. 2812
  29. 2947
  30. 3017
  31. 3158
All Critical High Medium Low Exploited only Public exploit

16 results · Clear filters · Feed

  • Medium —
    CVE-2012-3467

    Apache QPID Allows Remote Authentication Bypass

    Apache QPID 0.14, 0.16, and earlier uses a NullAuthenticator mechanism to authenticate catch-up shadow connections to AMQP brokers, which allows remote attackers to bypass authentication.

    org.apache.qpid:qpid-parent Maven
  • Medium —
    CVE-2012-2112

    Typo3 Exception Handler XSS

    Cross-site scripting (XSS) vulnerability in the Exception Handler in TYPO3 4.4.x before 4.4.15, 4.5.x before 4.5.15, 4.6.x before 4.6.8, and 4.7 allows remote attackers to inject arbitrary web script or HTML via exception messages.

    typo3/cms Packagist
  • Medium —
    CVE-2012-1296

    Elefant CMS Multiple XSS Vulnerabilities

    Multiple cross-site scripting (XSS) vulnerabilities in apps/admin/handlers/preview.php in Elefant CMS 1.0.x before 1.0.2-Beta and 1.1.x before 1.1.5-Beta allow remote attackers to inject arbitrary web script or HTML via the (1) title or (2) body parameter to …

    elefant/cms Packagist
  • Medium 4.8
    CVE-2010-5175

    Race condition in PrivateFirewall 7.0.20.37 on Windows XP allows local users to bypass kernel-mode hook handlers, and e…

  • Medium 5.3
    CVE-2010-5164

    Race condition in KingSoft Personal Firewall 9 Plus 2009.05.07.70 on Windows XP allows local users to bypass kernel-mod…

  • Medium 5.3
    CVE-2010-5153

    Race condition in Avira Premium Security Suite 10.0.0.536 on Windows XP allows local users to bypass kernel-mode hook h…

  • Medium 4.5
    CVE-2010-5160

    Race condition in ESET Smart Security 4.2.35.3 on Windows XP allows local users to bypass kernel-mode hook handlers, an…

  • Medium 6.5
    CVE-2012-3447

    Arbitrary file overwrite in OpenStack Nova

    virt/disk/api.py in OpenStack Compute (Nova) 2012.1.x before 2012.1.2 and Folsom before Folsom-3 allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an image that uses a symlink that is only readable by root. NOTE:…

    nova nova Debian PyPI
  • Medium —
    CVE-2012-1585

    OpenStack Nova Long server names grow nova-api log files significantly

    OpenStack Compute (Nova) Essex before 2011.3 allows remote authenticated users to cause a denial of service (Nova-API log file and disk consumption) via a long server name.

    nova nova Debian PyPI
  • Medium —
    CVE-2012-3463

    actionpack Cross-site Scripting vulnerability

    Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_tag_helper.rb in Ruby on Rails 3.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via the prompt fiel…

    actionpack RubyGems
  • Medium —
    CVE-2012-3464

    activesupport Cross-site Scripting vulnerability

    Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via ve…

    rails activesupport Debian RubyGems
  • Medium —
    CVE-2012-3465

    actionpack Cross-site Scripting vulnerability

    Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/sanitize_helper.rb in the strip_tags helper in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTM…

    rails actionpack Debian RubyGems
  • Medium —
    CVE-2012-3424

    actionpack Improper Authentication vulnerability

    The decode_credentials method in actionpack/lib/action_controller/metal/http_authentication.rb in Ruby on Rails 3.x before 3.0.16, 3.1.x before 3.1.7, and 3.2.x before 3.2.7 converts Digest Authentication strings to symbols, which allows remote attackers to c…

    actionpack RubyGems
  • Medium —
    CVE-2010-5142

    Chef Improper Access Control vulnerability

    chef-server-api/app/controllers/users.rb in the API in Chef before 0.9.0 does not require administrative privileges for the create, destroy, and update methods, which allows remote authenticated users to manage user accounts via requests to the /users URI.

    chef RubyGems
  • Medium —
    CVE-2012-0213

    Denial of Service in Apache POI

    The UnhandledDataStructure function in hwpf/model/UnhandledDataStructure.java in Apache POI 3.8 and earlier allows remote attackers to cause a denial of service (OutOfMemoryError exception and possibly JVM destabilization) via a crafted length value in a Chan…

    org.apache.poi:poi org.apache.poi:poi-scratchpad Maven
  • Medium —
    CVE-2012-3867

    Pupper does not properly restrict characters in Common Name field of Certificate Signing Request

    lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for u…

    puppet puppet Debian RubyGems