Archive
August 2012
Vulnerabilities first published in this month (UTC), newest first.
735 results · Feed
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in (1) application/views/admin/layout.php and (2) themes/default/vi…
-
Unscored —CVE-2012-2585 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine ServiceDesk Plus 8.1 allow remote attackers to inje…
-
Unscored —CVE-2012-2590 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in ESCON SupportPortal Professional Edition 3.0 allow remote attack…
-
Unscored —CVE-2012-2571 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in WinWebMail Server 3.8.1.6 allow remote attackers to inject arbit…
-
Unscored —CVE-2012-2587 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in AfterLogic MailSuite Pro 6.3 allow remote attackers to inject ar…
-
Unscored —CVE-2012-2573 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in T-dah WebMail 3.2.0-2.3 allow remote attackers to inject arbitra…
-
Unscored —
Dir2web 3.0 stores sensitive information under the web root with insufficient access control, which allows remote attac…
-
Unscored —CVE-2012-4070 Public exploit
SQL injection vulnerability in system/src/dispatcher.php in Dir2web 3.0 allows remote attackers to execute arbitrary SQ…
-
Unscored —
The Amazon Kindle Touch before 5.1.2 does not properly restrict access to the libkindleplugin.so NPAPI plugin interface…
-
Unscored —
The Amazon Lab126 com.lab126.system sendEvent implementation on the Kindle Touch before 5.1.2 allows context-dependent …
-
Unscored —CVE-2012-2584 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in Alt-N MDaemon Free 12.5.4 allow remote attackers to inject arbit…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in SolarWinds Orion Network Performance Monitor (NPM) before 10.3.1…
-
Unscored —CVE-2012-2602 Public exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in SolarWinds Orion Network Performance Monitor (NPM) before…
-
Unscored —
The administrative interface in the embedded web server on the BreakingPoint Storm appliance before 3.0 does not requir…
-
High —
Caucho Quercus, as distributed in Resin, does not properly handle unspecified characters in the names of variables
Caucho Quercus, as distributed in Resin before 4.0.29, does not properly handle unspecified characters in the names of variables, which has unknown impact and remote attack vectors, related to an "HTTP Parameter Contamination" issue.
-
High —
Caucho Quercus, as distributed in Resin, does not properly implement the `==` operator for comparisons
Caucho Quercus, as distributed in Resin before 4.0.29, does not properly implement the == (equals sign equals sign) operator for comparisons, which has unspecified impact and context-dependent attack vectors.
-
Unscored —
Caucho Quercus, as distributed in Resin before 4.0.29, allows remote attackers to bypass intended restrictions on filen…
-
Unscored —
The BreakingPoint Storm appliance before 3.0 requires cleartext credentials for establishing a session from a GUI admin…
-
High —
Caucho Quercus, as distributed in Resin, overwrites entries in SERVER superglobal array on basis of POST parameters
Caucho Quercus, as distributed in Resin before 4.0.29, overwrites entries in the SERVER superglobal array on the basis of POST parameters, which has unspecified impact and remote attack vectors.
-
Unscored —
Directory traversal vulnerability in Caucho Quercus, as distributed in Resin before 4.0.29, allows remote attackers to …
-
Unscored —CVE-2012-4247 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote att…
-
Unscored —CVE-2012-4034 Public exploit
Multiple SQL injection vulnerabilities in PBBoard 2.1.4 allow remote attackers to execute arbitrary SQL commands via th…
-
Unscored —CVE-2012-4035 Public exploit
The new_password page in PBBoard 2.1.4 allows remote attackers to change the password of arbitrary user accounts via th…
-
Unscored —CVE-2012-4246 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote att…
-
Unscored —CVE-2012-3953 Public exploit
SQL injection vulnerability in admin/index.php in phpList before 2.10.19 allows remote administrators to execute arbitr…
-
Unscored —
PNP4Nagios 0.6 through 0.6.16 uses world-readable permissions for process_perfdata.cfg, which allows local users to obt…
-
Unscored —CVE-2012-3952 Public exploit
Cross-site scripting (XSS) vulnerability in admin/index.php in phpList before 2.10.19 allows remote attackers to inject…
-
Unscored —
SQL injection vulnerability in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 al…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the comments module in the RSGallery2 (com_rsgallery2) component before 2.3…
-
Unscored —
The RSGallery2 (com_rsgallery2) component before 3.2.0 for Joomla! 2.5.x does not place index.html files in image direc…
-
Medium —
actionpack Cross-site Scripting vulnerability
Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_tag_helper.rb in Ruby on Rails 3.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via the prompt fiel…
-
Unscored —
SQL injection vulnerability in the RSGallery2 (com_rsgallery2) component before 2.3.0 for Joomla! 1.5.x, and before 3.2…
-
Medium —
activesupport Cross-site Scripting vulnerability
Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via ve…
-
Medium —
actionpack Cross-site Scripting vulnerability
Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/sanitize_helper.rb in the strip_tags helper in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTM…
-
Unscored —
The copy_creds function in kernel/cred.c in the Linux kernel before 3.3.2 provides an invalid replacement session keyri…
-
Unscored —
net/ipv6/netfilter/nf_conntrack_reasm.c in the Linux kernel before 2.6.34, when the nf_conntrack_ipv6 module is enabled…
-
Unscored —
Use-after-free vulnerability in the PDF functionality in Google Chrome before 21.0.1180.75 allows remote attackers to c…
-
Unscored —
The sock_alloc_send_pskb function in net/core/sock.c in the Linux kernel before 3.4.5 does not properly validate a cert…
-
Unscored —
The PDF functionality in Google Chrome before 21.0.1180.75 allows remote attackers to cause a denial of service or poss…
-
Unscored —
The Linux kernel before 3.4.5 on the x86 platform, when Physical Address Extension (PAE) is enabled, does not properly …