Skip to content
OpenAdvisories

Archive

5 September 2012

Vulnerabilities first published on this day (UTC), newest first.

← August 2012 2012 / September /5 October 2012 →
  1. 1 
  2. 2 
  3. 3 
  4. 413
  5. 540
  6. 680
  7. 757
  8. 88
  9. 919
  10. 1044
  11. 118
  12. 128
  13. 1358
  14. 1411
  15. 1529
  16. 1616
  17. 1721
  18. 1824
  19. 1935
  20. 2060
  21. 215
  22. 22 
  23. 2319
  24. 243
  25. 2530
  26. 2631
  27. 279
  28. 2827
  29. 29 
  30. 30 
All Critical High Medium Low Exploited only Public exploit

40 results · Feed

  • Unscored —
    CVE-2011-3146

    librsvg before 2.34.1 uses the node name to identify the type of node, which allows context-dependent attackers to caus…

    librsvg Debian
  • Unscored —
    CVE-2012-4390

    (1) apps/calendar/appinfo/remote.php and (2) apps/contacts/appinfo/remote.php in ownCloud before 4.0.7 allows remote au…

  • Unscored —
    CVE-2012-4391

    Cross-site request forgery (CSRF) vulnerability in core/ajax/appconfig.php in ownCloud before 4.0.7 allows remote attac…

  • Unscored —
    CVE-2012-4397

    Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.1 allow remote attackers to inject arbitrary…

  • Unscored —
    CVE-2012-4396

    Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.2 allow remote attackers to inject arbitrary…

  • Unscored —
    CVE-2012-4752

    appconfig.php in ownCloud before 4.0.6 does not properly restrict access, which allows remote authenticated users to ed…

  • Unscored —
    CVE-2012-4389

    Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.0.7 allows remote attackers to execute arbit…

  • Unscored —
    CVE-2012-4393

    Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud before 4.0.6 allow remote attackers to hijack th…

  • Unscored —
    CVE-2012-4395

    Cross-site scripting (XSS) vulnerability in index.php in ownCloud before 4.0.3 allows remote attackers to inject arbitr…

  • Medium —
    CVE-2012-4386

    Cross-Site Request Forgery in Apache Struts

    The token check mechanism in Apache Struts 2.0.0 through 2.3.4 does not properly validate the token name configuration parameter, which allows remote attackers to perform cross-site request forgery (CSRF) attacks by setting the token name configuration parame…

    org.apache.struts:struts2-core Maven
  • Unscored —
    CVE-2012-4394

    Cross-site scripting (XSS) vulnerability in apps/files/js/filelist.js in ownCloud before 4.0.5 allows remote attackers …

  • Medium —
    CVE-2012-4387

    Denial of service in Apache Struts

    Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is processed as an OGNL expression.

    org.apache.struts.xwork:xwork-core Maven
  • Unscored —
    CVE-2012-4392

    index.php in ownCloud 4.0.7 does not properly validate the oc_token cookie, which allows remote attackers to bypass aut…

  • Unscored —
    CVE-2012-4753

    Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud before 4.0.5 allow remote attackers to hijack th…

  • Unscored —
    CVE-2012-3540

    Open redirect vulnerability in views/auth_forms.py in OpenStack Dashboard (Horizon) Essex (2012.1) allows remote attack…

    horizon horizon Debian PyPI
  • Medium —
    CVE-2012-3530

    Typo3 API XSS Vulnerability

    Incomplete blacklist vulnerability in the t3lib_div::quoteJSvalue API function in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain HTML5 JavaScript events.

    typo3/cms Packagist
  • Medium —
    CVE-2012-3531

    Typo3 Install Tool XSS Vulnerability

    Cross-site scripting (XSS) vulnerability in the Install Tool in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    typo3/cms Packagist
  • Unscored —
    CVE-2012-3537

    The Crowbar Ohai plugin (chef/cookbooks/ohai/files/default/plugins/crowbar.rb) in the Deployer Barclamp in Crowbar, pos…

  • Unscored —
    CVE-2012-3509

    Multiple integer overflows in the (1) _objalloc_alloc function in objalloc.c and (2) objalloc_alloc macro in include/ob…

    binutils Debian
  • Unscored —
    CVE-2012-3551 Public exploit

    Cross-site scripting (XSS) vulnerability in crowbar_framework/app/views/support/index.html.haml in the Crowbar barclamp…

  • Low —
    CVE-2012-3529

    Typo3 Backend Configuration XSS Vulnerability

    The configuration module in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to obtain the encryption key via unspecified vectors.

    typo3/cms Packagist
  • Medium —
    CVE-2012-3527

    TYPO3 allows remote authenticated backend users to unserialize arbitrary objects

    view_help.php in the backend help system in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to unserialize arbitrary objects and possibly execute arbitrary PHP code via an unspecified parameter, …

    typo3/cms Packagist
  • Unscored —
    CVE-2012-3535

    Heap-based buffer overflow in OpenJPEG 1.5.0 and earlier allows remote attackers to cause a denial of service (applicat…

  • Unscored —
    CVE-2012-3526

    The reverse proxy add forward module (mod_rpaf) 0.5 and 0.6 for the Apache HTTP Server allows remote attackers to cause…

    libapache2-mod-rpaf Debian
  • Low —
    CVE-2012-3528

    Typo3 Backend XSS Vulnerability

    Multiple cross-site scripting (XSS) vulnerabilities in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.

    typo3/cms Packagist
  • High 7.5
    CVE-2012-3542

    OpenStack Keystone Allows Remote User Account Creation

    OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), allows remote attackers to add an arbitrary user to an arbitrary tenant via a request to update the user's default tenant to the administrative API. NOTE: this ide…

    keystone keystone Debian PyPI
  • Unscored —
    CVE-2010-4819

    The ProcRenderAddGlyphs function in the Render extension (render/render.c) in X.Org xserver 1.7.7 and earlier allows lo…

    xorg-server Debian
  • Unscored —
    CVE-2010-4818

    The GLX extension in X.Org xserver 1.7.7 allows remote authenticated users to cause a denial of service (server crash) …

    xorg-server Debian
  • Unscored —
    CVE-2011-4451 Public exploit EPSS 14%

    libs/Wakka.class.php in WikkaWiki 1.3.1 and 1.3.2, when the spam_logging option is enabled, allows remote attackers to …

  • Unscored —
    CVE-2011-4448 Public exploit

    SQL injection vulnerability in actions/usersettings/usersettings.php in WikkaWiki 1.3.1 and 1.3.2 allows remote attacke…

  • Unscored —
    CVE-2011-4449 Public exploit

    actions/files/files.php in WikkaWiki 1.3.1 and 1.3.2, when INTRANET_MODE is enabled, supports file uploads for file ext…

  • Unscored —
    CVE-2011-4452 Public exploit

    Cross-site request forgery (CSRF) vulnerability in the AdminUsers component in WikkaWiki 1.3.1 and 1.3.2 allows remote …

  • Unscored —
    CVE-2011-4450 Public exploit

    Directory traversal vulnerability in handlers/files.xml/files.xml.php in WikkaWiki 1.3.1 and 1.3.2 allows remote attack…

  • Unscored —
    CVE-2012-3012

    The Arbiter Power Sentinel 1133A device with firmware before 11Jun2012 Rev 421 allows remote attackers to cause a denia…

  • Unscored —
    CVE-2012-2068

    Multiple cross-site scripting (XSS) vulnerabilities in fancy_slide.module in the Fancy Slide module before 6.x-2.7 for …

  • Unscored —
    CVE-2012-2064

    Cross-site scripting (XSS) vulnerability in theme/views_lang_switch.theme.inc in the Views Language Switcher module bef…

  • Unscored —
    CVE-2012-2067

    Unspecified vulnerability in the CKeditor module 6.x-2.x before 6.x-2.3 and the CKEditor module 6.x-1.x before 6.x-1.9 …

  • Unscored —
    CVE-2012-2065

    Cross-site scripting (XSS) vulnerability in the Language Icons module 6.x-2.x before 6.x-2.1 and 7.x-1.x before 7.x-1.0…

  • Unscored —
    CVE-2012-2063

    The Slidebox module before 7.x-1.4 for Drupal does not properly check permissions, which allows remote attackers to obt…

  • Unscored —
    CVE-2012-2066

    Cross-site scripting (XSS) vulnerability in the FCKeditor module 6.x-2.x before 6.x-2.3 and the CKEditor module 6.x-1.x…