Skip to content
OpenAdvisories

Archive

September 2012

Vulnerabilities first published in this month (UTC), newest first.

← August 2012 2012 / September October 2012 →
  1. 1 
  2. 2 
  3. 3 
  4. 413
  5. 540
  6. 680
  7. 757
  8. 88
  9. 919
  10. 1044
  11. 118
  12. 128
  13. 1358
  14. 1411
  15. 1529
  16. 1616
  17. 1721
  18. 1824
  19. 1935
  20. 2060
  21. 215
  22. 22 
  23. 2319
  24. 243
  25. 2530
  26. 2631
  27. 279
  28. 2827
  29. 29 
  30. 30 
All Critical High Medium Low Exploited only Public exploit

16 results · Clear filters · Feed

  • Medium —
    CVE-2012-1188 Public exploit

    Fork CMS Multiple XSS Vulnerabilities

    Multiple cross-site scripting (XSS) vulnerabilities in Fork CMS before 3.2.7 allow remote attackers to inject arbitrary web script or HTML via the (1) type or (2) querystring parameters to private/en/error or (3) name parameter to private/en/locale/index.

    forkcms/forkcms Packagist
  • Medium —
    CVE-2011-4941

    Piwik (now Matomo) Vulnerable to Arbitrary Code Execution

    Unspecified vulnerability in Piwik 1.2 through 1.4 allows remote attackers with the view permission to execute arbitrary code via unknown attack vectors.

    matomo/matomo piwik/piwik Packagist
  • Medium —
    CVE-2012-4413

    OpenStack Keystone does not invalidate existing tokens when granting or revoking roles

    OpenStack Keystone 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles.

    keystone keystone Debian PyPI
  • Medium 5.9
    CVE-2012-2993

    Microsoft Windows Phone 7 does not verify the domain name in the subject's Common Name (CN) field of an X.509 certifica…

  • Medium —
    CVE-2011-4962

    Silverstripe CMS Arbitrary Code Execution

    code/sitefeatures/PageCommentInterface.php in SilverStripe 2.4.x before 2.4.6 might allow remote attackers to execute arbitrary code via a crafted cookie in a user comment submission, which is not properly handled when it is deserialized.

    silverstripe/cms Packagist
  • Medium —
    CVE-2012-4968

    Silverstripe XSS Vulnerabilities

    Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe 2.3.x before 2.3.13 and 2.4.x before 2.4.7 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted string to the AbsoluteLinks, (2) BigSummary, (3) ContextSummary, (4)…

    silverstripe/framework Packagist
  • Medium 5.3
    CVE-2012-3458

    Beaker Sensitive Information Disclosure vulnerability

    Beaker before 1.6.4, when using PyCrypto to encrypt sessions, uses AES in ECB cipher mode, which might allow remote attackers to obtain portions of sensitive session data via unspecified vectors.

    beaker beaker Debian PyPI
  • Medium 5.4
    CVE-2012-4404

    MoinMoin Improper Access Control

    security/__init__.py in MoinMoin 1.9 through 1.9.4 does not properly handle group names that contain virtual group names such as "All," "Known," or "Trusted," which allows remote authenticated users with virtual group membership to be treated as a member of t…

    moin PyPI
  • Medium —
    CVE-2012-4386

    Cross-Site Request Forgery in Apache Struts

    The token check mechanism in Apache Struts 2.0.0 through 2.3.4 does not properly validate the token name configuration parameter, which allows remote attackers to perform cross-site request forgery (CSRF) attacks by setting the token name configuration parame…

    org.apache.struts:struts2-core Maven
  • Medium —
    CVE-2012-4387

    Denial of service in Apache Struts

    Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is processed as an OGNL expression.

    org.apache.struts.xwork:xwork-core Maven
  • Medium —
    CVE-2012-3530

    Typo3 API XSS Vulnerability

    Incomplete blacklist vulnerability in the t3lib_div::quoteJSvalue API function in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain HTML5 JavaScript events.

    typo3/cms Packagist
  • Medium —
    CVE-2012-3531

    Typo3 Install Tool XSS Vulnerability

    Cross-site scripting (XSS) vulnerability in the Install Tool in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    typo3/cms Packagist
  • Medium —
    CVE-2012-3527

    TYPO3 allows remote authenticated backend users to unserialize arbitrary objects

    view_help.php in the backend help system in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to unserialize arbitrary objects and possibly execute arbitrary PHP code via an unspecified parameter, …

    typo3/cms Packagist
  • Medium —
    CVE-2012-1608

    Typo3 API XSS Vulnerabilities

    The t3lib_div::RemoveXSS API method in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism and inject arbitrary web script or HTML via non pr…

    typo3/cms Packagist
  • Medium —
    CVE-2012-1605

    Typo3 Extbase Framework Unsafe Deserialization

    The Extbase Framework in TYPO3 4.6.x through 4.6.6, 4.7, and 6.0 unserializes untrusted data, which allows remote attackers to unserialize arbitrary objects and possibly execute arbitrary code via vectors related to "a missing signature (HMAC) for a request a…

    typo3/cms Packagist
  • Medium —
    CVE-2012-1607

    TYPO3 allows remote attackers to obtain the database name via a direct request

    The Command Line Interface (CLI) script in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to obtain the database name via a direct request.

    typo3/cms Packagist