Archive

9 October 2012

Vulnerabilities first published on this day (UTC), newest first.

← September 2012 2012 / October /9 November 2012 →

All Critical High Medium Low Exploited only Public exploit

63 results · Feed

High 7.5

CVE-2012-4399 Public exploit EPSS 12%

CakePHPallows remote attackers to read arbitrary files via XML data containing external entity references

The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.

cakephp/cakephp Packagist

Oct 9, 2012
Unscored —

CVE-2012-4002

Cross-site request forgery (CSRF) vulnerability in GLPI-PROJECT GLPI before 0.83.3 allows remote attackers to hijack th…

Oct 9, 2012
Unscored —

CVE-2012-4452

MySQL 5.0.88, and possibly other versions and platforms, allows local users to bypass certain privilege checks by calli…

Oct 9, 2012
Unscored —

CVE-2012-4453

dracut.sh in dracut, as used in Red Hat Enterprise Linux 6, Fedora 16 and 17, and possibly other products, creates init…

dracut Debian

Oct 9, 2012
Unscored —

CVE-2012-4003

Multiple cross-site scripting (XSS) vulnerabilities in GLPI-PROJECT GLPI before 0.83.3 allow remote attackers to inject…

Oct 9, 2012
Medium —

CVE-2012-4418

Apache Axis2 Vulnerable to XML Signature wrapping attack

Apache Axis2 allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."

org.apache.axis2:axis2 Maven

Oct 9, 2012
Unscored —

CVE-2012-3505

Tinyproxy 1.8.3 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via (1) a…

tinyproxy Debian

Oct 9, 2012
Unscored —

CVE-2012-3549 Public exploit

The SCTP implementation in FreeBSD 8.2 allows remote attackers to cause a denial of service (NULL pointer dereference a…

Oct 9, 2012
Unscored —

CVE-2012-5353

Eduserv OpenAthens SP 2.0 for Java allows remote attackers to forge messages and bypass authentication via a SAML asser…

Oct 9, 2012
Medium —

CVE-2012-5351

Improper Authentication in Apache Axis2

Apache Axis2 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack," a different vulnerability than CVE-2012-4418.

org.apache.axis2:axis2 Maven

Oct 9, 2012
Unscored —

CVE-2012-5352

Java Open Single Sign-On Project Home (JOSSO) allows remote attackers to forge messages and bypass authentication via a…

Oct 9, 2012
Unscored —

CVE-2012-0182 EPSS 67%

Microsoft Word 2007 SP2 and SP3 does not properly handle memory during the parsing of Word documents, which allows remo…

Oct 9, 2012
Unscored —

CVE-2012-2529

Integer overflow in the kernel in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows…

Oct 9, 2012
Unscored —

CVE-2012-2551 EPSS 27%

The server in Kerberos in Microsoft Windows Server 2008 R2 and R2 SP1, and Windows 7 Gold and SP1, allows remote attack…

Oct 9, 2012
Unscored —

CVE-2012-2520 EPSS 34%

Cross-site scripting (XSS) vulnerability in Microsoft InfoPath 2007 SP2 and SP3 and 2010 SP1, Communicator 2007 R2, Lyn…

Oct 9, 2012
Unscored —

CVE-2012-2552 EPSS 16%

Cross-site scripting (XSS) vulnerability in the SQL Server Report Manager in Microsoft SQL Server 2000 Reporting Servic…

Oct 9, 2012
Unscored —

CVE-2012-2528 EPSS 22%

Use-after-free vulnerability in Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibil…

Oct 9, 2012
Unscored —

CVE-2012-2550 EPSS 22%

Microsoft Works 9 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruptio…

Oct 9, 2012
Unscored —

CVE-2012-3436

OpenTTD 0.6.0 through 1.2.1 does not properly validate requests to clear a water tile, which allows remote attackers to…

openttd Debian

Oct 9, 2012
Unscored —

CVE-2011-5210

Directory traversal vulnerability in admin/preview.php in Limny 3.0.0 allows remote attackers to read arbitrary files v…

Oct 9, 2012
Unscored —

CVE-2011-5209 Public exploit

Cross-site scripting (XSS) vulnerability in search/ in GraphicsClone Script, possibly 1.11, allows remote attackers to …

Oct 9, 2012
Medium —

CVE-2012-4457

OpenStack Keystone Token authorization for a user in a disabled tenant is allowed

OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-3 does not properly handle authorization tokens for disabled tenants, which allows remote authenticated users to access the tenant's resources by requesting a token for the tenant.

keystone keystone Debian PyPI

Oct 9, 2012
High —

CVE-2012-4456

OpenStack Keystone Improper Authentication vulnerability

The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrar…

keystone keystone Debian PyPI

Oct 9, 2012
Unscored —

CVE-2012-5350 Public exploit

SQL injection vulnerability in the Pay With Tweet plugin before 1.2 for WordPress allows remote authenticated users wit…

Oct 9, 2012
Unscored —

CVE-2012-5341 Public exploit

Multiple cross-site scripting (XSS) vulnerabilities in statistik.php in Otterware StatIt 4 allow remote attackers to in…

Oct 9, 2012
Unscored —

CVE-2012-5344 Public exploit

Directory traversal vulnerability in the WebServer (Thttpd.bat) in IpTools (aka Tiny TCP/IP server) 0.1.4 allows remote…

Oct 9, 2012
Unscored —

CVE-2012-5346 Public exploit

Cross-site scripting (XSS) vulnerability in wp-live.php in the WP Live.php module 1.2.1 for WordPress allows remote att…

Oct 9, 2012
Unscored —

CVE-2012-5347 Public exploit

TinyWebGallery 1.8.3 allows remote attackers to execute arbitrary code via shell metacharacters in the command paramete…

Oct 9, 2012
Unscored —

CVE-2012-5345 Public exploit

Buffer overflow in the Remote command server (Rcmd.bat) in IpTools (aka Tiny TCP/IP server) 0.1.4 allows remote attacke…

Oct 9, 2012
Unscored —

CVE-2012-5342 Public exploit

Multiple SQL injection vulnerabilities in SenseSites CommonSense CMS allow remote attackers to execute arbitrary SQL co…

Oct 9, 2012
Unscored —

CVE-2012-5348 Public exploit

SQL injection vulnerability in MangosWeb Enhanced 3.0.3 allows remote attackers to execute arbitrary SQL commands via t…

Oct 9, 2012
Unscored —

CVE-2012-5343 Public exploit

Cross-site scripting (XSS) vulnerability in admin/login.php in Limny 3.0.1 allows remote attackers to inject arbitrary …

Oct 9, 2012
Unscored —

CVE-2012-5349 Public exploit

Multiple cross-site scripting (XSS) vulnerabilities in pay.php in the Pay With Tweet plugin before 1.2 allow remote att…

Oct 9, 2012
Unscored —

CVE-2012-2900

Skia, as used in Google Chrome before 22.0.1229.92, does not properly render text, which allows remote attackers to cau…

Oct 9, 2012
Unscored —

CVE-2012-5267

Adobe Flash Player before 10.3.183.29 and 11.x before 11.4.402.287 on Windows and Mac OS X, before 10.3.183.29 and 11.x…

Oct 9, 2012
Unscored —

CVE-2012-5270

Adobe Flash Player before 10.3.183.29 and 11.x before 11.4.402.287 on Windows and Mac OS X, before 10.3.183.29 and 11.x…

Oct 9, 2012
Unscored —

CVE-2012-5108

Race condition in Google Chrome before 22.0.1229.92 allows remote attackers to execute arbitrary code via vectors relat…

Oct 9, 2012
Unscored —

CVE-2012-5255

Buffer overflow in Adobe Flash Player before 10.3.183.29 and 11.x before 11.4.402.287 on Windows and Mac OS X, before 1…

Oct 9, 2012
Unscored —

CVE-2012-5249

Buffer overflow in Adobe Flash Player before 10.3.183.29 and 11.x before 11.4.402.287 on Windows and Mac OS X, before 1…

Oct 9, 2012
Unscored —

CVE-2012-5111

Google Chrome before 22.0.1229.92 does not monitor for crashes of Pepper plug-ins, which has unspecified impact and rem…

Oct 9, 2012