Skip to content
OpenAdvisories

Archive

October 2012

Vulnerabilities first published in this month (UTC), newest first.

← September 2012 2012 / October November 2012 →
  1. 149
  2. 24
  3. 312
  4. 425
  5. 512
  6. 614
  7. 710
  8. 850
  9. 963
  10. 1040
  11. 1112
  12. 125
  13. 13 
  14. 14 
  15. 15 
  16. 1667
  17. 1767
  18. 183
  19. 19 
  20. 206
  21. 21 
  22. 2233
  23. 236
  24. 244
  25. 2531
  26. 264
  27. 27 
  28. 281
  29. 299
  30. 301
  31. 3125
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium —
    CVE-2012-5368

    phpMyAdmin Unsafe Fetching of Javascript Code

    phpMyAdmin 3.5.x before 3.5.3 uses JavaScript code that is obtained through an HTTP session to phpmyadmin.net without SSL, which allows man-in-the-middle attackers to conduct cross-site scripting (XSS) attacks by modifying this code.

    phpmyadmin/phpmyadmin Packagist
  • Medium —
    CVE-2012-1154

    Improper Access Control in JBoss mod_cluster

    mod_cluster 1.0.10 before 1.0.10 CP03 and 1.1.x before 1.1.4, as used in JBoss Enterprise Application Platform 5.1.2, when "ROOT" is set to excludedContexts, exposes the root context of the server, which allows remote attackers to bypass access restrictions a…

    org.jboss.mod_cluster:mod_cluster Maven
  • Medium 4.7
    CVE-2012-0518 Exploited

    Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.…

    KEV Mar 28, 2022
  • Medium 6.7
    CVE-2012-5380 Public exploit

    Untrusted search path vulnerability in the installation functionality in Ruby 1.9.3-p194, when installed in the top-lev…

  • Medium —
    CVE-2012-4418

    Apache Axis2 Vulnerable to XML Signature wrapping attack

    Apache Axis2 allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."

    org.apache.axis2:axis2 Maven
  • Medium —
    CVE-2012-5351

    Improper Authentication in Apache Axis2

    Apache Axis2 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack," a different vulnerability than CVE-2012-4418.

    org.apache.axis2:axis2 Maven
  • Medium —
    CVE-2012-4457

    OpenStack Keystone Token authorization for a user in a disabled tenant is allowed

    OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-3 does not properly handle authorization tokens for disabled tenants, which allows remote authenticated users to access the tenant's resources by requesting a token for the tenant.

    keystone keystone Debian PyPI
  • Medium —
    CVE-2012-4437

    Cross-site Scripting in SmartyException

    Cross-site scripting (XSS) vulnerability in the SmartyException class in Smarty (aka smarty-php) before 3.1.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors that trigger a Smarty exception.

    smarty3 smarty/smarty Debian Packagist
  • Medium —
    CVE-2012-2153

    Drupal improper access restrictions

    Drupal 7.x before 7.14 does not properly restrict access to nodes in a list when using a "contributed node access module," which allows remote authenticated users with the "Access the content overview page" permission to read all published nodes by accessing …

    drupal/drupal Packagist