Archive
17 November 2012
Vulnerabilities first published on this day (UTC), newest first.
34 results · Feed
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in GreenBrowser 6.1.0117 and 6.1.0216 allow remote attackers to inj…
-
Unscored —CVE-2012-5917 Public exploit
SnackAmp 3.1.3 allows remote attackers to cause a denial of service (application crash) via a long string in an aiff fi…
-
Unscored —
The Annotation Objects Extension ActiveX control in AnnotateX.dll in Quest InTrust 10.4.0.853 and earlier does not prop…
-
Unscored —CVE-2012-5905 Public exploit
Buffer overflow in KnFTPd 1.0.0 allows remote authenticated users to cause a denial of service (crash) via a long strin…
-
Low —
Basic SEO Features (seo_basics) extension TYPO3 vulnerable to Cross-site Scripting
Cross-site scripting (XSS) vulnerability in Basic SEO Features (seo_basics) extension before 0.8.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
-
Unscored —
Unrestricted file upload vulnerability in hava_upload.php in Havalite CMS 1.1.0 and earlier allows remote attackers to …
-
Unscored —CVE-2012-5912 Public exploit
Multiple SQL injection vulnerabilities in PicoPublisher 2.0 allow remote attackers to execute arbitrary SQL commands vi…
-
Unscored —
Cross-site scripting (XSS) vulnerability in wp-integrator.php in the WordPress Integrator module 1.32 for WordPress all…
-
Unscored —CVE-2012-5898 Public exploit
Cross-site request forgery (CSRF) vulnerability in SAMEDIA LandShop 0.9.2 allows remote attackers to hijack the authent…
-
Unscored —CVE-2012-5909 Public exploit
SQL injection vulnerability in admin/modules/user/users.php in MyBB (aka MyBulletinBoard) 1.6.6 allows remote attackers…
-
Unscored —
Neocrome Seditio build 161 allows remote attackers to obtain sensitive information via a direct request to (1) docs/new…
-
Unscored —
SQL injection vulnerability in blogs/htsrv/viewfile.php in b2evolution 4.1.3 allows remote authenticated users to execu…
-
Unscored —CVE-2012-5897 Public exploit
The (1) SimpleTree and (2) ReportTree classes in the ARDoc ActiveX control (ARDoc.dll) in Quest InTrust 10.4.0.853 and …
-
Unscored —
Cross-site scripting (XSS) vulnerability in ptk/lib/modal_bookmark.php in DFLabs PTK 1.0.5 allows remote attackers to i…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in the sed_import function in system/functions.php in Neocrome Sedi…
-
Unscored —
Heap-based buffer overflow in IrfanView before 4.33 allows remote attackers to execute arbitrary code via a crafted RLE…
-
Unscored —
Multiple unspecified vulnerabilities in iRODS before 3.1 have unknown impact and attack vectors.
-
Unscored —CVE-2012-5908 Public exploit
Cross-site scripting (XSS) vulnerability in admin/modules/user/users.php in MyBB (aka MyBulletinBoard) 1.6.6 allows rem…
-
Unscored —CVE-2012-5891 Public exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in photo/pass.php in DAlbum 1.44 build 174 and earlier allow…
-
Unscored —CVE-2012-5903 Public exploit
Cross-site scripting (XSS) vulnerability in Simple Machines Forum (SMF) 2.0.2 allows remote attackers to inject arbitra…
-
Unscored —
Havalite CMS 1.1.0 and earlier stores sensitive information under the web root with insufficient access control, which …
-
Unscored —CVE-2012-5907 Public exploit
Directory traversal vulnerability in json.php in TomatoCart 1.2.0 Alpha 2 and possibly earlier allows remote attackers …
-
Unscored —
Cross-site scripting (XSS) vulnerability in blogs/blog1.php in b2evolution 4.1.3 allows remote attackers to inject arbi…
-
Unscored —CVE-2012-5900 Public exploit
Multiple SQL injection vulnerabilities in SAMEDIA LandShop 0.9.2 allow remote attackers to execute arbitrary SQL comman…
-
Unscored —CVE-2012-5894 Public exploit
SQL injection vulnerability in hava_post.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbit…
-
Low —
powermail extension for TYPO3 has Cross-site Scripting vulnerability
Cross-site scripting (XSS) vulnerability in the powermail extension before 1.6.5 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
-
Unscored —
DFLabs PTK 1.0.5 stores data files with predictable names under the web document root with insufficient access control,…
-
Medium —
Front End User Registration (sr_feuser_register) extension for TYPO3 allows remote attackers to obtain user names, passwords
The Front End User Registration (sr_feuser_register) extension before 2.6.2 for TYPO3 allows remote attackers to obtain user names and passwords via the (1) edit perspective or (2) autologin feature.
-
Unscored —
Neocrome Seditio build 161 and earlier allows remote attackers to obtain sensitive information via direct request to (1…
-
Unscored —CVE-2012-5899 Public exploit
Cross-site scripting (XSS) vulnerability in admin/action/objects.php in SAMEDIA LandShop 0.9.2 allows remote attackers …
-
Medium —CVE-2012-5887 EPSS 12%
Improper Authentication in Apache Tomcat
The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Uk Cookie (aka uk-cookie) plugin for WordPress allows remote attackers …
-
Medium —
Improper Authentication in Apache Tomcat
The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass …
-
Medium —
Improper Access Control in Apache Tomcat
The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (…