Archive
November 2012
Vulnerabilities first published in this month (UTC), newest first.
436 results · Feed
-
Unscored —
Moodle 2.3.x before 2.3.3 allows remote authenticated users to bypass the moodle/role:manage capability requirement and…
-
Unscored —
Heap-based buffer overflow in the nsWindow::OnExposeEvent function in Mozilla Firefox before 17.0, Firefox ESR 10.x bef…
-
Medium —
Moodle Allows Unauthenticated Dropbox Access
The Dropbox Repository File Picker in Moodle 2.1.x before 2.1.9, 2.2.x before 2.2.6, and 2.3.x before 2.3.3 allows remote authenticated users to access the Dropbox of a different user by leveraging an unattended workstation after a logout.
-
Unscored —
The Database activity module in Moodle 2.1.x before 2.1.9, 2.2.x before 2.2.6, and 2.3.x before 2.3.3 allows remote att…
-
Unscored —
lib/formslib.php in Moodle 2.2.x before 2.2.6 and 2.3.x before 2.3.3 allows remote authenticated users to bypass intend…
-
Unscored —
The texImage2D implementation in the WebGL subsystem in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, T…
-
Unscored —
The vSphere API in VMware ESXi 4.1 and ESX 4.1 allows remote attackers to cause a denial of service (host daemon crash)…
-
Unscored —
Unspecified vulnerability in Adobe ColdFusion 10 before Update 5, when Internet Information Services (IIS) is used, all…
-
Unscored —
icecast before 2.3.3 allows remote attackers to inject control characters such as newlines into the error loc (error.lo…
-
Unscored —CVE-2012-4366 Public exploit
Belkin wireless routers Surf N150 Model F7D1301v1, N900 Model F9K1104v1, N450 Model F9K1105V2, and N300 Model F7D2301v1…
-
Unscored —
Cross-site scripting (XSS) vulnerability in Google Web Toolkit (GWT) 2.4 Beta and release candidates before 2.4.0 allow…
-
Unscored —
The DTLS support in radsecproxy before 1.6.2 does not properly verify certificates when there are configuration blocks …
-
Unscored —
cups-pk-helper before 0.2.3 does not properly wrap the (1) cupsGetFile and (2) cupsPutFile function calls, which allows…
-
Unscored —
radsecproxy before 1.6.1 does not properly verify certificates when there are configuration blocks with CA settings tha…
-
Unscored —
doku.php in DokuWiki, as used in Fedora 16, 17, and 18, when certain PHP error levels are set, allows remote attackers …
-
Unscored —CVE-2012-5519 Public exploit
CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web interface administrato…
-
Unscored —
Cross-site scripting (XSS) vulnerability in Google Web Toolkit (GWT) 2.4 through 2.5 Final, as used in JBoss Operations…
-
Unscored —
TraceManager in Firebird 2.5.0 and 2.5.1, when trace is enabled, allows remote authenticated users to cause a denial of…
-
Unscored —
Heap-based buffer overflow in the linetoken function in afmparse.c in t1lib, as used in teTeX 3.0.x, GNOME evince, and …
-
Unscored —
nspluginwrapper before 1.4.4 does not properly provide access to NPNVprivateModeBool variable settings, which could pre…
-
Unscored —
Multiple off-by-one errors in the (1) token and (2) linetoken functions in backend/dvi/mdvi-lib/afmparse.c in t1lib, as…
-
Unscored —
The virNetServerProgramDispatchCall function in libvirt before 0.10.2 allows remote attackers to cause a denial of serv…
-
Unscored —
LibreOffice 3.5.x before 3.5.7.2 and 3.6.x before 3.6.1, and OpenOffice.org (OOo), allows remote attackers to cause a d…
-
Unscored —
NVIDIA UNIX graphics driver before 295.71 and before 304.32 allows local users to write to arbitrary physical memory lo…
-
Unscored —
Cross-site scripting (XSS) vulnerability in Piwik before 1.9 allows remote attackers to inject arbitrary web script or …
-
Unscored —CVE-2012-5918 Public exploit
razorCMS 1.2 allows remote authenticated users to access administrator directories and files by creating and deleting a…
-
Unscored —
Heap-based buffer overflow in WeeChat 0.3.6 through 0.3.9 allows remote attackers to cause a denial of service (crash o…
-
Unscored —CVE-2012-5919 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in Havalite 1.0.4 and earlier allow remote attackers to inject arbi…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the "extra" details in the DiffSource._get_row function in lib/viewvc.py in…
-
Unscored —CVE-2012-4552 Public exploit
Stack-based buffer overflow in the error function in ssg/ssgParser.cxx in PLIB 1.8.5 allows remote attackers to execute…
-
Unscored —CVE-2012-4433 EPSS 13%
Multiple integer overflows in operations/external/ppm-load.c in GEGL (Generic Graphics Library) 0.2.0 allow remote atta…
-
High 7.5
Django Allows Arbitrary URL Generation
The django.http.HttpRequest.get_host function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and display arbitrary URLs via crafted username and password Host header values.
-
Unscored —
GlusterFS 3.3.0, as used in Red Hat Storage server 2.0, allows local users to overwrite arbitrary files via a symlink a…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the web interface in Pattern Insight 2.3 allows remote authenticated admini…
-
Unscored —
Agile FleetCommander and FleetCommander Kiosk before 4.08 use an XOR format for password encryption, which makes it eas…
-
Unscored —
The web interface in Pattern Insight 2.3 allows remote attackers to conduct clickjacking attacks via a FRAME element.
-
Unscored —
Session fixation vulnerability in the web interface in Pattern Insight 2.3 allows remote attackers to hijack web sessio…
-
Unscored —
Multiple cross-site request forgery (CSRF) vulnerabilities in Agile FleetCommander and FleetCommander Kiosk before 4.08…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Keyword Search page in the web interface in Pattern Insight 2.3 allows …
-
Unscored —
Agile FleetCommander and FleetCommander Kiosk before 4.08 store database credentials in cleartext, which allows remote …