Skip to content
OpenAdvisories

Archive

November 2012

Vulnerabilities first published in this month (UTC), newest first.

← October 2012 2012 / November December 2012 →
  1. 17
  2. 28
  3. 33
  4. 449
  5. 5 
  6. 68
  7. 724
  8. 86
  9. 99
  10. 101
  11. 1119
  12. 12 
  13. 138
  14. 1431
  15. 154
  16. 1615
  17. 1734
  18. 1821
  19. 1911
  20. 2012
  21. 2145
  22. 222
  23. 2336
  24. 2413
  25. 25 
  26. 2618
  27. 279
  28. 2814
  29. 293
  30. 3026
All Critical High Medium Low Exploited only Public exploit

436 results · Feed

  • Medium —
    CVE-2012-5887 EPSS 12%

    Improper Authentication in Apache Tomcat

    The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for…

    org.apache.tomcat:tomcat Maven
  • Unscored —
    CVE-2012-5856

    Cross-site scripting (XSS) vulnerability in the Uk Cookie (aka uk-cookie) plugin for WordPress allows remote attackers …

    Web / CMS
  • Medium —
    CVE-2012-5886

    Improper Authentication in Apache Tomcat

    The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass …

    org.apache.tomcat:tomcat-catalina Maven
  • Medium —
    CVE-2012-5885

    Improper Access Control in Apache Tomcat

    The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (…

    org.apache.tomcat:tomcat Maven
  • Unscored —
    CVE-2012-2733

    java/org/apache/coyote/http11/InternalNioInputBuffer.java in the HTTP NIO connector in Apache Tomcat 6.x before 6.0.36 …

  • Unscored —
    CVE-2012-5172

    The Asial Monaca Debugger application before 1.4.2 for Android allows remote attackers to obtain sensitive (1) account …

  • Unscored —
    CVE-2012-4199

    template/en/default/bug/field-events.js.tmpl in Bugzilla 3.x before 3.6.12, 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2…

  • Unscored —
    CVE-2012-4198

    The User.get method in Bugzilla/WebService/User.pm in Bugzilla 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2…

  • Unscored —
    CVE-2012-4197

    Bugzilla/Attachment.pm in attachment.cgi in Bugzilla 2.x and 3.x before 3.6.12, 3.7.x and 4.0.x before 4.0.9, 4.1.x and…

  • Unscored —
    CVE-2012-4189

    Cross-site scripting (XSS) vulnerability in Bugzilla 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1, a…

  • Unscored —
    CVE-2012-5883

    Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.8.0 through 2.9.0, as used in B…

  • Unscored —
    CVE-2012-5884

    The User.get method in Bugzilla/WebService/User.pm in Bugzilla 4.3.2 allows remote attackers to obtain sensitive inform…

  • Medium —
    CVE-2012-5881

    Cross-site scripting in yui 2.4.0

    Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.4.0 through 2.9.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to charts.swf, a similar issue to CVE-2010-4207.

    yui2 npm
  • Unscored —
    CVE-2012-5882

    Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.5.0 through 2.9.0 allows remote…

  • Unscored —
    CVE-2012-4612

    Cross-site scripting (XSS) vulnerability in EMC RSA Data Protection Manager Appliance and Software Server 2.7.x and 3.x…

  • Unscored —
    CVE-2012-4613

    EMC RSA Data Protection Manager Appliance 2.7.x and 3.x before 3.2.1 does not properly restrict the number of authentic…

  • Unscored —
    CVE-2012-5522

    MantisBT before 1.2.12 does not use an expected default value during decisions about whether a user may modify the stat…

  • Unscored —
    CVE-2012-5777

    Eval injection vulnerability in the ReplaceListVars function in the template parser in e/class/connect.php in EmpireCMS…

  • Unscored —
    CVE-2012-5523

    core/email_api.php in MantisBT before 1.2.12 does not properly manage the sending of e-mail notifications about restric…

  • Unscored —
    CVE-2012-4955

    Cross-site scripting (XSS) vulnerability in Dell OpenManage Server Administrator (OMSA) before 6.5.0.1, 7.0 before 7.0.…

  • Unscored —
    CVE-2012-4951 Public exploit

    Multiple SQL injection vulnerabilities in terminal/paramedit.aspx in VeriFone VeriCentre Web Console before 2.2 build 3…

  • Unscored —
    CVE-2012-4954

    The edit-profile page in Vanilla Forums before 2.1a32 allows remote authenticated users to modify arbitrary profile set…

  • Unscored —
    CVE-2012-5851 Public exploit

    html/parser/XSSAuditor.cpp in WebCore in WebKit, as used in Google Chrome through 22 and Safari 5.1.7, does not conside…

    qtwebkit-source Ubuntu
  • Unscored —
    CVE-2012-4847

    IBM Cognos Business Intelligence (BI) 8.4 and 8.4.1 allows remote authenticated users to cause a denial of service (CPU…

  • Unscored —
    CVE-2012-4850

    IBM WebSphere Application Server 8.5 Liberty Profile before 8.5.0.1, when JAX-RS is used, does not properly validate re…

  • Unscored —
    CVE-2012-4948

    The default configuration of Fortinet Fortigate UTM appliances uses the same Certification Authority certificate and sa…

  • Unscored —
    CVE-2012-4953

    The decomposer engine in Symantec Endpoint Protection (SEP) 11.0, Symantec Endpoint Protection Small Business Edition 1…

  • Unscored —
    CVE-2012-4853

    Cross-site request forgery (CSRF) vulnerability in IBM WebSphere Application Server 6.1 before 6.1.0.45, 7.0 before 7.0…

  • Unscored —
    CVE-2012-4851

    Cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server 8.5 Liberty Profile before 8.5.0.1 allows …

  • Unscored —
    CVE-2012-4949 Public exploit

    SQL injection vulnerability in ESRI ArcGIS 10.1 allows remote authenticated users to execute arbitrary SQL commands via…

  • Unscored —
    CVE-2012-3569 Public exploit EPSS 48%

    Format string vulnerability in VMware OVF Tool 2.1 on Windows, as used in VMware Workstation 8.x before 8.0.5, VMware P…

  • Unscored —
    CVE-2012-3330

    The proxy server in IBM WebSphere Application Server 7.0 before 7.0.0.27, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1, a…

  • Unscored —
    CVE-2012-2619 Public exploit EPSS 13%

    The Broadcom BCM4325 and BCM4329 Wi-Fi chips, as used in certain Acer, Apple, Asus, Ford, HTC, Kyocera, LG, Malata, Mot…

  • Unscored —
    CVE-2012-5860

    Unspecified vulnerability on Oberthur ID-One COSMO 5.2, 5.2a, and 64 smart cards makes it easier for attackers to defea…

  • Unscored —
    CVE-2012-5458

    VMware Workstation 8.x before 8.0.5 and VMware Player 4.x before 4.0.5 on Windows use weak permissions for unspecified …

  • Unscored —
    CVE-2012-5459

    Untrusted search path vulnerability in VMware Workstation 8.x before 8.0.5 and VMware Player 4.x before 4.0.5 on Window…

  • Unscored —
    CVE-2012-1885 EPSS 29%

    Heap-based buffer overflow in Microsoft Excel 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Office 2008 and 2011 for Mac; a…

  • Unscored —
    CVE-2012-1527 EPSS 21%

    Integer underflow in Windows Shell in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Win…

  • Unscored —
    CVE-2012-1895 EPSS 23%

    The reflection implementation in Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5.1, and 4 does not properly enf…

  • Unscored —
    CVE-2012-1896 EPSS 24%

    Microsoft .NET Framework 2.0 SP2 and 3.5.1 does not properly consider trust levels during construction of output data, …