Skip to content
OpenAdvisories

Archive

5 December 2012

Vulnerabilities first published on this day (UTC), newest first.

← November 2012 2012 / December /5 January 2013 →
  1. 1 
  2. 2 
  3. 338
  4. 46
  5. 524
  6. 67
  7. 7 
  8. 85
  9. 9 
  10. 102
  11. 114
  12. 1226
  13. 1315
  14. 14 
  15. 15 
  16. 16 
  17. 17 
  18. 1818
  19. 1918
  20. 2010
  21. 2120
  22. 22 
  23. 233
  24. 245
  25. 254
  26. 2624
  27. 275
  28. 2810
  29. 29 
  30. 301
  31. 3110
All Critical High Medium Low Exploited only Public exploit

24 results · Feed

  • Medium —
    CVE-2011-2732 Public exploit

    Improper Control of Generation of Code in Spring Security

    CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-re…

    org.springframework.security:spring-security-core Maven
  • High —
    CVE-2011-2730 EPSS 12%

    Improper Neutralization of Directives in Dynamically Evaluated Code in Spring Framework

    VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a (1) nam…

    org.springframework:spring-core Maven
  • Medium —
    CVE-2011-2731

    Concurrent Execution using Shared Resource with Improper Synchronization in Spring Security

    Race condition in the RunAsManager mechanism in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 stores the Authentication object in the shared security context, which allows attackers to gain privileges via a crafted thread.

    org.springframework.security:spring-security-core Maven
  • Medium —
    CVE-2012-5055

    Exposure of Sensitive Information to an Unauthorized Actor in Spring Security

    DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerat…

    org.springframework.security:spring-security-core Maven
  • Unscored —
    CVE-2009-2899

    The monitor perl script in the Sybase database plug-in in SpringSource Hyperic HQ before 4.3 allows local users to obta…

  • Unscored —
    CVE-2012-4985

    The Forescout CounterACT NAC device 6.3.4.1 does not block ARP and ICMP traffic from unrecognized clients, which allows…

  • Unscored —
    CVE-2012-4862

    The Host Connect emulator in IBM Rational Developer for System z 7.1 through 8.5.1 does not properly store the SSL cert…

  • Unscored —
    CVE-2012-4609

    The web interface in EMC RSA NetWitness Informer before 2.0.5.6 allows remote attackers to conduct clickjacking attacks…

  • Unscored —
    CVE-2012-4982 Public exploit Scanner template

    Open redirect vulnerability in assets/login on the Forescout CounterACT NAC device before 7.0 allows remote attackers t…

  • Unscored —
    CVE-2012-4983

    Multiple cross-site scripting (XSS) vulnerabilities on the Forescout CounterACT NAC device before 7.0 allow remote atta…

  • Unscored —
    CVE-2012-4608

    Cross-site request forgery (CSRF) vulnerability in the web interface in EMC RSA NetWitness Informer before 2.0.5.6 allo…

  • Unscored —
    CVE-2012-4347 Public exploit EPSS 59%

    Multiple directory traversal vulnerabilities in the management console in Symantec Messaging Gateway (SMG) 9.5.x allow …

  • Unscored —
    CVE-2012-6059

    The dissect_isakmp function in epan/dissectors/packet-isakmp.c in the ISAKMP dissector in Wireshark 1.6.x before 1.6.12…

    wireshark Debian
  • Unscored —
    CVE-2012-6060

    Integer overflow in the dissect_iscsi_pdu function in epan/dissectors/packet-iscsi.c in the iSCSI dissector in Wireshar…

    wireshark Debian
  • Unscored —
    CVE-2012-6062

    The dissect_rtcp_app function in epan/dissectors/packet-rtcp.c in the RTCP dissector in Wireshark 1.6.x before 1.6.12 a…

    wireshark Debian
  • Unscored —
    CVE-2012-6058

    Integer overflow in the dissect_icmpv6 function in epan/dissectors/packet-icmpv6.c in the ICMPv6 dissector in Wireshark…

    wireshark Debian
  • Unscored —
    CVE-2012-6054

    The dissect_sflow_245_address_type function in epan/dissectors/packet-sflow.c in the sFlow dissector in Wireshark 1.8.x…

    wireshark Debian
  • Unscored —
    CVE-2012-6053

    epan/dissectors/packet-usb.c in the USB dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 relies on a l…

    wireshark Debian
  • Unscored —
    CVE-2012-6056

    Integer overflow in the dissect_sack_chunk function in epan/dissectors/packet-sctp.c in the SCTP dissector in Wireshark…

    wireshark Debian
  • Unscored —
    CVE-2012-6052

    Wireshark 1.8.x before 1.8.4 allows remote attackers to obtain sensitive hostname information by reading pcap-ng files.

    wireshark Debian
  • Unscored —
    CVE-2012-6057

    The dissect_eigrp_metric_comm function in epan/dissectors/packet-eigrp.c in the EIGRP dissector in Wireshark 1.8.x befo…

    wireshark Debian
  • Unscored —
    CVE-2012-6061

    The dissect_wtp_common function in epan/dissectors/packet-wtp.c in the WTP dissector in Wireshark 1.6.x before 1.6.12 a…

    wireshark Debian
  • Unscored —
    CVE-2012-6055

    epan/dissectors/packet-3g-a11.c in the 3GPP2 A11 dissector in Wireshark 1.8.x before 1.8.4 allows remote attackers to c…

    wireshark Debian
  • Unscored —
    CVE-2012-3317

    IBM WebSphere Message Broker 6.1 before 6.1.0.11, 7.0 before 7.0.0.5, and 8.0 before 8.0.0.2 has incorrect ownership of…