Skip to content
OpenAdvisories

Archive

December 2012

Vulnerabilities first published in this month (UTC), newest first.

← November 2012 2012 / December January 2013 →
  1. 1 
  2. 2 
  3. 338
  4. 46
  5. 524
  6. 67
  7. 7 
  8. 85
  9. 9 
  10. 102
  11. 114
  12. 1226
  13. 1315
  14. 14 
  15. 15 
  16. 16 
  17. 17 
  18. 1818
  19. 1918
  20. 2010
  21. 2120
  22. 22 
  23. 233
  24. 245
  25. 254
  26. 2624
  27. 275
  28. 2810
  29. 29 
  30. 301
  31. 3110
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Medium —
    CVE-2012-6431

    Symfony Allows URI Restrictions Bypass Via Double-Encoded String

    Symfony 2.0.x before 2.0.20 does not process URL encoded data consistently within the Routing and Security components, which allows remote attackers to bypass intended URI restrictions via a doubly encoded string.

    symfony/symfony symfony/security symfony/http-foundation symfony/routing Packagist
  • Medium —
    CVE-2012-6432

    Symfony Access Control Vulnerability

    Symfony 2.0.x before 2.0.20, 2.1.x before 2.1.5, and 2.2-dev, when the internal routes configuration is enabled, allows remote attackers to access arbitrary services via vectors involving a URI beginning with a /_internal substring.

    symfony/symfony Packagist
  • Medium 6.5
    CVE-2012-5625

    Openstack nova: information leak in libvirt lvm-backed instances

    OpenStack Compute (Nova) Folsom before 2012.2.2 and Grizzly, when using libvirt and LVM backed instances, does not properly clear physical volume (PV) content when reallocating for instances, which allows attackers to obtain sensitive information by reading t…

    Red Hat Red Hat OpenStack Platform 16.2 Red Hat OpenStack Platform 18.0 Red Hat OpenStack Platform 17.1 PyPI
  • Medium —
    CVE-2012-5181

    Concrete5 Vulnerable to Cross-Site Scripting (XSS)

    Cross-site scripting (XSS) vulnerability in concrete5 Japanese 5.5.1 through 5.5.2.1 and concrete5 English 5.5.0 through 5.6.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    concrete5/concrete5 Packagist
  • Medium —
    CVE-2012-3428

    User confusion in IronJacamar

    The IronJacamar container before 1.0.12.Final for JBoss Application Server, when allow-multiple-users is enabled in conjunction with a security domain, does not use the credentials supplied in a getConnection function call, which allows remote attackers to ob…

    org.jboss.ironjacamar:ironjacamar-jdbc Maven
  • Medium —
    CVE-2012-4431 Public exploit

    Cross-Site Request Forgery in Apache Tomcat

    org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2012-3546 EPSS 12%

    Authentication Bypass in Apache Tomcat

    org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.30, when FORM authentication is used, allows remote attackers to bypass security-constraint checks by leveraging a previous setUserPrincipal call and then placing /…

    org.apache.tomcat:tomcat Maven
  • Medium 6.1
    CVE-2012-4898

    Tropos Wireless Mesh Routers Insufficient Entropy

    Mesh OS before 7.9.1.1 on Tropos wireless mesh routers does not use a sufficient source of entropy for SSH keys, which makes it easier for man-in-the-middle attackers to spoof a device or modify a client-server data stream by leveraging knowledge of a key fro…

    Tropos Mesh OS
  • Medium 5.4
    CVE-2012-5571

    Openstack keystone: openstack keystone: authorization bypass via improper ec2 token handling

    A flaw was found in OpenStack Keystone. This vulnerability allows remote authenticated users to bypass intended authorization restrictions. This occurs because OpenStack Keystone does not properly handle EC2 (Elastic Compute Cloud) tokens when a user's role h…

    Red Hat Red Hat OpenStack Platform 13 (Queens) Red Hat OpenStack Platform 16.2 Red Hat OpenStack Platform 18.0 Debian PyPI
  • Medium 5.9
    CVE-2012-5563

    OpenStack Keystone Insufficient token expiration

    OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by creating new tokens through token chaining. NOTE: this issue exists …

    keystone PyPI
  • Medium —
    CVE-2011-2732 Public exploit

    Improper Control of Generation of Code in Spring Security

    CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-re…

    org.springframework.security:spring-security-core Maven
  • Medium —
    CVE-2011-2731

    Concurrent Execution using Shared Resource with Improper Synchronization in Spring Security

    Race condition in the RunAsManager mechanism in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 stores the Authentication object in the shared security context, which allows attackers to gain privileges via a crafted thread.

    org.springframework.security:spring-security-core Maven
  • Medium —
    CVE-2012-5055

    Exposure of Sensitive Information to an Unauthorized Actor in Spring Security

    DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerat…

    org.springframework.security:spring-security-core Maven