Skip to content
OpenAdvisories

Archive

January 2013

Vulnerabilities first published in this month (UTC), newest first.

← December 2012 2013 / January February 2013 →
  1. 16
  2. 214
  3. 316
  4. 422
  5. 54
  6. 6 
  7. 7 
  8. 81
  9. 915
  10. 1028
  11. 118
  12. 128
  13. 1329
  14. 141
  15. 1524
  16. 16 
  17. 1793
  18. 1811
  19. 194
  20. 20 
  21. 2110
  22. 2210
  23. 231
  24. 2444
  25. 253
  26. 265
  27. 2720
  28. 281
  29. 2918
  30. 301
  31. 3142
All Critical High Medium Low Exploited only Public exploit

14 results · Clear filters · Feed

  • Medium —
    CVE-2012-6112

    PHP Spellchecker addon for TinyMCE allows attackers to trigger arbitrary outbound HTTP requests

    classes/GoogleSpell.php in the PHP Spellchecker (aka Google Spellchecker) addon before 2.0.6.1 for TinyMCE, as used in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 and other products, does not properly handle cont…

    moodle/moodle wordpress tinymce Debian Ubuntu Packagist
  • Medium —
    CVE-2012-6099

    Moodle Arbitrary File Read via Backup Functionality

    The moodle1 backup converter in backup/converter/moodle1/lib.php in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 does not properly validate pathnames, which allows remote authenticated users to read arbitrary file…

    moodle/moodle Packagist
  • Medium 5.0
    CVE-2012-6441 EPSS 57%

    Rockwell Automation ControlLogix PLC Information Exposure

    An information exposure of confidential information results when the device receives a specially crafted CIP packet to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP. Successful exploitation of this vulnerability could cause loss of confident…

    Rockwell Automation 1756-ENBT, 1756-EWEB, 1768-ENBT, 1768-EWEB communication modules 1788-ENBT FLEXLogix adapter ControlLogix, CompactLogix, GuardLogix, and SoftLogix ICS / OT
  • Medium 4.8
    CVE-2012-6440

    Rockwell Automation ControlLogix PLC Improper Input Validation

    The Web server password authentication mechanism used by the products is vulnerable to a MitM and Replay attack. Successful exploitation of this vulnerability will allow unauthorized access of the product’s Web server to view and alter product configuration a…

    Rockwell Automation ControlLogix, CompactLogix, GuardLogix, and SoftLogix ControlLogix and GuardLogix controllers CompactLogix L32E and L35E controllers ICS / OT
  • Medium —
    CVE-2013-0155

    Active Record allows bypassing of database-query restrictions

    Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended data…

    rails activerecord Debian RubyGems
  • Medium 6.5
    CVE-2012-4549

    Jboss enterprise application platform: org.jboss.as.ejb3: jboss enterprise application platform: access restriction bypass via improper ejb method authorization

    A flaw was found in JBoss Enterprise Application Platform. The `processInvocation` function within the `org.jboss.as.ejb3.security.AuthorizationInterceptor` component incorrectly authorizes all requests when no roles are defined for an Enterprise Java Beans (…

    Red Hat Red Hat JBoss Enterprise Application Platform 6.0 Red Hat JBoss Enterprise Application Platform 6 for RHEL 5
  • Medium 5.3
    CVE-2012-4550

    Jboss enterprise application platform: jboss eap: jbeap: jboss enterprise application platform: unauthorized ejb access via authorization module bypass

    A flaw was found in JBoss Enterprise Application Platform. When role-based authorization is used for Enterprise Java Beans (EJB) access, the system does not correctly call the necessary authorization modules. This prevents Java Authorization Contract for Cont…

    Red Hat Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 Red Hat JBoss Enterprise Application Platform 6.0
  • Medium —
    CVE-2012-2378

    Improper Authentication in Apache CXF

    Apache CXF 2.4.5 through 2.4.7, 2.5.1 through 2.5.3, and 2.6.x before 2.6.1, does not properly enforce child policies of a WS-SecurityPolicy 1.1 SupportingToken policy on the client side, which allows remote attackers to bypass the (1) AlgorithmSuite, (2) Sig…

    org.apache.cxf:cxf Maven
  • Medium 5.5
    CVE-2012-4574

    Pulp: red hat cloudforms: pulp in red hat cloudforms: information disclosure via world-readable configuration file

    A flaw was found in Pulp, as used in Red Hat CloudForms. This vulnerability allows a local user to read the administrative password due to world-readable permissions on the `pulp.conf` configuration file. This information disclosure could enable unauthorized …

    Red Hat CloudForms for RHEL 6 CloudForms Tools for RHEL 5 RHUI for RHEL 6
  • Medium —
    CVE-2012-6497

    Authlogic Information Exposure vulnerability

    The Authlogic gem for Ruby on Rails, when used with certain versions before 3.2.10, makes potentially unsafe find_by_id method calls, which might allow remote attackers to conduct CVE-2012-6496 SQL injection attacks via a crafted parameter in environments tha…

    rails authlogic Debian RubyGems
  • Medium 5.3
    CVE-2012-6080

    MoinMoin Directory Traversal vulnerability

    Directory traversal vulnerability in the _do_attachment_move function in the AttachFile action (action/AttachFile.py) in MoinMoin 1.9.3 through 1.9.5 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in a file name.

    moin PyPI
  • Medium 4.3
    CVE-2012-6495 Public exploit EPSS 19%

    MoinMoin Multiple vulnerable to directory traversal

    Multiple directory traversal vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to overwrite arbitrary files via unspe…

    moin PyPI
  • Medium 6.3
    CVE-2012-6081 Public exploit EPSS 35%

    MoinMoin Multiple unrestricted file upload vulnerabilities

    Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to execute arbitrary code by uplo…

    moin PyPI
  • Medium 6.1
    CVE-2012-6082

    MoinMoin Cross-site scripting (XSS) vulnerability

    Cross-site scripting (XSS) vulnerability in the rsslink function in theme/__init__.py in MoinMoin 1.9.5 allows remote attackers to inject arbitrary web script or HTML via the page name in a rss link.

    moin PyPI