Skip to content
OpenAdvisories

Archive

January 2013

Vulnerabilities first published in this month (UTC), newest first.

← December 2012 2013 / January February 2013 →
  1. 16
  2. 214
  3. 316
  4. 422
  5. 54
  6. 6 
  7. 7 
  8. 81
  9. 915
  10. 1028
  11. 118
  12. 128
  13. 1329
  14. 141
  15. 1524
  16. 16 
  17. 1793
  18. 1811
  19. 194
  20. 20 
  21. 2110
  22. 2210
  23. 231
  24. 2444
  25. 253
  26. 265
  27. 2720
  28. 281
  29. 2918
  30. 301
  31. 3142
All Critical High Medium Low Exploited only Public exploit

439 results · Feed

  • Unscored —
    CVE-2012-5976

    Multiple stack consumption vulnerabilities in Asterisk Open Source 1.8.x before 1.8.19.1, 10.x before 10.11.1, and 11.x…

    asterisk Debian
  • Medium —
    CVE-2012-6497

    Authlogic Information Exposure vulnerability

    The Authlogic gem for Ruby on Rails, when used with certain versions before 3.2.10, makes potentially unsafe find_by_id method calls, which might allow remote attackers to conduct CVE-2012-6496 SQL injection attacks via a crafted parameter in environments tha…

    rails authlogic Debian RubyGems
  • High —
    CVE-2012-6496

    Active Record contains SQL Injection

    SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic…

    rails activerecord Debian RubyGems
  • Unscored —
    CVE-2012-6434 Public exploit

    Multiple cross-site request forgery (CSRF) vulnerabilities in e107_admin/download.php in e107 1.0.2 allow remote attack…

  • Unscored —
    CVE-2012-6433 Public exploit

    Cross-site request forgery (CSRF) vulnerability in e107_admin/newspost.php in e107 1.0.1 allows remote attackers to hij…

  • Unscored —
    CVE-2012-5667 Public exploit

    Multiple integer overflows in GNU Grep before 2.11 might allow context-dependent attackers to execute arbitrary code vi…

    grep Debian
  • Unscored —
    CVE-2012-4545

    The http_negotiate_create_context function in protocol/http/http_negotiate.c in ELinks 0.12 before 0.12pre6, when using…

    elinks Debian
  • Medium 5.3
    CVE-2012-6080

    MoinMoin Directory Traversal vulnerability

    Directory traversal vulnerability in the _do_attachment_move function in the AttachFile action (action/AttachFile.py) in MoinMoin 1.9.3 through 1.9.5 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in a file name.

    moin PyPI
  • Medium 4.3
    CVE-2012-6495 Public exploit EPSS 19%

    MoinMoin Multiple vulnerable to directory traversal

    Multiple directory traversal vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to overwrite arbitrary files via unspe…

    moin PyPI
  • Medium 6.3
    CVE-2012-6081 Public exploit EPSS 35%

    MoinMoin Multiple unrestricted file upload vulnerabilities

    Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to execute arbitrary code by uplo…

    moin PyPI
  • Medium 6.1
    CVE-2012-6082

    MoinMoin Cross-site scripting (XSS) vulnerability

    Cross-site scripting (XSS) vulnerability in the rsslink function in theme/__init__.py in MoinMoin 1.9.5 allows remote attackers to inject arbitrary web script or HTML via the page name in a rss link.

    moin PyPI
  • High —
    CVE-2012-2379

    XML Signature/Encryption Not Validated in Apache CXF

    Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does not properly ensure that an XML element is signed or encrypted, which has unspecified impact and att…

    org.apache.cxf:cxf Maven
  • Unscored —
    CVE-2012-5652

    Drupal 6.x before 6.27 allows remote attackers to obtain sensitive information about uploaded files via a (1) RSS feed …

  • Unscored —
    CVE-2012-5665

    ownCloud 4.0.x before 4.0.10 and 4.5.x before 4.5.5 does not properly restrict access to settings.php, which allows rem…

  • Unscored —
    CVE-2012-5666

    Cross-site scripting (XSS) vulnerability in bookmarks/js/bookmarks.js in ownCloud 4.0.x before 4.0.10 and 4.5.x before …

  • Unscored —
    CVE-2012-5653

    The file upload feature in Drupal 6.x before 6.27 and 7.x before 7.18 allows remote authenticated users to bypass the p…

  • Unscored —
    CVE-2012-5654

    The Nodewords: D6 Meta Tags module before 6.x-1.14 for Drupal, when configured to automatically generate description me…

  • Unscored —
    CVE-2012-5651

    Drupal 6.x before 6.27 and 7.x before 7.18 displays information for blocked users, which might allow remote attackers t…

  • Unscored —
    CVE-2012-5655

    The Context module 6.x-3.x before 6.x-3.1 and 7.x-3.x before 7.x-3.0-beta6 for Drupal does not properly restrict access…

  • Unscored —
    CVE-2013-0721

    wp-php-widget.php in the WP PHP widget plugin 1.0.2 for WordPress allows remote attackers to obtain sensitive informati…

  • Unscored —
    CVE-2012-6460

    Opera before 11.67 and 12.x before 12.02 allows remote attackers to cause truncation of a dialog, and possibly trigger …

  • Unscored —
    CVE-2012-6470 Public exploit

    Opera before 12.12 does not properly allocate memory for GIF images, which allows remote attackers to execute arbitrary…

  • Unscored —
    CVE-2012-6465

    Opera before 12.10 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) v…

  • Unscored —
    CVE-2012-6468

    Heap-based buffer overflow in Opera before 12.11 allows remote attackers to execute arbitrary code or cause a denial of…

  • Unscored —
    CVE-2012-6472

    Opera before 12.12 on UNIX uses weak permissions for the profile directory, which allows local users to obtain sensitiv…

  • Unscored —
    CVE-2012-6461

    The X.509 certificate-validation functionality in the https implementation in Opera before 12.10 allows remote attacker…

  • Unscored —
    CVE-2012-6469

    Opera before 12.11 allows remote attackers to determine the existence of arbitrary local files via vectors involving we…

  • Unscored —
    CVE-2012-6462

    Opera before 12.10 does not properly implement the Cross-Origin Resource Sharing (CORS) specification, which allows rem…

  • Unscored —
    CVE-2012-6466

    Opera before 12.10 does not properly handle incorrect size data in a WebP image, which allows remote attackers to obtai…

  • Unscored —
    CVE-2012-6464

    Cross-site scripting (XSS) vulnerability in Opera before 12.10 allows remote attackers to inject arbitrary web script o…

  • Unscored —
    CVE-2012-6467

    Opera before 12.10 follows Internet shortcuts that are referenced by a (1) IMG element or (2) other inline element, whi…

  • Unscored —
    CVE-2012-6471

    Opera before 12.12 allows remote attackers to spoof the address field via a high rate of HTTP requests.

  • Unscored —
    CVE-2012-6463

    Cross-site scripting (XSS) vulnerability in Opera before 12.10 allows remote attackers to inject arbitrary web script o…

  • Unscored —
    CVE-2012-6084

    modules/m_capab.c in (1) ircd-ratbox before 3.0.8 and (2) Charybdis before 3.4.2 does not properly support capability n…

  • Unscored —
    CVE-2012-6459

    ConnMan 1.3 on Tizen continues to list the bluetooth service after offline mode has been enabled, which might allow rem…

    connman Debian
  • Unscored —
    CVE-2012-6426

    LemonLDAP::NG before 1.2.3 does not use the signature-verification capability of the Lasso library, which allows remote…

    lemonldap-ng Debian
  • Unscored —
    CVE-2012-4970

    Cross-site scripting (XSS) vulnerability in the web management interface on Polycom HDX Video End Points with UC APL so…

  • Unscored —
    CVE-2012-5769

    IBM SPSS Modeler 14.0, 14.1, 14.2 through FP3, and 15.0 before FP2 allows remote attackers to read arbitrary files, and…

  • Unscored —
    CVE-2012-5573

    The connection_edge_process_relay_cell function in or/relay.c in Tor before 0.2.3.25 maintains circuits even if an unex…

    tor Debian