Archive
January 2013
Vulnerabilities first published in this month (UTC), newest first.
439 results · Feed
-
Unscored —
Cross-site scripting (XSS) vulnerability in the virtual member manager (VMM) administrative console in IBM WebSphere Ap…
-
Unscored —
The client in FreeIPA 2.x and 3.x before 3.1.2 does not properly obtain the Certification Authority (CA) certificate fr…
-
Unscored —
Stack-based buffer overflow in the reader in CoolPDF 3.0.2.256 allows remote attackers to execute arbitrary code via a …
-
Unscored —
The TripAdvisor app 6.6 for iOS sends cleartext credentials, which allows remote attackers to obtain sensitive informat…
-
Unscored —
Stack-based buffer overflow in Foxit Advanced PDF Editor 3 before 3.04 might allow remote attackers to execute arbitrar…
-
Unscored —
SUSE WebYaST before 1.2 0.2.63-0.6.1 allows remote attackers to modify the hosts list, and subsequently conduct man-in-…
-
Unscored —CVE-2012-6276 Public exploit
Directory traversal vulnerability in the web-based management interface on the TP-LINK TL-WR841N router with firmware 3…
-
Unscored —CVE-2012-3278 EPSS 11%
Stack-based buffer overflow in magentservice.exe in HP Diagnostics Server 8.x through 8.07 and 9.x through 9.21 allows …
-
Unscored —CVE-2012-6272 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in Dell OpenManage Server Administrator 6.5.0.1, 7.0.0.1, and 7.1.0…
-
Unscored —CVE-2012-5689 EPSS 12%
ISC BIND 9.8.x through 9.8.4-P1 and 9.9.x through 9.9.2-P1, in certain configurations involving DNS64 with a Response P…
-
Unscored —
content/renderer/media/webrtc_audio_renderer.cc in Google Chrome before 24.0.1312.56 on Mac OS X does not use an approp…
-
Unscored —
Array index error in the content-blocking functionality in Google Chrome before 24.0.1312.56 allows remote attackers to…
-
Unscored —
Use-after-free vulnerability in Google Chrome before 24.0.1312.56 allows remote attackers to cause a denial of service …
-
Unscored —
Google Chrome before 24.0.1312.56 does not validate URLs during the opening of new windows, which has unspecified impac…
-
Unscored —
Google Chrome before 24.0.1312.56 does not properly handle %00 characters in pathnames, which has unspecified impact an…
-
Unscored —
Cisco Wireless LAN Controller (WLC) devices with software 7.0 before 7.0.235.3, 7.1 and 7.2 before 7.2.111.3, and 7.3 b…
-
Unscored —
Cisco Wireless LAN Controller (WLC) devices with software 7.0 before 7.0.220.0, 7.1 before 7.1.91.0, and 7.2 before 7.2…
-
Unscored —
The HTTP Profiling functionality on Cisco Wireless LAN Controller (WLC) devices with software 7.3.101.0 allows remote a…
-
Unscored —
The Wireless Intrusion Prevention System (wIPS) component on Cisco Wireless LAN Controller (WLC) devices with software …
-
Medium 5.0CVE-2012-6441 EPSS 57%
Rockwell Automation ControlLogix PLC Information Exposure
An information exposure of confidential information results when the device receives a specially crafted CIP packet to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP. Successful exploitation of this vulnerability could cause loss of confident…
-
High 7.5CVE-2012-6438 EPSS 36%
Rockwell Automation ControlLogix PLC Improper Input Validation
The device does not properly validate the data being sent to the buffer. An attacker can send a malformed CIP packet to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP, which creates a buffer overflow and causes the NIC to crash. Successful ex…
-
Unscored —
ProFTPD before 1.3.5rc1, when using the UserOwner directive, allows local users to modify the ownership of arbitrary fi…
-
High 8.5CVE-2012-6439 EPSS 23%
Rockwell Automation ControlLogix PLC Improper Access Control
When an affected product receives a valid CIP message from an unauthorized or unintended source to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP that changes the product’s configuration and network parameters, a DoS condition can occur. This…
-
High 7.5CVE-2012-6435 EPSS 43%
Rockwell Automation ControlLogix PLC Improper Access Control
When an affected product receives a valid CIP message from an unauthorized or unintended source to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP that instructs the CPU to stop logic execution and enter a fault state, a DoS can occur. This si…
-
Critical 9.8CVE-2012-6437 EPSS 11%
Rockwell Automation ControlLogix PLC Improper Authentication
The device does not properly authenticate users and the potential exists for a remote user to upload a new firmware image to the Ethernet card, whether it is a corrupt or legitimate firmware image. Successful exploitation of this vulnerability could cause los…
-
High 7.5CVE-2012-6442 EPSS 35%
Rockwell Automation ControlLogix PLC Improper Access Control
When an affected product receives a valid CIP message from an unauthorized or unintended source to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP that instructs the product to reset, a DoS can occur. This situation could cause loss of availab…
-
High 7.5CVE-2012-6436 EPSS 35%
Rockwell Automation ControlLogix PLC Improper Input Validation
The device does not properly validate the data being sent to the buffer. An attacker can send a malformed CIP packet to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP, which creates a buffer overflow and causes the CPU to crash. Successful ex…
-
Medium 4.8
Rockwell Automation ControlLogix PLC Improper Input Validation
The Web server password authentication mechanism used by the products is vulnerable to a MitM and Replay attack. Successful exploitation of this vulnerability will allow unauthorized access of the product’s Web server to view and alter product configuration a…
-
Unscored —
FreeType before 2.4.11 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and cr…
-
Unscored —
The _bdf_parse_glyphs function in FreeType before 2.4.11 allows context-dependent attackers to cause a denial of servic…
-
Unscored —
The _bdf_parse_glyphs function in FreeType before 2.4.11 allows context-dependent attackers to cause a denial of servic…
-
Unscored —
Cross-site scripting (XSS) vulnerability in advancedtext.php in Advanced Text Widget plugin before 2.0.2 for WordPress …
-
Unscored —CVE-2012-1922 Public exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in Sitecom WLM-2501 allow remote attackers to hijack the aut…
-
Unscored —
Multiple SQL injection vulnerabilities in admin.php in ChurchCMS 0.0.1 allow remote attackers to execute arbitrary SQL …
-
Unscored —CVE-2012-6510 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in NetArt Media Car Portal 3.0 allow remote attackers to inject arb…
-
Unscored —CVE-2012-6508 Public exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in NetArt Media Car Portal 3.0 allow remote attackers to hij…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the nBill (com_nbill) component 2.3.2 for Joomla! allows remote attackers t…
-
Unscored —
eFront 3.6.10, 3.6.11 build 15059, and earlier allows remote attackers to obtain sensitive information via invalid cour…
-
Unscored —CVE-2012-6520 Public exploit
Multiple SQL injection vulnerabilities in the advanced search in Wikidforum 2.10 allow remote attackers to execute arbi…
-
Unscored —
Unspecified vulnerability in the NinjaXplorer component before 1.0.7 for Joomla! has unknown impact and attack vectors.