Archive
January 2013
Vulnerabilities first published in this month (UTC), newest first.
439 results · Feed
-
Unscored —
Cross-site scripting (XSS) vulnerability in apps/admin/handlers/versions.php in Elefant CMS 1.2.0 allows remote attacke…
-
Unscored —CVE-2012-6505 Public exploit
Cross-site scripting (XSS) vulnerability in mods/hours/data/get_hours.php in PHP Volunteer Management 1.0.2 allows remo…
-
Unscored —CVE-2012-6518 Public exploit
Cross-site request forgery (CSRF) vulnerability in mod.php in DiY-CMS 1.0 allows remote attackers to hijack the authent…
-
Unscored —
The Organizer plugin 1.2.1 for WordPress allows remote attackers to obtain the installation path via unspecified vector…
-
Unscored —CVE-2012-6517 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in DiY-CMS 1.0 allow remote attackers to inject arbitrary web scrip…
-
Unscored —CVE-2012-6504 Public exploit
SQL injection vulnerability in mods/hours/data/get_hours.php in PHP Volunteer Management 1.0.2 allows remote attackers …
-
Unscored —CVE-2012-6519 Public exploit
SQL injection vulnerability in modules/poll/index.php in DIY-CMS 1.0 allows remote attackers to execute arbitrary SQL c…
-
Unscored —CVE-2012-6516 Public exploit
SQL injection vulnerability in PHP Ticket System Beta 1 allows remote attackers to execute arbitrary SQL commands via t…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in organizer/page/users.php in the Organizer plugin 1.2.1 for WordP…
-
Unscored —CVE-2012-6513 Public exploit
Cross-site scripting (XSS) vulnerability in index.php/Admin_Preferences in gpEasy CMS 2.3.3 allows remote attackers to …
-
Unscored —
The read_block function in g10/import.c in GnuPG 1.4.x before 1.4.13 and 2.0.x through 2.0.19, when importing a key, al…
-
Unscored —CVE-2012-6506 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in the Zingiri Web Shop plugin 2.4.0 for WordPress allow remote att…
-
Unscored —CVE-2012-6509 Public exploit
Unrestricted file upload vulnerability in NetArt Media Car Portal 3.0 allows remote attackers to execute arbitrary PHP …
-
Unscored —CVE-2012-2099 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in Wikidforum 2.10 allow remote attackers to inject arbitrary web s…
-
Unscored —
lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x through 4.38 does not require authentication for requ…
-
Unscored —
Multiple SQL injection vulnerabilities in the replication code in Oracle MySQL possibly before 5.5.29, and MariaDB 5.1.…
-
Unscored —
Call of Duty Elite for iOS 2.0.1 does not properly validate the server SSL certificate, which allows remote attackers t…
-
Unscored —
The KVM subsystem in the Linux kernel before 3.6.9, when running on hosts that use qemu userspace without XSAVE, allows…
-
Unscored —
Multiple stack-based buffer overflows in the get_history function in history.cgi in Nagios Core before 3.4.4, and Icing…
-
Unscored —
Multiple stack-based buffer overflows in the Near Field Communication Controller Interface (NCI) in the Linux kernel be…
-
Unscored —
The rds_ib_xmit function in net/rds/ib_send.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Lin…
-
Unscored —
Buffer overflow in virt/kvm/irq_comm.c in the KVM subsystem in the Linux kernel before 3.2.24 allows local users to cau…
-
Unscored —
Buffer overflow in the macvtap device driver in the Linux kernel before 3.4.5, when running in certain configurations, …
-
Unscored —
Apache CloudStack 4.0.0-incubating and Citrix CloudPlatform (formerly Citrix CloudStack) before 3.0.6 stores sensitive …
-
Unscored —CVE-2012-6502 EPSS 10%
Microsoft Internet Explorer before 10 allows remote attackers to obtain sensitive information about the existence of fi…
-
Unscored —
The NetWorker command processor in rrobotd.exe in the Device Manager in EMC AlphaStor 4.0 before build 800 allows remot…
-
Unscored —
Format string vulnerability in the _vsnsprintf function in rrobotd.exe in the Device Manager in EMC AlphaStor 4.0 befor…
-
Unscored —
Buffer overflow in a third-party ActiveX component in Siemens SIMATIC RF-MANAGER 2008, and RF-MANAGER Basic 3.0 and ear…
-
Unscored —
Cisco WebEx Training Center allow remote authenticated users to bypass intended privilege restrictions and (1) enable o…
-
Unscored —
Cisco WebEx Training Center allows remote authenticated users to remove hands-on lab-session reservations via a crafted…
-
Critical 10.0
3S CoDeSys Relative Path Traversal
The CoDeSys Runtime Toolkit’s file transfer functionality does not perform input validation, which allows an attacker to access files and directories outside the intended scope. This may allow an attacker to upload and download any file on the device. This co…
-
Critical 9.8
3S CoDeSys Improper Access Control
The Runtime Toolkit in CODESYS Runtime System 2.3.x and 2.4.x does not require authentication, which allows remote attackers to execute commands via the command-line interface in the TCP listener service or transfer files via requests to the TCP listener serv…
-
Unscored —
EMC Avamar Client 4.x, 5.x, and 6.x on HP-UX and Mac OS X, and the EMC Avamar plugin 4.x, 5.x, and 6.x for Oracle, uses…
-
Unscored —
The client in Schneider Electric Software Update (SESU) Utility 1.0.x and 1.1.x does not ensure that updates have a val…
-
Unscored —
Stack-based buffer overflow in Schneider Electric Interactive Graphical SCADA System (IGSS) 10 and earlier allows remot…
-
Unscored —
The openssl_encrypt function in ext/openssl/openssl.c in PHP 5.3.9 through 5.3.13 does not initialize a certain variabl…
-
Unscored —
Cisco NX-OS on Nexus 7000 series switches does not properly handle certain line-card replacements, which might allow re…
-
Unscored —
Directory traversal vulnerability in the Olive Toast Documents Pro File Viewer (formerly Files HD) app before 1.11.1 fo…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Olive Toast Documents Pro File Viewer (formerly Files HD) app before 1.…
-
Unscored —
Unspecified vulnerability in JustSystems Corporation ATOK 2006 through 2009 and ATOK flat-rate service, and Just Smile …