2012 CVEs (page 2)
Page 2 of 60 — CVEs published in 2012, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2012-1932 | Medium | 4.8 | 2020-02-19 | A cross-site scripting (XSS) vulnerability in Wolf CMS 0.75 and earlier allows remote attackers to inject arbitrary web script or HTML via the setting[admin_em… |
CVE-2012-0718 | Medium | 5.4 | 2020-02-18 | IBM Tivoli Endpoint Manager 8 does not set the HttpOnly flag on cookies. |
CVE-2012-6091 | High | 7.5 | 2020-02-13 | Zend_XmlRpc Class in Magento before 1.7.0.2 contains an information disclosure vulnerability. |
CVE-2012-5623 | High | 7.5 | 2020-02-13 | Squirrelmail 4.0 uses the outdated MD5 hash algorithm for passwords. |
CVE-2012-1903 | Medium | 5.4 | 2020-02-13 | XSS in Telligent Community 5.6.583.20496 via a flash file and related to the allowScriptAccess parameter. |
CVE-2012-1500 | Medium | 5.4 | 2020-02-13 | Stored XSS vulnerability in UpdateFieldJson.jspa in JIRA 4.4.3 and GreenHopper before 5.9.8 allows an attacker to inject arbitrary script code. |
CVE-2012-0951 | High | 7.8 | 2020-02-12 | A Memory Corruption Vulnerability exists in NVIDIA Graphics Drivers 29549 due to an unknown function in the file proc/driver/nvidia/registry. |
CVE-2012-0810 | Medium | 5.5 | 2020-02-12 | The int3 handler in the Linux kernel before 3.3 relies on a per-CPU debug stack, which allows local users to cause a denial of service (stack corruption and pa… |
CVE-2012-6721 | Medium | 6.3 | 2020-02-11 | Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) Forum, (2) Event, and (3) Classifieds plugins in SocialEngine before 4.2.4. |
CVE-2012-6720 | Medium | 6.1 | 2020-02-11 | Multiple cross-site scripting (XSS) vulnerabilities in SocialEngine before 4.2.4 allow remote attackers to inject arbitrary web script or HTML via the (1) titl… |
CVE-2012-2517 | Medium | 6.1 | 2020-02-11 | Cross-site scripting (XSS) vulnerability in PrestaShop before 1.4.9 allows remote attackers to inject arbitrary web script or HTML via the index of the product… |
CVE-2012-2452 | Medium | 6.1 | 2020-02-11 | Multiple cross-site scripting (XSS) vulnerabilities in pragmaMx 1.x before 1.12.2 allow remote attackers to inject arbitrary web script or HTML via the (1) nam… |
CVE-2012-1124 | Critical | 9.8 | 2020-02-11 | SQL injection vulnerability in search.php in phxEventManager 2.0 beta 5 allows remote attackers to execute arbitrary SQL commands via the search_terms paramete… |
CVE-2012-4519 | Medium | 6.1 | 2020-02-11 | Zenphoto before 1.4.3.4 admin-news-articles.php date parameter XSS. |
CVE-2012-5828 | Medium | 6.5 | 2020-02-10 | BlackBerry PlayBook before 2.1 has an Information Disclosure Vulnerability via a Web browser component error |
CVE-2012-2204 | Medium | 5.5 | 2020-02-10 | InfoSphere Guardium aix_ktap module: DoS |
CVE-2012-1994 | Medium | 5.7 | 2020-02-10 | HP Systems Insight Manager before 7.0 allows a remote user on adjacent network to access information |
CVE-2012-6611 | Critical | 9.8 | 2020-02-10 | An issue was discovered in Polycom Web Management Interface G3/HDX 8000 HD with Durango 2.6.0 4740 software and embedded Polycom Linux Development Platform 2.1… |
CVE-2012-6449 | Medium | 5.4 | 2020-02-10 | The clientconf.html and detailbw.html pages in x3 in cPanel & WHM 11.34.0 (build 8) have a XSS vulnerability. |
CVE-2012-6666 | Medium | 6.1 | 2020-02-10 | vBSeo before 3.6.0PL2 allows XSS via the member.php u parameter. |
CVE-2012-5570 | Medium | 4.3 | 2020-02-08 | The Basic webmail module 6.x-1.x before 6.x-1.2 for Drupal allows remote authenticated users with the "access basic_webmail" permission to read arbitrary users… |
CVE-2012-4512 | High | 8.8 | 2020-02-08 | The CSS parser (khtml/css/cssparser.cpp) in Konqueror in KDE 4.7.3 allows remote attackers to cause a denial of service (crash) and possibly read memory via a… |
CVE-2012-4381 | High | 8.1 | 2020-02-08 | MediaWiki before 1.18.5, and 1.19.x before 1.19.2 saves passwords in the local database, (1) which could make it easier for context-dependent attackers to obta… |
CVE-2012-4029 | Medium | 6.1 | 2020-02-08 | Cross-site scripting (XSS) vulnerability in main/dropbox/index.php in Chamilo LMS before 1.8.8.6 allows remote attackers to inject arbitrary web script or HTML… |
CVE-2012-1567 | High | 7.5 | 2020-02-07 | LinuxMint as of 2012-03-19 has temporary file creation vulnerabilities in mintUpdate. |
CVE-2012-1566 | High | 7.5 | 2020-02-07 | LinuxMint as of 2012-03-19 has temporary file creation vulnerabilities in mintNanny. |
CVE-2012-6341 | Medium | 6.5 | 2020-02-06 | An Information Disclosure vulnerability exists in the my config file in NEtGEAR WGR614 v7 and v9, which could let a malicious user recover all previously used… |
CVE-2012-6340 | Medium | 4.6 | 2020-02-06 | An Authentication vulnerability exists in NETGEAR WGR614 v7 and v9 due to a hardcoded credential used for serial programming, a related issue to CVE-2006-1002. |
CVE-2012-6309 | High | 7.5 | 2020-02-06 | A vulnerability exists in Arctic Torrent 1.4 via unspecified vectors in .torrent file handling, which could let a malicious user cause a Denial of Service. |
CVE-2012-6307 | High | 8.8 | 2020-02-06 | A vulnerability exists in JPEGsnoop 1.5.2 due to an unspecified issue in JPEG file handling, which could let a malicious user execute arbitrary code |
CVE-2012-6306 | Critical | 9.8 | 2020-02-06 | A vulnerability exists in HCView (aka Hardcoreview) 1.4 due to a write access violation with a GIF file. |
CVE-2012-6297 | High | 8.8 | 2020-02-06 | Command Injection vulnerability exists via a CSRF in DD-WRT 24-sp2 from specially crafted configuration values containing shell meta-characters, which could le… |
CVE-2012-2593 | Medium | 6.1 | 2020-02-06 | Cross-site scripting (XSS) vulnerability in the administrative interface in Atmail Webmail Server 6.4 allows remote attackers to inject arbitrary web script or… |
CVE-2012-5686 | Critical | 9.8 | 2020-02-04 | ZPanel 10.0.1 has insufficient entropy for its password reset process. |
CVE-2012-5618 | Critical | 9.8 | 2020-02-04 | Ushahidi before 2.6.1 has insufficient entropy for forgot-password tokens. |
CVE-2012-6133 | Medium | 6.1 | 2020-01-30 | Multiple cross-site scripting (XSS) vulnerabilities in Roundup before 1.4.20 allow remote attackers to inject arbitrary web script or HTML via the (1) @ok_mess… |
CVE-2012-5776 | Medium | 5.4 | 2020-01-29 | Dokeos 2.1.1 has multiple XSS issues involving "extra_" parameters in main/auth/profile.php. |
CVE-2012-4383 | High | 8.8 | 2020-01-29 | contao prior to 2.11.4 has a sql injection vulnerability |
CVE-2012-6610 | High | 8.8 | 2020-01-28 | Polycom HDX Video End Points before 3.0.4 and UC APL before 2.7.1.J allows remote authenticated users to execute arbitrary commands as demonstrated by a ; (sem… |
CVE-2012-6609 | High | 7.5 | 2020-01-28 | Directory traversal vulnerability in a_getlog.cgi in Polycom HDX Video End Points before 3.0.4 and UC APL before 2.7.1.J allows remote attackers to read arbitr… |
CVE-2012-6114 | Medium | 5.5 | 2020-01-28 | The git-changelog utility in git-extras 1.7.0 allows local users to overwrite arbitrary files via a symlink attack on (1) /tmp/changelog or (2) /tmp/.git-effor… |
CVE-2012-6448 | Medium | 6.1 | 2020-01-27 | Cross-site Scripting (XSS) in cPanel WebHost Manager (WHM) 11.34.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
CVE-2012-1496 | High | 8.8 | 2020-01-27 | Local file inclusion in WebCalendar before 1.2.5. |
CVE-2012-1495 | Critical | 9.8 | 2020-01-27 | install/index.php in WebCalendar before 1.2.5 allows remote attackers to execute arbitrary code via the form_single_user_login parameter. |
CVE-2012-6613 | High | 7.2 | 2020-01-25 | D-Link DSR-250N devices with firmware 1.05B73_WW allow Persistent Root Access because of the admin password for the admin account. |
CVE-2012-6494 | Medium | 6.1 | 2020-01-25 | Rapid7 Nexpose before 5.5.4 contains a session hijacking vulnerability which allows remote attackers to capture a user's session and gain unauthorized access. |
CVE-2012-6345 | High | 7.5 | 2020-01-25 | Novell ZENworks Configuration Management before 11.2.4 allows obtaining sensitive trace information. |
CVE-2012-6344 | Medium | 6.1 | 2020-01-25 | Novell ZENworks Configuration Management before 11.2.4 allows XSS. |
CVE-2012-6451 | Critical | 9.8 | 2020-01-24 | Lorex LNC116 and LNC104 IP Cameras have a Remote Authentication Bypass Vulnerability |
CVE-2012-6302 | High | 7.8 | 2020-01-24 | Soapbox through 0.3.1: Sandbox bypass - runs a second instance of Soapbox within a sandboxed Soapbox. |
CVE-2012-6663 | High | 7.5 | 2020-01-23 | General Electric D20ME devices are not properly configured and reveal plaintext passwords. |
CVE-2012-6649 | Critical | 9.8 | 2020-01-23 | WordPress WP GPX Maps Plugin 1.1.21 allows remote attackers to execute arbitrary PHP code via improper file upload. |
CVE-2012-5389 | High | 7.5 | 2020-01-23 | NULL Pointer Dereference in PowerTCP WebServer for ActiveX 1.9.2 and earlier allows remote attackers to cause a denial of service (application crash) via a cra… |
CVE-2012-5340 | High | 7.8 | 2020-01-23 | SumatraPDF 2.1.1/MuPDF 1.0 allows remote attackers to cause an Integer Overflow in the lex_number() function via a corrupt PDF file. |
CVE-2012-4606 | High | 7.8 | 2020-01-23 | Citrix XenServer 4.1, 6.0, 5.6 SP2, 5.6 Feature Pack 1, 5.6 Common Criteria, 5.6, 5.5, 5.0, and 5.0 Update 3 contains a Local Privilege Escalation Vulnerabilit… |
CVE-2012-5626 | High | 7.5 | 2020-01-23 | EJB method in Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 5; Red Hat JBoss Operations Network 3.1; Red Hat JBoss Portal 4 and 5; Red Ha… |
CVE-2012-6083 | High | 7.5 | 2020-01-23 | Freeciv before 2.3.3 allows remote attackers to cause a denial of service via a crafted packet. |
CVE-2012-5867 | Critical | 9.8 | 2020-01-23 | HT Editor 2.0.20 has a Remote Stack Buffer Overflow Vulnerability |
CVE-2012-5699 | Critical | 9.8 | 2020-01-23 | BabyGekko before 1.2.4 allows PHP file inclusion. |
CVE-2012-5698 | High | 8.8 | 2020-01-23 | BabyGekko before 1.2.4 has SQL injection. |
CVE-2012-4981 | High | 8.8 | 2020-01-23 | Toshiba ConfigFree 8.0.38 has a CF7 File Remote Command Execution Vulnerability |
CVE-2012-4900 | Medium | 5.5 | 2020-01-23 | Corel WordPerfect Office X6 16.0.0.388 has a DoS Vulnerability via untrusted pointer dereference |
CVE-2012-4863 | Medium | 6.5 | 2020-01-23 | IBM WebSphere MQ 7.1 and 7.5: Queue manager has a DoS vulnerability |
CVE-2012-2087 | Critical | 9.8 | 2020-01-23 | ISPConfig 3.0.4.3: the "Add new Webdav user" can chmod and chown entire server from client interface. |
CVE-2012-4919 | Critical | 9.8 | 2020-01-22 | Gallery Plugin1.4 for WordPress has a Remote File Include Vulnerability |
CVE-2012-5190 | Critical | 9.8 | 2020-01-21 | Prizm Content Connect 5.1 has an Arbitrary File Upload Vulnerability |
CVE-2012-1326 | High | 7.4 | 2020-01-15 | Cisco IronPort Web Security Appliance up to and including 7.5 does not validate the basic constraints of the certificate authority which could lead to MITM att… |
CVE-2012-1316 | Medium | 5.9 | 2020-01-15 | Cisco IronPort Web Security Appliance does not check for certificate revocation which could lead to MITM attacks |
CVE-2012-0070 | High | 7.5 | 2020-01-15 | spamdyke prior to 4.2.1: STARTTLS reveals plaintext |
CVE-2012-1563 | High | 7.5 | 2020-01-15 | Joomla! before 2.5.3 allows Admin Account Creation. |
CVE-2012-1562 | High | 7.5 | 2020-01-15 | Joomla! core before 2.5.3 allows unauthorized password change. |
CVE-2012-0945 | Medium | 4.9 | 2020-01-15 | whoopsie-daisy before 0.1.26: Root user can remove arbitrary files |
CVE-2012-0334 | Medium | 6.4 | 2020-01-15 | Cisco IronPort Web Security Appliance AsyncOS software prior to 7.5 has a SSL Certificate Caching vulnerability which could allow man-in-the-middle attacks |
CVE-2012-4761 | High | 7.8 | 2020-01-13 | A Privilege Escalation vulnerability exists in the unquoted Service Binary in SDPAgent or SDBAgent in Safend Data Protector Agent 3.4.5586.9772, which could le… |
CVE-2012-4760 | High | 7.8 | 2020-01-13 | A Privilege Escalation vulnerability exists in the SDBagent service in Safend Data Protector Agent 3.4.5586.9772, which could let a local malicious user obtain… |
CVE-2012-4750 | Critical | 9.8 | 2020-01-13 | A Code Execution vulnerability exists in the memcpy function when processing AMF requests in Ezhometech EzServer 7.0, which could let a remote malicious user e… |
CVE-2012-4767 | Medium | 6.1 | 2020-01-13 | An issue exists in Safend Data Protector Agent 3.4.5586.9772 in the securitylayer.log file in the logs.9972 directory, which could let a malicious user decrypt… |
CVE-2012-4603 | High | 7.8 | 2020-01-10 | Citrix XenApp Online Plug-in for Windows 12.1 and earlier, and Citrix Receiver for Windows 3.2 and earlier could allow remote attackers to execute arbitrary co… |
CVE-2012-4284 | Critical | 9.8 | 2020-01-10 | A Privilege Escalation vulnerability exists in Viscosity 1.4.1 on Mac OS X due to a path name validation issue in the setuid-set ViscosityHelper binary, which… |
CVE-2012-3821 | Medium | 4.3 | 2020-01-10 | A Security Bypass vulnerability exists in the activate.asp page in Arial Software Campaign Enterprise 11.0.551, which could let a remote malicious user modify… |
CVE-2012-4030 | High | 7.5 | 2020-01-10 | Chamilo before 1.8.8.6 does not adequately handle user supplied input by the index.php script, which could allow remote attackers to delete arbitrary files. |
CVE-2012-3824 | High | 7.5 | 2020-01-10 | In Arial Campaign Enterprise before 11.0.551, multiple pages are accessible without authentication or authorization. |
CVE-2012-3823 | High | 7.5 | 2020-01-10 | Arial Campaign Enterprise before 11.0.551 stores passwords in clear text and these may be retrieved. |
CVE-2012-3822 | High | 7.5 | 2020-01-10 | Arial Campaign Enterprise before 11.0.551 has unauthorized access to the User-Edit.asp page, which allows remote attackers to enumerate users' credentials. |
CVE-2012-3810 | High | 7.5 | 2020-01-09 | Samsung Kies before 2.5.0.12094_27_11 has registry modification. |
CVE-2012-3809 | High | 7.5 | 2020-01-09 | Samsung Kies before 2.5.0.12094_27_11 has arbitrary directory modification. |
CVE-2012-3808 | High | 7.5 | 2020-01-09 | Samsung Kies before 2.5.0.12094_27_11 has arbitrary file modification. |
CVE-2012-3807 | Critical | 9.8 | 2020-01-09 | Samsung Kies before 2.5.0.12094_27_11 has arbitrary file execution. |
CVE-2012-3806 | High | 7.5 | 2020-01-09 | Samsung Kies before 2.5.0.12094_27_11 contains a NULL pointer dereference vulnerability which could allow remote attackers to perform a denial of service. |
CVE-2012-2950 | High | 8.1 | 2020-01-09 | Gateway Geomatics MapServer for Windows before 3.0.6 contains a Local File Include Vulnerability which allows remote attackers to execute local PHP code and ob… |
CVE-2012-5558 | Medium | 4.8 | 2020-01-09 | Cross-site scripting (XSS) vulnerability in the Smiley module 6.x-1.x versions prior to 6.x-1.1 and Smileys module 6.x-1.x versions prior to 6.x-1.1 for Drupal… |
CVE-2012-4434 | High | 8.8 | 2020-01-09 | fwknop before 2.0.3 allow remote authenticated users to cause a denial of service (server crash) or possibly execute arbitrary code. |
CVE-2012-3490 | High | 8.8 | 2020-01-09 | The (1) my_popenv_impl and (2) my_spawnv functions in src/condor_utils/my_popen.cpp and the (3) systemCommand function in condor_vm-gahp/vmgahp_common.cpp in C… |
CVE-2012-2931 | High | 7.2 | 2020-01-09 | PHP code injection in TinyWebGallery before 1.8.8 allows remote authenticated users with admin privileges to inject arbitrary code into the .htusers.php file. |
CVE-2012-2226 | Critical | 9.8 | 2020-01-09 | Invision Power Board before 3.3.1 fails to sanitize user-supplied input which could allow remote attackers to obtain sensitive information or execute arbitrary… |
CVE-2012-2142 | High | 7.8 | 2020-01-09 | The error function in Error.cc in poppler before 0.21.4 allows remote attackers to execute arbitrary commands via a PDF containing an escape sequence for a ter… |
CVE-2012-1915 | Medium | 6.1 | 2020-01-09 | EllisLab CodeIgniter 2.1.2 allows remote attackers to bypass the xss_clean() Filter and perform XSS attacks. |
CVE-2012-2724 | Medium | 5.3 | 2020-01-09 | The Simplenews module 6.x-1.x before 6.x-1.4, 6.x-2.x before 6.x-2.0-alpha4, and 7.x-1.x before 7.x-1.0-rc1 for Drupal reveals the email addresses of new maili… |
CVE-2012-2714 | Critical | 9.8 | 2020-01-09 | The BrowserID (Mozilla Persona) module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of arbitrary users via the audien… |
CVE-2012-1261 | Medium | 6.1 | 2020-01-09 | Cross-site scripting (XSS) vulnerability in cgi-bin/scrut_fa_exclusions.cgi in Plixer International Scrutinizer NetFlow and sFlow Analyzer 8.6.2.16204 and othe… |