2012 CVEs (page 3)
Page 3 of 60 — CVEs published in 2012, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2012-1260 | Medium | 6.1 | 2020-01-09 | Cross-site scripting (XSS) vulnerability in cgi-bin/userprefs.cgi in Plixer International Scrutinizer NetFlow & sFlow Analyzer 8.6.2.16204, and possibly other… |
CVE-2012-1259 | Critical | 9.8 | 2020-01-09 | Multiple SQL injection vulnerabilities in Plixer International Scrutinizer NetFlow & sFlow Analyzer 8.6.2.16204, and possibly other versions before 9.0.1.19899… |
CVE-2012-1258 | Medium | 6.5 | 2020-01-09 | cgi-bin/userprefs.cgi in Plixer International Scrutinizer NetFlow & sFlow Analyzer before 9.0.1.19899 does not validate user permissions, which allow remote at… |
CVE-2012-5878 | Critical | 9.8 | 2020-01-03 | Bulb Security Smartphone Pentest Framework (SPF) 0.1.2 through 0.1.4 allows remote attackers to execute arbitrary commands via shell metacharacters in the host… |
CVE-2012-5693 | High | 8.8 | 2020-01-03 | Bulb Security Smartphone Pentest Framework (SPF) before 0.1.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the ipAddressTB… |
CVE-2012-4451 | Medium | 6.1 | 2020-01-03 | Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unsp… |
CVE-2012-5663 | High | 7.5 | 2019-12-30 | The isearch package (textproc/isearch) before 1.47.01nb1 uses the tempnam() function to create insecure temporary files into a publicly-writable area (/tmp). |
CVE-2012-5645 | High | 7.5 | 2019-12-30 | A denial of service flaw was found in the way the server component of Freeciv before 2.3.4 processed certain packets. A remote attacker could send a specially-… |
CVE-2012-5476 | Medium | 5.5 | 2019-12-30 | Within the RHOS Essex Preview (2012.2) of the OpenStack dashboard package, the file /etc/quantum/quantum.conf is world readable which exposes the admin passwor… |
CVE-2012-5474 | Medium | 5.5 | 2019-12-30 | The file /etc/openstack-dashboard/local_settings within Red Hat OpenStack Platform 2.0 and RHOS Essex Release (python-django-horizon package before 2012.1.1) i… |
CVE-2012-4980 | High | 7.8 | 2019-12-27 | Multiple stack-based buffer overflows in CFProfile.exe in Toshiba ConfigFree Utility 8.0.38 allow user-assisted attackers to execute arbitrary code. |
CVE-2012-4420 | High | 7.5 | 2019-12-26 | An information disclosure flaw was found in the way the Java Virtual Machine (JVM) implementation of Java SE 7 as provided by OpenJDK 7 incorrectly initialized… |
CVE-2012-3462 | High | 8.8 | 2019-12-26 | A flaw was found in SSSD version 1.9.0. The SSSD's access-provider logic causes the result of the HBAC rule processing to be ignored in the event that the acce… |
CVE-2012-2736 | Medium | 4.4 | 2019-12-26 | In NetworkManager 0.9.2.0, when a new wireless network was created with WPA/WPA2 security in AdHoc mode, it created an open/insecure network. |
CVE-2012-6111 | High | 7.5 | 2019-12-20 | gnome-keyring does not discard stored secrets when using gnome_keyring_lock_all_sync function |
CVE-2012-6094 | Critical | 9.8 | 2019-12-20 | cups (Common Unix Printing System) 'Listen localhost:631' option not honored correctly which could provide unauthorized access to the system |
CVE-2012-5639 | Medium | 6.5 | 2019-12-20 | LibreOffice and OpenOffice automatically open embedded content |
CVE-2012-3409 | High | 7.8 | 2019-12-20 | ecryptfs-utils: suid helper does not restrict mounting filesystems with nosuid,nodev which creates a possible privilege escalation |
CVE-2012-2656 | High | 7.5 | 2019-12-18 | An XML eXternal Entity (XXE) issue exists in Restlet 1.1.10 in an endpoint using XML transport, which lets a remote attacker obtain sensitive information. |
CVE-2012-2312 | High | 7.8 | 2019-12-18 | An Elevated Privileges issue exists in JBoss AS 7 Community Release due to the improper implementation in the security context propagation, A threat gets reuse… |
CVE-2012-2237 | Medium | 6.1 | 2019-12-17 | Multiple cross-site scripting (XSS) vulnerabilities in Mahara 1.4.x before 1.4.3 and 1.5.x before 1.5.2 allow remote attackers to inject arbitrary web script o… |
CVE-2012-1577 | Critical | 9.8 | 2019-12-10 | lib/libc/stdlib/random.c in OpenBSD returns 0 when seeded with 0. |
CVE-2012-2148 | Low | 3.3 | 2019-12-06 | An issue exists in the property replacements feature in any descriptor in JBoxx AS 7.1.1 ignores java security policies |
CVE-2012-2130 | High | 7.4 | 2019-12-06 | A Security Bypass vulnerability exists in PolarSSL 0.99pre4 through 1.1.1 due to a weak encryption error when generating Diffie-Hellman values and RSA keys. |
CVE-2012-2092 | Medium | 5.9 | 2019-12-06 | A Security Bypass vulnerability exists in Ubuntu Cobbler before 2,2,2 in the cobbler-ubuntu-import script due to an error when verifying the GPG signature. |
CVE-2012-1615 | High | 7.8 | 2019-12-06 | A Privilege Escalation vulnerability exits in Fedoraproject Sectool due to an incorrect DBus file. |
CVE-2012-1592 | High | 8.8 | 2019-12-05 | A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files. |
CVE-2012-1115 | Medium | 6.1 | 2019-12-05 | A Cross-Site Scripting (XSS) vulnerability exists in LDAP Account Manager (LAM) Pro 3.6 in the export, add_value_form, and dn parameters to cmd.php. |
CVE-2012-1114 | Medium | 6.1 | 2019-12-05 | A Cross-Site Scripting (XSS) vulnerability exists in LDAP Account Manager (LAM) Pro 3.6 in the filter parameter to cmd.php in an export and exporter_id action… |
CVE-2012-1105 | Medium | 5.5 | 2019-12-05 | An Information Disclosure vulnerability exists in the Jasig Project php-pear-CAS 1.2.2 package in the /tmp directory. The Central Authentication Service client… |
CVE-2012-1104 | Medium | 5.3 | 2019-12-05 | A Security Bypass vulnerability exists in the phpCAS 1.2.2 library from the jasig project due to the way proxying of services are managed. |
CVE-2012-5562 | High | 8.6 | 2019-12-02 | A flaw was found in rhn-proxy. This vulnerability may allow the rhn-proxy to transmit user credentials in clear-text when it accesses RHN Satellite. This could… |
CVE-2012-4576 | High | 7.8 | 2019-12-02 | FreeBSD: Input Validation Flaw allows local users to gain elevated privileges |
CVE-2012-4526 | Medium | 6.1 | 2019-12-02 | piwigo has XSS in password.php (incomplete fix for CVE-2012-4525) |
CVE-2012-4525 | Medium | 6.1 | 2019-12-02 | piwigo has XSS in password.php |
CVE-2012-4480 | High | 7.8 | 2019-12-02 | mom creates world-writable pid files in /var/run |
CVE-2012-4428 | High | 7.5 | 2019-12-02 | openslp: SLPIntersectStringList()' Function has a DoS vulnerability |
CVE-2012-6655 | Low | 3.3 | 2019-11-27 | An issue exists AccountService 0.6.37 in the user_change_password_authorized_cb() function in user.c which could let a local users obtain encrypted passwords. |
CVE-2012-2248 | High | 8.1 | 2019-11-27 | An issue was discovered in dhclient 4.3.1-6 due to an embedded path variable. |
CVE-2012-6639 | High | 8.8 | 2019-11-25 | An privilege elevation vulnerability exists in Cloud-init before 0.7.0 when requests to an untrusted system are submitted for EC2 instance data. |
CVE-2012-5644 | Medium | 5.5 | 2019-11-25 | libuser has information disclosure when moving user's home directory |
CVE-2012-5640 | Medium | 5.5 | 2019-11-25 | thttpd has a local DoS vulnerability via specially-crafted .htpasswd files |
CVE-2012-5631 | High | 8.8 | 2019-11-25 | ipa 3.0 does not properly check server identity before sending credential containing cookies |
CVE-2012-5630 | Medium | 6.3 | 2019-11-25 | libuser 0.56 and 0.57 has a TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees. |
CVE-2012-5617 | High | 7.8 | 2019-11-25 | gksu-polkit: permissive PolicyKit policy configuration file allows privilege escalation |
CVE-2012-5582 | Critical | 9.8 | 2019-11-25 | opendnssec misuses libcurl API |
CVE-2012-5535 | High | 7.5 | 2019-11-25 | gnome-system-log polkit policy allows arbitrary files on the system to be read |
CVE-2012-5527 | Medium | 5.5 | 2019-11-25 | Claws Mail vCalendar plugin: credentials exposed on interface |
CVE-2012-5521 | Medium | 6.5 | 2019-11-25 | quagga (ospf6d) 0.99.21 has a DoS flaw in the way the ospf6d daemon performs routes removal |
CVE-2012-5518 | High | 7.5 | 2019-11-25 | vdsm: certificate generation upon node creation allowing vdsm to start and serve requests from anyone who has a matching key (and certificate) |
CVE-2012-5578 | Medium | 6.2 | 2019-11-25 | Python keyring has insecure permissions on new databases allowing world-readable files to be created |
CVE-2012-6079 | High | 7.5 | 2019-11-22 | W3 Total Cache before 0.9.2.5 exposes sensitive cached database information which allows remote attackers to download this information via their hash keys. |
CVE-2012-6078 | High | 7.5 | 2019-11-22 | W3 Total Cache before 0.9.2.5 generates hash keys insecurely which allows remote attackers to predict the values of the hashes. |
CVE-2012-6077 | High | 7.5 | 2019-11-22 | W3 Total Cache before 0.9.2.5 allows remote attackers to retrieve password hash information due to insecure storage of database cache files. |
CVE-2012-0877 | High | 7.5 | 2019-11-22 | PyXML: Hash table collisions CPU usage Denial of Service |
CVE-2012-0812 | Medium | 6.1 | 2019-11-22 | PostfixAdmin 2.3.4 has multiple XSS vulnerabilities |
CVE-2012-3407 | High | 7.8 | 2019-11-22 | plow has local buffer overflow vulnerability |
CVE-2012-2079 | High | 8.8 | 2019-11-22 | A cross-site request forgery (CSRF) vulnerability in the Activity module 6.x-1.x for Drupal. |
CVE-2012-2078 | Medium | 4.8 | 2019-11-21 | Cross-site scripting (XSS) vulnerability in the Activity module 6.x-1.x for Drupal. |
CVE-2012-1637 | Medium | 4.8 | 2019-11-21 | Cross-site scripting vulnerability (XSS) in the Quick Tabs module 6.x-2.x before 6.x-2.1, 6.x-3.x before 6.x-3.1, and 7.x-3.x before 7.x-3.3 for Drupal. |
CVE-2012-1001 | Medium | 6.1 | 2019-11-21 | Multiple cross-site scripting (XSS) vulnerabilities in Chyrp before 2.1.2 and before 2.5 Beta 2 allow remote attackers to inject arbitrary web script or HTML v… |
CVE-2012-4524 | High | 7.5 | 2019-11-21 | xlockmore before 5.43 'dclock' security bypass vulnerability |
CVE-2012-3460 | Critical | 9.8 | 2019-11-21 | cumin: At installation postgresql database user created without password |
CVE-2012-3543 | High | 7.5 | 2019-11-21 | mono 2.10.x ASP.NET Web Form Hash collision DoS |
CVE-2012-2350 | High | 7.5 | 2019-11-21 | pam_shield before 0.9.4: Default configuration does not perform protective action |
CVE-2012-2238 | High | 7.5 | 2019-11-21 | trytond 2.4: ModelView.button fails to validate authorization |
CVE-2012-1257 | Medium | 5.5 | 2019-11-20 | Pidgin 2.10.0 uses DBUS for certain cleartext communication, which allows local users to obtain sensitive information via a dbus session monitor. |
CVE-2012-6136 | Medium | 5.5 | 2019-11-20 | tuned 2.10.0 creates its PID file with insecure permissions which allows local users to kill arbitrary processes. |
CVE-2012-6135 | High | 7.5 | 2019-11-19 | RubyGems passenger 4.0.0 betas 1 and 2 allows remote attackers to delete arbitrary files during the startup process. |
CVE-2012-6071 | High | 7.5 | 2019-11-19 | nuSOAP before 0.7.3-5 does not properly check the hostname of a cert. |
CVE-2012-6070 | High | 7.5 | 2019-11-19 | Falconpl before 0.9.6.9-git20120606 misuses the libcurl API which may allow remote attackers to interfere with security checks. |
CVE-2012-0843 | Medium | 5.5 | 2019-11-19 | uzbl: Information disclosure via world-readable cookies storage file |
CVE-2012-0824 | Critical | 9.8 | 2019-11-19 | gnusound 0.7.5 has format string issue |
CVE-2012-0842 | Medium | 5.5 | 2019-11-19 | surf: cookie jar has read access from other local user |
CVE-2012-4441 | Medium | 6.1 | 2019-11-18 | Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML in the CI game pl… |
CVE-2012-4440 | Medium | 6.1 | 2019-11-18 | Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML in the Violations… |
CVE-2012-4439 | Medium | 6.1 | 2019-11-18 | Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL… |
CVE-2012-4438 | High | 8.8 | 2019-11-18 | Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers with read access and HTTP access to Jenkins master to insert data and execute arbitrar… |
CVE-2012-1170 | High | 7.5 | 2019-11-14 | Moodle before 2.2.2 has an external enrolment plugin context check issue where capability checks are not thorough |
CVE-2012-1169 | Medium | 5.3 | 2019-11-14 | Moodle before 2.2.2 has Personal information disclosure, when administrative setting users name display is set to first name only full names are shown in page… |
CVE-2012-1161 | Medium | 4.3 | 2019-11-14 | Moodle before 2.2.2: Course information leak via hidden courses being displayed in tag search results |
CVE-2012-1160 | Low | 2.7 | 2019-11-14 | Moodle before 2.2.2 has a permission issue in Forum Subscriptions where unenrolled users can subscribe/unsubscribe via mod/forum/index.php |
CVE-2012-1159 | Medium | 4.3 | 2019-11-14 | Moodle before 2.2.2: Overview report allows users to see hidden courses |
CVE-2012-1158 | Medium | 4.3 | 2019-11-14 | Moodle before 2.2.2 has a course information leak in gradebook where users are able to see hidden grade items in export |
CVE-2012-1157 | Medium | 4.3 | 2019-11-14 | Moodle before 2.2.2 has a default repository capabilities issue where all repositories are viewable by all users by default |
CVE-2012-1168 | High | 8.2 | 2019-11-14 | Moodle before 2.2.2 has a password and web services issue where when the user profile is updated the user password is reset if not specified. |
CVE-2012-1156 | High | 7.5 | 2019-11-14 | Moodle before 2.2.2 has users' private files included in course backups |
CVE-2012-1155 | High | 7.5 | 2019-11-14 | Moodle has a database activity export permission issue where the export function of the database activity module exports all entries even those from groups the… |
CVE-2012-5193 | Medium | 6.1 | 2019-11-13 | Multiple cross-site scripting (XSS) vulnerabilities in Bitweaver 2.8.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the path i… |
CVE-2012-4385 | Medium | 6.5 | 2019-11-13 | letodms 3.3.6 has CSRF via change password |
CVE-2012-4384 | Medium | 6.1 | 2019-11-13 | letodms has multiple XSS issues: Reflected XSS in Login Page, Stored XSS in Document Owner/User name, Stored XSS in Calendar |
CVE-2012-1572 | High | 7.5 | 2019-11-12 | OpenStack Keystone: extremely long passwords can crash Keystone by exhausting stack space |
CVE-2012-1109 | High | 7.5 | 2019-11-12 | mwlib 0.13 through 0.13.4 has a denial of service vulnerability when parsing #iferror magic functions |
CVE-2012-0051 | High | 7.4 | 2019-11-07 | Tahoe-LAFS 1.9.0 fails to ensure integrity which allows remote attackers to corrupt mutable files or directories upon retrieval. |
CVE-2012-0049 | Medium | 4.3 | 2019-11-07 | OpenTTD before 1.1.5 contains a Denial of Service (slow read attack) that prevents users from joining the server. |
CVE-2012-2979 | High | 7.5 | 2019-11-01 | FreeBSD NSD before 3.2.13 allows remote attackers to crash a NSD child server process (SIGSEGV) and cause a denial of service in the NSD server. |
CVE-2012-6125 | Critical | 9.8 | 2019-10-31 | Chicken before 4.8.0 is susceptible to algorithmic complexity attacks related to hash table collisions. |
CVE-2012-6124 | Medium | 5.3 | 2019-10-31 | A casting error in Chicken before 4.8.0 on 64-bit platform caused the random number generator to return a constant value. NOTE: the vendor states "This functio… |
CVE-2012-6123 | Medium | 6.5 | 2019-10-31 | Chicken before 4.8.0 does not properly handle NUL bytes in certain strings, which allows an attacker to conduct "poisoned NUL byte attack." |
CVE-2012-6122 | High | 7.5 | 2019-10-31 | Buffer overflow in the thread scheduler in Chicken before 4.8.0.1 allows attackers to cause a denial of service (crash) by opening a file descriptor with a lar… |