2012 CVEs (page 4)
Page 4 of 60 — CVEs published in 2012, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2012-0694 | Critical | 9.8 | 2019-10-29 | SugarCRM CE <= 6.3.1 contains scripts that use "unserialize()" with user controlled input which allows remote attackers to execute arbitrary PHP code. |
CVE-2012-2945 | High | 7.5 | 2019-10-29 | Hadoop 1.0.3 contains a symlink vulnerability. |
CVE-2012-1187 | Critical | 9.8 | 2019-10-29 | Bitlbee does not drop extra group privileges correctly in unix.c |
CVE-2012-0046 | High | 7.5 | 2019-10-29 | mediawiki allows deleted text to be exposed |
CVE-2012-5577 | High | 7.5 | 2019-10-28 | Python keyring lib before 0.10 created keyring files with world-readable permissions. |
CVE-2012-6719 | Critical | 9.8 | 2019-08-28 | The sharebar plugin before 1.2.2 for WordPress has SQL injection. |
CVE-2012-6718 | Medium | 6.1 | 2019-08-28 | The sharebar plugin before 1.2.2 for WordPress has XSS, a different issue than CVE-2013-3491. |
CVE-2012-6717 | Medium | 6.1 | 2019-08-28 | The redirection plugin before 2.2.12 for WordPress has XSS, a different issue than CVE-2011-4562. |
CVE-2012-6716 | Medium | 6.1 | 2019-08-22 | The events-manager plugin before 5.1.7 for WordPress has XSS via JSON call links. |
CVE-2012-6714 | Medium | 6.1 | 2019-08-21 | The count-per-day plugin before 3.2.3 for WordPress has XSS via search words. |
CVE-2012-6715 | Medium | 6.1 | 2019-08-21 | The formbuilder plugin before 0.9.1 for WordPress has XSS via a Referer header. |
CVE-2012-6713 | Medium | 6.1 | 2019-08-13 | The job-manager plugin before 0.7.19 for WordPress has multiple XSS issues. |
CVE-2012-6712 | Critical | 9.8 | 2019-07-27 | In the Linux kernel before 3.4, a buffer overflow occurs in drivers/net/wireless/iwlwifi/iwl-agn-sta.c, which will cause at least memory corruption. |
CVE-2012-6711 | High | 7.0 | 2019-06-18 | A heap-based buffer overflow exists in GNU Bash before 4.3 when wide characters, not supported by the current locale set in the LC_CTYPE environment variable… |
CVE-2012-6652 | Critical | 9.8 | 2019-05-13 | Directory traversal vulnerability in pageflipbook.php script from index.php in Page Flip Book plugin for WordPress (wppageflip) allows remote attackers to incl… |
CVE-2012-6710 | Critical | 9.8 | 2018-10-07 | ext_find_user in eXtplorer through 2.1.2 allows remote attackers to bypass authentication via a password[]= (aka an empty array) in an action=login request to… |
CVE-2012-0433 | Low | 3.3 | 2018-06-08 | The install-chef-suse.sh script shipped with crowbar before 2012-10-02 is creating files containing confidential data with insecure permissions, allowing local… |
CVE-2012-5628 | Medium | 4.4 | 2018-05-04 | gofer before 0.68 uses world-writable permissions for /var/lib/gofer/journal/watchdog, which allows local users to cause a denial of service by removing journa… |
CVE-2012-3536 | Medium | 6.1 | 2018-02-27 | Two XSS vulnerabilities were fixed in message list and view in the Hupa Webmail application from the Apache James project. An attacker could send a carefully c… |
CVE-2012-6709 | Medium | 5.9 | 2018-02-23 | ELinks 0.12 and Twibright Links 2.3 have Missing SSL Certificate Validation. |
CVE-2012-0771 | High | 8.8 | 2018-02-19 | Adobe Shockwave Player before 11.6.4.634 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a… |
CVE-2012-6347 | Medium | 6.1 | 2018-02-09 | Multiple cross-site scripting (XSS) vulnerabilities in Java number format exception handling in FortiGate FortiDB before 4.4.2 allow remote attackers to inject… |
CVE-2012-6346 | Medium | 6.1 | 2018-02-09 | Multiple cross-site scripting (XSS) vulnerabilities in FortiWeb before 4.4.4 allow remote attackers to inject arbitrary web script or HTML via the (1) redir or… |
CVE-2012-5360 | High | 8.8 | 2018-02-08 | Libavcodec in FFmpeg before 0.11 allows remote attackers to execute arbitrary code via a crafted QT file. |
CVE-2012-5359 | High | 8.8 | 2018-02-08 | Libavcodec in FFmpeg before 0.11 allows remote attackers to execute arbitrary code via a crafted ASF file. |
CVE-2012-3331 | Medium | 5.3 | 2018-02-08 | IBM Sametime allows remote attackers to obtain sensitive information from the Sametime Log database via a direct request to STLOG.NSF. IBM X-Force ID: 78048. |
CVE-2012-2166 | Critical | 9.8 | 2018-02-08 | IBM XIV Storage System 2810-A14 and 2812-A14 devices before level 10.2.4.e-2 and 2810-114 and 2812-114 devices before level 11.1.1 have hardcoded passwords for… |
CVE-2012-0941 | Medium | 6.1 | 2018-02-08 | Multiple cross-site scripting (XSS) vulnerabilities in Fortinet FortiGate UTM WAF appliances with FortiOS 4.3.x before 4.3.6 allow remote attackers to inject a… |
CVE-2012-6708 | Medium | 6.1 | 2018-01-18 | jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable… |
CVE-2012-6682 | Medium | 6.1 | 2018-01-11 | Cross-site scripting (XSS) vulnerability in downloads/actions/editdownload.php in the DragonByte Technologies vBDownloads module 1.3.2 and earlier for vBulleti… |
CVE-2012-6671 | Medium | 6.1 | 2018-01-11 | Multiple cross-site scripting (XSS) vulnerabilities in actions/main.php in the DragonByte Technologies Forumon RPG module before 1.0.8 for vBulletin when creat… |
CVE-2012-6670 | Medium | 6.1 | 2018-01-11 | Multiple cross-site scripting (XSS) vulnerabilities in the DragonByte Technologies vbActivity module before 3.0.1 for vBulletin allow remote attackers to injec… |
CVE-2012-6668 | Medium | 6.1 | 2018-01-11 | Multiple cross-site scripting (XSS) vulnerabilities in the Shout Reports in the DragonByte Technologies vBShout module before 6.0.6 for vBulletin allow remote… |
CVE-2012-0699 | High | 8.8 | 2018-01-11 | Multiple cross-site request forgery (CSRF) vulnerabilities in Family Connections CMS (aka FCMS) 2.9 and earlier allow remote attackers to hijack the authentica… |
CVE-2012-6667 | Medium | 6.1 | 2018-01-11 | Cross-site scripting (XSS) vulnerability in vbshout.php in DragonByte Technologies vBShout module for vBulletin allows remote attackers to inject arbitrary web… |
CVE-2012-3353 | High | 7.5 | 2018-01-09 | The Apache Sling JCR ContentLoader 2.1.4 XmlReader used in the Sling JCR content loader module makes it possible to import arbitrary files in the content repos… |
CVE-2012-2576 | Critical | 9.8 | 2017-12-20 | SQL injection vulnerability in the LoginServlet page in SolarWinds Storage Manager before 5.1.2, SolarWinds Storage Profiler before 5.1.2, and SolarWinds Backu… |
CVE-2012-5636 | Medium | 6.1 | 2017-10-30 | Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.22, 1.5.x before 1.5.10, and 6.x before 6.4.0 might allow remote attackers to inject… |
CVE-2012-4449 | Critical | 9.8 | 2017-10-30 | Apache Hadoop before 0.23.4, 1.x before 1.0.4, and 2.x before 2.0.2 generate token passwords using a 20-bit secret when Kerberos security features are enabled… |
CVE-2012-0881 | High | 7.5 | 2017-10-30 | Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service (CPU consumption) via a crafted message to an XML service, which… |
CVE-2012-5358 | Critical | 9.8 | 2017-10-30 | The XSLTCompiledTransform function in Ektron Content Management System (CMS) before 8.02 SP5 configures the XSL with enableDocumentFunction set to true, which… |
CVE-2012-5357 | Critical | 9.8 | 2017-10-30 | Ektron Content Management System (CMS) before 8.02 SP5 uses the XslCompiledTransform class with enablescript set to true, which allows remote attackers to exec… |
CVE-2012-4378 | Medium | 6.1 | 2017-10-26 | Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki before 1.18.5 and 1.19.x before 1.19.2, when unspecified JavaScript gadgets are used, allow re… |
CVE-2012-4377 | Medium | 6.1 | 2017-10-26 | Cross-site scripting (XSS) vulnerability in MediaWiki before 1.18.5 and 1.19.x before 1.19.2 allows remote attackers to inject arbitrary web script or HTML via… |
CVE-2012-1622 | Critical | 9.8 | 2017-10-26 | Apache OFBiz 10.04.x before 10.04.02 allows remote attackers to execute arbitrary code via unspecified vectors. |
CVE-2012-4570 | Critical | 9.8 | 2017-10-23 | SQL injection vulnerability in LetoDMS_Core/Core/inc.ClassDMS.php in LetoDMS (formerly MyDMS) before 3.3.8 allows remote attackers to execute arbitrary SQL com… |
CVE-2012-4569 | Medium | 6.1 | 2017-10-23 | Multiple cross-site scripting (XSS) vulnerabilities in out/out.UsrMgr.php in LetoDMS (formerly MyDMS) before 3.3.9 allow remote attackers to inject arbitrary w… |
CVE-2012-4568 | High | 8.8 | 2017-10-23 | Multiple cross-site request forgery (CSRF) vulnerabilities in LetoDMS (formerly MyDMS) before 3.3.8 allow remote attackers to hijack the authentication of unsp… |
CVE-2012-4567 | Medium | 6.1 | 2017-10-23 | Multiple cross-site scripting (XSS) vulnerabilities in LetoDMS (formerly MyDMS) before 3.3.8 allow remote attackers to inject arbitrary web script or HTML via… |
CVE-2012-4382 | Medium | 4.9 | 2017-10-19 | MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not properly protect user block metadata, which allows remote administrators to read a user block reason… |
CVE-2012-4380 | High | 7.5 | 2017-10-19 | MediaWiki before 1.18.5, and 1.19.x before 1.19.2 allows remote attackers to bypass GlobalBlocking extension IP address blocking and create an account via unsp… |
CVE-2012-4379 | Medium | 6.5 | 2017-10-19 | MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not send a restrictive X-Frame-Options HTTP header, which allows remote attackers to conduct clickjackin… |
CVE-2012-6707 | High | 7.5 | 2017-10-19 | WordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which makes it easier for attackers to determine cleartext values by leveraging acces… |
CVE-2012-6696 | Critical | 9.8 | 2017-09-25 | inspircd in Debian before 2.0.7 does not properly handle unsigned integers. NOTE: This vulnerability exists because of an incomplete fix to CVE-2012-1836. |
CVE-2012-2805 | High | 7.5 | 2017-08-28 | Unspecified vulnerability in FFMPEG 0.10 allows remote attackers to cause a denial of service. |
CVE-2012-2781 | Critical | 9.8 | 2017-08-09 | Unspecified vulnerability in FFmpeg before 0.10.3 has unknown impact and attack vectors, a different vulnerability than CVE-2012-2771, CVE-2012-2773, CVE-2012-… |
CVE-2012-2780 | Critical | 9.8 | 2017-08-09 | Unspecified vulnerability in FFmpeg before 0.10.3 has unknown impact and attack vectors, a different vulnerability than CVE-2012-2771, CVE-2012-2773, CVE-2012-… |
CVE-2012-2778 | Critical | 9.8 | 2017-08-09 | Unspecified vulnerability in FFmpeg before 0.10.3 has unknown impact and attack vectors, a different vulnerability than CVE-2012-2771, CVE-2012-2773, CVE-2012-… |
CVE-2012-2773 | Critical | 9.8 | 2017-08-09 | Unspecified vulnerability in FFmpeg before 0.10.3 has unknown impact and attack vectors, a different vulnerability than CVE-2012-2771, CVE-2012-2778, CVE-2012-… |
CVE-2012-2771 | Critical | 9.8 | 2017-08-09 | Unspecified vulnerability in FFmpeg before 0.10.3 has unknown impact and attack vectors, a different vulnerability than CVE-2012-2773, CVE-2012-2778, CVE-2012-… |
CVE-2012-0880 | High | 7.5 | 2017-08-08 | Apache Xerces-C++ allows remote attackers to cause a denial of service (CPU consumption) via a crafted message sent to an XML service that causes hash table co… |
CVE-2012-0803 | Critical | 9.8 | 2017-08-08 | The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1 allows remote attackers to bypass authentication by sending an empty UsernameToken as part of a SO… |
CVE-2012-5030 | Medium | 6.5 | 2017-08-02 | Cisco IOS before 15.2(4)S6 does not initialize an unspecified variable, which might allow remote authenticated users to cause a denial of service (CPU consumpt… |
CVE-2012-5010 | High | 8.1 | 2017-06-27 | ASA 5515-X Adaptive Security Appliance Adaptive Security Appliance (ASA) Software 9.4.x before 9.4.1 Interim, 9.2.x before 9.2.4 Interim, ASA 5510 Adaptive Sec… |
CVE-2012-6706 | Critical | 9.8 | 2017-06-22 | A VMSF_DELTA memory corruption was discovered in unrar before 5.5.5, as used in Sophos Anti-Virus Threat Detection Engine before 3.37.2 and other products, tha… |
CVE-2012-6705 | Medium | 6.1 | 2017-06-04 | Cross Site Scripting (XSS) exists in Jamroom before 4.2.7 via the Status Update field. |
CVE-2012-1301 | Critical | 9.8 | 2017-04-13 | The FeedProxy.aspx script in Umbraco 4.7.0 allows remote attackers to proxy requests on their behalf via the "url" parameter. |
CVE-2012-6697 | High | 7.5 | 2017-04-13 | InspIRCd before 2.0.7 allows remote attackers to cause a denial of service (infinite loop). |
CVE-2012-5361 | High | 7.8 | 2017-03-20 | Libavcodec in FFmpeg before 0.11 allows remote attackers to execute arbitrary code via a crafted WMV file. |
CVE-2012-6704 | High | 7.8 | 2016-12-28 | The sock_setsockopt function in net/core/sock.c in the Linux kernel before 3.5 mishandles negative values of sk_sndbuf and sk_rcvbuf, which allows local users… |
CVE-2012-6703 | High | 7.8 | 2016-06-29 | Integer overflow in the snd_compr_allocate_buffer function in sound/core/compress_offload.c in the ALSA subsystem in the Linux kernel before 3.6-rc6-next-20120… |
CVE-2012-6702 | Medium | 5.9 | 2016-06-16 | Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, makes it easier for context-dependent attackers to defeat cryptograp… |
CVE-2012-6701 | High | 7.8 | 2016-05-02 | Integer overflow in fs/aio.c in the Linux kernel before 3.4.1 allows local users to cause a denial of service or possibly have unspecified other impact via a l… |
CVE-2012-6689 | High | 7.8 | 2016-05-02 | The netlink_sendmsg function in net/netlink/af_netlink.c in the Linux kernel before 3.5.5 does not validate the dst_pid field, which allows local users to have… |
CVE-2012-6700 | High | 7.5 | 2016-04-11 | The decode_search function in dhcp.c in dhcpcd 3.x does not properly free allocated memory, which allows remote DHCP servers to cause a denial of service via a… |
CVE-2012-6699 | High | 7.5 | 2016-04-11 | The decode_search function in dhcp.c in dhcpcd 3.x allows remote DHCP servers to cause a denial of service (out-of-bounds read) via a crafted response. |
CVE-2012-6698 | High | 7.5 | 2016-04-11 | The decode_search function in dhcp.c in dhcpcd 3.x allows remote DHCP servers to cause a denial of service (out-of-bounds write) via a crafted response. |
CVE-2012-2150 | | 2015-08-25 | xfs_metadump in xfsprogs before 3.2.4 does not properly obfuscate file data, which allows remote attackers to obtain sensitive information by reading a generat… | |
CVE-2012-6695 | | 2015-08-04 | GE Healthcare Centricity PACS Workstation 4.0 and 4.0.1 has a password of ddpadmin for the ddpadmin user, which has unspecified impact and attack vectors. NOT… | |
CVE-2012-6694 | | 2015-08-04 | GE Healthcare Centricity PACS Workstation 4.0 and 4.0.1, and Server 4.0, has a password of 2charGE for the geservice account, which has unspecified impact and… | |
CVE-2012-6693 | | 2015-08-04 | GE Healthcare Centricity PACS 4.0 Server has a default password of (1) nasro for the nasro (ReadOnly) user and (2) nasrw for the nasrw (Read/Write) user, which… | |
CVE-2012-6660 | | 2015-08-04 | GE Healthcare Precision MPi has a password of (1) orion for the serviceapp user, (2) orion for the clinical operator user, and (3) PlatinumOne for the administ… | |
CVE-2012-6692 | | 2015-06-17 | Cross-site scripting (XSS) vulnerability in js/wp-seo-metabox.js in the WordPress SEO by Yoast plugin before 2.2 for WordPress allows remote attackers to injec… | |
CVE-2012-4716 | | 2015-06-13 | N-Tron 702-W Industrial Wireless Access Point devices use the same (1) SSH and (2) HTTPS private keys across different customers' installations, which makes it… | |
CVE-2012-1978 | | 2015-05-21 | Multiple cross-site request forgery (CSRF) vulnerabilities in Simple PHP Agenda 2.2.8 and earlier allow remote attackers to hijack the authentication of admini… | |
CVE-2012-4902 | | 2015-05-20 | Multiple cross-site request forgery (CSRF) vulnerabilities in Template CMS 2.1.1 and earlier allow remote attackers to hijack the authentication of administrat… | |
CVE-2012-4901 | | 2015-05-20 | Cross-site scripting (XSS) vulnerability in Template CMS 2.1.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the themes_editor… | |
CVE-2012-6691 | | 2015-05-20 | Multiple cross-site request forgery (CSRF) vulnerabilities in the admin panel in osCMax before 2.5.1 allow remote attackers to hijack the authentication of adm… | |
CVE-2012-3243 | | 2015-05-20 | Cross-site scripting (XSS) vulnerability in the SEOgento plugin for Magento allows remote attackers to inject arbitrary web script or HTML via the id parameter… | |
CVE-2012-1665 | | 2015-05-20 | Multiple SQL injection vulnerabilities in the admin panel in osCMax before 2.5.1 allow (1) remote attackers to execute arbitrary SQL commands via the username… | |
CVE-2012-1664 | | 2015-05-20 | Multiple cross-site scripting (XSS) vulnerabilities in the admin panel in osCMax before 2.5.1 allow remote attackers to inject arbitrary web script or HTML via… | |
CVE-2012-5849 | | 2015-05-14 | Multiple SQL injection vulnerabilities in ClipBucket 2.6 Revision 738 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) uid para… | |
CVE-2012-5451 | | 2015-04-24 | Multiple stack-based buffer overflows in HttpUtils.dll in TVMOBiLi before 2.1.0.3974 allow remote attackers to cause a denial of service (tvMobiliService servi… | |
CVE-2012-2932 | | 2015-04-24 | Multiple cross-site scripting (XSS) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to inject arbitrary web script or HTML via the… | |
CVE-2012-2930 | | 2015-04-24 | Multiple cross-site request forgery (CSRF) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to hijack the authentication of administ… | |
CVE-2012-2808 | | 2015-04-01 | The PRNG implementation in the DNS resolver in Bionic in Android before 4.1.1 incorrectly uses time and PID information during the generation of random numbers… | |
CVE-2012-6687 | | 2015-02-19 | FastCGI (aka fcgi and libfcgi) 2.4.0 allows remote attackers to cause a denial of service (segmentation fault and crash) via a large number of connections. | |
CVE-2012-6684 | | 2015-01-08 | Cross-site scripting (XSS) vulnerability in the RedCloth library 4.2.9 for Ruby and earlier allows remote attackers to inject arbitrary web script or HTML via… | |
CVE-2012-5853 | | 2015-01-08 | SQL injection vulnerability in the "the_search_function" function in cardoza_ajax_search.php in the AJAX Post Search (cardoza-ajax-search) plugin before 1.3 fo… | |
CVE-2012-1415 | | 2014-12-28 | Cross-site request forgery (CSRF) vulnerability in lib/logout.php in DFLabs PTK 1.0.5 and earlier allows remote attackers to hijack the authentication of admin… |