CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In May 2012 (CVSS score >= 9)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2012-2949 264 +Priv 2012-05-29 2012-05-30
10.0
 None Remote Low Not required Complete Complete Complete
The ZTE sync_agent program for Android 2.3.4 on the Score M device uses a hardcoded ztex1609523 password to control access to commands, which allows remote attackers to gain privileges via a crafted application.
2 CVE-2012-2915 119 Exec Code Overflow 2012-05-21 2017-08-29
9.3
 None Remote Medium Not required Complete Complete Complete
Stack-based buffer overflow in Lattice Semiconductor PAC-Designer 6.2.1344 allows remote attackers to execute arbitrary code via a long string in a Value tag in a SymbolicSchematicData definition tag in PAC Design (.pac) file.
3 CVE-2012-2611 20 Exec Code 2012-05-15 2012-08-19
9.3
 None Remote Medium Not required Complete Complete Complete
The DiagTraceR3Info function in the Dialog processor in disp+work.exe 7010.29.15.58313 and 7200.70.18.23869 in the Dispatcher in SAP NetWeaver 7.0 EHP1 and EHP2, when a certain Developer Trace configuration is enabled, allows remote attackers to execute arbitrary code via a crafted SAP Diag packet.
4 CVE-2012-2568 264 2012-05-25 2017-08-29
10.0
 None Remote Low Not required Complete Complete Complete
d41d8cd98f00b204e9800998ecf8427e.php in the management web server on the Seagate BlackArmor device allows remote attackers to change the administrator password via unspecified vectors.
5 CVE-2012-2561 264 Exec Code 2012-05-21 2013-05-25
10.0
 None Remote Low Not required Complete Complete Complete
HP Business Service Management (BSM) 9.12 does not properly restrict the uploading of .war files, which allows remote attackers to execute arbitrary JSP code within the JBOSS Application Server component via a crafted request to TCP port 1098, 1099, or 4444.
6 CVE-2012-2450 DoS Exec Code 2012-05-04 2017-12-14
9.0
 None Remote Low ??? Complete Complete Complete
VMware Workstation 8.x before 8.0.3, VMware Player 4.x before 4.0.3, VMware Fusion 4.x before 4.1.2, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 do not properly register SCSI devices, which allows guest OS users to cause a denial of service (invalid write operation and VMX process crash) or possibly execute arbitrary code on the host OS by leveraging administrative privileges on the guest OS.
7 CVE-2012-2449 119 DoS Exec Code Overflow 2012-05-04 2017-12-14
9.0
 None Remote Low ??? Complete Complete Complete
VMware Workstation 8.x before 8.0.3, VMware Player 4.x before 4.0.3, VMware Fusion 4.x through 4.1.2, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 do not properly configure the virtual floppy device, which allows guest OS users to cause a denial of service (out-of-bounds write operation and VMX process crash) or possibly execute arbitrary code on the host OS by leveraging administrative privileges on the guest OS.
8 CVE-2012-2429 189 Exec Code 2012-05-25 2012-05-28
10.0
 None Remote Low Not required Complete Complete Complete
The server in xArrow before 3.4.1 performs an invalid read operation, which allows remote attackers to execute arbitrary code via unspecified vectors.
9 CVE-2012-2428 189 Exec Code Overflow 2012-05-25 2012-05-28
10.0
 None Remote Low Not required Complete Complete Complete
Integer overflow in the server in xArrow before 3.4.1 allows remote attackers to execute arbitrary code via a crafted packet that triggers an out-of-bounds read operation.
10 CVE-2012-2427 119 Exec Code Overflow 2012-05-25 2012-05-28
10.0
 None Remote Low Not required Complete Complete Complete
Heap-based buffer overflow in the server in xArrow before 3.4.1 allows remote attackers to execute arbitrary code via packets that trigger an invalid free operation.
11 CVE-2012-2411 119 Exec Code Overflow 2012-05-18 2017-08-29
9.3
 None Remote Medium Not required Complete Complete Complete
Buffer overflow in RealNetworks RealPlayer before 15.0.4.53, and RealPlayer SP 1.0 through 1.1.5, allows remote attackers to execute arbitrary code via a crafted RealJukebox Media file.
12 CVE-2012-2406 Exec Code 2012-05-18 2017-08-29
9.3
 None Remote Medium Not required Complete Complete Complete
RealNetworks RealPlayer before 15.0.4.53, and RealPlayer SP 1.0 through 1.1.5, does not properly parse ASMRuleBook data in RealMedia files, which allows remote attackers to execute arbitrary code via a crafted file.
13 CVE-2012-2376 119 1 Exec Code Overflow 2012-05-21 2017-08-29
10.0
 None Remote Low Not required Complete Complete Complete
Buffer overflow in the com_print_typeinfo function in PHP 5.4.3 and earlier on Windows allows remote attackers to execute arbitrary code via crafted arguments that trigger incorrect handling of COM object VARIANT types, as exploited in the wild in May 2012.
14 CVE-2012-2321 20 Exec Code 2012-05-18 2017-08-29
10.0
 None Remote Low Not required Complete Complete Complete
The loopback plug-in in ConnMan before 0.85 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) host name or (2) domain name in a DHCP reply.
15 CVE-2012-2271 119 1 Exec Code Overflow 2012-05-21 2017-12-05
10.0
 None Remote Low Not required Complete Complete Complete
Buffer overflow in the InitLicenKeys function in a certain ActiveX control in SkinCrafter3_vs2005.dll in SkinCrafter 3.0 allows remote attackers to execute arbitrary code via a long string in the first argument (aka the reg_name argument).
16 CVE-2012-2176 119 Exec Code Overflow 2012-05-25 2017-08-29
9.3
 None Remote Medium Not required Complete Complete Complete
Multiple stack-based buffer overflows in a certain ActiveX control in qp2.cab in IBM Lotus Quickr 8.2 before 8.2.0.27-002a for Domino allow remote attackers to execute arbitrary code via a long argument to the (1) Attachment_Times or (2) Import_Times method.
17 CVE-2012-2118 20 DoS Exec Code 2012-05-18 2017-08-29
10.0
 None Remote Low Not required Complete Complete Complete
Format string vulnerability in the LogVHdrMessageVerb function in os/log.c in X.Org X11 1.11 allows attackers to cause a denial of service or possibly execute arbitrary code via format string specifiers in an input device name.
18 CVE-2012-2042 119 DoS Exec Code Overflow Mem. Corr. 2012-05-24 2012-09-29
10.0
 None Remote Low Not required Complete Complete Complete
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-0780, CVE-2012-2023, CVE-2012-2024, CVE-2012-2025, and CVE-2012-2026.
19 CVE-2012-2033 119 DoS Exec Code Overflow Mem. Corr. 2012-05-09 2017-11-22
10.0
 None Remote Low Not required Complete Complete Complete
Adobe Shockwave Player before 11.6.5.635 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-2029, CVE-2012-2030, CVE-2012-2031, and CVE-2012-2032.
20 CVE-2012-2032 119 DoS Exec Code Overflow Mem. Corr. 2012-05-09 2017-11-22
10.0
 None Remote Low Not required Complete Complete Complete
Adobe Shockwave Player before 11.6.5.635 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-2029, CVE-2012-2030, CVE-2012-2031, and CVE-2012-2033.
21 CVE-2012-2031 119 DoS Exec Code Overflow Mem. Corr. 2012-05-09 2017-11-22
10.0
 None Remote Low Not required Complete Complete Complete
Adobe Shockwave Player before 11.6.5.635 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-2029, CVE-2012-2030, CVE-2012-2032, and CVE-2012-2033.
22 CVE-2012-2030 119 DoS Exec Code Overflow Mem. Corr. 2012-05-09 2017-11-22
10.0
 None Remote Low Not required Complete Complete Complete
Adobe Shockwave Player before 11.6.5.635 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-2029, CVE-2012-2031, CVE-2012-2032, and CVE-2012-2033.
23 CVE-2012-2029 119 DoS Exec Code Overflow Mem. Corr. 2012-05-09 2017-11-22
10.0
 None Remote Low Not required Complete Complete Complete
Adobe Shockwave Player before 11.6.5.635 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-2030, CVE-2012-2031, CVE-2012-2032, and CVE-2012-2033.
24 CVE-2012-2028 119 Exec Code Overflow 2012-05-09 2017-11-22
9.3
 None Remote Medium Not required Complete Complete Complete
Buffer overflow in Adobe Photoshop CS5 12.x before 12.0.5 and CS5.1 12.1.x before 12.1.1 allows remote attackers to execute arbitrary code via unspecified vectors.
25 CVE-2012-2027 399 Exec Code 2012-05-09 2014-06-21
9.3
 None Remote Medium Not required Complete Complete Complete
Use-after-free vulnerability in Adobe Photoshop CS5 12.x before 12.0.5 and CS5.1 12.1.x before 12.1.1 allows remote attackers to execute arbitrary code via a crafted TIFF (aka .TIF) file.
26 CVE-2012-2026 119 DoS Exec Code Overflow Mem. Corr. 2012-05-09 2017-08-29
10.0
 None Remote Low Not required Complete Complete Complete
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-0780, CVE-2012-2023, CVE-2012-2024, and CVE-2012-2025.
27 CVE-2012-2025 119 DoS Exec Code Overflow Mem. Corr. 2012-05-09 2017-08-29
10.0
 None Remote Low Not required Complete Complete Complete
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-0780, CVE-2012-2023, CVE-2012-2024, and CVE-2012-2026.
28 CVE-2012-2024 119 DoS Exec Code Overflow Mem. Corr. 2012-05-09 2017-08-29
10.0
 None Remote Low Not required Complete Complete Complete
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-0780, CVE-2012-2023, CVE-2012-2025, and CVE-2012-2026.
29 CVE-2012-2023 119 DoS Exec Code Overflow Mem. Corr. 2012-05-09 2017-08-29
10.0
 None Remote Low Not required Complete Complete Complete
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-0780, CVE-2012-2024, CVE-2012-2025, and CVE-2012-2026.
30 CVE-2012-2009 264 +Priv 2012-05-09 2017-11-22
9.0
 None Remote Low ??? Complete Complete Complete
Unspecified vulnerability in HP Performance Insight for Networks 5.3.x, 5.41, 5.41.001, and 5.41.002 allows remote authenticated users to gain privileges via unknown vectors.
31 CVE-2012-1847 264 Exec Code 2012-05-09 2018-10-12
9.3
 None Remote Medium Not required Complete Complete Complete
Microsoft Excel 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2008 and 2011 for Mac; Excel Viewer; and Office Compatibility Pack SP2 and SP3 do not properly handle memory during the opening of files, which allows remote attackers to execute arbitrary code via a crafted spreadsheet, aka "Excel Series Record Parsing Type Mismatch Could Result in Remote Code Execution Vulnerability."
32 CVE-2012-1819 +Priv 2012-05-02 2017-12-14
9.3
 None Remote Medium Not required Complete Complete Complete
Untrusted search path vulnerability in WellinTech KingView 6.53 allows local users to gain privileges via a Trojan horse DLL in the current working directory.
33 CVE-2012-1695 2012-05-03 2017-12-14
10.0
 None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in the Oracle JRockit component in Oracle Fusion Middleware 28.2.2 and earlier, and JDK/JRE 5 and 6 27.7.1 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
34 CVE-2012-1517 119 DoS Exec Code Overflow 2012-05-04 2017-12-13
9.0
 None Remote Low ??? Complete Complete Complete
The VMX process in VMware ESXi 4.1 and ESX 4.1 does not properly handle RPC commands, which allows guest OS users to cause a denial of service (memory overwrite and process crash) or possibly execute arbitrary code on the host OS via vectors involving function pointers.
35 CVE-2012-1516 119 DoS Exec Code Overflow 2012-05-04 2019-09-27
9.0
 None Remote Low ??? Complete Complete Complete
The VMX process in VMware ESXi 3.5 through 4.1 and ESX 3.5 through 4.1 does not properly handle RPC commands, which allows guest OS users to cause a denial of service (memory overwrite and process crash) or possibly execute arbitrary code on the host OS via vectors involving data pointers.
36 CVE-2012-0804 119 DoS Exec Code Overflow 2012-05-29 2018-01-18
10.0
 None Remote Low Not required Complete Complete Complete
Heap-based buffer overflow in the proxy_connect function in src/client.c in CVS 1.11 and 1.12 allows remote HTTP proxy servers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTTP response.
37 CVE-2012-0780 119 DoS Exec Code Overflow Mem. Corr. 2012-05-09 2017-12-05
10.0
 None Remote Low Not required Complete Complete Complete
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-2023, CVE-2012-2024, CVE-2012-2025, and CVE-2012-2026.
38 CVE-2012-0779 Exec Code 2012-05-04 2019-07-18
9.3
 None Remote Medium Not required Complete Complete Complete
Adobe Flash Player before 10.3.183.19 and 11.x before 11.2.202.235 on Windows, Mac OS X, and Linux; before 11.1.111.9 on Android 2.x and 3.x; and before 11.1.115.8 on Android 4.x allows remote attackers to execute arbitrary code via a crafted file, related to an "object confusion vulnerability," as exploited in the wild in May 2012.
39 CVE-2012-0778 119 Exec Code Overflow 2012-05-09 2017-12-05
10.0
 None Remote Low Not required Complete Complete Complete
Buffer overflow in Adobe Flash Professional before CS6 allows attackers to execute arbitrary code via unspecified vectors.
40 CVE-2012-0736 20 Exec Code 2012-05-03 2017-08-29
9.3
 None Remote Medium Not required Complete Complete Complete
IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 does not properly create scan jobs, which allows remote attackers to execute arbitrary code via a crafted web site.
41 CVE-2012-0685 189 Exec Code Overflow 2012-05-09 2012-05-10
9.3
 None Remote Medium Not required Complete Complete Complete
Integer overflow in XnViewer (aka XnView) before 1.98.5 allows remote attackers to execute arbitrary code via a crafted file containing PSD record types, a different vulnerability than CVE-2012-0684.
42 CVE-2012-0684 189 Exec Code Overflow 2012-05-09 2012-05-10
9.3
 None Remote Medium Not required Complete Complete Complete
Integer overflow in XnViewer (aka XnView) before 1.98.5 allows remote attackers to execute arbitrary code via a crafted file containing PSD record types, a different vulnerability than CVE-2012-0685.
43 CVE-2012-0671 94 DoS Exec Code Mem. Corr. 2012-05-16 2017-09-19
9.3
 None Remote Medium Not required Complete Complete Complete
Apple QuickTime before 7.7.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted .pict file.
44 CVE-2012-0670 189 DoS Exec Code Overflow 2012-05-16 2017-09-19
9.3
 None Remote Medium Not required Complete Complete Complete
Integer overflow in Apple QuickTime before 7.7.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted sean atom in a movie file.
45 CVE-2012-0669 119 DoS Exec Code Overflow 2012-05-16 2017-09-19
9.3
 None Remote Medium Not required Complete Complete Complete
Buffer overflow in Apple QuickTime before 7.7.2 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with Sorenson encoding.
46 CVE-2012-0668 119 DoS Exec Code Overflow 2012-05-16 2017-09-19
9.3
 None Remote Medium Not required Complete Complete Complete
Buffer overflow in Apple QuickTime before 7.7.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with RLE encoding.
47 CVE-2012-0667 189 DoS Exec Code 2012-05-16 2017-09-19
9.3
 None Remote Medium Not required Complete Complete Complete
Integer signedness error in Apple QuickTime before 7.7.2 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted QTVR movie file.
48 CVE-2012-0666 119 DoS Exec Code Overflow 2012-05-16 2017-09-19
9.3
 None Remote Medium Not required Complete Complete Complete
Stack-based buffer overflow in the plugin in Apple QuickTime before 7.7.2 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted QTMovie object.
49 CVE-2012-0665 119 DoS Exec Code Overflow 2012-05-16 2017-12-05
9.3
 None Remote Medium Not required Complete Complete Complete
Heap-based buffer overflow in Apple QuickTime before 7.7.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with H.264 encoding.
50 CVE-2012-0664 119 DoS Exec Code Overflow 2012-05-16 2017-09-19
9.3
 None Remote Medium Not required Complete Complete Complete
Heap-based buffer overflow in Apple QuickTime before 7.7.2 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted text track in a movie file.
Total number of vulnerabilities : 86   Page : 1 (This Page)2
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.