CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In 2012

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
5251 CVE-2010-3497 264 Exec Code 2012-08-22 2012-08-22
6.4
None Remote Low Not required None Partial Partial
Symantec Norton AntiVirus 2011 does not properly interact with the processing of hcp:// URLs by the Microsoft Help and Support Center, which makes it easier for remote attackers to execute arbitrary code via malware that is correctly detected by this product, but with a detection approach that occurs too late to stop the code execution. NOTE: the researcher indicates that a vendor response was received, stating that this issue "falls into the work of our Firewall and not our AV (per our methodology of layers of defense)."
5252 CVE-2010-3496 264 Exec Code 2012-08-22 2012-08-22
6.4
None Remote Low Not required None Partial Partial
McAfee VirusScan Enterprise 8.5i and 8.7i does not properly interact with the processing of hcp:// URLs by the Microsoft Help and Support Center, which makes it easier for remote attackers to execute arbitrary code via malware that is correctly detected by this product, but with a detection approach that occurs too late to stop the code execution.
5253 CVE-2010-2387 255 +Priv 2012-12-21 2017-08-17
1.9
None Local Medium Not required Partial None None
vicious-extensions/ve-misc.c in GNOME Display Manager (gdm) 2.20.x before 2.20.11, when GDM debug is enabled, logs the user password when it contains invalid UTF8 encoded characters, which might allow local users to gain privileges by reading the information from syslog logs.
5254 CVE-2010-2021 20 2012-06-25 2017-08-17
5.8
None Remote Medium Not required None Partial Partial
Open redirect vulnerability in the Global Redirect module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.4 for Drupal, when non-clean to clean is enabled, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the q parameter.
5255 CVE-2010-1330 79 XSS 2012-11-23 2021-01-12
4.3
None Remote Medium Not required None Partial None
The regular expression engine in JRuby before 1.4.1, when $KCODE is set to 'u', does not properly handle characters immediately after a UTF-8 character, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted string.
5256 CVE-2009-5132 DoS 2012-08-26 2017-08-29
5.0
None Remote Low Not required None None Partial
The Filtering Service in Websense Web Security and Web Filter before 6.3.1 Hotfix 106 and 7.x before 7.1 allow remote attackers to cause a denial of service (filtering outage) via a crafted URL.
5257 CVE-2009-5131 264 Bypass 2012-08-26 2012-08-27
5.0
None Remote Low Not required None Partial None
The Receive Service in Websense Email Security before 7.1 does not recognize domain extensions in the blacklist, which allows remote attackers to bypass intended access restrictions and send e-mail messages via an SMTP session.
5258 CVE-2009-5130 119 DoS Overflow 2012-08-26 2012-08-27
4.3
None Remote Medium Not required None None Partial
The Rules Service in Websense Email Security before 7.1 allows remote attackers to cause a denial of service (service crash) via an attachment with a crafted size.
5259 CVE-2009-5129 119 DoS Overflow 2012-08-26 2012-08-27
5.0
None Remote Low Not required None None Partial
The Websense V10000 appliance before 1.0.1 allows remote attackers to cause a denial of service (intermittent LDAP authentication outage) via a login attempt with an incorrect password.
5260 CVE-2009-5128 119 DoS Overflow 2012-08-26 2012-08-27
5.0
None Remote Low Not required None None Partial
The Websense V10000 appliance before 1.0.1 allows remote attackers to cause a denial of service (memory consumption and process crash) via a large file that is not properly handled during buffering.
5261 CVE-2009-5127 DoS 2012-08-26 2012-08-27
4.3
None Remote Medium Not required None None Partial
The Antivirus component in Comodo Internet Security before 3.8.64739.471 allows remote attackers to cause a denial of service (application crash) via a crafted file.
5262 CVE-2009-5126 DoS 2012-08-26 2012-08-27
4.3
None Remote Medium Not required None None Partial
The Antivirus component in Comodo Internet Security before 3.8.65951.477 allows remote attackers to cause a denial of service (application crash) via a crafted file.
5263 CVE-2009-5125 Bypass 2012-08-26 2012-08-27
4.3
None Remote Medium Not required None Partial None
Comodo Internet Security before 3.9.95478.509 allows remote attackers to bypass malware detection in an RAR archive via an unspecified manipulation of the archive file format.
5264 CVE-2009-5124 119 DoS Overflow 2012-08-26 2012-08-27
4.3
None Remote Medium Not required None None Partial
The Antivirus component in Comodo Internet Security before 3.11.108364.552 allows remote attackers to cause a denial of service (application crash) via a crafted packed file.
5265 CVE-2009-5123 119 DoS Overflow 2012-08-26 2012-09-03
4.3
None Remote Medium Not required None None Partial
The Antivirus component in Comodo Internet Security before 3.11.108364.552 allows remote attackers to cause a denial of service (memory consumption) via a crafted compressed file.
5266 CVE-2009-5122 200 +Info 2012-08-23 2017-08-29
5.0
None Remote Low Not required Partial None None
The Personal Email Manager component in Websense Email Security before 7.2 allows remote attackers to obtain potentially sensitive information from the JBoss status page via an unspecified query.
5267 CVE-2009-5121 264 Bypass 2012-08-23 2012-08-23
5.0
None Remote Low Not required None Partial None
Websense Email Security 7.1 before Hotfix 4 allows remote attackers to bypass the sender-based blacklist by using the 8BITMIME EHLO keyword in the SMTP session.
5268 CVE-2009-5120 16 XSS 2012-08-23 2012-08-23
4.3
None Remote Medium Not required None Partial None
The default configuration of Apache Tomcat in Websense Manager in Websense Web Security 7.0 and Web Filter 7.0 allows connections to TCP port 1812 from arbitrary source IP addresses, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via UTF-7 text to the 404 error page of a Project Woodstock service on this port.
5269 CVE-2009-5119 16 +Info 2012-08-23 2012-08-23
4.3
None Remote Medium Not required Partial None None
The default configuration of Apache Tomcat in Websense Manager in Websense Web Security 7.0 and Web Filter 7.0 enables weak SSL ciphers in conf/server.xml, which makes it easier for remote attackers to obtain sensitive information by sniffing the network and then conducting a brute-force attack against encrypted session data.
5270 CVE-2009-5118 +Priv 2012-08-22 2017-08-29
9.3
None Remote Medium Not required Complete Complete Complete
Untrusted search path vulnerability in McAfee VirusScan Enterprise before 8.7i allows local users to gain privileges via a Trojan horse DLL in an unspecified directory, as demonstrated by scanning a document located on a remote share.
5271 CVE-2009-5117 200 +Info 2012-08-22 2017-08-29
1.9
None Local Medium Not required Partial None None
The Web Post Protection feature in McAfee Host Data Loss Prevention (DLP) 3.x before 3.0.100.10 and 9.x before 9.0.0.422, when HTTP Capture mode is enabled, allows local users to obtain sensitive information from web traffic by reading unspecified files.
5272 CVE-2009-5116 287 2012-08-22 2012-08-22
6.5
None Remote Low ??? Partial Partial Partial
McAfee LinuxShield 1.5.1 and earlier does not properly implement client authentication, which allows remote authenticated users to obtain Admin access to the statistics server by leveraging a client account.
5273 CVE-2009-5115 264 2012-08-22 2017-08-29
6.5
None Remote Low ??? Partial Partial Partial
McAfee Common Management Agent (CMA) 3.5.5 through 3.5.5.588 and 3.6.0 through 3.6.0.608, and McAfee Agent 4.0 before Patch 3, allows remote authenticated users to overwrite arbitrary files by accessing a report-writing ActiveX control COM object.
5274 CVE-2009-5114 22 Dir. Trav. 2012-03-19 2017-12-29
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in wgarcmin.cgi in WebGlimpse 2.18.7 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the DOC parameter.
5275 CVE-2009-5113 79 XSS 2012-03-19 2017-08-29
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in wgarcmin.cgi in WebGlimpse 2.18.7 and earlier allows remote attackers to inject arbitrary web script or HTML via the DOC parameter.
5276 CVE-2009-5112 200 +Info 2012-03-19 2017-12-29
5.0
None Remote Low Not required Partial None None
wgarcmin.cgi in WebGlimpse 2.18.7 and earlier allows remote attackers to obtain the installation path via a crafted request.
5277 CVE-2009-5067 22 1 DoS Dir. Trav. 2012-10-10 2013-01-30
4.3
None Remote Medium Not required Partial None None
Directory traversal vulnerability in html2ps before 1.0b6 allows remote attackers to read arbitrary files via a .. (dot dot) in the "include file" SSI directive. NOTE: this issue only might be a vulnerability in limited scenarios, such as if html2ps is invoked by a web application, or if a user-assisted attacker provides filenames whose contents could cause a denial of service, such as certain devices.
5278 CVE-2009-5066 255 2012-08-13 2015-01-18
2.1
None Local Low Not required Partial None None
twiddle.sh in JBoss AS 5.0 and EAP 5.0 and earlier accepts credentials as command-line arguments, which allows local users to read the credentials by listing the process and its arguments.
5279 CVE-2009-5031 79 XSS Bypass 2012-07-22 2021-02-12
4.3
None Remote Medium Not required None Partial None
ModSecurity before 2.5.11 treats request parameter values containing single quotes as files, which allows remote attackers to bypass filtering rules and perform other attacks such as cross-site scripting (XSS) attacks via a single quote in a request parameter in the Content-Disposition field of a request with a multipart/form-data Content-Type header.
5280 CVE-2009-5030 119 DoS Exec Code Overflow Mem. Corr. 2012-07-18 2020-09-09
6.8
None Remote Medium Not required Partial Partial Partial
The tcd_free_encode function in tcd.c in OpenJPEG 1.3 through 1.5 allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted tile information in a Gray16 TIFF image, which causes insufficient memory to be allocated and leads to an "invalid free."
5281 CVE-2009-5026 89 Exec Code Sql 2012-08-17 2019-12-17
6.8
None Remote Medium Not required Partial Partial Partial
The executable comment feature in MySQL 5.0.x before 5.0.93 and 5.1.x before 5.1.50, when running in certain slave configurations in which the slave is running a newer version than the master, allows remote attackers to execute arbitrary SQL commands via custom comments.
5282 CVE-2009-2899 200 +Info 2012-12-05 2012-12-24
2.1
None Local Low Not required Partial None None
The monitor perl script in the Sybase database plug-in in SpringSource Hyperic HQ before 4.3 allows local users to obtain the database password by listing the process and its arguments.
5283 CVE-2009-0695 287 1 2012-06-19 2012-06-26
7.5
None Remote Low Not required Partial Partial Partial
hagent.exe in Wyse Device Manager (WDM) 4.7.x does not require authentication for commands, which allows remote attackers to obtain management access via a crafted query, as demonstrated by a V52 query that triggers a power-off action.
5284 CVE-2009-0693 119 Exec Code Overflow 2012-06-19 2012-06-20
7.5
None Remote Low Not required Partial Partial Partial
Multiple buffer overflows in Wyse Device Manager (WDM) 4.7.x allow remote attackers to execute arbitrary code via (1) the User-Agent HTTP header to hserver.dll or (2) unspecified input to hagent.exe.
5285 CVE-2008-7312 20 Bypass 2012-08-23 2017-08-29
5.0
None Remote Low Not required None Partial None
The Filtering Service in Websense Enterprise 5.2 through 6.3 does not consider the IP address during URL categorization, which makes it easier for remote attackers to bypass filtering via an HTTP request, as demonstrated by a request to a compromised server associated with a specific IP address.
5286 CVE-2008-7311 255 Bypass 2012-04-05 2012-04-12
5.0
None Remote Low Not required None Partial None
The session cookie store implementation in Spree 0.2.0 uses a hardcoded config.action_controller_session hash value (aka secret key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging an application that contains this value within the config/environment.rb file.
5287 CVE-2008-7310 255 Bypass 2012-04-05 2012-04-05
5.0
None Remote Low Not required None Partial None
Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the Order state value and bypass the intended payment step via a modified URL, related to a "mass assignment" vulnerability.
5288 CVE-2008-7309 255 2012-04-05 2012-04-12
5.0
None Remote Low Not required None Partial None
Insoshi before 20080920 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the ForumPost user_id value via a modified URL, related to a "mass assignment" vulnerability.
5289 CVE-2007-6754 189 Overflow 2012-07-25 2012-07-26
5.0
None Remote Low Not required None None Partial
The ipalloc function in libc/stdlib/malloc.c in jemalloc in libc for FreeBSD 6.4 and NetBSD does not properly allocate memory, which makes it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, related to "integer rounding and overflow" errors.
5290 CVE-2007-6753 +Priv 2012-03-28 2016-11-28
6.2
None Local High Not required Complete Complete Complete
Untrusted search path vulnerability in Shell32.dll in Microsoft Windows 2000, Windows XP, Windows Vista, Windows Server 2008, and Windows 7, when using an environment configured with a string such as %APPDATA% or %PROGRAMFILES% in a certain way, allows local users to gain privileges via a Trojan horse DLL under the current working directory, as demonstrated by iTunes and Safari.
5291 CVE-2007-6752 352 2 CSRF 2012-03-28 2012-03-28
6.8
None Remote Medium Not required Partial Partial Partial
** DISPUTED ** Cross-site request forgery (CSRF) vulnerability in Drupal 7.12 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that end a session via the user/logout URI. NOTE: the vendor disputes the significance of this issue, by considering the "security benefit against platform complexity and performance impact" and concluding that a change to the logout behavior is not planned because "for most sites it is not worth the trade-off."
5292 CVE-2007-6751 79 XSS 2012-01-04 2017-08-29
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the MailForm plugin before 1.20 for Movable Type allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
5293 CVE-2007-6744 200 +Info 2012-01-19 2012-01-20
2.1
None Local Low Not required Partial None None
Flexera Macrovision InstallShield before 2008 sends a digital-signature password to an unintended application during certain signature operations involving .spc and .pvk files, which might allow local users to obtain sensitive information via unspecified vectors, related to an incorrect interaction between InstallShield and Signcode.exe.
5294 CVE-2006-7252 189 Overflow 2012-07-25 2012-07-26
5.0
None Remote Low Not required None None Partial
Integer overflow in the calloc function in libc/stdlib/malloc.c in jemalloc in libc for FreeBSD 6.4 and NetBSD makes it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which triggers a memory allocation of one byte.
5295 CVE-2006-7250 DoS 2012-02-29 2018-01-06
5.0
None Remote Low Not required None None Partial
The mime_hdr_cmp function in crypto/asn1/asn_mime.c in OpenSSL 0.9.8t and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted S/MIME message.
5296 CVE-2006-7247 89 1 Exec Code Sql 2012-09-06 2013-08-16
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Weblinks (com_weblinks) component for Joomla! and Mambo 1.0.9 and earlier allows remote attackers to execute arbitrary SQL commands via the title parameter.
5297 CVE-2005-4895 189 Overflow 2012-07-25 2012-08-09
5.0
None Remote Low Not required None None Partial
Multiple integer overflows in TCMalloc (tcmalloc.cc) in gperftools before 0.4 make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which causes less memory to be allocated than expected.
Total number of vulnerabilities : 5297   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.