CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In July 2012

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
501 CVE-2011-4291 DoS 2012-07-16 2020-12-01
4.0
 None Remote Low ??? None None Partial
Moodle 2.0.x before 2.0.3 allows remote authenticated users to cause a denial of service (invalid database records) via a series of crafted ratings operations.
502 CVE-2011-4290 79 XSS 2012-07-16 2020-12-01
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in lib/weblib.php in Moodle 1.9.x before 1.9.12 allow remote attackers to inject arbitrary web script or HTML via vectors related to URL encoding.
503 CVE-2011-4289 264 +Info 2012-07-16 2020-12-01
4.0
 None Remote Low ??? Partial None None
Moodle 2.0.x before 2.0.3 does not recognize the configuration setting that makes e-mail addresses visible only to course members, which allows remote authenticated users to obtain sensitive address information by reading a full profile page.
504 CVE-2011-4288 264 2012-07-16 2020-12-01
4.0
 None Remote Low ??? Partial None None
Moodle 1.9.x before 1.9.12 and 2.0.x before 2.0.3 does not properly implement associations between teachers and groups, which allows remote authenticated users to read quiz reports of arbitrary students by leveraging the teacher role.
505 CVE-2011-4287 264 2012-07-16 2020-12-01
6.8
 None Remote Medium Not required Partial Partial Partial
admin/uploaduser_form.php in Moodle 2.0.x before 2.0.3 does not force password changes for autosubscribed users, which makes it easier for remote attackers to obtain access by leveraging knowledge of the initial password of a new user.
506 CVE-2011-4286 79 XSS 2012-07-16 2020-12-01
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in the media-filter implementation in filter/mediaplugin/filter.php in Moodle 1.9.x before 1.9.11 and 2.0.x before 2.0.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) Flash Video (aka FLV) files and (2) YouTube videos.
507 CVE-2011-4285 264 2012-07-16 2020-12-01
5.5
 None Remote Low ??? None Partial Partial
The default configuration of Moodle 2.0.x before 2.0.2 has an incorrect setting of the moodle/course:delete capability, which allows remote authenticated users to delete arbitrary courses by leveraging the teacher role.
508 CVE-2011-4284 200 +Info 2012-07-16 2020-12-01
5.0
 None Remote Low Not required Partial None None
Moodle 2.0.x before 2.0.2 allows remote attackers to obtain sensitive information from a myprofile (aka My profile) block by visiting a user-context page.
509 CVE-2011-4283 200 +Info 2012-07-16 2020-12-01
5.0
 None Remote Low Not required Partial None None
Moodle 1.9.x before 1.9.11 and 2.0.x before 2.0.2 places an IMS enterprise enrolment file in the course-files area, which allows remote attackers to obtain sensitive information via a request for imsenterprise-enrol.xml.
510 CVE-2011-4282 79 XSS 2012-07-16 2020-12-01
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in the course-tags functionality in tag/coursetags_more.php in Moodle 2.0.x before 2.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) sort or (2) show parameter.
511 CVE-2011-4281 352 CSRF 2012-07-16 2020-12-01
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple cross-site request forgery (CSRF) vulnerabilities in Moodle 2.0.x before 2.0.2 allow remote attackers to hijack the authentication of arbitrary users for requests that mark the completion of (1) an activity or (2) a course.
512 CVE-2011-4280 79 XSS 2012-07-16 2020-12-01
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the Spike PHPCoverage (aka spikephpcoverage) library, as used in Moodle 2.0.x before 2.0.2 and other products, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
513 CVE-2011-4279 200 +Info 2012-07-16 2020-12-01
5.0
 None Remote Low Not required Partial None None
Moodle 2.0.x before 2.0.2 does not use the forceloginforprofiles setting for course-profiles access control, which makes it easier for remote attackers to obtain potentially sensitive information via vectors involving use of a search engine, as demonstrated by the search functionality of Google, Yahoo!, Wrensoft Zoom, MSN, Yandex, and AltaVista.
514 CVE-2011-4278 79 XSS 2012-07-16 2020-12-01
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the tag autocomplete functionality in Moodle 1.9.x before 1.9.11 and 2.0.x before 2.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
515 CVE-2011-4133 352 CSRF 2012-07-16 2020-12-01
6.8
 None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in Moodle 1.9.x before 1.9.11 allows remote attackers to hijack the authentication of unspecified victims for requests that modify an RSS feed in an RSS block.
516 CVE-2011-4127 264 Bypass 2012-07-03 2017-12-29
4.6
 None Local Low Not required Partial Partial Partial
The Linux kernel before 3.2.2 does not properly restrict SG_IO ioctl calls, which allows local users to bypass intended restrictions on disk read and write operations by sending a SCSI command to (1) a partition block device or (2) an LVM volume.
517 CVE-2011-4086 119 DoS Overflow 2012-07-03 2017-12-29
4.9
 None Local Low Not required None None Complete
The journal_unmap_buffer function in fs/jbd2/transaction.c in the Linux kernel before 3.3.1 does not properly handle the _Delay and _Unwritten buffer head states, which allows local users to cause a denial of service (system crash) by leveraging the presence of an ext4 filesystem that was mounted with a journal.
518 CVE-2011-4029 362 DoS 2012-07-03 2020-08-24
1.9
 None Local Medium Not required Partial None None
The LockServer function in os/utils.c in X.Org xserver before 1.11.2 allows local users to change the permissions of arbitrary files to 444, read those files, and possibly cause a denial of service (removed execution permission) via a symlink attack on a temporary lock file.
519 CVE-2011-4028 59 2012-07-03 2020-08-24
1.2
 None Local High Not required Partial None None
The LockServer function in os/utils.c in X.Org xserver before 1.11.2 allows local users to determine the existence of arbitrary files via a symlink attack on a temporary lock file, which is handled differently if the file exists.
520 CVE-2011-3562 2012-07-17 2017-08-29
4.3
 None Remote Medium Not required None Partial None
Unspecified vulnerability in the Portal component in Oracle Fusion Middleware 11.1.1.5, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect integrity via unknown vectors.
521 CVE-2011-3464 189 DoS Exec Code Overflow 2012-07-22 2012-07-23
7.5
 None Remote Low Not required Partial Partial Partial
Off-by-one error in the png_formatted_warning function in pngerror.c in libpng 1.5.4 through 1.5.7 might allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via unspecified vectors, which trigger a stack-based buffer overflow.
522 CVE-2011-3174 119 Exec Code Overflow 2012-07-26 2012-07-27
6.8
 None Remote Medium Not required Partial Partial Partial
Buffer overflow in the DoFindReplace function in the ISGrid.Grid2.1 ActiveX control in InstallShield/ISGrid2.dll in AdminStudio in Novell ZENworks Configuration Management (ZCM) 10.2, 10.3, and 11 SP1 allows remote attackers to execute arbitrary code via a long bstrReplaceText parameter.
523 CVE-2011-3149 119 DoS Overflow 2012-07-22 2019-01-03
2.1
 None Local Low Not required None None Partial
The _expand_arg function in the pam_env module (modules/pam_env/pam_env.c) in Linux-PAM (aka pam) before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service (CPU consumption).
524 CVE-2011-3148 119 DoS Exec Code Overflow 2012-07-22 2019-01-03
4.6
 None Local Low Not required Partial Partial Partial
Stack-based buffer overflow in the _assemble_line function in modules/pam_env/pam_env.c in Linux-PAM (aka pam) before 1.1.5 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long string of white spaces at the beginning of the ~/.pam_environment file.
525 CVE-2011-2716 20 Exec Code 2012-07-03 2020-08-27
6.8
 None Local Network High Not required Complete Complete Complete
The DHCP client (udhcpc) in BusyBox before 1.20.0 allows remote DHCP servers to execute arbitrary commands via shell metacharacters in the (1) HOST_NAME, (2) DOMAIN_NAME, (3) NIS_DOMAIN, and (4) TFTP_SERVER_NAME host name options.
526 CVE-2011-2658 264 Exec Code 2012-07-26 2012-07-27
6.8
 None Remote Medium Not required Partial Partial Partial
The ISList.ISAvi ActiveX control in AdminStudio in Novell ZENworks Configuration Management (ZCM) 10.2, 10.3, and 11 SP1 provides access to the mscomct2.ocx file, which allows remote attackers to execute arbitrary code by leveraging unspecified mscomct2 flaws.
527 CVE-2011-2657 22 1 Exec Code Dir. Trav. 2012-07-26 2012-07-27
6.8
 None Remote Medium Not required Partial Partial Partial
Directory traversal vulnerability in the LaunchProcess function in the LaunchHelp.HelpLauncher.1 ActiveX control in LaunchHelp.dll in AdminStudio in Novell ZENworks Configuration Management (ZCM) 10.2, 10.3, and 11 SP1 allows remote attackers to execute arbitrary commands via a pathname in the first argument.
528 CVE-2011-2503 20 +Priv 2012-07-26 2012-07-27
3.7
 None Local High Not required Partial Partial Partial
The insert_module function in runtime/staprun/staprun_funcs.c in the systemtap runtime tool (staprun) in SystemTap before 1.6 does not properly validate a module when loading it, which allows local users to gain privileges via a race condition between the signature validation and the module initialization.
529 CVE-2011-2502 20 +Priv 2012-07-26 2012-07-27
4.4
 None Local Medium Not required Partial Partial Partial
runtime/staprun/staprun_funcs.c in the systemtap runtime tool (staprun) in SystemTap before 1.6 does not properly validate modules when a module path is specified by a user for user-space probing, which allows local users in the stapusr group to gain privileges via a crafted module in the search path in the -u argument.
530 CVE-2011-2485 DoS 2012-07-03 2012-07-03
4.3
 None Remote Medium Not required None None Partial
The gdk_pixbuf__gif_image_load function in gdk-pixbuf/io-gif.c in gdk-pixbuf before 2.23.5 does not properly handle certain return values, which allows remote attackers to cause a denial of service (memory consumption) via a crafted GIF image file.
531 CVE-2011-2199 119 DoS Exec Code Overflow 2012-07-22 2012-07-23
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in tftp-hpa before 5.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via the utimeout option.
532 CVE-2009-5031 79 XSS Bypass 2012-07-22 2021-02-12
4.3
 None Remote Medium Not required None Partial None
ModSecurity before 2.5.11 treats request parameter values containing single quotes as files, which allows remote attackers to bypass filtering rules and perform other attacks such as cross-site scripting (XSS) attacks via a single quote in a request parameter in the Content-Disposition field of a request with a multipart/form-data Content-Type header.
533 CVE-2009-5030 119 DoS Exec Code Overflow Mem. Corr. 2012-07-18 2020-09-09
6.8
 None Remote Medium Not required Partial Partial Partial
The tcd_free_encode function in tcd.c in OpenJPEG 1.3 through 1.5 allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted tile information in a Gray16 TIFF image, which causes insufficient memory to be allocated and leads to an "invalid free."
534 CVE-2007-6754 189 Overflow 2012-07-25 2012-07-26
5.0
 None Remote Low Not required None None Partial
The ipalloc function in libc/stdlib/malloc.c in jemalloc in libc for FreeBSD 6.4 and NetBSD does not properly allocate memory, which makes it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, related to "integer rounding and overflow" errors.
535 CVE-2006-7252 189 Overflow 2012-07-25 2012-07-26
5.0
 None Remote Low Not required None None Partial
Integer overflow in the calloc function in libc/stdlib/malloc.c in jemalloc in libc for FreeBSD 6.4 and NetBSD makes it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which triggers a memory allocation of one byte.
536 CVE-2005-4895 189 Overflow 2012-07-25 2012-08-09
5.0
 None Remote Low Not required None None Partial
Multiple integer overflows in TCMalloc (tcmalloc.cc) in gperftools before 0.4 make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which causes less memory to be allocated than expected.
Total number of vulnerabilities : 536   Page : 1 2 3 4 5 6 7 8 9 10 11 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.