CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In 2012

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
2801 CVE-2012-1830 119 Exec Code Overflow 2012-07-05 2012-07-17
10.0
 None Remote Low Not required Complete Complete Complete
Stack-based buffer overflow in WellinTech KingView 6.53 allows remote attackers to execute arbitrary code via a crafted packet to TCP port 555.
2802 CVE-2012-1829 79 XSS 2012-06-13 2012-09-29
3.5
 None Remote Medium ??? None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in AutoFORM PDM Archive before 6.920 allow remote authenticated users to inject arbitrary web script or HTML via unspecified fields.
2803 CVE-2012-1828 264 2012-06-13 2012-09-29
6.5
 None Remote Low ??? Partial Partial Partial
The administrative functions in AutoFORM PDM Archive before 7.1 do not have authorization requirements, which allows remote authenticated users to perform administrative actions by leveraging knowledge of a hidden function, as demonstrated by the password-change function.
2804 CVE-2012-1827 264 2012-06-13 2012-09-29
6.5
 None Remote Low ??? Partial Partial Partial
The web service in AutoFORM PDM Archive before 7.1 does not have authorization requirements, which allows remote authenticated users to perform database operations via a SOAP request, as demonstrated by the initializeQueryDatabase2 request.
2805 CVE-2012-1826 264 Exec Code 2012-06-08 2012-11-27
6.0
 None Remote Medium ??? Partial Partial Partial
dotCMS 1.9 before 1.9.5.1 allows remote authenticated users to execute arbitrary Java code via a crafted (1) XSLT or (2) Velocity template.
2806 CVE-2012-1825 79 XSS 2012-06-11 2012-06-12
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in the status program on the ForeScout CounterACT appliance with software 6.3.3.2 through 6.3.4.10 allow remote attackers to inject arbitrary web script or HTML via (1) the loginname parameter in a forgotpass action or (2) the username parameter.
2807 CVE-2012-1824 +Priv 2012-05-25 2012-05-28
7.2
 None Local Low Not required Complete Complete Complete
Untrusted search path vulnerability in Measuresoft ScadaPro Client before 4.0.0 and ScadaPro Server before 4.0.0 allows local users to gain privileges via a Trojan horse DLL in the current working directory.
2808 CVE-2012-1823 20 Exec Code 2012-05-11 2018-01-18
7.5
 None Remote Low Not required Partial Partial Partial
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.
2809 CVE-2012-1821 DoS 2012-05-24 2018-01-05
5.0
 None Remote Low Not required None None Partial
The Network Threat Protection module in the Manager component in Symantec Endpoint Protection (SEP) 11.0.600x through 11.0.700x on Windows Server 2003 allows remote attackers to cause a denial of service (web-server outage, or daemon crash or hang) via a flood of packets that triggers automated blocking of network traffic.
2810 CVE-2012-1820 DoS 2012-06-13 2013-03-02
2.9
 None Local Network Medium Not required None None Partial
The bgp_capability_orf function in bgpd in Quagga 0.99.20.1 and earlier allows remote attackers to cause a denial of service (assertion failure and daemon exit) by leveraging a BGP peering relationship and sending a malformed Outbound Route Filtering (ORF) capability TLV in an OPEN message.
2811 CVE-2012-1819 +Priv 2012-05-02 2017-12-14
9.3
 None Remote Medium Not required Complete Complete Complete
Untrusted search path vulnerability in WellinTech KingView 6.53 allows local users to gain privileges via a Trojan horse DLL in the current working directory.
2812 CVE-2012-1818 264 2012-06-08 2012-10-13
6.4
 None Remote Low Not required None Partial Partial
An unspecified ActiveX control in Emerson DeltaV and DeltaV Workstations 9.3.1, 10.3.1, 11.3, and 11.3.1 and DeltaV ProEssentials Scientific Graph 5.0.0.6 allows remote attackers to overwrite arbitrary files via unknown vectors.
2813 CVE-2012-1817 20 DoS Exec Code Overflow 2012-06-08 2012-10-13
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in Emerson DeltaV and DeltaV Workstations 9.3.1, 10.3.1, 11.3, and 11.3.1 and DeltaV ProEssentials Scientific Graph 5.0.0.6 allows user-assisted remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via an invalid field in a project file.
2814 CVE-2012-1816 119 DoS Overflow 2012-06-08 2012-10-13
5.0
 None Remote Low Not required None None Partial
PORTSERV.exe in Emerson DeltaV and DeltaV Workstations 9.3.1, 10.3.1, 11.3, and 11.3.1 and DeltaV ProEssentials Scientific Graph 5.0.0.6 allows remote attackers to cause a denial of service (daemon crash) via a crafted (1) TCP or (2) UDP packet to port 111.
2815 CVE-2012-1815 89 Exec Code Sql 2012-06-08 2012-10-30
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Emerson DeltaV and DeltaV Workstations 9.3.1, 10.3.1, 11.3, and 11.3.1 and DeltaV ProEssentials Scientific Graph 5.0.0.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
2816 CVE-2012-1814 79 XSS 2012-06-08 2012-10-30
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Emerson DeltaV and DeltaV Workstations 9.3.1, 10.3.1, 11.3, and 11.3.1 and DeltaV ProEssentials Scientific Graph 5.0.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
2817 CVE-2012-1813 399 DoS 2012-11-13 2017-08-29
7.8
 None Remote Low Not required None None Complete
eosfailoverservice.exe in C3-ilex EOScada before 11.0.19.2 allows remote attackers to cause a denial of service by sending a large amount of data to TCP port 12000.
2818 CVE-2012-1812 200 +Info 2012-11-13 2017-08-29
5.0
 None Remote Low Not required Partial None None
eosfailoverservice.exe in C3-ilex EOScada before 11.0.19.2 allows remote attackers to obtain sensitive cleartext information via a session on TCP port 12000.
2819 CVE-2012-1811 399 DoS 2012-11-13 2017-08-29
7.8
 None Remote Low Not required None None Complete
EOSDataServer.exe in C3-ilex EOScada before 11.0.19.2 allows remote attackers to cause a denial of service by sending a large amount of data to TCP port 24006.
2820 CVE-2012-1810 264 DoS 2012-11-13 2017-08-29
5.0
 None Remote Low Not required None None Partial
EOSCoreScada.exe in C3-ilex EOScada before 11.0.19.2 allows remote attackers to cause a denial of service (daemon restart) by sending data to TCP port (1) 5050 or (2) 24004.
2821 CVE-2012-1809 399 DoS 2012-04-13 2012-04-16
5.0
 None Remote Low Not required None None Partial
The web server in the ECOM Ethernet module in Koyo H0-ECOM, H0-ECOM100, H2-ECOM, H2-ECOM-F, H2-ECOM100, H4-ECOM, H4-ECOM-F, and H4-ECOM100 allows remote attackers to cause a denial of service (resource consumption) via unspecified vectors.
2822 CVE-2012-1808 287 2012-04-13 2017-12-20
10.0
 None Remote Low Not required Complete Complete Complete
The web server in the ECOM Ethernet module in Koyo H0-ECOM, H0-ECOM100, H2-ECOM, H2-ECOM-F, H2-ECOM100, H4-ECOM, H4-ECOM-F, and H4-ECOM100 does not require authentication, which allows remote attackers to perform unspecified functions via unknown vectors.
2823 CVE-2012-1807 79 XSS 2012-04-13 2012-04-16
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the web server in the ECOM Ethernet module in Koyo H0-ECOM, H0-ECOM100, H2-ECOM, H2-ECOM-F, H2-ECOM100, H4-ECOM, H4-ECOM-F, and H4-ECOM100 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
2824 CVE-2012-1806 287 2012-04-13 2017-12-20
7.5
 None Remote Low Not required Partial Partial Partial
The ECOM Ethernet module in Koyo H0-ECOM, H0-ECOM100, H2-ECOM, H2-ECOM-F, H2-ECOM100, H4-ECOM, H4-ECOM-F, and H4-ECOM100 supports a maximum password length of 8 bytes, which makes it easier for remote attackers to obtain access via a brute-force attack.
2825 CVE-2012-1805 119 Exec Code Overflow 2012-04-13 2017-12-20
10.0
 None Remote Low Not required Complete Complete Complete
Buffer overflow in the ECOM Ethernet module in Koyo H0-ECOM, H0-ECOM100, H2-ECOM, H2-ECOM-F, H2-ECOM100, H4-ECOM, H4-ECOM-F, and H4-ECOM100 allows remote attackers to execute arbitrary code via long strings in unspecified parameters.
2826 CVE-2012-1804 119 DoS Overflow Mem. Corr. 2012-05-14 2013-10-03
7.8
 None Remote Low Not required None None Complete
The OPC server in Progea Movicon before 11.3 allows remote attackers to cause a denial of service (out-of-bounds read and memory corruption) via a crafted HTTP request.
2827 CVE-2012-1803 310 1 2012-04-28 2022-02-01
8.5
 None Remote Medium ??? Complete Complete Complete
RuggedCom Rugged Operating System (ROS) 3.10.x and earlier has a factory account with a password derived from the MAC Address field in the banner, which makes it easier for remote attackers to obtain access by performing a calculation on this address value, and then establishing a (1) TELNET, (2) remote shell (aka rsh), or (3) serial-console session.
2828 CVE-2012-1802 119 DoS Exec Code Overflow 2012-04-18 2012-11-20
7.8
 None Remote Low Not required None None Complete
Buffer overflow in the embedded web server on the Siemens Scalance X Industrial Ethernet switch X414-3E before 3.7.1, X308-2M before 3.7.2, X-300EEC before 3.7.2, XR-300 before 3.7.2, and X-300 before 3.7.2 allows remote attackers to cause a denial of service (device reboot) or possibly execute arbitrary code via a malformed URL.
2829 CVE-2012-1801 119 Exec Code Overflow 2012-04-18 2017-12-20
7.7
 None Local Network Low ??? Complete Complete Complete
Multiple stack-based buffer overflows in (1) COM and (2) ActiveX controls in ABB WebWare Server, WebWare SDK, Interlink Module, S4 OPC Server, QuickTeach, RobotStudio S4, and RobotStudio Lite allow remote attackers to execute arbitrary code via crafted input data.
2830 CVE-2012-1800 119 DoS Exec Code Overflow 2012-04-18 2012-11-20
6.1
 None Local Network Low Not required None None Complete
Stack-based buffer overflow in the Profinet DCP protocol implementation on the Siemens Scalance S Security Module firewall S602 V2, S612 V2, and S613 V2 with firmware before 2.3.0.3 allows remote attackers to cause a denial of service (device outage) or possibly execute arbitrary code via a crafted DCP frame.
2831 CVE-2012-1799 287 2012-04-18 2012-12-06
10.0
 None Remote Low Not required Complete Complete Complete
The web server on the Siemens Scalance S Security Module firewall S602 V2, S612 V2, and S613 V2 with firmware before 2.3.0.3 does not limit the rate of authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force attack on the administrative password.
2832 CVE-2012-1798 125 DoS 2012-06-05 2020-07-31
4.3
 None Remote Medium Not required None None Partial
The TIFFGetEXIFProperties function in coders/tiff.c in ImageMagick before 6.7.6-3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted EXIF IFD in a TIFF image.
2833 CVE-2012-1797 264 2012-03-20 2018-01-10
10.0
 None Remote Low Not required Complete Complete Complete
IBM DB2 9.5 uses world-writable permissions for nodes.reg, which has unspecified impact and attack vectors.
2834 CVE-2012-1796 +Priv 2012-03-20 2018-01-10
7.2
 None Local Low Not required Complete Complete Complete
Unspecified vulnerability in IBM Tivoli Monitoring Agent (ITMA), as used in IBM DB2 9.5 before FP9 on UNIX, allows local users to gain privileges via unknown vectors.
2835 CVE-2012-1795 78 Exec Code 2012-03-20 2018-01-12
7.5
 None Remote Low Not required Partial Partial Partial
webglimpse.cgi in Webglimpse before 2.20.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the query parameter, as exploited in the wild in March 2012.
2836 CVE-2012-1792 79 XSS 2012-05-27 2012-05-28
2.6
 None Remote High Not required None Partial None
Cross-site scripting (XSS) vulnerability in osCommerce/OM/Core/Site/Setup/Application/Install/RPC/DBCheck.php in OSCommerce Online Merchant 3.0.2, when the software is being installed, allows remote attackers to inject arbitrary web script or HTML via the name parameter to oscommerce/index.php, which is not properly handled in an error message. NOTE: this might not be a vulnerability, since the ability to access oscommerce/index.php during installation may already imply administrator privileges.
2837 CVE-2012-1790 22 2 Dir. Trav. 2012-03-19 2018-08-30
5.0
 None Remote Low Not required Partial None None
Absolute path traversal vulnerability in Webgrind 1.0 and 1.0.2 allows remote attackers to read arbitrary files via a full pathname in the file parameter to index.php.
2838 CVE-2012-1789 79 XSS 2012-03-19 2017-08-29
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Kongreg8 1.7.3 allow remote attackers to inject arbitrary web script or HTML via the (1) surname or (2) firstname parameters to modules/members/addmember.php; or (3) groupdescription or (4) groupname parameters to modules/groups/addgroupform.php.
2839 CVE-2012-1788 79 1 XSS 2012-03-19 2018-01-11
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in wonderdesk.cgi in WonderDesk SQL 4.14 allow remote attackers to inject arbitrary web script or HTML via the (1) cus_email parameter in a cust_lostpw action; or (2) help_name, (3) help_email, (4) help_website, or (5) help_example_url parameters in an hd_modify_record action.
2840 CVE-2012-1787 79 1 XSS 2012-03-19 2018-01-11
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in wgarcmin.cgi in Webglimpse 2.20.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) URL, (2) FILE, or (3) DOMAIN parameters.
2841 CVE-2012-1786 200 +Info 2012-03-19 2012-11-06
5.0
 None Remote Low Not required Partial None None
The Media Upload form in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to obtain the installation path via unknown vectors.
2842 CVE-2012-1785 20 Exec Code 2012-03-19 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
kg_callffmpeg.php in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to execute arbitrary commands via unspecified vectors.
2843 CVE-2012-1784 89 1 Exec Code Sql 2012-03-19 2018-01-11
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in MyJobList 0.1.3 allows remote attackers to execute arbitrary SQL commands via the eid parameter in a profile action to index.php.
2844 CVE-2012-1783 20 1 DoS 2012-03-19 2017-08-29
7.8
 None Remote Low Not required None None Complete
Tiny Server 1.1.9 and earlier allows remote attackers to cause a denial of service (crash) via a long string in a GET request without an HTTP version number.
2845 CVE-2012-1782 79 XSS 2012-03-19 2012-03-20
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in questions/ask in OSQA 3b allow remote attackers to inject arbitrary web script or HTML via the (1) url bar or (2) picture bar.
2846 CVE-2012-1781 79 1 XSS 2012-03-19 2017-08-29
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in ajax/commentajax.php in SocialCMS 1.0.5 allow remote attackers to inject arbitrary web script or HTML via the (1) TREF_email_address or (2) TR_name parameters.
2847 CVE-2012-1780 89 1 Exec Code Sql 2012-03-19 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in search.php in SocialCMS 1.0.5 allows remote attackers to execute arbitrary SQL commands via the category parameter.
2848 CVE-2012-1779 79 1 XSS 2012-03-19 2018-01-11
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in IDevSpot idev-BusinessDirectory 3.0 allows remote attackers to inject arbitrary web script or HTML via the SEARCH parameter to index.php.
2849 CVE-2012-1778 89 1 Exec Code Sql 2012-03-19 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in artykul_print.php in CreateVision CMS allows remote attackers to execute arbitrary SQL commands via the id parameter.
2850 CVE-2012-1777 89 1 Exec Code Sql 2012-04-05 2018-01-06
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in my.activation.php3 in F5 FirePass 6.0.0 through 6.1.0 and 7.0.0 allows remote attackers to execute arbitrary SQL commands via the state parameter.
Total number of vulnerabilities : 5297   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 (This Page)58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.