CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In November 2012

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
251 CVE-2012-4566 264 Bypass 2012-11-20 2012-11-20
6.4
 None Remote Low Not required Partial Partial None
The DTLS support in radsecproxy before 1.6.2 does not properly verify certificates when there are configuration blocks with CA settings that are unrelated to the block being used for verifying the certificate chain, which might allow remote attackers to bypass intended access restrictions and spoof clients, a different vulnerability than CVE-2012-4523.
252 CVE-2012-4564 DoS Exec Code Overflow 2012-11-11 2020-11-12
6.8
 None Remote Medium Not required Partial Partial Partial
ppm2tiff does not check the return value of the TIFFScanlineSize function, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PPM image that triggers an integer overflow, a zero-memory allocation, and a heap-based buffer overflow.
253 CVE-2012-4563 79 XSS 2012-11-20 2013-03-02
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Google Web Toolkit (GWT) 2.4 Beta and release candidates before 2.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
254 CVE-2012-4562 189 DoS Exec Code Overflow 2012-11-30 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
Multiple integer overflows in libssh before 0.5.3 allow remote attackers to cause a denial of service (infinite loop or crash) and possibly execute arbitrary code via unspecified vectors, which triggers a buffer overflow, infinite loop, or possibly some other unspecified vulnerabilities.
255 CVE-2012-4561 DoS 2012-11-30 2017-08-29
5.0
 None Remote Low Not required None None Partial
The (1) publickey_make_dss, (2) publickey_make_rsa, (3) signature_from_string, (4) ssh_do_sign, and (5) ssh_sign_session_id functions in keys.c in libssh before 0.5.3 free "an invalid pointer on an error path," which might allow remote attackers to cause a denial of service (crash) via unspecified vectors.
256 CVE-2012-4560 119 DoS Exec Code Overflow 2012-11-30 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
Multiple buffer overflows in libssh before 0.5.3 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors.
257 CVE-2012-4559 399 DoS Exec Code 2012-11-30 2017-08-29
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple double free vulnerabilities in the (1) agent_sign_data function in agent.c, (2) channel_request function in channels.c, (3) ssh_userauth_pubkey function in auth.c, (4) sftp_parse_attr_3 function in sftp.c, and (5) try_publickey_from_file function in keyfiles.c in libssh before 0.5.3 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
258 CVE-2012-4557 399 DoS 2012-11-30 2021-06-06
5.0
 None Remote Low Not required None None Partial
The mod_proxy_ajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker node into an error state upon detection of a long request-processing time, which allows remote attackers to cause a denial of service (worker consumption) via an expensive request.
259 CVE-2012-4554 264 2012-11-11 2012-11-12
5.0
 None Remote Low Not required Partial None None
The OpenID module in Drupal 7.x before 7.16 allows remote OpenID servers to read arbitrary files via a crafted DOCTYPE declaration in an XRDS file.
260 CVE-2012-4553 264 Exec Code +Info 2012-11-11 2012-11-12
6.8
 None Remote Medium Not required Partial Partial Partial
Drupal 7.x before 7.16 allows remote attackers to obtain sensitive information and possibly re-install Drupal and execute arbitrary PHP code via an external database server, related to "transient conditions."
261 CVE-2012-4552 119 Exec Code Overflow 2012-11-18 2013-06-26
6.8
 None Remote Medium Not required Partial Partial Partial
Stack-based buffer overflow in the error function in ssg/ssgParser.cxx in PLIB 1.8.5 allows remote attackers to execute arbitrary code via a crafted 3d model file that triggers a long error message, as demonstrated by a .ase file.
262 CVE-2012-4551 399 DoS Exec Code Mem. Corr. 2012-11-30 2012-12-03
7.5
 None Remote Low Not required Partial Partial Partial
Use-after-free vulnerability in libunity-webapps before 2.4.1 allows remote attackers to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code via a crafted web site, related to "certain hash tables."
263 CVE-2012-4548 Exec Code 2012-11-11 2017-08-29
6.0
 None Remote Medium ??? Partial Partial Partial
Argument injection vulnerability in syntax-highlighting.sh in cgit 9.0.3 and earlier allows remote authenticated users with permissions to add files to execute arbitrary commands via the --plug-in argument to the highlight command.
264 CVE-2012-4541 79 XSS 2012-11-19 2019-11-21
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Piwik before 1.9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
265 CVE-2012-4540 189 DoS Exec Code Overflow +Info 2012-11-11 2018-10-30
6.8
 None Remote Medium Not required Partial Partial Partial
Off-by-one error in the invoke function in IcedTeaScriptablePluginObject.cc in IcedTea-Web 1.1.x before 1.1.7, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.x before 1.4.1 allows remote attackers to obtain sensitive information, cause a denial of service (crash), or possibly execute arbitrary code via a crafted webpage that triggers a heap-based buffer overflow, related to an error message and a "triggering event attached to applet." NOTE: the 1.4.x versions were originally associated with CVE-2013-4349, but that entry has been MERGED with this one.
266 CVE-2012-4539 399 DoS 2012-11-21 2017-08-29
2.1
 None Local Low Not required None None Partial
Xen 4.0 through 4.2, when running 32-bit x86 PV guests on 64-bit hypervisors, allows local guest OS administrators to cause a denial of service (infinite loop and hang or crash) via invalid arguments to GNTTABOP_get_status_frames, aka "Grant table hypercall infinite loop DoS vulnerability."
267 CVE-2012-4538 20 DoS 2012-11-24 2017-08-29
4.9
 None Local Low Not required None None Complete
The HVMOP_pagetable_dying hypercall in Xen 4.0, 4.1, and 4.2 does not properly check the pagetable state when running on shadow pagetables, which allows a local HVM guest OS to cause a denial of service (hypervisor crash) via unspecified vectors.
268 CVE-2012-4537 16 DoS 2012-11-21 2017-08-29
2.1
 None Local Low Not required None None Partial
Xen 3.4 through 4.2, and possibly earlier versions, does not properly synchronize the p2m and m2p tables when the set_p2m_entry function fails, which allows local HVM guest OS administrators to cause a denial of service (memory consumption and assertion failure), aka "Memory mapping failure DoS vulnerability."
269 CVE-2012-4536 DoS 2012-11-21 2017-08-29
2.1
 None Local Low Not required None None Partial
The (1) domain_pirq_to_emuirq and (2) physdev_unmap_pirq functions in Xen 2.2 allows local guest OS administrators to cause a denial of service (Xen crash) via a crafted pirq value that triggers an out-of-bounds read.
270 CVE-2012-4535 399 DoS 2012-11-21 2017-08-29
1.9
 None Local Medium Not required None None Partial
Xen 3.4 through 4.2, and possibly earlier versions, allows local guest OS administrators to cause a denial of service (Xen infinite loop and physical CPU consumption) by setting a VCPU with an "inappropriate deadline."
271 CVE-2012-4533 79 XSS 2012-11-19 2018-12-04
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the "extra" details in the DiffSource._get_row function in lib/viewvc.py in ViewVC 1.0.x before 1.0.13 and 1.1.x before 1.1.16 allows remote authenticated users with repository commit access to inject arbitrary web script or HTML via the "function name" line.
272 CVE-2012-4527 119 DoS Exec Code Overflow 2012-11-21 2016-12-08
6.8
 None Remote Medium Not required Partial Partial Partial
Stack-based buffer overflow in mcrypt 2.6.8 and earlier allows user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long file name. NOTE: it is not clear whether this is a vulnerability.
273 CVE-2012-4523 264 Bypass 2012-11-20 2013-01-30
6.4
 None Remote Low Not required Partial Partial None
radsecproxy before 1.6.1 does not properly verify certificates when there are configuration blocks with CA settings that are unrelated to the block being used for verifying the certificate chain, which might allow remote attackers to bypass intended access restrictions and spoof clients.
274 CVE-2012-4522 264 2012-11-24 2013-05-04
5.0
 None Remote Low Not required None Partial None
The rb_get_path_check function in file.c in Ruby 1.9.3 before patchlevel 286 and Ruby 2.0.0 before r37163 allows context-dependent attackers to create files in unexpected locations or with unexpected names via a NUL byte in a file path.
275 CVE-2012-4520 20 2012-11-18 2013-05-04
6.4
 None Remote Low Not required Partial Partial None
The django.http.HttpRequest.get_host function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and display arbitrary URLs via crafted username and password Host header values.
276 CVE-2012-4515 399 DoS Exec Code 2012-11-11 2012-11-12
6.8
 None Remote Medium Not required Partial Partial Partial
Use-after-free vulnerability in khtml/rendering/render_replaced.cpp in Konqueror in KDE 4.7.3, when the context menu is shown, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by accessing an iframe when it is being updated.
277 CVE-2012-4514 DoS 2012-11-11 2012-11-12
5.0
 None Remote Low Not required None None Partial
rendering/render_replaced.cpp in Konqueror in KDE before 4.9.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted web page, related to "trying to reuse a frame with a null part."
278 CVE-2012-4513 119 DoS Overflow 2012-11-11 2012-11-12
6.4
 None Remote Low Not required Partial None Partial
khtml/imload/scaledimageplane.h in Konqueror in KDE 4.7.3 allows remote attackers to cause a denial of service (crash) and possibly read memory via large canvas dimensions, which leads to an unexpected sign extension and a heap-based buffer over-read.
279 CVE-2012-4510 264 2012-11-20 2013-12-05
5.8
 None Remote Medium Not required Partial Partial None
cups-pk-helper before 0.2.3 does not properly wrap the (1) cupsGetFile and (2) cupsPutFile function calls, which allows user-assisted remote attackers to read or overwrite sensitive files using CUPS resources.
280 CVE-2012-4505 119 Overflow 2012-11-11 2018-08-13
10.0
 None Remote Low Not required Complete Complete Complete
Heap-based buffer overflow in the px_pac_reload function in lib/pac.c in libproxy 0.2.x and 0.3.x allows remote servers to have an unspecified impact via a crafted Content-Length size in an HTTP response header for a proxy.pac file request, a different vulnerability than CVE-2012-4504.
281 CVE-2012-4504 119 Overflow 2012-11-11 2018-08-13
10.0
 None Remote Low Not required Complete Complete Complete
Stack-based buffer overflow in the url::get_pac function in url.cpp in libproxy 0.4.x before 0.4.9 allows remote servers to have an unspecified impact via a large proxy.pac file.
282 CVE-2012-4498 264 Bypass 2012-11-02 2012-11-06
7.5
 None Remote Low Not required Partial Partial Partial
The Activism module 6.x-2.x before 6.x-2.1 for Drupal does not properly restrict access to the "Campaign" content type, which might allow remote attackers to bypass access restrictions and possibly have other unspecified impact.
283 CVE-2012-4497 79 XSS 2012-11-02 2017-11-29
2.1
 None Remote High ??? None Partial None
Cross-site scripting (XSS) vulnerability in the "3 slide gallery" in the Elegant Theme module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via a slide URL.
284 CVE-2012-4493 79 XSS 2012-11-02 2012-11-06
2.1
 None Remote High ??? None Partial None
Cross-site scripting (XSS) vulnerability in the administrative interface in the Better Revisions module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer better revisions" permission to inject arbitrary web script or HTML via unspecified vectors.
285 CVE-2012-4487 264 2012-11-02 2012-11-05
4.0
 None Remote Low ??? None Partial None
The Subuser module before 6.x-1.8 for Drupal does not properly check "switch subuser" permissions, which allows remote authenticated parent users to change their role by switching to a subuser they created.
286 CVE-2012-4486 352 CSRF 2012-11-02 2012-11-06
6.8
 None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in the Subuser module before 6.x-1.8 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that switch the user to a subuser via unspecified vectors.
287 CVE-2012-4479 89 Exec Code Sql 2012-11-30 2012-12-03
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
288 CVE-2012-4478 352 CSRF 2012-11-30 2012-12-03
6.8
 None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to hijack the authentication of administrators.
289 CVE-2012-4477 264 Bypass 2012-11-30 2012-12-03
5.0
 None Remote Low Not required None Partial None
Unspecified vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to bypass access restrictions via unknown attack vectors.
290 CVE-2012-4476 79 XSS 2012-11-30 2012-12-03
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
291 CVE-2012-4475 264 2012-11-30 2012-12-03
5.0
 None Remote Low Not required None Partial None
The Security Questions module for Drupal 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.1 does not properly restrict access, which allows remote attackers to edit an arbitrary user's questions and answers via unspecified vectors.
292 CVE-2012-4474 79 XSS 2012-11-30 2013-01-30
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in the Colorbox Node module 7.x-2.x before 7.x-2.2 for Drupal allow remote attackers to inject arbitrary web script or HTML via unspecified parameters.
293 CVE-2012-4473 264 2012-11-30 2013-01-30
3.5
 None Remote Medium ??? Partial None None
The Restrict node page view module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the "view any node page" or "view any node {type} page" permission to access unpublished nodes via a direct request.
294 CVE-2012-4472 Exec Code 2012-11-30 2013-01-30
5.1
 None Remote High Not required Partial Partial Partial
Unrestricted file upload vulnerability in upload.php in the Drag & Drop Gallery module 6.x-1.5 and earlier for Drupal allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension followed by a safe extension, then accessing it via a direct request to the directory specified by the filedir parameter.
295 CVE-2012-4471 264 2012-11-30 2013-01-30
5.0
 None Remote Low Not required None Partial None
The Search Autocomplete module 7.x-2.x before 7.x-2.4 for Drupal does not properly restrict access to the module admin page, which allows remote attackers to disable an autocompletion or change the priority order via unspecified vectors.
296 CVE-2012-4470 264 Bypass 2012-11-30 2013-01-30
7.5
 None Remote Low Not required Partial Partial Partial
The Listhandler module 6.x-1.x before 6.x-1.1 for Drupal does not properly check permissions when importing emails, which allows remote comment authors to bypass access restrictions and possibly have other unspecified impact.
297 CVE-2012-4469 79 XSS 2012-11-30 2012-12-03
2.6
 None Remote High Not required None Partial None
Cross-site scripting (XSS) vulnerability in the Hashcash module 6.x-2.x before 6.x-2.6 and 7.x-2.x before 7.x-2.2 for Drupal, when "Log failed hashcash" is enabled, allows remote attackers to inject arbitrary web script or HTML via an invalid token, which is not properly handled when administrators use the Database logging module.
298 CVE-2012-4468 79 XSS 2012-11-30 2013-01-30
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the Privatemsg module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via a user name in a private message.
299 CVE-2012-4433 189 DoS Exec Code Overflow 2012-11-18 2017-08-29
7.5
 None Remote Low Not required Partial Partial Partial
Multiple integer overflows in operations/external/ppm-load.c in GEGL (Generic Graphics Library) 0.2.0 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a large (1) width or (2) height value in a Portable Pixel Map (ppm) image, which triggers a heap-based buffer overflow.
300 CVE-2012-4426 134 DoS Exec Code 2012-11-21 2016-12-08
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple format string vulnerabilities in mcrypt 2.6.8 and earlier might allow user-assisted remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via vectors involving (1) errors.c or (2) mcrypt.c.
Total number of vulnerabilities : 436   Page : 1 2 3 4 5 6 (This Page)7 8 9
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.