CVE-2012-5514

CVE-2012-5514 affects the Xen hypervisor (4.2 and earlier). The vulnerability stems from the guest_physmap_mark_populate_on_demand function not properly unlocking subject GFNs when checking in-use status, enabling a local guest HVM administrator to induce a denial of service (hang) via unspecifie...

CVE-2012-5510

Xen 4.x, when downgrading the grant table version, does not properly remove the status page from the tracking list when freeing the page, which allows local guest OS administrators to cause a denial of service hypervisor crash via unspecified vectors...

CVE-2012-5525

The getpagefromgfn hypercall function in Xen 4.2 allows local PV guest OS administrators to cause a denial of service crash via a crafted GFN that triggers a buffer over-read...

CVE-2012-5515

The 1 XENMEMdecreasereservation, 2 XENMEMpopulatephysmap, and 3 XENMEMexchange hypercalls in Xen 4.2 and earlier allow local guest administrators to cause a denial of service long loop and hang via a crafted extentorder value...

CVE-2012-6333: Undefined Security Weakness

Multiple HVM control operations in Xen 3.4 through 4.2 allow local HVM guest OS administrators to cause a denial of service physical CPU consumption via a large input...

CVE-2012-5515: Undefined Security Weakness

The 1 XENMEMdecreasereservation, 2 XENMEMpopulatephysmap, and 3 XENMEMexchange hypercalls in Xen 4.2 and earlier allow local guest administrators to cause a denial of service long loop and hang via a crafted extentorder value...

CVE-2012-5514: Undefined Security Weakness

The guestphysmapmarkpopulateondemand function in Xen 4.2 and earlier does not properly unlock the subject GFNs when checking if they are in use, which allows local guest HVM administrators to cause a denial of service hang via unspecified vectors...

CVE-2012-5367

Multiple SQL injection vulnerabilities in OrangeHRM 2.7.1 RC 1 allow remote authenticated administrators to execute arbitrary SQL commands via the sortField parameter to 1 viewCustomers, 2 viewPayGrades, or 3 viewSystemUsers in symfony/web/index.php/admin/, as demonstrated using cross-site reques...

Sql injection

Multiple SQL injection vulnerabilities in OrangeHRM 2.7.1 RC 1 allow remote authenticated administrators to execute arbitrary SQL commands via the sortField parameter to 1 viewCustomers, 2 viewPayGrades, or 3 viewSystemUsers in symfony/web/index.php/admin/, as demonstrated using cross-site reques...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Search API module 7.x-1.x before 7.x-1.3 for Drupal allow remote attackers to hijack the authentication of administrators for requests that 1 enable a server via a server action or 2 enable a search index via an enable index action...

Directory traversal

Directory traversal vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple CMSMS before 1.11.2.1 allows remote authenticated administrators to delete arbitrary files via a .. dot dot in the deld parameter. NOTE: this can be leveraged using CSRF CVE-2012-5450 to allow remote...

CVE-2012-5450

Cross-site request forgery CSRF vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple CMSMS 1.11.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary files via the deld parameter...

CVE-2012-5547

Multiple cross-site request forgery CSRF vulnerabilities in the Search API module 7.x-1.x before 7.x-1.3 for Drupal allow remote attackers to hijack the authentication of administrators for requests that 1 enable a server via a server action or 2 enable a search index via an enable index action...

CVE-2012-5367

Multiple SQL injection vulnerabilities in OrangeHRM 2.7.1 RC 1 allow remote authenticated administrators to execute arbitrary SQL commands via the sortField parameter to 1 viewCustomers, 2 viewPayGrades, or 3 viewSystemUsers in symfony/web/index.php/admin/, as demonstrated using cross-site reques...

Novell NetIQ Privileged User Manager Security Bypass

Added: 12/03/2012 BID: 56539 OSVDB: 87334 Background Novell NetIQ Privileged User Manager NPUM allows IT administrators to work on systems without exposing superuser administrator or supervisor passwords or root-account credentials to the administrator. Problem NetIQ Privileged User Manager 2.3.1...

CVE-2012-4478

Cross-site request forgery CSRF vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to hijack the authentication of administrators...

CVE-2012-4478

Cross-site request forgery CSRF vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to hijack the authentication of administrators...

CVE-2012-6047

Cross-site request forgery CSRF vulnerability in X7 Chat 2.0.5.1 and earlier allows remote attackers to hijack the authentication of administrators for requests that add a user to an arbitrary group via the users page in an adminpanel action to index.php...

CVE-2010-5283

Cross-site request forgery CSRF vulnerability in OpenText ECM formerly Livelink ECM 9.7.1 allows remote attackers to hijack the authentication of administrators for requests that change folder and resource permissions...

CVE-2010-5283

Cross-site request forgery CSRF vulnerability in OpenText ECM formerly Livelink ECM 9.7.1 allows remote attackers to hijack the authentication of administrators for requests that change folder and resource permissions...