CVE-2012-4381

CVE-2012-4381 affects MediaWiki prior to 1.18.5 and 1.19.x prior to 1.19.2. The root issue is that passwords are stored in the local database in cleartext, enabling context-dependent attackers to obtain plaintext passwords via brute-force. Additionally, when an external authentication plugin retu...

CVE-2012-4029

Cross-site scripting XSS vulnerability in main/dropbox/index.php in Chamilo LMS before 1.8.8.6 allows remote attackers to inject arbitrary web script or HTML via the categoryname parameter in an addsentcategory action...

CVE-2012-4029

CVE-2012-4029 is a documented XSS vulnerability in Chamilo LMS before 1.8.8.6. The flaw occurs in main/dropbox/index.php via the category_name parameter in an addsentcategory action, allowing remote attackers to inject arbitrary web script or HTML. The issue is part of Chamilo 1.8.8.4/1.8.8.6 fam...

CVE-2012-6686

...

CVE-2012-6686

CVE-2012-6686 is a duplicate of CVE-2013-4357. Connected documents describe the underlying issue as an eglibc getaddrinfo handling flaw that can enable denial of service. The F5 advisory explicitly notes the vulnerability in eglibc before 2.14 and that none of their supported products are affecte...

CVE-2012-1566

LinuxMint as of 2012-03-19 has temporary file creation vulnerabilities in mintNanny...

CVE-2012-1567

LinuxMint as of 2012-03-19 has temporary file creation vulnerabilities in mintUpdate...

CVE-2012-1567

Technical details about CVE-2012-1567 are not provided in the supplied documents. Monitor for updates from vendor advisories and security bulletins.

CVE-2012-1566

CVE-2012-1566 involves Linux Mint’s mintNanny and reports temporary file creation vulnerabilities. The connected sources corroborate a vulnerability in mintNanny on Linux Mint as of 2012-03-19. Details such as affected versions, root cause, exploitability, impact scope, and remediation are not ex...

Information disclosure

An Information Disclosure vulnerability exists in the my config file in NEtGEAR WGR614 v7 and v9, which could let a malicious user recover all previously used passwords on the device, for both the control panel and WEP/WPA/WPA2, in plaintext. This is a different issue than CVE-2012-6340...

CVE-2012-6341

The CVE-2012-6341 entry describes an Information Disclosure vulnerability in NETGEAR WGR614 devices (v7 and v9) where a malicious user could recover all previously used passwords stored in plaintext in the device’s configuration. The root cause is exposure of credentials via the my config file, e...

CVE-2012-6297

Command Injection vulnerability exists via a CSRF in DD-WRT 24-sp2 from specially crafted configuration values containing shell meta-characters, which could let a remote malicious user cause a Denial of Service...

CVE-2012-6340

NETGEAR WGR614 v7 and v9 are affected by CVE-2012-6340 due to a hardcoded credential used for serial programming, enabling authentication bypass for local attackers. The issue is related to CVE-2006-1002. Affected component: the device firmware implementing serial programming authentication. Root...

CVE-2012-6309

CVE-2012-6309 affects Arctic Torrent 1.4. A vulnerability in .torrent file handling could allow a remote attacker to cause a Denial of Service. Documents specify unspecified vectors and do not provide concrete exploit details. CVSS metrics indicate a network-accessible issue with low initial comp...

CVE-2012-6307

A vulnerability exists in JPEGsnoop 1.5.2 due to an unspecified issue in JPEG file handling, which could let a malicious user execute arbitrary code...

CVE-2012-6297

CVE-2012-6297 concerns DD-WRT v24-sp2, where a CSRF flaw allows command injection via specially crafted configuration values containing shell meta-characters. The vulnerability enables a remote attacker (authenticated client) to execute commands as root, with potential system-wide compromise or a...

CVE-2012-2593

The connected documentation confirms a concrete issue: Atmail Webmail Server 6.4 has an XSS vulnerability in its administrative interface that can be triggered via the Date field of an email, enabling attackers to inject arbitrary script/HTML. Exploitation is evidenced by linked exploit-publicati...

CVE-2012-5686

CVE-2012-5686 affects ZPanel 10.0.1 and is caused by insufficient entropy in the password reset process. The Red Hat and NVD entries, as well as related advisories, consistently describe the issue as a password-reset entropy weakness in ZPanel 10.0.1. Documented impact is high/critical depending ...

CVE-2012-5618

CVE-2012-5618 affects Ushahidi prior to 2.6.1, where forgot-password tokens use insufficient entropy. This vulnerability could allow token guessing and account compromise with network access. Upgrade to Ushahidi 2.6.1 or later as the implied fix; the connected documents do not provide further exp...

CVE-2012-6133

Multiple cross-site scripting XSS vulnerabilities in Roundup before 1.4.20 allow remote attackers to inject arbitrary web script or HTML via the 1 @okmessage or 2 @errormessage parameter to issue...