CVE-2012-3807

Samsung Kies before 2.5.0.120942711 has arbitrary file execution...

CVE-2012-3806

CVE-2012-3806 concerns Samsung Kies prior to 2.5.0.12094_27_11, with a NULL pointer dereference vulnerability that could allow remote attackers to cause a denial of service. The vulnerability is associated with the Samsung Kies ActiveX components as well as the desktop client’s handling of certai...

CVE-2012-3806

Samsung Kies before 2.5.0.120942711 contains a NULL pointer dereference vulnerability which could allow remote attackers to perform a denial of service...

CVE-2012-4434

fwknop before 2.0.3 allow remote authenticated users to cause a denial of service server crash or possibly execute arbitrary code...

CVE-2012-3490

The 1 mypopenvimpl and 2 myspawnv functions in src/condorutils/mypopen.cpp and the 3 systemCommand function in condorvm-gahp/vmgahpcommon.cpp in Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 does not properly check the return value of setuid calls, which might cause a subprocess to be created...

CVE-2012-4434

fwknop before 2.0.3 allow remote authenticated users to cause a denial of service server crash or possibly execute arbitrary code...

CVE-2012-2950

CVE-2012-2950 affects Gateway Geomatics MapServer for Windows (MS4W). The vulnerability is a Local File Inclusion in the bundled Apache/PHP configuration that allows remote attackers to view arbitrary files and execute PHP code with SYSTEM privileges. Affected releases are the MS4W packages up to...

CVE-2012-2931

PHP code injection in TinyWebGallery before 1.8.8 allows remote authenticated users with admin privileges to inject arbitrary code into the .htusers.php file...

CVE-2012-2931

CVE-2012-2931 affects TinyWebGallery prior to 1.8.8. The vulnerability arises from unsanitized input in the admin user-creation flow: the POST parameter for user is written into .htusers.php, and a remote authenticated admin can inject arbitrary PHP code, enabling code execution via admin/index.p...

CVE-2012-2142

CVE-2012-2142 affects Poppler up to version 0.21.4, where the error function in Error.cc can be abused by a crafted PDF containing an escape sequence for a terminal emulator to execute arbitrary commands. The vulnerability arises from improper handling of escape sequences in PDFs, enabling potent...

CVE-2012-5558

CVE-2012-5558 affects Drupal contributed modules Smiley (6.x-1.x before 6.x-1.1) and Smileys (6.x-1.x before 6.x-1.1). Root cause: these modules do not sufficiently sanitize user-defined smiley acronyms, enabling XSS when an attacker with the administer smiley permission injects arbitrary script/...

CVE-2012-4434

fwknop before 2.0.3 is affected by a vulnerability that lets remote authenticated users cause a denial-of-service (server crash) and possibly execute arbitrary code. Root cause details are not provided in the documents. Upgrade to fwknop 2.0.3 or apply vendor-recommended remediation per the linke...

CVE-2012-4434

fwknop before 2.0.3 allow remote authenticated users to cause a denial of service server crash or possibly execute arbitrary code...

CVE-2012-3490

CVE-2012-3490 affects the Condor project (7.6.x before 7.6.10 and 7.8.x before 7.8.4). The vulnerability arises from not properly checking the return value of setuid in (1) my_popenv_impl, (2) my_spawnv (src/condor_utils/my_popen.cpp), and (3) systemCommand (condor_vm-gahp/vmgahp_common.cpp). Thi...

CVE-2012-2226

CVE-2012-2226 concerns Invision Power Board (IPB) versions 3.3.0 and 3.2.3, where unsanitized user input in the like.php flow enables Local File Inclusion (LFI) via a crafted key parameter. The vulnerability chain involves base64 decoding a user-supplied value, splitting it into app/area/relId/li...

CVE-2012-1915

CVE-2012-1915 affects EllisLab CodeIgniter up to version 2.1.1; CodeIgniter 2.1.2 fixes bypasses of the xss_clean() filter in system/core/Security.php, enabling XSS that could bypass input filtering. Documented bypass vectors include various HTML tag/attribute configurations that bypass the filte...

CVE-2012-1261

Cross-site scripting XSS vulnerability in cgi-bin/scrutfaexclusions.cgi in Plixer International Scrutinizer NetFlow and sFlow Analyzer 8.6.2.16204 and other versions before 9.0.1.19899 allows remote attackers to inject arbitrary web script or HTML via the standalone parameter...

CVE-2012-1260

Cross-site scripting XSS vulnerability in cgi-bin/userprefs.cgi in Plixer International Scrutinizer NetFlow & sFlow Analyzer 8.6.2.16204, and possibly other versions before 9.0.1.19899, allows remote attackers to inject arbitrary web script or HTML via the newUser parameter. NOTE: this might not ...

CVE-2012-2714

The CVE-2012-2714 entry concerns the Drupal BrowserID (Mozilla Persona) module for Drupal 7.x-1.x, vulnerable before 7.x-1.3. The underlying issue is insufficient validation of authentication requests, allowing remote attackers to hijack arbitrary user authentication via the audience identifier. ...

CVE-2012-2724

The vulnerability CVE-2012-2724 affects the Drupal Simplenews module (versions 6.x-1.x prior to 6.x-1.4, 6.x-2.x prior to 6.x-2.0-alpha4, and 7.x-1.x prior to 7.x-1.0-rc1). The root cause is information disclosure: when confirmation is required for new subscribers, the confirmation page reveals t...