CVE-2012-5359

CVE-2012-5359 affects FFmpeg’s Libavcodec prior to 0.11. The vulnerability arises in the libavcodec ASF (and QT/WMV) parsing path, where memory corruption can occur, allowing remote code execution. Exploitation requires a user to open a specially crafted ASF file (not automatically via email), wi...

CVE-2012-0941

Fortinet FortiGate UTM WAF appliances running FortiOS 4.3.x before 4.3.6 are affected by multiple XSS vulnerabilities. Exploitation vectors include the Endpoint Monitor, Dialup List, or Log&Report Display modules, or the fields_sorted_opt parameter to user/auth/list and endpointcompliance/app_det...

CVE-2012-5359

Libavcodec in FFmpeg before 0.11 allows remote attackers to execute arbitrary code via a crafted ASF file...

CVE-2012-3878

...

Design/Logic Flaw

Jenkins Maven Plugin 2.17 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrectly verified SSL certificates, making it susceptible to man-in-the-middle attacks. Maven Plugin 3.0 no longer has a dependency on commons-httpclient...

CVE-2017-1000397

CVE-2017-1000397 affects Jenkins Maven Plugin versions up to 2.17, which bundled Commons HttpClient that is vulnerable to CVE-2012-6153 due to improper SSL certificate verification, enabling MITM attacks. The issue is tied to the plugin’s transitive dependency on Commons HttpClient; Maven Plugin ...

AZL-44730 CVE-2012-6708 affecting package python-httplib2 0.20.3-3

jQuery before 1.9.0 is vulnerable to Cross-site Scripting XSS attacks. The jQuerystrInput function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '' character anywhere in the string, giving...

CVE-2012-6708

Removed by vendor...

CVE-2012-0699

Multiple cross-site request forgery CSRF vulnerabilities in Family Connections CMS aka FCMS 2.9 and earlier allow remote attackers to hijack the authentication of arbitrary users for requests that 1 add news via an add action to familynews.php or 2 add a prayer via an add action to prayers.php...

CVE-2012-6682

Cross-site scripting XSS vulnerability in downloads/actions/editdownload.php in the DragonByte Technologies vBDownloads module 1.3.2 and earlier for vBulletin allows remote attackers to inject arbitrary web script or HTML via the mirrors parameter...

CVE-2012-6682

DragonByte Technologies vBDownloads for vBulletin (versions 1.3.2 and earlier) is affected by a cross-site scripting (XSS) vulnerability in downloads/actions/editdownload.php, exploitable via the mirrors[] parameter. The underlying issue is a reflected/scriptable input handling flaw that allows r...

CVE-2012-6682

Cross-site scripting XSS vulnerability in downloads/actions/editdownload.php in the DragonByte Technologies vBDownloads module 1.3.2 and earlier for vBulletin allows remote attackers to inject arbitrary web script or HTML via the mirrors parameter...

CVE-2012-6668

DragonByte Technologies vBShout for vBulletin (Shout Reports) is affected by XSS vulnerabilities in the Shout Reports feature prior to version 6.0.6. The issues arise in the reportreason parameter (actions/doreport.php) and the modnotes parameter (actions/updatereport.php), enabling remote attack...

CVE-2012-0699

CVE-2012-0699 affects Family Connections CMS (FCMS) 2.9 and earlier. The vulnerability is cross-site request forgery (CSRF) that allows remote attackers to hijack a user’s authenticated session to perform actions: adding news via familynews.php and adding a prayer via prayers.php. Connected sourc...

CVE-2012-6671

DragonByte Technologies Forumon RPG for vBulletin (module) is affected by cross-site scripting in actions/main.php prior to version 1.0.8. The vulnerability allows remote attackers to inject arbitrary script/HTML via monster[title] or monster[description] when creating a new monster, indicating a...

CVE-2012-6670

DragonByte Technologies vbActivity for vBulletin is affected by multiple XSS vulnerabilities in versions prior to 3.0.1. The issue allows remote attackers to inject arbitrary web script or HTML via the reason parameter in actions/nominatemedal.php or actions/requestmedal.php. This is due to impro...

CVE-2012-6667

Cross-site scripting XSS vulnerability in vbshout.php in DragonByte Technologies vBShout module for vBulletin allows remote attackers to inject arbitrary web script or HTML via the shout parameter in a shout action...

CVE-2012-6667

DragonByte Technologies vBShout for vBulletin contains a Cross‑site Scripting (XSS) vulnerability in vbshout.php. The issue allows remote attackers to inject arbitrary web script or HTML via the shout parameter in a shout action. The provided references indicate reflected XSS and standard impacts...

CVE-2012-3353

The CVE-2012-3353 entry concerns Apache Sling JCR ContentLoader’s XmlReader in version 2.1.4, which allows importing arbitrary files (including local files) into the content repository, enabling potential information disclosure. The vulnerability arises from how XmlReader handles import operation...

CVE-2012-2576

SQL injection vulnerability in the LoginServlet page in SolarWinds Storage Manager before 5.1.2, SolarWinds Storage Profiler before 5.1.2, and SolarWinds Backup Profiler before 5.1.2 allows remote attackers to execute arbitrary SQL commands via the loginName field...