CVE-2012-6072

CVE-2012-6072 is a CRLF injection vulnerability in Jenkins core exposed to remote attackers who can inject HTTP headers and trigger HTTP response splitting via unspecified vectors. Affected are Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.4...

CVE-2012-5658

OpenShift Origin before 1.1 is vulnerable: when running rhc-chk.rb with -d (debug mode), it writes passwords and other sensitive information in cleartext (e.g., in logs or support channels). The root cause is that the rhc-chk output is not redacted in debug mode. Red Hat’s RHSA-2013-0220 confirms...

CVE-2012-6074

The CVE-2012-6074 entry concerns a Cross-site scripting (XSS) vulnerability in Jenkins. Affected versions include Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1. The root cause is an XSS f...

CVE-2012-6073

Summary (CVE-2012-6073) : Jenkins core components prior to specific versions are vulnerable to an open redirect that allows remote attackers to redirect users to arbitrary sites and facilitate phishing via unspecified vectors. Affected products/versions include Jenkins before 1.491, Jenkins LTS b...

CVE-2012-6121

Cross-site scripting XSS vulnerability in Roundcube Webmail before 0.8.5 allows remote attackers to inject arbitrary web script or HTML via a 1 data:text or 2 vbscript link...

CVE-2012-5647

CVE-2012-5647 is an open redirect flaw in OpenShift Origin’s restorer.php (node-util), present before version 1.0.5-3. A remote attacker could craft a link to cause PATH_INFO parsing to redirect victims to an arbitrary site, enabling phishing. The issue is documented alongside CVE-2012-5646, with...

CVE-2012-6121

CVE-2012-6121 is a cross-site scripting (XSS) vulnerability in Roundcube Webmail prior to 0.8.5. An attacker can inject arbitrary script/html via data:text or vbscript links, potentially affecting users who click such links. The issue is documented in multiple connected sources (e.g., SUSE securi...

CVE-2012-5646

CVE-2012-5646 affects Red Hat OpenShift Origin, specifically node-util/restorer.php (path: restorer.php) in the OpenShift Origin package, prior to version 1.0.5-3. A crafted uuid in the PATH_INFO enables remote attackers to execute arbitrary commands with the privileges of the application. The is...

CVE-2012-5337

Multiple cross-site scripting XSS vulnerabilities in jforum.page in JForum 2.1.9 allow remote attackers to inject arbitrary web script or HTML via the 1 action, 2 matchtype, 3 sortby, or 4 start parameters...

CVE-2012-5337

CVE-2012-5337 affects the web forum component JForum 2.1.9, specifically the jforum.page script. The vulnerability is a cross-site scripting (XSS) issue triggered by unsanitized input in parameters (action, match_type, sort_by, start), enabling remote attackers to inject arbitrary scripts/HTML in...

CVE-2012-6128

Multiple stack-based buffer overflows in http.c in OpenConnect before 4.08 allow remote VPN gateways to cause a denial of service application crash via a long 1 hostname, 2 path, or 3 cookie list in a response...

CVE-2012-5624

The XMLHttpRequest object in Qt before 4.8.4 enables http redirection to the file scheme, which allows man-in-the-middle attackers to force the read of arbitrary local files and possibly obtain sensitive information via a file: URL to a QML application...

CVE-2012-5624

CVE-2012-5624 affects Qt 4.x where the XMLHttpRequest implementation could be redirected from http to the file: URL scheme, enabling a man‑in‑the‑middle attacker to trigger reads of local files in a QML application. The root cause is improper handling of redirects in XMLHttpRequest, allowing acce...

CVE-2012-6093

The CVE-2012-6093 issue affects Qt's QSslSocket::sslErrors across Qt versions (pre-4.6.5; pre-4.7.6 for 4.7.x; pre-4.8.5 for 4.8.x) when used with certain OpenSSL versions. It arises from an incompatible structure layout that can read memory from the wrong location, causing Qt to report an incorr...

CVE-2012-5624

The XMLHttpRequest object in Qt before 4.8.4 enables http redirection to the file scheme, which allows man-in-the-middle attackers to force the read of arbitrary local files and possibly obtain sensitive information via a file: URL to a QML application...

CVE-2012-6128

Multiple stack-based buffer overflows in http.c in OpenConnect before 4.08 allow remote VPN gateways to cause a denial of service application crash via a long 1 hostname, 2 path, or 3 cookie list in a response...

CVE-2012-6275

Multiple stack-based buffer overflows in AntDS.exe in BigAntSoft BigAnt IM Message Server allow remote attackers to have an unspecified impact via 1 the filename header in an SCH request or 2 the userid component in a DUPF request...

CVE-2012-4704

CVE-2012-4704 affects the 3S CODESYS Gateway-Server (prior to ver. 2.3.9.27). The vulnerability is described as a memory access error (array/index handling) in the Gateway-Server that can allow a remote attacker to execute arbitrary code via a crafted packet. ICS-CERT/3S advisories confirm remote...

CVE-2012-4705

Affected software: 3S CODESYS Gateway-Server (GATEWAY-SERVER). Vulnerability: Directory traversal that can lead to remote code execution via crafted pathnames; impact per ICS-CERT includes remote execution potential. Root cause / vector: Improper handling of directory traversal in the Gateway-Ser...

CVE-2012-4706

CVE-2012-4706 affects the 3S CODESYS Gateway-Server prior to version 2.3.9.27. The vulnerability is a heap-based buffer overflow caused by a signedness/error in processing a crafted TCP packet (port 1211), enabling remote denial of service. Documents indicate this is part of a set of vulnerabilit...