20296 matches found
CVE-2012-6085
The readblock function in g10/import.c in GnuPG 1.4.x before 1.4.13 and 2.0.x through 2.0.19, when importing a key, allows remote attackers to corrupt the public keyring database or cause a denial of service application crash via a crafted length field of an OpenPGP packet...
Cross site request forgery (csrf)
Multiple cross-site request forgery CSRF vulnerabilities in Sitecom WLM-2501 allow remote attackers to hijack the authentication of administrators for requests that modify settings for 1 Mac Filtering via admin/formFilter, 2 IP/Port Filtering via formFilter, 3 Port Forwarding via formPortFw, 4...
CVE-2012-6518
Cross-site request forgery CSRF vulnerability in mod.php in DiY-CMS 1.0 allows remote attackers to hijack the authentication of administrators for requests that create a poll via an add action to the poll module...
CVE-2012-6509
Unrestricted file upload vulnerability in NetArt Media Car Portal 3.0 allows remote attackers to execute arbitrary PHP code by uploading a file a double extension, as demonstrated by .php%00.jpg...
CVE-2012-6505
CVE-2012-6505 is an XSS vulnerability in PHP Volunteer Management 1.0.2, specifically in mods/hours/data/get_hours.php where the id parameter can be abused to inject arbitrary script/HTML. Affected component is the get_hours.php routine; root cause is improper handling/validation of the id input....
CVE-2012-6508
Multiple cross-site request forgery CSRF vulnerabilities in NetArt Media Car Portal 3.0 allow remote attackers to hijack the authentication of administrators for requests that 1 change arbitrary user passwords via a nouveau action in the security module to cars/ADMIN/index.php; 2 create a user or...
CVE-2012-6503
Unspecified vulnerability in the NinjaXplorer component before 1.0.7 for Joomla! has unknown impact and attack vectors...
CVE-2012-6520
CVE-2012-6520 affects Wikidforum 2.10. Multiple SQL injection flaws in the advanced search allow remote attackers to execute arbitrary SQL via the select_sort and opt_search_select parameters. CVSSv2 base 7.5 (HIGH) with network attack vector and no authentication. Note: exploitation status is no...
CVE-2012-6517
DiY-CMS 1.0 is affected by multiple XSS vulnerabilities allowing remote attackers to inject arbitrary script/HTML via (1) the question parameter to /modules/poll/add.php and (2) the question or (3) the answer parameter to /modules/poll/edit.php. The root cause is unsafe handling of input leading ...
CVE-2012-6512
CVE-2012-6512 affects the WordPress Organizer plugin v1.2.1, where remote attackers can retrieve the installation path via unspecified vectors targeting multiple pages (plugin_hook.php, page/index.php, page/dir.php, page/options.php, page/resize.php, page/upload.php, page/users.php, page/view.php...
CVE-2012-6519
The CVE-2012-6519 issue affects DIY-CMS 1.0, where an SQL injection flaw exists in modules/poll/index.php. The vulnerability is triggered by the start parameter to mod.php, allowing remote attackers to execute arbitrary SQL commands. The impact is described as enabling data access/ modification w...
CVE-2012-6503
Technical details about CVE-2012-6503 are not provided in the connected documents. The NVD entry notes an unspecified vulnerability in NinjaXplorer
CVE-2012-6510
Multiple cross-site scripting XSS vulnerabilities in NetArt Media Car Portal 3.0 allow remote attackers to inject arbitrary web script or HTML via the 1 PWRS or 2 Description field when posting a new vehicle; 3 news title when creating news; 4 Name when creating a sub user; 5 group name when...
CVE-2012-6504
CVE-2012-6504 affects PHP Volunteer Management 1.0.2, with the vulnerability in mods/hours/data/get_hours.php . An attacker can exploit an SQL injection via the id parameter to execute arbitrary SQL commands. The NVD metrics show a base score of 7.5 (HIGH) with network access, low attack complexi...
CVE-2012-6520
Multiple SQL injection vulnerabilities in the advanced search in Wikidforum 2.10 allow remote attackers to execute arbitrary SQL commands via the 1 selectsort or 2 optsearchselect parameters. NOTE: this issue could not be reproduced by third parties...
CVE-2012-2099
CVE-2012-2099 concerns Wikidforum 2.10 with multiple cross-site scripting (XSS) vulnerabilities. The issue allows remote attackers to inject arbitrary web script or HTML via the advanced search interface: (1) search field, (2) Author, or (3) select_sort parameters. The NVD entry lists a Medium se...
CVE-2012-6508
CVE-2012-6508 affects NetArt Media Car Portal 3.0 with multiple CSRF vulnerabilities that allow an attacker to hijack administrator sessions and perform admin-level actions such as changing user passwords, creating new users or sub-users, and editing profile data via specific actions in the secur...
CVE-2012-6085
CVE-2012-6085 details (mode C) : In GnuPG, the read_block function (g10/import.c) is vulnerable when importing a key in versions: 1.4.x before 1.4.13 and 2.0.x through 2.0.19. A crafted length field in an OpenPGP packet can cause the public keyring database to be corrupted or the application to c...
CVE-2012-6514
CVE-2012-6514 is a Cross-site Scripting (XSS) vulnerability in the Joomla! environment using the nBill (com_nbill) component 2.3.2 . The issue occurs when an attacker can inject arbitrary web script or HTML via the message parameter in an income action to administrator/index.php . The CVSS metric...