CVE-2012-6495

Multiple directory traversal vulnerabilities in the 1 twikidraw action/twikidraw.py and 2 anywikidraw action/anywikidraw.py actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to overwrite arbitrary files via unspecified vectors. NOTE: this can be leveraged wi...

CVE-2012-5666

CVE-2012-5666 is an XSS vulnerability affecting ownCloud 4.0.x (before 4.0.10) and 4.5.x (before 4.5.5). The issue resides in bookmarks/js/bookmarks.js, enabling remote attackers to inject arbitrary web script or HTML via the PATH_INFO parameter to apps/bookmark/index.php. Proof of impact: cross-...

CVE-2012-5665

Affected software: ownCloud 4.0.x (before 4.0.10) and 4.5.x (before 4.5.5). Vulnerability: improper restriction of access to settings.php, enabling remote attackers to edit app configurations for user_webdavauth and user_ldap by editing this file. Root cause: settings.php access is not properly g...

CVE-2012-6495

CVE-2012-6081 describes multiple directory traversal/file-upload vulnerabilities in MoinMoin up to version 1.9.6, specifically in the twikidraw (action/twikidraw.py) and anywikidraw (action/anywikidraw.py) actions. The root cause is unrestricted directory traversal and improper sanitization that ...

CVE-2012-6080

MoinMoin is vulnerable to multiple issues (CVE-2012-6080/6081/6082) in versions 1.9.3–1.9.5. The directory traversal flaw in AttachFile.py’s _do_attachment_move allows remote attackers to overwrite arbitrary files by crafting a filename with .., enabling unauthorized file writes. CVE-2012-6081 de...

CVE-2012-5654

The CVE concerns Nodewords: D6 Meta Tags module for Drupal (pre-6.x-1.14). The flaw is that when configured to auto-generate description meta tags from node text, it does not properly filter node content, allowing remote attackers to read sensitive information via the description, dc.description,...

CVE-2012-6082

CVE-2012-6082 concerns MoinMoin prior to 1.9.6. The vulnerability is an XSS in the rsslink function (theme/init .py) where the page name parameter is not properly sanitized, allowing remote attackers to inject arbitrary HTML/JavaScript. Public references describe affected versions as 1.9.5 and ea...

CVE-2012-5655

The CVE-2012-5655 vulnerability affects the Drupal Context module (6.x-3.x prior to 6.x-3.1 and 7.x-3.x prior to 7.x-3.0-beta6). The issue, as described in the initial document, is that access to block content is not properly restricted, enabling remote attackers to obtain sensitive information v...

CVE-2012-2379

CVE-2012-2379 is tied to Apache CXF in the 2.4.x/2.5.x/2.6.x lines where a Supporting Token with a child WS-SecurityPolicy 1.1/1.2 policy may fail to ensure an XML element is signed or encrypted. The F5 advisory repository lists this CVE among multiple CXF/JBoss issues, reiterating the same under...

CVE-2012-6080

Removed by vendor...

CVE-2012-6495

Removed by vendor...

CVE-2012-6082

Cross-site scripting XSS vulnerability in the rsslink function in theme/init.py in MoinMoin 1.9.5 allows remote attackers to inject arbitrary web script or HTML via the page name in a rss link...

CVE-2012-5653

CVE-2012-5653 affects Drupal 6.x up to 6.26 and Drupal 7.x up to 7.17, where the file upload feature can be abused by a remote authenticated user to bypass protections and execute arbitrary PHP code via a null byte in the file name. The connected advisories corroborate this vulnerability being fi...

CVE-2012-5651

CVE-2012-5651 affects Drupal 6.x (before 6.27) and Drupal 7.x (before 7.18). The vulnerability causes information disclosure by exposing results that include blocked users in search results, enabling remote attackers to read sensitive data via the search functionality. The issue is documented acr...

CVE-2012-4366

creationtimestamp| type| source ---|---|--- 2013-01-03 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/38164...

Mandriva Linux Security Advisory : gnupg (MDVSA-2013:001-1)

A vulnerability has been found and corrected in gnupg : Versions of GnuPG = 1.4.12 are vulnerable to memory access violations and public keyring database corruption when importing public keys that have been manipulated. An OpenPGP key can be fuzzed in such a way that gpg segfaults or has other...

CFR watering hole attack also target Capstone Turbine Corporation

Last week Council on Foreign Relations website was compromised and recently hit by a drive-by attack using a zero day Internet Explorer 6 vulnerability for Cyber Espionage attack, suspected by Chinese Hackers. Later Microsoft confirmed that Internet Explorer 6, 7, and 8 are vulnerable to remote...

CVE-2012-6463

Cross-site scripting XSS vulnerability in Opera before 12.10 allows remote attackers to inject arbitrary web script or HTML via vectors involving an unspecified sequence of loading of documents and loading of data: URLs...

CVE-2012-6462

CVE-2012-6462 refers to Opera before 12.10, where improper CORS handling allows remote attackers to bypass page-content restrictions with a crafted request. The impact is a partial confidentiality concern; no exploitation details are provided in the sources. Remediation guidance from Gentoo GLSA ...

CVE-2012-6469

CVE-2012-6469 affects the Opera browser. The primary detail in the Initial Document states Opera before 12.11 allows remote attackers to determine the existence of arbitrary local files via vectors in an error page. The connected OpenVAS entries list CVE-2012-6469 as part of a set of Opera vulner...