Adobe Flash Player Out of Bound Memory Corruption (APSB12-22; CVE-2012-5269)

A remote code execution vulnerability has been reported in Adobe Flash Player...

Adobe Flash Player Plugin Use-After-Free Code Execution (APSB12-22; CVE-2012-5272)

A remote code execution vulnerability has been reported in Adobe Flash Player plugin for Internet Explorer...

Squid Proxy Cache cachemgr.cgi Resource Exhaustion (CVE-2012-5643)

A resource exhaustion vulnerability has been reported in Squid Proxy Cache Manager. The vulnerability is due to missing input validation in the cachemgr.cgi tool. A remote, unauthenticated attacker can send specially crafted POST requests to cause cachemgr.cgi to use large amounts of memory...

Adobe Flash Player PCM File Integer Overflow (APSB12-27; CVE-2012-5677)

A remote code execution vulnerability has been reported in Adobe Flash Player and AIR...

Adobe Flash Player JPEG Parsing Buffer Overflow (APSB22-12; CVE-2012-5267)

A remote code execution vulnerability has been reported in Adobe Flash Player...

CA ARCserve Backup Authentication Service Invalid Call Remote Code Execution (CVE-2012-2971)

An input validation vulnerability has been reported in the CA ARCserve Backup authentication service...

Adobe Flash Player and AIR SWF File Buffer Overflow (APSB12-27; CVE-2012-5676)

A remote code execution vulnerability has been reported in Adobe Flash Player and AIR...

CVE-2012-6081

Multiple unrestricted file upload vulnerabilities in the 1 twikidraw action/twikidraw.py and 2 anywikidraw action/anywikidraw.py actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to execute arbitrary code by uploading a file with an executable extension, the...

DEBIAN-CVE-2012-4528

The modsecurity2 module before 2.7.0 for the Apache HTTP Server allows remote attackers to bypass rules, and deliver arbitrary POST data to a PHP application, via a multipart request in which an invalid part precedes the crafted data...

CVE-2012-3871

Cross-site scripting XSS vulnerability in data/hybrid/ihybrid.php in Open Constructor 3.12.0 allows remote authenticated users to inject arbitrary web script or HTML via the header parameter...

CVE-2012-5445

The kernel in Cisco Native Unix CNU on Cisco Unified IP Phone 7900 series devices aka TNP phones with software before 9.3.1-ES10 does not properly validate unspecified system calls, which allows attackers to execute arbitrary code or cause a denial of service memory overwrite via a crafted binary...

UBUNTU-CVE-2012-4528

The modsecurity2 module before 2.7.0 for the Apache HTTP Server allows remote attackers to bypass rules, and deliver arbitrary POST data to a PHP application, via a multipart request in which an invalid part precedes the crafted data...

CVE-2012-6369

CVE-2012-6369 affects AgileBits 1Password 3.9.9, involving a Cross-site Scripting (XSS) vulnerability in the Troubleshooting Reporting System. The issue arises because a crafted User-Agent HTTP header is not properly handled in the View Troubleshooting Report action, allowing remote attackers to ...

CVE-2012-4528

CVE-2012-4528 applies to the mod_security2 module for Apache HTTP Server, before version 2.7.0. The issue arises in multipart request handling where an invalid part precedes crafted data, allowing remote attackers to bypass rules and deliver arbitrary POST data to a PHP application. Impact is a r...

CVE-2012-3870

OpenConstructor CMS 3.12.0 contains Stored XSS in objects/createobject.php. The vulnerable code assigns user-supplied POST values name and description to an object without HTML escaping, enabling an authenticated user to inject arbitrary script that can run in other users’ browsers. Affected prod...

CVE-2012-6369

Cross-site scripting XSS vulnerability in the Troubleshooting Reporting System feature in AgileBits 1Password 3.9.9 might allow remote attackers to inject arbitrary web script or HTML via a crafted User-Agent HTTP header that is not properly handled in a View Troubleshooting Report action...

CVE-2012-4932

CVE-2012-4932 corresponds to multiple Cross-Site Scripting (XSS) vulnerabilities in SimpleInvoices prior to stable-2012-1-CIS3000. Provided connected sources confirm numerous injectable fields (e.g., managing/index parameters; Email, Customer Name, Address fields; PayPal and other fields; Invoice...

CVE-2012-3871

CVE-2012-3871 describes a stored XSS vulnerability in Open Constructor 3.12.0, exposed through the header parameter in data/hybrid/i_hybrid.php when creating a catalogue document. Exploitation requires an authenticated user, who can inject arbitrary scripting/HTML that may execute in other users’...

CVE-2012-3873

OpenConstructor CMS 3.12.0 is vulnerable to multiple SQL injections via the id parameter in several edit pages (gallery, guestbook, file, htmltext, publication, event). Root cause: code calls get_record($_GET['id']) without input validation; authenticated attackers can execute arbitrary SQL queri...

CVE-2012-5445

CVE-2012-5445 affects Cisco Unified IP Phone 7900 series (Cisco Native Unix kernel) prior to 9.3.1-ES10. The vulnerability arises from improper validation of unspecified kernel system calls in the TNP phones, enabling either arbitrary code execution or a memory overwrite-based denial of service w...