CVE-2012-5978

Multiple directory traversal vulnerabilities in the 1 View Connection Server and 2 View Security Server in VMware View 4.x before 4.6.2 and 5.x before 5.1.2 allow remote attackers to read arbitrary files via unspecified vectors...

CVE-2012-5691

CVE-2012-5691 is a buffer overflow in RealNetworks RealPlayer prior to 16.0.0.282 and RealPlayer SP 1.0–1.1.5 that allows remote code execution via a crafted RealMedia file. Connected advisories and exploits confirm real-world discussion and tooling around RealPlayer RealMedia file handling BOF (...

CVE-2012-5177

Cross-site scripting XSS vulnerability in the Welcart plugin before 1.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-4534

The CVE-2012-4534 issue affects Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28. When using the NIO connector with sendfile over HTTPS, the NioEndpoint can enter an infinite loop if the client terminates the connection while reading a response, causing a denial of service. The root cause is...

CVE-2012-5178

CVE-2012-5178 affects the Welcart WordPress plugin up to version 1.2.1 (pre-1.2.2). It is a CSRF vulnerability that allows an attacker to hijack a logged-in user’s authentication to complete a purchase. The issue arises in requests that finalize a purchase; no exploit details are provided in the ...

CVE-2012-3546

CVE-2012-3546 affects Apache Tomcat 6.x (before 6.0.36) and 7.x (before 7.0.30). The flaw, in RealmBase/FormAuthenticator when FORM authentication is used, lets remote attackers bypass security-constraint checks by leveraging a prior setUserPrincipal() and appending /j_security_check to the URL. ...

CVE-2012-5968

The CVE-2012-5968 issue affects Huawei E585 devices where admin session status is not validated, enabling a LAN-adjacent attacker to obtain user data and session IDs and modify data. The advisory notes remediation via vendor updates Huawei-SA-20121124-1-E585 and Huawei-SA-20121203-1-E585; exploit...

CVE-2012-5970

CVE-2012-5970 affects the Huawei E585 pocket wifi 2 device. The vulnerability is a NULL pointer dereference in the HTTP handling code triggered by crafted requests, leading to a denial of service and device outage. Public documents describe this as part of a set of vulnerabilities in the same dev...

USN-1671-1: Linux kernel vulnerability

Dmitry Monakhov reported a race condition flaw the Linux ext4 filesystem that can expose stale data. An unprivileged user could exploit this flaw to cause an information leak. CVE-2012-4508 A flaw was discovered in the Linux kernel's handling of new hot-plugged memory. An unprivileged local user...

Cross-Site Scripting (XSS) vulnerability in Quick.Cms and Quick.Cart

High-Tech Bridge Security Research Lab discovered XSS vulnerability in Quick.Cms and Quick.Cart - two products developed by OpenSolution team, which can be exploited to perform cross-site scripting attacks. 1. Cross-Site Scripting XSS vulnerability in Quick.Cms and Quick.Cart: CVE-2012-6430 The...

Unbreakable Enterprise kernel security update

2.6.39-300.17.3 - mm/hotplug: correctly add new zone to all other nodes zone lists Jiang Liu Orabug: 16020976 Bug-db: 14798 CVE-2012-5517 - Divide by zero in TCP congestion control Algorithm. Jesper Dangaard Brouer Orabug: 16020656 Bug-db: 14798 CVE-2012-4565 - Fix length of buffer copied in...

CVE-2012-4431

org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery CSRF protection mechanism via a request that lacks a session identifier...

IBM RBD Web Services Information Disclosure Vulnerability (Windows)

This host is installed with IBM Rational Business Developer and is prone information disclosure vulnerability. OpenVAS Vulnerability Test $Id: gbibmrationalbusideveloperinfodiscvulnwin.nasl 5366 2017-02-20 13:55:38Z cfi $ IBM RBD Web Services Information Disclosure Vulnerability Windows Authors:...

RHEL 6 : kernel (RHSA-2012:1580)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1580 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. This update fixes the following security issues: It wa...

KLA10384 RLF vulnerability in VMware View

A directory traversal vulnerability was found in VMware Viewer. By exploiting this vulnerability malicious users can execute arbitrary code. This vulnerability can be exploited remotely via unspecified vectors. Original advisories VMware bulletin Related products VMware-View CVE list CVE-2012-597...

SA-CORE-2012-004 - Drupal core - Multiple vulnerabilities

Multiple vulnerabilities were fixed in the supported Drupal core versions 6 and 7. Access bypass User module search - Drupal 6 and 7 A vulnerability was identified that allows blocked users to appear in user search results, even when the search results are viewed by unprivileged users. This...

Important: Red Hat Security Advisory: JBoss Enterprise Application Platform 6.0.1 update

JBoss Enterprise Application Platform 6.0.1, which fixes multiple security issues, various bugs, and adds enhancements, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring...

Moderate: Red Hat Security Advisory: libtiff security update

Updated libtiff packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity rating...

CVE-2012-4350

Symantec Enterprise Security Manager (ESM) for Windows is affected by CVE-2012-4350 due to an unquoted search path in both the Manager and Agent components, enabling local privilege escalation. Public sources (OpenVAS/Nessus entries) confirm the issue affects Windows and provide remediation: upgr...

CVE-2012-4348

The CVE-2012-4348 entry corresponds to a vulnerability in Symantec Endpoint Protection Manager/Protection Center where PHP scripts do not properly validate external input, enabling remote code execution. Affected products are SEP 11.0 before RU7-MP3, SEP 12.1 before RU2, and SEP Small Business Ed...