CVE-2012-5538

The CVE-2012-5538 issue is a cross-site scripting (XSS) vulnerability in the Drupal FileField Sources module (versions 6.x-1.x prior to 6.x-1.6 and 7.x-1.x prior to 7.x-1.6). When the field uses the “Reference existing” source, remote authenticated users can inject arbitrary web script or HTML vi...

CVE-2012-5556

The CVE-2012-5556 issue affects the Drupal RESTful Web Services (RESTWS) module for Drupal 7.x, specifically RESTWS 7.x-1.x before 7.x-1.1 and 7.x-2.x before 7.x-2.0-alpha3. Root cause: POST requests were not sufficiently verified, enabling CSRF. Impact: remote attackers could hijack the authenti...

CVE-2012-5569

Multiple cross-site scripting XSS vulnerabilities in the Basic webmail module 6.x-1.x before 6.x-1.2 for Drupal allow remote attackers to inject arbitrary web script or HTML via a 1 page title or 2 crafted email message...

CVE-2012-5556

Multiple cross-site request forgery CSRF vulnerabilities in the RESTful Web Services RESTWS module 7.x-1.x before 7.x-1.1 and 7.x-2.x before 7.x-2.0-alpha3 for Drupal allow remote attackers to hijack the authentication of arbitrary users via unknown vectors...

CVE-2012-5534

The hookprocess function in the plugin API for WeeChat 0.3.0 through 0.3.9.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a command from a plugin, related to "shell expansion."...

CVE-2012-5557

The User Read-Only module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.4 for Drupal, does not properly assign roles when there are more than three roles on the site and certain unspecified configurations, which might allow remote authenticated users to gain privileges by performing certain...

CVE-2012-5858

CVE-2012-5858 affects Samsung Kies Air (versions 2.1.207051 and 2.1.210161). The vulnerability stems from IP-based authentication, enabling remote attackers to spoof the IP and perform MITM to read phone contents. Public details in connected sources confirm an authorization bypass/DoS scenario ti...

CVE-2012-5367

OrangeHRM 2.7.1 RC 1 contains SQL injection in the /symfony/web/index.php/admin/ endpoints (viewCustomers, viewPayGrades, viewSystemUsers) triggered by the sortField parameter. The vulnerability is exploitable via CSRF and can allow an attacker to alter database queries; HTB’s advisory notes that...

CVE-2012-5548

Cross-site scripting XSS vulnerability in the Time Spent module 6.x and 7.x for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-1598

CVE-2012-1598 affects Joomla! 1.5.x before 1.5.26, with an unspecified impact related to insufficient randomness and a password reset vulnerability. Connected sources confirm the existence of these issues but do not provide concrete exploit details or remediation in the available documents. No ex...

CVE-2012-5540

Multiple cross-site scripting XSS vulnerabilities in the Hostip module 6.x-2.x before 6.x-2.2 and 7.x-2.x before 7.x-2.2 for Drupal allow remote attackers with control of hostip.info to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-5538

Cross-site scripting XSS vulnerability in the FileField Sources module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.6 for Drupal, when the field has "Reference existing" source enabled, allows remote authenticated users to inject arbitrary web script or HTML via the filename of an uploaded fil...

CVE-2012-5547

CVE-2012-5547 concerns the Drupal contributed Search API module (7.x-1.x) vulnerable to Cross-Site Request Forgery (CSRF) before version 7.x-1.3. The flaw allows remote attackers to hijack administrator sessions to perform actions such as enabling a server via a server action or enabling a search...

CVE-2012-5548

CVE-2012-5548 is a Drupal Time Spent module (6.x/7.x) XSS vulnerability caused by insufficient input sanitization. Reports in the Drup al security advisory note multiple vulnerabilities (XSS, CSRF, SQL injection) across all Time Spent module versions, with Drupal core unaffected. Remediation per ...

CVE-2012-0218

The CVE-2012-0218 vulnerability affects Xen 3.4, 4.0, and 4.1 where a guest OS that has not registered a handler for a syscall/sysenter can fail to clear the exception-injection flag when a General Protection Fault is injected, allowing a local PV guest to crash the guest via a later exception. I...

CVE-2012-5569

CVE-2012-5569 affects the Drupal Basic webmail module (6.x-1.x prior to 6.x-1.2). The root cause is several XSS flaws that allow remote attackers to inject arbitrary script/HTML via the page title or crafted email messages. Impact is limited to sites using this contributed module; successful expl...

CVE-2012-6065

The CVE-2012-6065 vulnerability affects the Drupal OM Maximenu module (6.x-1.43 and earlier). When the “Title has PHP” option is enabled, remote authenticated users with the "Administer OM Maximenu" permission can trigger execution of arbitrary PHP code via a Link Title. This is a distinct issue ...

CVE-2012-6064

CMS Made Simple (CMSMS) versions prior to 1.11.2.1 are affected by CVE-2012-6064 due to a directory traversal vulnerability in lib/filemanager/imagemanager/images.php. The flaw allows remote authenticated administrators to delete arbitrary files via a deld parameter, and can be leveraged with CSR...

CVE-2012-3432

CVE-2012-3432 affects Xen’s MMIO emulation for HVM guests in Xen 3.3 and 4.x. The issue in handle_mmio is a failure to reset certain state between emulation cycles, enabling a local guest OS user to cause a denial of service (guest crash). The provided documents do not specify a concrete patch/ve...

Multiple MySQL database Zero-day vulnerabilities published

Researcher discovered Multiple Zero-day vulnerabilities in MySQL database software including Stack based buffer overrun, Heap Based Overrun, Privilege Elevation, Denial of Service and Remote Preauth User Enumeration. Common Vulnerabilities and Exposures CVE assigned as : CVE-2012-5611 — MySQL Lin...