CVE-2012-5134

Heap-based buffer underflow in the xmlParseAttValueComplex function in parser.c in libxml2 2.9.0 and earlier, as used in Google Chrome before 23.0.1271.91 and other products, allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted entities in an XML...

CVE-2012-5130

CVE-2012-5130 is an out-of-bounds read in Skia used by Chromium/Chrome, leading to potential DoS. OpenSUSE advisories patch Chromium to 25.0.1343 and list CVE-2012-5130 among several fixes; other connected entries corroborate theSkia-based issue and its remediation via updated Chromium components...

DSA-2578-1 rssh - several

Bulletin has no description...

SA-CONTRIB-2012-168 - Services - Information Disclosure

This module enables you to access content from a remote client. The module doesn't sufficiently adhere to standard Drupal permissions and exposes users emails via the user index method. This vulnerability is mitigated by the fact that an attacker most know the path to the user resource and must b...

SA-CONTRIB-2012-169 - Email Field - Cross Site Scripting and Access bypass

The email module provides a field type CCK / FieldAPI for storing email addresses and a formatter to output the email address as a link to a contact form. The contact form formatter allows a site visitor to email the stored address without letting them see what that e-mail address is. Access bypa...

CVE-2012-3753

creationtimestamp| type| source ---|---|--- 2012-11-28 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/22973 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/applequicktimemimetype.rb 2025-02-06...

VMware Workstation 8.x < 8.0.5 Multiple Vulnerabilities (VMSA-2012-0015)

The VMware Workstation 8.x install detected on the remote host is earlier than 8.0.5 and is, therefore, potentially affected by the following vulnerabilities : - Certain processes, when created, have weak security permissions assigned. It is possible to commandeer these process threads, which cou...

Debian DSA-2578-1 : rssh - insufficient filtering of rsync command line

James Clawson discovered that rssh, a restricted shell for OpenSSH to be used with scp, sftp, rdist and cvs, was not correctly filtering command line options. This could be used to force the execution of a remote script and thus allow arbitrary command execution. Two CVE were assigned : -...

SA-CONTRIB-2012-171 - Webmail Plus - SQL injection - (unsupported)

The Webmail plus module is a full-featured email client for Drupal. It's designed to provide email for any or all members of a Drupal site. The module doesn't sufficiently sanitize user input as it is used in a database query. CVE: CVE-2012-5590 Versions affected All Webmail Plus module versions...

CVE-2011-5371

CVE-2011-5371 entry is rejected and not active; reference CVE-2012-5371.

CVE-2012-5563

OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by creating new tokens through token chaining. NOTE: this issue exists because of a CVE-2012-3426 regression...

SA-CONTRIB-2012-170 - MultiLink - Access Bypass

MultiLink allows you to generate in-content links to a suitable node or node translation based on the visitor's language preferences. It allows the Node Title of the target node to be shown as the visible text and title attribute for the generated link. Prior to versions 6.x-2.7 and 7.x-2.7 the...

SA-CONTRIB-2012-172 - Zero Point - Cross Site Scripting (XSS)

Zero Point is an advanced theme which includes many options, ideal for a wide range of sites. The theme does not escape path aliases exposing a Cross site scripting XSS vulnerability in URLs. There are no mitigating factors. CVE: CVE-2012-5591 Versions affected zeropoint 6.x-1.x versions prior to...

SA-CONTRIB-2012-167 - Mixpanel - Cross site scripting (XSS)

This module provides integration with the Mixpanel real-time analytics service. The module doesn't sufficiently escape the Mixpanel token when adding the tracking Javascript to the page. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "access...

SuSE 10 Security Update : libotr (ZYPP Patch Number 8377)

This update fixes various heap overflows in libotr. CVE-2012-3461 has been assigned to this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid63072;...

[SECURITY] [DSA 2578-1] rssh security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2578-1 [email protected] http://www.debian.org/security/ Yves-Alexis Perez November 28, 2012 http://www.debian.org/security/faq -...

CVE-2012-4611

RSA Adaptive Authentication On-Premise (AAOP) 6.x contains cross-site scripting vulnerabilities (CVE-2012-4611) that could allow an attacker to execute scripts in the context of an authenticated user. The ESA-2012-054 advisory from RSA EMC notes a Base Score of 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P) an...

CVE-2012-4615

EMC Smarts Network Configuration Manager (NCM) prior to version 9.1 is affected by CVE-2012-4615 due to a hard-coded encryption key used to store credentials, enabling local users to obtain sensitive information via unspecified vectors. The related security advisory(ESA-2012-057) notes this and r...

CVE-2012-4614

CVE-2012-4614 affects EMC Smarts Network Configuration Manager (NCM) prior to version 9.1. The default NCM configuration allows unauthenticated access to the NCM database, enabling remote attackers to interact via the network (impact described as complete confidentiality/integrity/availability). ...

CVE-2012-6047

Cross-site request forgery CSRF vulnerability in X7 Chat 2.0.5.1 and earlier allows remote attackers to hijack the authentication of administrators for requests that add a user to an arbitrary group via the users page in an adminpanel action to index.php...