CVE-2012-6045

CVE-2012-6045 is a cross-site scripting (XSS) vulnerability in Ramui Forum, in gb/user/index.php (likely 1.0 Beta). An attacker can inject arbitrary script/HTML via the query parameter. According to the NVD entry, the CVSS2 base score is 4.3 (Medium): attack vector Network, privileges Required No...

CVE-2012-6050

CVE-2012-6050 affects MikroTik RouterOS where the winbox service (RouterOS 5.15 and earlier) is exploitable. An attacker can remotely trigger a denial of service by consuming CPU, and may read the router version, with possible additional impacts via a request to download the router’s DLLs or plug...

CVE-2012-6045

Cross-site scripting XSS vulnerability in gb/user/index.php in Ramui Forum, possibly 1.0 Beta, allows remote attackers to inject arbitrary web script or HTML via the query parameter...

CVE-2012-6046

The CVE-2012-6046 entry concerns a static code injection in admin/banners.php of PHP Enter, allowing remote attackers to inject arbitrary PHP code into horad.php via the code parameter. Connected sources confirm the same description and indicate a high-severity impact (complete confidentiality, i...

CVE-2012-6048

CVE-2012-6048 affects Guitar Pro 6.1.1 r10791, where processing a specially crafted GPX file can cause a remote denial of service (crash). The root cause is triggered by a long string in a GPX file, as described across multiple sources (NVD and Red Hat). Exploitation details are not provided in t...

CVE-2012-5134

Heap-based buffer underflow in the xmlParseAttValueComplex function in parser.c in libxml2 2.9.0 and earlier, as used in Google Chrome before 23.0.1271.91 and other products, allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted entities in an XML...

CVE-2012-5576

Multiple stack-based buffer overflows in file-xwd.c in the X Window Dump XWD plug-in in GIMP 2.8.2 allow remote attackers to cause a denial of service crash and possibly execute arbitrary code via a large 1 red, 2 green, or 3 blue color mask in an XWD file...

Fedora 18 : libssh-0.5.3-1.fc18 (2012-18610)

This is an important SECURITY and maintenance release in order to address CVE-2012-4559, CVE-2012-4560, CVE-2012-4561 and CVE-2012-4562. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to...

Fedora 18 : moodle-2.3.3-1.fc18 (2012-18598)

CVE-2012-5471 moodle: Various security issues fixed in upstream 2.3.3, 2.2.6 and 2.1.9 versions MSA-12-0057, MSA-12-0058, MSA-12-0059, MSA-12-0060, MSA-12-0061, MSA-12-0062, MSA-12-0063 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora...

Fedora 18 : kernel-3.6.7-5.fc18 (2012-18740)

Fixes CVE-2012-4461 and adds support for two rebranded BCM20702A0 bluetooth adapters. Also adds 1/2 of the fix for bug 859485. Latest upstream stable release v3.6.7. As usual, fixes across the tree. In addition to the listed bugs, this also fixes : - correct module signatures on PAE and...

Wordfence Plugin for WordPress 'email' Parameter XSS

The version of the Wordfence plugin for WordPress installed on the remote host fails to properly sanitize user-supplied input to the 'email' parameter in the lib/wordfenceClass.php script. An unauthenticated, remote attacker can exploit this issue, via a specially crafted request, to execute...

Ubuntu 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : libssh vulnerabilities (USN-1640-1)

Xi Wang and Florian Weimer discovered that libssh incorrectly handled memory. A remote attacker could use this to cause libssh to crash, resulting in a denial of service, or possibly execute arbitrary code. CVE-2012-4559, CVE-2012-4560, CVE-2012-4561, CVE-2012-4562. Note that Tenable Network...

CVE-2012-6044

M-Player 0.4 allows remote attackers to cause a denial of service crash via a crafted MP3 file...

CVE-2012-6038

The CVE-2012-6038 entry concerns razorCMS prior to 1.2.1 where admin/core/admin_func.php fails to restrict access to certain administrator directories/files. The vulnerability enables remote authenticated users to read, edit, rename, move, copy and delete files through (1) the dir parameter in fi...

CVE-2012-6039

CVE-2012-6039 affects the YABSoft Advanced Image Hosting (AIH) Script, likely version 2.3. The vulnerability is a SQL injection in view_comments.php exploitable via the gal parameter, enabling remote attackers to execute arbitrary SQL commands. Root cause is an input-driven SQL query without prop...

CVE-2012-6042

GPSMapEdit 1.1.73.2 is affected by a denial-of-service vulnerability triggered by a long string in a .lst file. The issue allows user-assisted remote attackers to crash the application. No explicit root-cause details beyond the long string are provided in the sources; exploitation specifics, affe...

CVE-2012-6043

CVE-2012-6043 describes a cross-site scripting (XSS) vulnerability in PHP-Fusion 7.02.04. The flaw resides in downloads.php, where the cat_id parameter can be exploited to inject arbitrary web script or HTML. Affected software/changelog details: PHP-Fusion 7.02.04; vulnerability type: XSS; vector...

CVE-2012-6041

GreenBrowser is affected by CVE-2012-6041. The vulnerability is a double-free in the iframe handling logic (triggered when the keyword search bar F6 is activated) that could allow remote code execution. Affected product: GreenBrowser prior to version 6.0.1002. Root cause: improper memory manageme...

CVE-2012-6040

CVE-2012-6040 corresponds to a cross-site scripting (XSS) flaw in the File King Advanced File Management 1.4 package. The vulnerability affects the users.php component and allows remote attackers to inject arbitrary web script or HTML by manipulating the page parameter. The primary sources descri...

CVE-2012-6044

CVE-2012-6044 affects M-Player 0.4 . A crafted MP3 file can be used by a remote attacker to cause a denial of service (crash). The entry indicates a network-exposed vulnerability with partial availability impact, and no authentication required. The provided connected documents confirm the descrip...