CVE-2012-2243

Cross-site scripting XSS vulnerability in Mahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4 allows remote attackers to inject arbitrary web script or HTML by uploading an XML file with the xhtml extension, which is rendered inline as script. NOTE: this can be leveraged with CVE-2012-2244 to execut...

CVE-2012-6037

Multiple cross-site scripting XSS vulnerabilities in Mahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4, and other versions including 1.2, allow remote attackers to inject arbitrary web script or HTML via a CSV header with "unknown fields," which are not properly handled in error messages in the 1...

CVE-2012-2247

Cross-site scripting XSS vulnerability in Mahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4 allows remote attackers to inject arbitrary web script or HTML via vectors related to artefact/file/ and a crafted SVG file...

CVE-2012-5533

The httprequestsplitvalue function in request.c in lighttpd before 1.4.32 allows remote attackers to cause a denial of service infinite loop via a request with a header containing an empty token, as demonstrated using the "Connection: TE,,Keep-Alive" header...

CVE-2012-2246

CVE-2012-2246 affects Mahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4. The issue allows remote attackers to perform clickjacking and bypass CSRF protections to delete arbitrary users via account/delete.php. The vulnerability is described in the standard CVE details and is tied to Mahara deployme...

CVE-2012-2243

CVE-2012-2243 is a cross-site scripting (XSS) vulnerability in Mahara versions 1.4.x before 1.4.5 and 1.5.x before 1.5.4, exploitable by uploading an XML file with the xhtml extension, which is rendered inline as script. The note indicates this can be leveraged with CVE-2012-2244 to execute arbit...

CVE-2012-2244

CVE-2012-2244 affects Mahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4. The issue allows remote arbitrary code execution by an authenticated admin via manipulating the path to clamav; note it can be exploited without authentication through CVE-2012-2243. Impact per the sources is remote code exec...

CVE-2012-2244

Mahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4 allows remote authenticated administrators to execute arbitrary programs by modifying the path to clamav. NOTE: this can be exploited without authentication by leveraging CVE-2012-2243...

CVE-2012-2239

CVE-2012-2239 affects Mahara 1.4.x before 1.4.4 and 1.5.x before 1.5.3, enabling a remote XXE injection that can read arbitrary files (e.g., config.php) or cause TCP connections. The root cause is an XML external entity flaw in Mahara’s handling of XML input. Public references in connected adviso...

CVE-2012-4538

Technical details about CVE-2012-4538 are not publicly provided in the connected documents. Please monitor for updates in the referenced advisories and vendor notices.

CVE-2012-3433

CVE-2012-3433 affects Xen 4.0/4.1, enabling a local HVM guest to cause a denial-of-service by manipulating the guest’s physical address space, triggering an extended p2m teardown search and blocking domain 0 VCPU during destruction, potentially panicking the domain0 kernel. Documented impact: loc...

CVE-2012-2247

CVE-2012-2247 describes a cross-site scripting (XSS) vulnerability in Mahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4. An attacker can inject arbitrary scripts/HTML via vectors related to artefact/file handling and a crafted SVG file. The underlying impact is partial integrity impact of user dat...

CVE-2012-0960

CVE-2012-0960 affects the Unity integration extension (unity-firefox-extension) for Firefox, before version 2.4.1. The root cause is improper handling of callbacks, which can allow a remote attacker to crash Firefox (DoS) and potentially execute arbitrary code via a crafted request. Public disclo...

CVE-2012-4522

CVE-2012-4522 affects Ruby 1.9.3 before patchlevel 286 and Ruby 2.0.0 before r37163, where a NUL byte in a file path enables context‑dependent attackers to create files in unintended locations or with unexpected names. The issue arises from rb_get_path_check in file.c and is confirmed by multiple...

CVE-2012-4522

The rbgetpathcheck function in file.c in Ruby 1.9.3 before patchlevel 286 and Ruby 2.0.0 before r37163 allows context-dependent attackers to create files in unexpected locations or with unexpected names via a NUL byte in a file path...

CVE-2012-0959

CVE-2012-0959 affects the Ubuntu remote-login-service (RLS) 1.0.0, where account information is not properly cleared when switching users. This could allow physically proximate users to obtain login credentials. The vulnerability is detailed in the Ubuntu security advisory USN-1624-1 and related ...

CVE-2012-3752

creationtimestamp| type| source ---|---|--- 2012-11-24 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/22905 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/applequicktimetexmlfonttable.rb 2025-02-06...

CVE-2012-6030

The dotmemop function in the Transcendent Memory TMEM in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service host crash and possibly have other unspecified impacts via unspecified vectors related to "broken locking checks" in an "error path." NOTE: this issue was...

CVE-2012-6036

The 1 memcsavegetnextpage, 2 tmemcrestoreputpage and 3 tmemcrestoreflushpage functions in the Transcendent Memory TMEM in Xen 4.0, 4.1, and 4.2 do not check for negative id pools, which allows local guest OS users to cause a denial of service memory corruption and host crash or possibly execute...

CVE-2012-6034

The 1 tmemcsavegetnextpage and 2 tmemcsavegetnextinv functions and the 3 TMEMCSAVEGETPOOLUUID sub-operation in the Transcendent Memory TMEM in Xen 4.0, 4.1, and 4.2 "do not check incoming guest output buffer pointers," which allows local guest OS users to cause a denial of service memory corrupti...