CVE-2012-2086

SQL injection vulnerability in the getlastconversationlines function in common/logger.py in Gajim before 0.15 allows remote attackers to execute arbitrary SQL commands via the jig parameter...

CVE-2012-3498

PHYSDEVOPmappirq in Xen 4.1 and 4.2 and Citrix XenServer 6.0.2 and earlier allows local HVM guest OS kernels to cause a denial of service host crash and possibly read hypervisor or guest memory via vectors related to a missing range check of map-index...

CVE-2012-6032

Multiple integer overflows in the 1 tmhcopyfromclient and 2 tmhcopytoclient functions in the Transcendent Memory TMEM in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service memory corruption and host crash via unspecified vectors. NOTE: this issue was originally publishe...

CVE-2012-3497

1 TMEMCSAVEGETCLIENTWEIGHT, 2 TMEMCSAVEGETCLIENTCAP, 3 TMEMCSAVEGETCLIENTFLAGS and 4 TMEMCSAVEEND in the Transcendent Memory TMEM in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service NULL pointer dereference or memory corruption and host crash or possibly have other...

CVE-2012-6031

The dotmemget function in the Transcendent Memory TMEM in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service CPU hang and host crash via unspecified vectors related to a spinlock being held in the "badcopy error path." NOTE: this issue was originally published as part o...

CVE-2012-6033

The dotmemcontrol function in the Transcendent Memory TMEM in Xen 4.0, 4.1, and 4.2 does not properly check privileges, which allows local guest OS users to access control stack operations via unspecified vectors. NOTE: this issue was originally published as part of CVE-2012-3497, which was too...

CVE-2012-4601

CVE-2012-4601 affects Nicola Asuni TCExam before 11.3.009. The vulnerability is an SQL injection caused by improper sanitization of input in two parameters: the POST parameter user_groups[] to admin/code/tce_edit_test.php and the POST parameter subject_id to admin/code/tce_show_all_questions.php....

CVE-2012-3515

CVE-2012-3515 affects QEMU (as used in Xen 4.0/4.1) where emulating certain devices with a virtual console backend lets local guest OS users gain privileges via a crafted escape VT100 sequence that overwrites a device model’s address space. Connected documents confirm this CVE is included in mult...

CVE-2012-5759

The IBM WebSphere DataPower XC10 Appliance 2.0.0.0 through 2.0.0.3 and 2.1.0.0 through 2.1.0.2 allows remote authenticated users to bypass intended administrative-role requirements and perform arbitrary JMX operations via unspecified vectors...

CVE-2012-5864

The CVE-2012-5864 issue affects Sinapsi eSolar family web-based management interfaces (Light, eSolar, and DUO) prior to firmware 2.0.2870_2.2.12. The root cause is improper authentication: management pages do not require login, enabling remote attackers to obtain administrative access via direct ...

CVE-2012-5758

CVE-2012-5758 affects IBM WebSphere DataPower XC10 Appliance versions 2.0.0.0–2.0.0.3 and 2.1.0.0–2.1.0.2. An unprotected interface allows an unauthorized user to stop the appliance server processes without authentication/authorization, causing a denial of service. The IBM security bulletin confi...

CVE-2012-5173

Summary: CVE-2012-5173 is a session-fixation vulnerability in BIGACE prior to version 2.7.8. A remote unauthenticated attacker can impersonate a registered user, potentially leading to information disclosure or alteration. Affected product/version(s): BIGACE 2.7.7 and earlier (as cited by JVN) an...

CVE-2012-5861

CVE-2012-5861 affects Sinapsi Sinapsi eSolar family devices (Light, DUO, eSolar) with firmware prior to 2.0.2870_xxx_2.2.12. The issue is SQL injection caused by unvalidated data in web-facing components, allowing remote attackers to access SQL tables and leak confidential information. The relate...

CVE-2012-5862

CVE-2012-5862 concerns Sinapsi/Sinapsi eSolar devices where hard-coded credentials are stored in the login.php PHP script. Multiple connected sources confirm that an attacker can log in with administrative privileges, enabling unauthorized access. The ICS-CERT advisory for Sinapsi (and related PR...

CVE-2012-5863

The CVE-2012-5863 vulnerability affects Sinapsi eSolar systems (Light, DUO, and related Sinapsi devices) with firmware prior to 2.0.2870_xx_2.2.12. It is an OS Command Injection flaw in the ping.php endpoint, where shell metacharacters in the ip dominio parameter can be used by an unauthenticated...

CVE-2012-5759

CVE-2012-5759 affects IBM WebSphere DataPower XC10 Appliance (versions 2.0.0.0–2.0.0.3 and 2.1.0.0–2.1.0.2). The issue allows remote authenticated users to bypass administrative-role requirements and perform arbitrary JMX operations via unspecified vectors. Impact is described as enabling adminis...

[SECURITY] [DSA 2576-1] trousers security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2576-1 [email protected] http://www.debian.org/security/ Yves-Alexis Perez November 23, 2012 http://www.debian.org/security/faq -...

Java JAX-WS gmbal package sandbox breach

Added: 11/23/2012 CVE: CVE-2012-5076 BID: 56054 OSVDB: 86350 Background Java API for XML Web Services JAX-WS is a technology for developing web services in Java. It is included in the Java EE 5 platform. Problem A vulnerability in JAX-WS when handling the gmbal package allows code execution outsi...

Fedora Update for libsocialweb FEDORA-2012-17746

Check for the Version of libsocialweb OpenVAS Vulnerability Test Fedora Update for libsocialweb FEDORA-2012-17746 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

Fedora Update for libsocialweb FEDORA-2012-17749

Check for the Version of libsocialweb OpenVAS Vulnerability Test Fedora Update for libsocialweb FEDORA-2012-17749 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...