CVE-2012-5917

CVE-2012-5917 affects SnackAmp 3.1.3. A remote attacker can crash the application by supplying a long string inside an AIFF file, causing a denial of service. The available documents describe the vulnerability as a remote DoS via excessive input in AIFF parsing but do not provide exploit code, af...

CVE-2012-5905

KnFTPd 1.0.0 is affected by a buffer overflow in the FEAT command handling, enabling remote authenticated users to crash the server (DoS) by sending a long FEAT string. The issue (CVE-2012-5905) is confirmed in the connected records with affected component and root cause; however, no remediation/...

CVE-2012-5893

The CVE-2012-5893 entry concerns Havalite CMS (versions up to 1.1.0). A vulnerability in hava_upload.php allows unrestricted file upload, where an attacker can upload a file with a .php;.gif extension and then access it directly under tmp/files/ to execute arbitrary code on the server. This const...

CVE-2012-5891

DAlbum 1.44 build 174 and earlier is affected by multiple CSRF vulnerabilities in photo/pass.php that allow remote attackers to hijack administrator authentication for actions (1) add a user, (2) change user passwords, or (3) delete a user. The vulnerability is in CSRF protection for these admin ...

CVE-2012-5890

The CVE-2012-5890 entry concerns the Front End User Registration (sr_feuser_register) extension for TYPO3, affected up to version 2.6.1. The root cause is a vulnerability in the extension that allows remote attackers to obtain user names and passwords through the edit perspective or autologin fea...

CVE-2012-5895

Technical details about CVE-2012-5895 are not publicly available in the provided documents. Monitor for updates.

CVE-2012-5897

The 1 SimpleTree and 2 ReportTree classes in the ARDoc ActiveX control ARDoc.dll in Quest InTrust 10.4.0.853 and earlier do not properly implement the SaveToFile method, which allows remote attackers to write or overwrite arbitrary files via the bstrFileName argument...

CVE-2012-5915

CVE-2012-5915 affects Neocrome Seditio builds 161 and earlier. The vulnerability is an information-disclosure flaw where remote attackers can cause an error message to reveal the installation path by directly requesting any of the following: view.php, plugins/contact/lang/contact.en.lang.php, sys...

CVE-2012-5916

CVE-2012-5916 concerns Neocrome Seditio build 161, where a remote attacker can disclose sensitive information by directly requesting one of three SQL files: docs/new/seditio-createnew-160.sql, docs/upgrade/sedito_convert_to_utf8.optional.sql, or system/install/install.parser.sql. The accompanying...

CVE-2012-5895

Multiple unspecified vulnerabilities in iRODS before 3.1 have unknown impact and attack vectors...

CVE-2012-5885

The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce aka client nonce values instead of nonce aka server nonce and nc aka nonce-count values, which makes it easi...

CVE-2012-5886

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass authentication via vectors related to...

CVE-2012-5887

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended...

CVE-2012-5856

Cross-site scripting XSS vulnerability in the Uk Cookie aka uk-cookie plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-3439

...

CVE-2012-3439

CVE-2012-3439 is rejected/not used; refer to CVE-2012-5885/5886/5887.

CVE-2012-5856

The CVE-2012-5856 entry concerns the WordPress uk-cookie plugin (uk-cookie) and is a Cross‑Site Scripting (XSS) vulnerability. The vulnerability is described as a reflective XSS issue that allows remote attackers to inject arbitrary script/HTML via unspecified vectors in the plugin. Several conne...

CVE-2012-5886

CVE-2012-5886 (Apache Tomcat) is an authentication bypass issue in the Digest Access Authentication implementation. It occurs because the HTTP Digest Auth stores information about the authenticated user in the session state, enabling remote attackers to bypass authentication by exploiting session...

CVE-2012-5885

Affected software: Apache Tomcat (5.5.x up to 5.5.36, 6.x up to 6.0.36, 7.x up to 7.0.30) using the HTTP Digest Access Authentication replay-countermeasure. Root cause: replay-countermeasure tracks cnonce values instead of server nonce and nonce-count, enabling bypass of access restrictions when ...

CVE-2012-5887

The CVE-2012-5887 entry concerns the HTTP Digest Access Authentication in Apache Tomcat (versions 5.5.x before 5.5.36, 6.x before 6.0.36, 7.x before 7.0.30). The vulnerability is a failure to properly check stale nonce values when enforcing credentials, enabling remote attackers to bypass access ...