CVE-2012-5704

CVE-2012-5704 affects the Drupal Hotblocks module (6.x-1.x) prior to 6.x-1.8. The flaw allows remote authenticated users with the "administer hotblocks" permission to trigger a DoS by configuring a hotblock that references itself, causing an infinite loop/time‑out. The impact is a site denial of ...

CVE-2012-3010

Vulnerability summary (CVE-2012-3010 / related CVEs) : The GE Intelligent Platforms Proficy Real-Time Information Portal’s Remote Interface Service (rifsrvd.exe), across versions 2.6–3.5 SP1, is affected. A long input data vector in the Remote Interface Service can trigger memory corruption, lead...

CVE-2012-5409

Siemens SiPass integrated MP2.6 (and earlier) is affected by CVE-2012-5409 due to AscoServer.exe failing to properly handle IOCP RPC messages over Ethernet, enabling remote attackers to write data to memory and potentially execute arbitrary code via crafted messages (pointer dereference or buffer...

SQL Injection Vulnerability in OrangeHRM

Advisory ID: HTB23119 Product: OrangeHRM Vendor: OrangeHRM Inc. Vulnerable Versions: 2.7.1-rc.1 and probably prior Tested Version: 2.7.1-rc.1 Vendor Notification: October 10, 2012 Public Disclosure: October 31, 2012 Vulnerability Type: SQL Injection CWE-89 CVE Reference: CVE-2012-5367 CVSSv2 Base...

SuSE 10 Security Update : Mozilla Firefox (ZYPP Patch Number 8348)

MozillaFirefox was updated to the 10.0.10ESR security release. The following issues have been fixed : - Mozilla has fixed a number of issues related to the Location object in order to enhance overall security. Details for each of the current fixed issues are below. MFSA 2012-90 Thunderbird is onl...

SuSE 10 Security Update : LibreOffice (ZYPP Patch Number 8286)

LibreOffice was updated to SUSE 3.5 bugfix release 13 based on upstream 3.5.6-rc2 which fixes a lot of bugs. The following bugs have been fixed : - polygon fill rule. bnc759172 - open XML in Writer. bnc777181 - undo in text objects fdo36138 - broken numbering level. bnc760019 - better MathML...

[BUGTRAQ]Security Advisory - TP-LINK TL-WR841N LFI - [UPDATE]

=| Security Advisory - TP-LINK TL-WR841N LFI |= Issue: TL-WR841N 300Mbps Wireless N Router by "TP-LINK" Firmware Version: 3.13.9 Build 120201 Rel.54965n And Below versions Discovered Date: 24/10/2012 CVE-ID: CVE-2012-5687 Author: Matan Azugi [email protected] Product Vendor:...

Konqueror 4.7.3 - Memory Corruption

Konqueror 4.7.3 - Memory Corruption -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Nth Dimension Security Advisory NDSA20121010 Date: 10th October 2012 Author: Tim Brown URL: / Product: Konqueror 4.7.3 Vendor: KDE Risk: Medium Summary The Konqueror web browser is vulnerable to a number of memory...

Invision Power Board (IP.Board) 3.3.4 - 'Unserialize()' PHP Code Execution

?php / ---------------------------------------------------------------- Invision Power Board = 3.3.4 "unserialize" PHP Code Execution ---------------------------------------------------------------- author..............: Egidio Romano aka EgiX mail................: n0b0d13satgmaildotcom software...

CVE-2012-4939

Cross-site scripting XSS vulnerability in IPAMSummaryView.aspx in the IPAM web interface before 3.0-HotFix1 in SolarWinds Orion Network Performance Monitor might allow remote attackers to inject arbitrary web script or HTML via the "Search for an IP address" field...

CVE-2012-4939

SolarWinds Orion IPAM IPAMSummaryView.aspx is affected by a reflected XSS in the IPAM web interface prior to 3.0–HotFix1. An attacker can inject script via the "Search for an IP address" field, which could execute in a logged-in user’s browser and potentially lead to information leakage or creden...

CVE-2012-4940

The Axigen Free Mail Server is vulnerable to multiple directory traversal flaws within the View Log Files component. The root cause is the failure of the index.hsp script to properly sanitize user input, specifically the fileName parameter. Remote attackers can use .. sequences to read or delete ...

java-1_6_0-openjdk: update to 1.11.5 (important)

java 1.6.0 openjdk / icedtea was updated to 1.11.5 bnc785433 Security fixes - S6631398, CVE-2012-3216: FilePermission improved path checking - S7093490: adjust package access in rmiregistry - S7143535, CVE-2012-5068: ScriptEngine corrected permissions - S7167656, CVE-2012-5077: Multiple Seeders a...

CVE-2012-4531

Cross-site scripting XSS vulnerability in Joomla! 2.5.x before 2.5.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-2625

The PyGrub boot loader in Xen unstable before changeset 25589:60f09d1ab1fe, 4.2.x, and 4.1.x allows local para-virtualized guest users to cause a denial of service memory consumption via a large 1 bzip2 or 2 lzma compressed kernel image...

CVE-2012-4484

Cross-site scripting XSS vulnerability in the administrative interface in the Campaign Monitor module before 6.x-2.5 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: this refers to an issue in an independently developed Drupal module, and NO...

CVE-2012-2625

CVE-2012-2625 affects the PyGrub boot loader in Xen unstable before changeset 25589:60f09d1ab1fe, and in Xen 4.2.x and 4.1.x. It allows local para-virtualized guest users to cause a denial of service by triggering memory consumption when loading a kernel image that is large and compressed (either...

CVE-2012-4491

The vulnerability CVE-2012-4491 affects the Drupal module Monthly Archive by Node Type (6.x). The issue is improper permission checks defined by node_access modules, enabling remote attackers to access restricted nodes through unspecified vectors. The available references corroborate that the pro...

CVE-2012-4482

CVE-2012-4482 affects the Ubercart SecureTrading Payment Method module 6.x for Drupal. The root cause is that payment notification information is not properly verified, enabling remote attackers to complete a purchase without payment via unspecified vectors. The connected sources (including NVD a...

CVE-2012-4499

The contact formatter page in the Email Field module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers to email the stored address in the entity via unspecified vectors...