CVE-2012-4532

Cross-site scripting XSS vulnerability in modules/modlanguages/tmpl/default.php in the Language Switcher module for Joomla! 2.5.x before 2.5.7 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to index.php. NOTE: some of these details are obtained from third party...

CVE-2012-4544

CVE-2012-4544 affects the Xen PV domain builder in Xen 4.2 and earlier. The vulnerability stems from not validating the size of the kernel or ramdisk (before or after decompression), enabling a local guest administrator to cause a denial of service by exhausting domain 0 memory with a crafted ker...

CVE-2012-5671

Exim versions 4.70 through 4.80 are vulnerable to a heap-based buffer overflow within the dkim_exim_query_dns_txt function in dkim.c. This flaw occurs when DKIM support is enabled and the acl_smtp_connect and acl_smtp_rcpt parameters are not configured with warn control = dkim_disable_verify. A r...

CVE-2012-4488

CVE-2012-4488 – Drupal Location module) affected: Location module 6.x (before 6.x-3.2) and 7.x (before 7.x-3.0-alpha1). Issue: improper access control in the location search page allows remote attackers to read node or user results. Impact: exposure of node/user data due to insufficient permissio...

CVE-2012-4531

Joomla! 2.5.x before 2.5.7 is affected by multiple XSS flaws. The vulnerabilities arise in (1) default_system.php due to improper validation of the User-Agent string before it’s sent to sysinfo.php, and (2) the Language Switcher module (modules/mod_languages/tmpl/default.php) due to improper sani...

CVE-2012-5671

Heap-based buffer overflow in the dkimeximquerydnstxt function in dkim.c in Exim 4.70 through 4.80, when DKIM support is enabled and aclsmtpconnect and aclsmtprcpt are not set to "warn control = dkimdisableverify," allows remote attackers to execute arbitrary code via an email from a malicious DN...

CVE-2012-4496

The CVE-2012-4496 entry concerns the Drupal module “Custom Publishing Options” (6.x-1.x) with a flaw prior to 6.x-1.4. The vulnerability is an XSS in the status labels parameter that can be exploited by remote authenticated users who have the “administer nodes” permission. This is a component/ent...

CVE-2012-4490

The CVE-2012-4490 issue affects the Drupal Excluded Users module (versions 6.x-1.x prior to 6.x-1.1). It enables cross-site scripting via two input fields: user name and email address. The documented impact is client-side script/HTML injection (XSS) with no server-side impact specified beyond tha...

CVE-2012-4489

CVE-2012-4489 describes an open redirect in Drupal’s Secure Login module (7.x-1.x) prior to 7.x-1.3, via the q parameter in securelogin_secure_redirect. An unauthenticated user could lure victims to phishing sites by supplying a malicious redirect URL. Supported by NVD entry and multiple vendor r...

CVE-2012-4495

CVE-2012-4495 affects the Drupal Mime Mail module (6.x-1.x before 6.x-1.1). The root cause is improper restriction of access to files outside Drupal’s publish files directory, allowing remote authenticated users to send arbitrary files as attachments. Impact is that authenticated users can attach...

CVE-2012-4494

The CVE-2012-4494 issue affects the Drupal Shibboleth authentication module (7.x-4.0). The vulnerability arises because the module does not properly verify the active status of users, allowing remote blocked users to bypass intended access restrictions by logging in. This is supported by multiple...

CVE-2012-4499

The CVE-2012-4499 issue affects the Drupal Email Field module (versions 6.x-1.x prior to 6.x-1.2 and 7.x-1.x prior to 7.x-1.1). The vulnerability arises on the contact formatter page, allowing remote attackers to email the stored address in the entity via unspecified vectors. The impact is exposu...

CVE-2012-4485

The CVE concerns the Drupal Gallery formatter module prior to 7.x-1.2, specifically the galleryformatter_field_formatter_view function in galleryformatter.tpl.php. The vulnerability arises from multiple XSS flaws that allow remote authenticated users with node/entity creation permissions to injec...

CVE-2012-4500

The CVE-2012-4500 entry concerns Drupal’s Announcements module (6.x-1.x) prior to version 6.x-1.5. The vulnerability allows remote authenticated users who have the 'access announcements' permission to bypass node access restrictions, potentially leading to additional unspecified impact. Patch/fix...

CVE-2012-4492

Multiple cross-site scripting XSS vulnerabilities in the Shorten URLs module 6.x-1.x before 6.x-1.13 and 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors to the 1 report or 2 Custom Services...

CVE-2012-4492

The CVE-2012-4492 entry affects Drupal’s Shorten URLs module (versions 6.x-1.x prior to 6.x-1.13 and 7.x-1.x prior to 7.x-1.2). It describes cross-site scripting (XSS) vulnerabilities where remote authenticated users with certain permissions can inject arbitrary web script or HTML via unspecified...

CVE-2012-4532

CVE-2012-4532 affects Joomla! 2.5.x prior to 2.5.7, where the Language Switcher module (modules/mod_languages/tmpl/default.php) is vulnerable to cross-site scripting via PATH_INFO to index.php. The issue is an XSS in the Language Switcher component, enabling remote injection of script/HTML. The p...

CVE-2012-4483

CVE-2012-4483 affects the Drupal Commons module (6.x-2.x) before 6.x-2.8. The underling root cause is that the function commons_discussion_views_default_views does not properly enforce node access restrictions, potentially allowing remote attackers to view sensitive information via the recent com...

CVE-2012-4934

TomatoCart 1.1.7, when the PayPal Express Checkout module is enabled in sandbox mode, allows remote authenticated users to bypass intended payment requirements by modifying a certain redirection URL...

CVE-2012-4610

EMC Avamar Client for VMware 6.1 stores the Avamar server root password in clear text on the proxy client. A user with network access to the proxy and Avamar server could obtain privileged access to the server. EMC issued a security advisory (40843) and hotfixes (e.g., 6.1.100-402) to address thi...