CVE-2013-0229

The ProcessSSDPRequest function in minissdp.c in the SSDP handler in MiniUPnP MiniUPnPd before 1.4 allows remote attackers to cause a denial of service service crash via a crafted request that triggers a buffer over-read...

Stack overflow

Stack-based buffer overflow in Sysax Multi Server before 5.52, when HTTP is enabled, allows remote authenticated users with the create folder permission to execute arbitrary code via a crafted request...

CVE-2012-6530

Stack-based buffer overflow in Sysax Multi Server before 5.52, when HTTP is enabled, allows remote authenticated users with the create folder permission to execute arbitrary code via a crafted request...

Devise Database Type Conversion Crafted Request Parsing Security Bypass

Devise contains a flaw that is triggered during when a type conversion error occurs during the parsing of a malformed request. With a specially crafted request, a remote attacker can bypass security restrictions...

Design/Logic Flaw

Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NU...

Novell File Reporter FSFUI Arbitrary File Retrieval (CVE-2012-4958)

A file retrieval vulnerability has been reported in Novell File Reporter. The vulnerability is due to lack of authorization on certain requests, resulting in the retrieval of the contents of a file. A remote attacker can exploit this issue by sending a specially crafted request to the affected...

rubygem-actionpack: Unsafe query generation (a different flaw than CVE-2012-2660)

actionpack/lib/actiondispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended...

CVE-2012-6496

SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use...

Sql injection

SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use...

Cross site request forgery (csrf)

The Context module 6.x-3.x before 6.x-3.1 and 7.x-3.x before 7.x-3.0-beta6 for Drupal does not properly restrict access to block content, which allows remote attackers to obtain sensitive information via a crafted request...

Cross site scripting

Opera before 12.10 does not properly implement the Cross-Origin Resource Sharing CORS specification, which allows remote attackers to bypass intended page-content restrictions via a crafted request...

Novell File Reporter SRS Arbitrary File Retrieval (CVE-2012-4957)

A file retrieval vulnerability has been reported in Novell File Reporter. The vulnerability is due to lack of authorization on certain requests. A remote attacker can exploit this issue by sending a specially crafted request to the affected service. Successful exploitation could result in arbitra...

CVE-2012-5973

CA XCOM Data Transport r11.0 and r11.5 on UNIX and Linux allows remote attackers to execute arbitrary commands via a crafted request...

Cross site request forgery (csrf)

CA XCOM Data Transport r11.0 and r11.5 on UNIX and Linux allows remote attackers to execute arbitrary commands via a crafted request...

CVE-2012-5973

CA XCOM Data Transport r11.0 and r11.5 on UNIX and Linux allows remote attackers to execute arbitrary commands via a crafted request...

Novell File Reporter FSFUI File Upload (CVE-2012-4959)

A file upload vulnerability has been reported in Novell File Reporter. The vulnerability is due to lack of authorization on certain requests. A remote attacker can exploit this issue by sending a specially crafted request to the target. Successful exploitation could result in arbitrary files bein...

CVE-2012-5859

Samsung Kies Air 2.1.207051 and 2.1.210161 allows remote attackers to cause a denial of service crash via a crafted request to www/apps/KiesAir/jws/ssd.php...

Websense Proxy - Filter Bypass

Websense Proxy - Filter Bypass Websense Proxy Filter Bypass 1. Advisory Information Date published: 2012-11-25 Vendors contacted: Websense Release mode: Coordinated release Vendor was notified 2. Vulnerability Information Class: Filter Bypass Remotely Exploitable: Yes 3. Software Description...

CVE-2012-0960

Unity integration extension unity-firefox-extension before 2.4.1 for Firefox does not properly handle callbacks, which allows remote attackers to cause a denial of service Firefox crash and possibly execute arbitrary code via a crafted request...

Cross site request forgery (csrf)

Unity integration extension unity-firefox-extension before 2.4.1 for Firefox does not properly handle callbacks, which allows remote attackers to cause a denial of service Firefox crash and possibly execute arbitrary code via a crafted request...