Mozilla: X-Frame-Options header ignored when duplicated (MFSA 2012-51)

Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 do not properly handle duplicate values in X-Frame-Options headers, which makes it easier for remote attackers to conduct clickjacking...

CVE-2011-4293

The theme implementation in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 triggers duplicate caching of Cascading Style Sheets CSS and JavaScript content, which allows remote attackers to bypass intended access restrictions and write to an operating-system temporary directory via unspecified...

CVE-2011-4293

The theme implementation in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 triggers duplicate caching of Cascading Style Sheets CSS and JavaScript content, which allows remote attackers to bypass intended access restrictions and write to an operating-system temporary directory via unspecified...

CVE-2012-2709

CVE-2012-2709 is a duplicate of CVE-2012-2907. The connected records provide concrete details: an XSS vulnerability in the Aberdeen Drupal theme (aberdeen_breadcrumb in template.php) for Drupal 6.x-1.x, exploitable when the “Append the content title to the end of the breadcrumb” option is enabled...

CVE-2012-2699

CVE-2012-2699 is a duplicate of CVE-2012-2339. Connected documents confirm a Cross-site Scripting (XSS) vulnerability in the Drupal Glossary module (6.x-1.x) prior to 6.x-1.8, where taxonomy information is not fully sanitized. Impact is remote execution of arbitrary script via UI vectors related ...

CVE-2012-3801

CVE-2012-3801 is rejected/not used; it is a duplicate of CVE-2012-2704 and not an active vulnerability entry.

CVE-2012-2701

CVE-2012-2701 is a duplicate of CVE-2012-2341. The connected records indicate a Cross-site request forgery (CSRF) vulnerability in the Drupal Take Control module (6.x-2.x) before 6.x-2.2, allowing remote attackers to hijack the authentication of unspecified users for Ajax requests that manipulate...

CVE-2012-2639

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2011-4940. Reason: This candidate is a reservation duplicate of CVE-2011-4940. Notes: All CVE users should reference CVE-2011-4940 instead of this candidate. All references and descriptions in this candidate have been removed to...

CVE-2012-2639

CVE-2012-2639 is rejected/not used; reference CVE-2011-4940.

glibc: stack overflow in getaddrinfo()'s use of alloca()

REJECTED CVE This CVE has been rejected. This candidate is a duplicate of CVE-2013-4357. Note: All CVE users should reference CVE-2013-4357 instead of this candidate...

CVE-2011-4964

CVE-2011-4964 is a duplicate of CVE-2012-2667 and is thus not the active vulnerability entry. Connected documents show concrete details for CVE-2012-2667 related to the same software family: php-symfony-symfony. The Fedora advisories (FEDORA-2012-8911, -8966, -8985) and OpenVAS/Nessus entries rep...

CVE-2012-2951

CVE-2012-2951 is a duplicate of CVE-2007-6587. The connected data identifies the active vulnerability as CVE-2007-6587: SQL injection in plog-rss.php in Plogger 1.0 Beta 3.0, allowing remote attackers to execute arbitrary SQL via the id parameter. Affected software is Plogger (PHP photo gallery);...

CVE-2012-2342

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2010-5097. Reason: This candidate is a duplicate of CVE-2010-5097. Notes: All CVE users should reference CVE-2010-5097 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...

CVE-2012-2345

CVE-2010-5100 and the related duplicates describe: TYPO3 Install Tool contains multiple XSS vulnerabilities in 4.2.x (before 4.2.16), 4.3.x (before 4.3.9), and 4.4.x (before 4.4.5). The vulnerability is exploitable by remote authenticated users who can inject arbitrary web script or HTML via unsp...

CVE-2012-2346

CVE-2012-2346 is a duplicate of CVE-2010-5101; the connected documents confirm a directory traversal vulnerability in TYPO3 TypoScript setup across TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5. The root cause is a file inclusion functionality-related flaw that allows remo...

CVE-2012-2342

CVE-2012-2342 is rejected/not used; reference CVE-2010-5097.

CVE-2012-2347

CVE-2012-2347 is a duplicate of CVE-2010-5102 and is marked as rejected/not to be used. The connected records show the underlying issue as a directory traversal vulnerability in TYPO3’s unzip handling (mod/tools/em/class.em_unzip.php) affecting TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4...

CVE-2012-2344

CVE-2012-2344 is a duplicate of CVE-2010-5099. The TYPO3 fileDenyPattern flaw described in CVE-2010-5099 allows remote access to arbitrary PHP files via path traversal (using %00 null bytes) in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5. Affected versions should be upda...

CVE-2012-2343

CVE-2012-2343 is a duplicate of CVE-2010-5098; the actual vulnerability is TYPO3 FORM content object XSS. Affected TYPO3 versions: 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5, where remote authenticated users can inject arbitrary web script or HTML via unspecified vectors. Rem...

CVE-2012-2349

CVE-2012-2349 is a reservation duplicate of CVE-2010-5104. The connected records show the underlying issue is TYPO3’s escapeStrForLike handling in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5, which can leak information via LIKE queries when sql_mode NO_BACKSLASH_ESCAPES ...