20292 matches found
CVE-2012-10033
Narcissus (backend.php) Image Configuration Command Injection is CVE-2012-10033. The flaw: release parameter is not sanitized before passing to configure_image(), which invokes PHP passthru() with the unsanitized input. This enables remote code execution via a crafted POST request under the web s...
CVE-2012-10029
Nagios XI Network Monitor prior to Graph Explorer component version 1.3 contains a command injection vulnerability in visApi.php. An authenticated user can inject system commands via unsanitized parameters such as host, resulting in remote code execution...
CVE-2012-10032 Maxthon3 about:history XCS Trusted Zone Code Execution
Maxthon3 version 3.2.2 build 1000 and prior are vulnerable to cross context scripting XCS via the about:history page. The browser’s trusted zone improperly handles injected script content, allowing attackers to execute arbitrary JavaScript in a privileged context. This flaw enables modification o...
CVE-2012-10031 BlazeVideo HDTV Player Pro 6.6.0.3 Filename Handling Buffer Overflow
BlazeVideo HDTV Player Pro v6.6.0.3 is vulnerable to a stack-based buffer overflow due to improper handling of user-supplied input embedded in .plf playlist files. When parsing a crafted .plf file, the MediaPlayerCtrl.dll component invokes PathFindFileNameA to extract a filename from a URL-like...
CVE-2012-10022
Kloxo versions 6.1.12 and earlier contain two setuid root binaries—lxsuexec and lxrestart—that allow local privilege escalation from uid 48. The lxsuexec binary performs a uid check and permits execution of arbitrary commands as root if the invoking user matches uid 48. This flaw enables attacker...
CVE-2012-10020 FoxyPress <= 0.4.2.1 - Arbitrary File Upload
The FoxyPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadify.php file in versions up to, and including, 0.4.2.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may...
WordPress FoxyPress plugin <= 0.4.2.1 - Arbitrary File Upload vulnerability
Arbitrary File Upload vulnerability discovered by WordFence in WordPress Plugin Foxypress versions 0.4.2.2...
CVE-2012-10019
The Front End Editor plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the upload.php file in versions before 2.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote...
Ubuntu: Security Advisory (USN-7622-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2012-6428
creationtimestamp| type| source ---|---|--- 2025-07-01 20:09:37+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/20077...
CVE-2012-6427
creationtimestamp| type| source ---|---|--- 2025-07-01 20:09:35+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/20076...
CVE-2012-6439
creationtimestamp| type| source ---|---|--- 2025-06-30 22:06:41+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/19987...
CVE-2012-6436
creationtimestamp| type| source ---|---|--- 2025-06-30 22:06:36+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/19982...
VulnCheck KEV: CVE-2012-3153
Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Servlet. NOTE: the previous information is from the October 2012 CPU...
ABB M2M Gateway Information Disclosure in embedded OpenSSL (CVE-2012-4929)
The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, Qt, and other products, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differenc...
CVE-2012-3034
WebNavigator in Siemens WinCC 7.0 SP3 and earlier, as used in SIMATIC PCS7 and other products, allows remote attackers to discover a username and password via crafted parameters to unspecified methods in ActiveX controls...
CVE-2012-3276
HP OpenVMS 8.3, 8.3-1H1, and 8.4 on the Itanium platform and 7.3-2, 8.2, 8.3, and 8.4 on the Alpha platform does not properly implement the LOGIN and ACMESERVER ACMELOGIN programs, which allows local users to cause a denial of service via unspecified vectors...
CVE-2012-3694
WebKit in Apple Safari before 6.0 does not properly handle drag-and-drop events, which allows user-assisted remote attackers to obtain sensitive information about full pathnames via a crafted web site...
CVE-2012-3560
Opera before 11.65 does not ensure that the address field corresponds to the displayed web page during blocked navigation, which makes it easier for remote attackers to conduct spoofing attacks by detecting and preventing attempts to load a different web page...