13133 matches found
Code injection
Cool Aid module before 6.x-1.9 for Drupal does not enforce access restrictions, which allows remote authenticated users with the administer coolaid permission to modify arbitrary pages via unspecified vectors...
CVE-2012-3255
Cross-site scripting XSS vulnerability in HP Business Availability Center BAC 8.07 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2012-3257
HP Business Availability Center BAC 8.07 allows remote authenticated users to hijack web sessions via unspecified vectors...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in HP Business Availability Center BAC 8.07 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...
Code injection
HP Business Availability Center BAC 8.07 allows remote authenticated users to hijack web sessions via unspecified vectors...
CVE-2012-3255
Cross-site scripting XSS vulnerability in HP Business Availability Center BAC 8.07 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2012-3256
Cross-site request forgery CSRF vulnerability in HP Business Availability Center BAC 8.07 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...
CVE-2012-1612
Cross-site scripting XSS vulnerability in the update manager in Joomla! 2.5.x before 2.5.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
Design/Logic Flaw
Joomla! 1.7.x before 1.7.5 and 2.5.x before 2.5.1 allows attackers to obtain the installation path via unspecified vectors related to "administrator."...
CVE-2012-0836
Unspecified vulnerability in Joomla! 1.7.x before 1.7.5 allows attackers to read the error log via unknown vectors...
CVE-2012-3529
The configuration module in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to obtain the encryption key via unspecified vectors...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in ownCloud before 4.0.1 allow remote attackers to inject arbitrary web script or HTML via the 1 calendar displayname to part.choosecalendar.rowfields.php or 2 part.choosecalendar.rowfields.shared.php in apps/calendar/templates/; or 3 unspecified...
CVE-2012-3531
Cross-site scripting XSS vulnerability in the Install Tool in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2012-3529
The configuration module in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to obtain the encryption key via unspecified vectors...
CVE-2012-3529
The configuration module in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to obtain the encryption key via unspecified vectors...
CVE-2012-1606
Multiple cross-site scripting XSS vulnerabilities in the Backend component in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors...
UBUNTU-CVE-2012-1606
Multiple cross-site scripting XSS vulnerabilities in the Backend component in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors...
OpenJDK: beans ClassFinder insufficient permission checks (beans, 7162476)
Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 6 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Beans, a different vulnerability than CVE-2012-3136. NOTE: Oracle has not...