CVE-2012-3174

CVE-2012-3174 refers to an unspecified Oracle Java 7 vulnerability; connected sources indicate two improper permission checks in the reflection API that could bypass sandbox restrictions and enable remote code execution in Java 7 before updates. Publicly discussed correlations link CVE-2012-3174 ...

CVE-2013-0156

CVE-2013-0156 is a vulnerability in Ruby on Rails where active_support/core_ext/hash/conversions.rb fails to restrict casts of string values, enabling object-injection that can lead to remote code execution or a DoS via nested XML entities. Affected are Rails before 2.3.15, 3.0.x before 3.0.19, 3...

CVE-2013-0422

CVE-2013-0422 affects Oracle Java 7 before Update 11, combining two issues: (1) JMX/MBean path via getMBeanInstantiator and findClass enabling private MBeanInstantiator reference retrieval, and (2) recursive use of Reflection API bypassing java.lang.invoke.MethodHandles.Lookup.checkSecurityManage...

CVE-2013-0631

CVE-2013-0631 concerns an information-disclosure vulnerability in Adobe ColdFusion 9.0, 9.0.1, and 9.0.2. The published data indicate that an attacker could obtain sensitive information via unspecified vectors, with exploitation reported in the wild in January 2013. The CVSS data from NVD shows a...

CVE-2013-0625

Adobe ColdFusion 9.0, 9.0.1, and 9.0.2 are affected by CVE-2013-0625, where an unauthenticated bypass is possible if a password is not configured, potentially enabling remote code execution via unspecified vectors; exploited in the wild in January 2013. (CVSS v2 base 6.8; CVSS v3.1 base 9.8). No ...

CVE-2013-0629

CVE-2013-0629 is an Adobe ColdFusion directory traversal vulnerability affecting ColdFusion 9.0, 9.0.1, 9.0.2, and 10 when a password is not configured. It allows an attacker to access restricted directories via unspecified vectors and was exploited in the wild in January 2013. Connected sources ...

CVE-2012-6081

CVE-2012-6081 affects MoinMoin before 1.9.6, with multiple unrestricted file upload vulnerabilities in the twikidraw and anywikidraw actions. Remote authenticated users with write permissions can upload a file with an executable extension and access it to execute arbitrary code; this is corrobora...

CVE-2012-4792

CVE-2012-4792 is a use-after-free vulnerability in Microsoft Internet Explorer 6–8 that allows remote code execution when a crafted website triggers access to an object (not properly allocated or deleted), exemplified by a CDwnBindInfo object. The issue has been exploited in the wild (Dec 2012). ...

CVE-2012-5469

The CVE-2012-5469 case concerns the WordPress Portable phpMyAdmin Plugin (wp-pma-mod). The vulnerability arises because the plugin does not verify an existing WordPress session before accessing the wp-pma-mod path, which allows an unauthenticated remote attacker to gain access to a full phpMyAdmi...

CVE-2012-2539

CVE-2012-2539 is Microsoft Word remote code execution vulnerability caused by parsing crafted RTF data (Word RTF 'listoverridecount'). It affects Word 2003 SP3, 2007 SP2/SP3, 2010 SP1; Word Viewer; Office Compatibility Pack SP2/SP3; and Office Web Apps 2010 SP1. The underlying issue is memory cor...

CVE-2011-4085

The CVE-2011-4085 description specifies an authentication bypass vulnerability in JBoss platforms where the servlets invoked by httpha-invoker (in JBoss EAP before 5.1.2, SOA Platform before 5.2.0, BRMS Platform before 5.3.0, and Portal Platform before 4.3 CP07) enforce access control only for GE...

CVE-2012-4940

CVE-2012-4940 describes directory traversal vulnerabilities in Axigen Mail Server’s View Log Files component, allowing unauthenticated (per CERT entry) or authenticated users to read or delete arbitrary files via dot-dot sequences in the fileName parameter (download, edit, or delete actions) to t...

CVE-2012-3175

Technical details for CVE-2012-3175 are not publicly provided in the connected documents. The available sources mention Oracle SSO 10.1.4.3.0 and redirects generally, but no concrete exploit, affected components/versions, root cause, or fixes are described here. Monitor for updates.

CVE-2012-0518

Oracle Fusion Middleware – Oracle Application Server Single Sign-On (SASO) 10.1.4.3.0 is listed as vulnerable in CVE-2012-0518, with the issue related to Redirects and affecting integrity. A connected PT-2012-4537 entry confirms the affected version (10.1.4.3.0) and notes there is no information ...

CVE-2012-3152

CVE-2012-3152/3153 affect Oracle Fusion Middleware’s Oracle Reports Developer component (11.1.1.4, 11.1.1.6, 11.1.2.0). An unspecified vulnerability in the Report Server/Servlet can allow remote attackers to affect confidentiality and integrity; one note indicates possible file read/upload of a ....

CVE-2012-3153

CVE-2012-3153 affects Oracle Fusion Middleware’s Oracle Reports Developer (11.1.1.4/11.1.1.6/11.1.2.0). It involves an unspecified vulnerability in the Reports Servlet that can compromise confidentiality and integrity via unknown vectors related to the Report Server component; the vulnerability m...

CVE-2012-5076

CVE-2012-5076 is described in IBM’s JRE/JRules bulletin as an issue in IBM JRE 7.0 SR2 or earlier (shipped with Rational Functional Tester) and in non-IBM Java 7.0. The IBM document lists the vulnerability as affecting a number of internal com.sun packages which should be restricted. Remediation ...

CVE-2012-5054

CVE-2012-5054 specifies an integer overflow in the Matrix3D.copyRawDataTo method of Adobe Flash Player, enabling remote code execution via malformed arguments. Affected component: Flash Player (Matrix3D class). Root cause: integer overflow in copyRawDataTo. Impact: arbitrary code execution with n...

CVE-2012-4969

The CVE-2012-4969 issue is a use-after-free in the CMshtmlEd::Exec function of mshtml.dll used by Microsoft Internet Explorer (IE6–IE9 according to the CVE payload). Exploitation enabled remote code execution via a crafted website; the vulnerability was observed in the wild around September 2012....

CVE-2012-4867

CVE-2012-4867 affects vtiger CRM 5.1.0: directory traversal via .. in the module_name parameter of sortfieldsjson.php allows reading arbitrary files (Local File Include). Root cause: unsanitized user input. Several connected sources (Red Hat, NVD, CIRCL, OpenVAS, etc.) consistently describe a VTi...