CVE-2013-0080: Undefined Security Weakness

Microsoft SharePoint Server 2010 SP1 and SharePoint Foundation 2010 SP1 allow remote attackers to bypass intended read restrictions for content, and hijack user accounts, via a crafted URL, aka "Callback Function Vulnerability."...

CVE-2012-4550: Improper Handling of Insufficient Permissions or Privileges

A flaw was found in JBoss Enterprise Application Platform. When role-based authorization is used for Enterprise Java Beans EJB access, the system does not correctly call the necessary authorization modules. This prevents Java Authorization Contract for Containers JACC permissions from being...

CVE-2012-5622: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the management console openshift-console/app/controllers/applicationcontroller.rb in OpenShift 0.0.5 allows remote attackers to hijack the authentication of arbitrary users via unspecified vectors...

CVE-2012-4608: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the web interface in EMC RSA NetWitness Informer before 2.0.5.6 allows remote attackers to hijack the authentication of arbitrary users...

CVE-2012-2437: Improper Authentication

cookiegen.php in ar web content manager AWCM 2.2 does not require authentication, which allows remote attackers to generate arbitrary cookies via the name parameter in conjunction with the content parameter...

CVE-2012-5459: Undefined Security Weakness

Untrusted search path vulnerability in VMware Workstation 8.x before 8.0.5 and VMware Player 4.x before 4.0.5 on Windows allows host OS users to gain host OS privileges via a Trojan horse DLL in a "system folder."...

CVE-2011-5213: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in BrowserCRM 5.100.01 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 loginusername parameter to index.php, 2 parentid parameter to modules/Documents/versionlist.php, or 3 contactid parameter to modules/Documents/index.php...

CVE-2012-3716: Improper Restriction of Operations within the Bounds of a Memory Buffer

CoreText in Apple Mac OS X 10.7.x before 10.7.5 allows remote attackers to execute arbitrary code or cause a denial of service out-of-bounds write or read via a crafted text glyph...

CVE-2012-1921: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in goform/admin/formWlEncrypt in Sitecom WLM-2501 allows remote attackers to hijack the authentication of administrators for requests that change the router passphrase via the pskValue parameter...

CVE-2010-3497: Undefined Security Weakness

Symantec Norton AntiVirus 2011 does not properly interact with the processing of hcp:// URLs by the Microsoft Help and Support Center, which makes it easier for remote attackers to execute arbitrary code via malware that is correctly detected by this product, but with a detection approach that...

CVE-2012-2206: Undefined Security Weakness

The Web Gateway component in IBM WebSphere MQ File Transfer Edition 7.0.4 and earlier allows remote authenticated users to read files of arbitrary users via vectors involving a username in a URI, as demonstrated by a modified metadata=fteSamplesUser field to the /transfer URI...

CVE-2012-3124: Undefined Security Weakness

Unspecified vulnerability in Oracle Sun Solaris 10 allows remote attackers to affect availability, related to Kernel/KSSL...

CVE-2012-2281: Improper Authentication

EMC RSA Access Manager Server 6.x before 6.1 SP4 and RSA Access Manager Agent do not properly validate session tokens after a logout, which might allow remote attackers to conduct replay attacks via unspecified vectors...

CVE-2012-2015: Undefined Security Weakness

Unspecified vulnerability in HP System Management Homepage SMH before 7.1.1 allows remote authenticated users to gain privileges and obtain sensitive information via unknown vectors...

CVE-2012-1442: Undefined Security Weakness

The ELF file parser in Quick Heal aka Cat QuickHeal 11.00, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway formerly Webwasher 2010.1C, eSafe 7.0.17.0, Kaspersky Anti-Virus 7.0.0.125, F-Secure Anti-Virus 9.0.16160.0, Sophos Anti-Virus 4.61.0, Antiy Labs AVL SDK 2.0.3.7, Rising...

CVE-2012-1443: Undefined Security Weakness

The RAR file parser in ClamAV 0.96.4, Rising Antivirus 22.83.00.03, Quick Heal aka Cat QuickHeal 11.00, G Data AntiVirus 21, AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11, Command Antivirus 5.2.11.5, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Emsisoft Anti-Malware 5.1.0....

CVE-2012-0100: Undefined Security Weakness

Unspecified vulnerability in Oracle Solaris 9, 10, and 11 Express allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Kerberos...

CVE-2010-4495: Undefined Security Weakness

Unspecified vulnerability in the ActiveMatrix Runtime component in TIBCO ActiveMatrix Service Grid 3.0.0, 3.0.1, and 3.1.0; ActiveMatrix Service Bus 3.0.0 and 3.0.1; ActiveMatrix BusinessWorks Service Engine 5.9.0; ActiveMatrix BPM 1.0.1 and 1.0.2; Silver BPM Service 1.0.1; and Silver CAP Service...

CVE-2010-4047: Improper Neutralization of Input During Web Page Generation

Opera before 10.63 does not properly select the security context of JavaScript code associated with an error page, which allows user-assisted remote attackers to conduct cross-site scripting XSS attacks via a crafted web site...

CVE-2010-2363: Undefined Security Weakness

The IPv6 Unicast Reverse Path Forwarding RPF implementation on the SEIL/X1, SEIL/X2, and SEIL/B1 routers with firmware 1.00 through 2.73, when strict mode is used, does not properly drop packets, which might allow remote attackers to bypass intended access restrictions via a spoofed IP address...

CVE-2010-2814: Undefined Security Weakness

Unspecified vulnerability in the Transport Layer Security TLS implementation on Cisco Adaptive Security Appliances ASA 5500 series devices with software 7.2 before 7.25, 8.0 before 8.05.15, 8.1 before 8.12.44, 8.2 before 8.22.17, and 8.3 before 8.31.6 and Cisco PIX Security Appliances 500 series...

CVE-2010-1251: Improper Control of Generation of Code

Unspecified vulnerability in Microsoft Office Excel 2002 SP3 and Office 2004 for Mac allows remote attackers to execute arbitrary code via a crafted Excel file, aka "Excel Record Stack Corruption Vulnerability."...

CVE-2010-2130: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in wflogin.jsp in Aris Global ARISg 5.0 allows remote attackers to inject arbitrary web script or HTML via the errmsg parameter...

CVE-2009-4737: Improper Restriction of Operations within the Bounds of a Memory Buffer

Stack-based buffer overflow in JustSystems Corporation Ichitaro 13, 2004 through 2009, Viewer 2009 19.0.1.0 and earlier, and other versions allows context-dependent attackers to execute arbitrary code via a crafted Rich Text File RTF, related to "pvpara ffooter."...

CVE-2009-2897: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in hq/web/common/GenericError.jsp in the generic exception handler in the web interface in SpringSource Hyperic HQ 3.2.x before 3.2.6.1, 4.0.x before 4.0.3.1, 4.1.x before 4.1.2.1, and 4.2-beta1; Application Management Suite AMS 2.0.0.SR3; and tc...

CVE-2009-2743: Undefined Security Weakness

IBM WebSphere Application Server WAS 6.1 before 6.1.0.27, and 7.0 before 7.0.0.7, does not properly handle an exception occurring after use of wsadmin scripts and configuration of JAAS-J2C Authentication Data, which allows local users to obtain sensitive information by reading the First Failure...

CVE-2008-7161: Undefined Security Weakness

Fortinet FortiGuard Fortinet FortiGate-1000 3.00 build 040075,070111 allows remote attackers to bypass URL filtering via fragmented GET or POST requests that use HTTP/1.0 without the Host header. NOTE: this issue might be related to CVE-2005-3058...

CVE-2009-2914: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in XZero Community Classifieds 4.97.8 and earlier allows remote attackers to inject arbitrary web script or HTML via the name of an uploaded file. NOTE: the provenance of this information is unknown; the details are obtained solely from third...

CVE-2009-2085: Improper Authentication

The Security component in IBM WebSphere Application Server WAS 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5 does not properly handle use of Identity Assertion with CSIv2 Security, which allows remote attackers to bypass intended CSIv2 access restrictions via vectors involving Enterprise JavaBeans E...

CVE-2008-6947: Improper Authentication

Collabtive 0.4.8 allows remote attackers to bypass authentication and create new users, including administrators, via unspecified vectors associated with the added mode in a users action to admin.php...

CVE-2008-6872: Exposure of Sensitive Information to an Unauthorized Actor

ASPThai.NET ASPThai Forums 8.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for database/aspthaiForum.mdb...

CVE-2009-1900: Exposure of Sensitive Information to an Unauthorized Actor

The Configservice APIs in the Administrative Console component in IBM WebSphere Application Server WAS 6.0.2 before 6.0.2.35, 6.1 before 6.1.0.25, and 7.0 before 7.0.0.5, when tracing is enabled, allow remote attackers to obtain sensitive information via unspecified use of the wsadmin scripting...

CVE-2008-5259: Undefined Security Weakness

Integer signedness error in DivX Web Player 1.4.2.7, and possibly earlier versions, allows remote attackers to execute arbitrary code via a DivX file containing a crafted Stream Format STRF chunk, which triggers a heap-based buffer overflow...

CVE-2009-0027: Improper Input Validation

The request handler in JBossWS in JBoss Enterprise Application Platform aka JBoss EAP or JBEAP 4.2 before 4.2.0.CP06 and 4.3 before 4.3.0.CP04 does not properly validate the resource path during a request for a WSDL file with a custom web-service endpoint, which allows remote attackers to read...

CVE-2008-6221: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in config.dadamail.php in the Dada Mail Manager comdadamail component 2.6 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALSmosConfigabsolutepath parameter...

CVE-2008-6184: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the OwnBiblio comownbiblio component 1.5.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in a catalogue action to index.php...

CVE-2008-5725: Undefined Security Weakness

The NT kernel-mode driver aka pstrip.sys 5.0.1.1 and earlier in EnTech Taiwan PowerStrip 3.84 and earlier allows local users to gain privileges via certain IRP parameters in an IOCTL request to \Device\Powerstrip1 that overwrites portions of memory...

CVE-2008-5099: Exposure of Sensitive Information to an Unauthorized Actor

Sun Logical Domain Manager aka LDoms Manager or ldm 1.0 through 1.0.3 displays the value of the OpenBoot PROM OBP security-password variable in cleartext, which allows local users to bypass the SPARC firmware's password protection, and gain privileges or obtain data access, via the "ldm ls -l"...

CVE-2008-5070: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Pro Chat Rooms 3.0.3, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the gud parameter to 1 profiles/index.php and 2 profiles/admin.php...

CVE-2008-1547: URL Redirection to Untrusted Site

Open redirect vulnerability in exchweb/bin/redir.asp in Microsoft Outlook Web Access OWA for Exchange Server 2003 SP2 aka build 6.5.7638 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the URL parameter...

CVE-2008-3610: Improper Authentication

Race condition in Login Window in Apple Mac OS X 10.5 through 10.5.4, when a blank-password account is enabled, allows attackers to bypass password authentication and login to any account via multiple attempts to login to the blank-password account, followed by selection of an arbitrary account...

CVE-2008-3453: Undefined Security Weakness

Multiple unspecified vulnerabilities in ImpressCMS 1.0 have unknown impact and attack vectors, related to modules/admin.php and "a few files."...

CVE-2008-3027: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in getarticle.php in VanGogh Web CMS 0.9 allows remote attackers to execute arbitrary SQL commands via the articleID parameter to index.php...

CVE-2008-2207: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/index.php in Maian Gallery 2.0 allows remote attackers to inject arbitrary web script or HTML via the keywords parameter in a search action...

CVE-2008-1087: Improper Restriction of Operations within the Bounds of a Memory Buffer

Stack-based buffer overflow in GDI in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Vista, and Server 2008 allows remote attackers to execute arbitrary code via an EMF image file with crafted filename parameters, aka "GDI Stack Overflow Vulnerability."...

CVE-2008-0643: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Adobe ColdFusion MX 7 and ColdFusion 8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2008-0118: Improper Control of Generation of Code

Unspecified vulnerability in Microsoft Office 2000 SP3, XP SP3, 2003 SP2, Excel Viewer 2003 up to SP3, and Office 2004 for Mac allows user-assisted remote attackers to execute arbitrary code via a crafted Office document that triggers memory corruption from an "allocation error," aka "Microsoft...

CVE-2008-1248: Cross-Site Request Forgery (CSRF)

The web interface on the central phone server for the Snom 320 SIP Phone allows remote attackers to make arbitrary phone calls via the "Call a number" field. NOTE: this might overlap CVE-2007-3440...

CVE-2008-1253: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in cgi-bin/webcm on the D-Link DSL-G604T router allows remote attackers to inject arbitrary web script or HTML via the var:category parameter, as demonstrated by a request for advanced/portforw.htm on the fwan page...

CVE-2008-1268: Improper Authentication

The FTP server on the Linksys WRT54G 7 router with 7.00.1 firmware does not verify authentication credentials, which allows remote attackers to establish an FTP session by sending an arbitrary username and password...