CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In 2012

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Copy Results Download Results Select Table
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2012-6369 79 1 XSS 2012-12-28 2013-01-08
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the Troubleshooting Reporting System feature in AgileBits 1Password 3.9.9 might allow remote attackers to inject arbitrary web script or HTML via a crafted User-Agent HTTP header that is not properly handled in a View Troubleshooting Report action.
2 CVE-2012-6301 20 1 DoS 2012-12-10 2012-12-11
5.0
 None Remote Low Not required None None Partial
The Browser application in Android 4.0.3 allows remote attackers to cause a denial of service (application crash) via a crafted market: URI in the SRC attribute of an IFRAME element.
3 CVE-2012-6064 22 1 Dir. Trav. CSRF 2012-12-03 2012-12-04
3.5
 None Remote Medium Single system None Partial None
Directory traversal vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple (CMSMS) before 1.11.2.1 allows remote authenticated administrators to delete arbitrary files via a .. (dot dot) in the deld parameter. NOTE: this can be leveraged using CSRF (CVE-2012-5450) to allow remote attackers to delete arbitrary files.
4 CVE-2012-6050 16 1 DoS 2012-11-26 2012-11-28
6.4
 None Remote Low Not required Partial None Partial
The winbox service in MikroTik RouterOS 5.15 and earlier allows remote attackers to cause a denial of service (CPU consumption), read the router version, and possibly have other impacts via a request to download the router's DLLs or plugins, as demonstrated by roteros.dll.
5 CVE-2012-6049 200 1 +Info 2012-11-26 2012-11-27
5.0
 None Remote Low Not required Partial None None
Open Solution Quick.Cart 5.0 allows remote attackers to obtain sensitive information via (1) a long string or (2) invalid characters in a cookie, which reveals the installation path in an error message.
6 CVE-2012-6048 119 1 DoS Overflow 2012-11-26 2012-11-27
5.0
 None Remote Low Not required None None Partial
Guitar Pro 6.1.1 r10791 allows remote attackers to cause a denial of service (crash) via a long string in a gpx file.
7 CVE-2012-6047 352 1 CSRF 2012-11-26 2012-11-27
6.8
 None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in X7 Chat 2.0.5.1 and earlier allows remote attackers to hijack the authentication of administrators for requests that add a user to an arbitrary group via the users page in an adminpanel action to index.php.
8 CVE-2012-6046 94 1 2012-11-26 2012-11-27
10.0
 None Remote Low Not required Complete Complete Complete
Static code injection vulnerability in admin/banners.php in PHP Enter allows remote attackers to inject arbitrary PHP code into horad.php via the code parameter.
9 CVE-2012-6045 79 1 XSS 2012-11-26 2012-11-27
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in gb/user/index.php in Ramui Forum, possibly 1.0 Beta, allows remote attackers to inject arbitrary web script or HTML via the query parameter.
10 CVE-2012-6044 20 1 DoS 2012-11-26 2012-11-27
4.3
 None Remote Medium Not required None None Partial
M-Player 0.4 allows remote attackers to cause a denial of service (crash) via a crafted MP3 file.
11 CVE-2012-6043 79 1 XSS 2012-11-26 2012-11-27
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in downloads.php in PHP-Fusion 7.02.04 allows remote attackers to inject arbitrary web script or HTML via the cat_id parameter.
12 CVE-2012-6042 119 1 DoS Overflow 2012-11-26 2012-11-27
4.3
 None Remote Medium Not required None None Partial
GPSMapEdit 1.1.73.2 allows user-assisted remote attackers to cause a denial of service (crash) via a long string in a lst file.
13 CVE-2012-6040 79 1 XSS 2012-11-26 2012-11-27
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in users.php in File King Advanced File Management 1.4 allows remote attackers to inject arbitrary web script or HTML via the page parameter.
14 CVE-2012-6039 89 1 Exec Code Sql 2012-11-26 2012-11-27
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in view_comments.php in YABSoft Advanced Image Hosting (AIH) Script, possibly 2.3, allows remote attackers to execute arbitrary SQL commands via the gal parameter.
15 CVE-2012-6038 22 1 Dir. Trav. 2012-11-26 2012-11-27
6.5
 None Remote Low Single system Partial Partial Partial
admin/core/admin_func.php in razorCMS before 1.2.1 does not properly restrict access to certain administrator directories and files, which allows remote authenticated users to read, edit, rename, move, copy and delete files via the (1) dir parameter in a fileman or (2) filemanview action. NOTE: this issue has been referred to as a "path traversal."
16 CVE-2012-5975 287 1 Bypass 2012-12-04 2012-12-05
9.3
 Admin Remote Medium Not required Complete Complete Complete
The SSH USERAUTH CHANGE REQUEST feature in SSH Tectia Server 6.0.4 through 6.0.20, 6.1.0 through 6.1.12, 6.2.0 through 6.2.5, and 6.3.0 through 6.3.2 on UNIX and Linux, when old-style password authentication is enabled, allows remote attackers to bypass authentication via a crafted session involving entry of blank passwords, as demonstrated by a root login session from a modified OpenSSH client with an added input_userauth_passwd_changereq call in sshconnect2.c.
17 CVE-2012-5919 79 1 XSS 2012-11-19 2012-12-18
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Havalite 1.0.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) find or (2) replace fields to havalite/findReplace.php; (3) username parameter to havalite/hava_login.php, (4) the Edit Article module, or (5) hava_post.php in the postAuthor module; (6) postId parameter to hava_post.php; (7) userId parameter to hava_user.php; or (8) linkId parameter to hava_link.php.
18 CVE-2012-5918 264 1 2012-11-19 2012-11-19
4.0
 None Remote Low Single system None Partial None
razorCMS 1.2 allows remote authenticated users to access administrator directories and files by creating and deleting a directory.
19 CVE-2012-5917 119 1 DoS Overflow 2012-11-17 2012-11-19
4.3
 None Remote Medium Not required None None Partial
SnackAmp 3.1.3 allows remote attackers to cause a denial of service (application crash) via a long string in an aiff file.
20 CVE-2012-5916 200 1 +Info 2012-11-17 2012-11-19
5.0
 None Remote Low Not required Partial None None
Neocrome Seditio build 161 allows remote attackers to obtain sensitive information via a direct request to (1) docs/new/seditio-createnew-160.sql, (2) docs/upgrade/sedito_convert_to_utf8.optional.sql, or (3) system/install/install.parser.sql.
21 CVE-2012-5915 200 1 +Info 2012-11-17 2012-11-19
5.0
 None Remote Low Not required Partial None None
Neocrome Seditio build 161 and earlier allows remote attackers to obtain sensitive information via direct request to (1) view.php, (2) plugins/contact/lang/contact.en.lang.php, (3) system/lang/en/main.lang.php, (4) system/lang/en/message.lang.php, or (5) system/core/view/view.inc.php, which reveals the installation path in an error message.
22 CVE-2012-5914 79 1 XSS 2012-11-17 2012-11-19
2.6
 None Remote High Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in the sed_import function in system/functions.php in Neocrome Seditio build 160 and 161 allow remote attackers to inject arbitrary web script or HTML via the (1) newmsg or (2) rtext parameter. NOTE: some of these details are obtained from third party information.
23 CVE-2012-5913 79 1 XSS 2012-11-17 2012-11-19
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in wp-integrator.php in the WordPress Integrator module 1.32 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirect_to parameter to wp-login.php.
24 CVE-2012-5912 89 2 Exec Code Sql 2012-11-17 2012-11-19
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in PicoPublisher 2.0 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) page.php or (2) single.php.
25 CVE-2012-5911 79 1 XSS 2012-11-17 2012-11-19
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in blogs/blog1.php in b2evolution 4.1.3 allows remote attackers to inject arbitrary web script or HTML via the message body.
26 CVE-2012-5910 89 1 Exec Code Sql 2012-11-17 2012-11-19
6.5
 None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in blogs/htsrv/viewfile.php in b2evolution 4.1.3 allows remote authenticated users to execute arbitrary SQL commands via the root parameter.
27 CVE-2012-5909 89 1 Exec Code Sql 2012-11-17 2012-11-19
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in admin/modules/user/users.php in MyBB (aka MyBulletinBoard) 1.6.6 allows remote attackers to execute arbitrary SQL commands via the conditions[usergroup][] parameter in a search action to admin/index.php.
28 CVE-2012-5908 79 1 XSS 2012-11-17 2012-11-19
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in admin/modules/user/users.php in MyBB (aka MyBulletinBoard) 1.6.6 allows remote attackers to inject arbitrary web script or HTML via the conditions[usergroup][] parameter in a search action to admin/index.php.
29 CVE-2012-5907 22 1 Dir. Trav. 2012-11-17 2012-11-19
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in json.php in TomatoCart 1.2.0 Alpha 2 and possibly earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the module parameter in a "3" action.
30 CVE-2012-5906 79 1 XSS 2012-11-17 2012-11-19
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in GreenBrowser 6.1.0117 and 6.1.0216 allow remote attackers to inject arbitrary web script or HTML via (1) the URI in an about: page or (2) the last visited URL in the LastVisitWriteEn function in function.js.
31 CVE-2012-5905 119 2 DoS Overflow 2012-11-17 2012-11-19
4.0
 None Remote Low Single system None None Partial
Buffer overflow in KnFTPd 1.0.0 allows remote authenticated users to cause a denial of service (crash) via a long string in a FEAT command.
32 CVE-2012-5903 79 1 XSS 2012-11-17 2012-11-19
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Simple Machines Forum (SMF) 2.0.2 allows remote attackers to inject arbitrary web script or HTML via the scheduled parameter to index.php.
33 CVE-2012-5902 79 1 XSS 2012-11-17 2012-11-19
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in ptk/lib/modal_bookmark.php in DFLabs PTK 1.0.5 allows remote attackers to inject arbitrary web script or HTML via the arg4 parameter.
34 CVE-2012-5901 264 1 2012-11-17 2012-11-19
5.0
 None Remote Low Not required Partial None None
DFLabs PTK 1.0.5 stores data files with predictable names under the web document root with insufficient access control, which allows remote attackers to read logs, images, or reports via a direct request to the file in the (1) log, (2) images, or (3) report directory.
35 CVE-2012-5900 89 2 Exec Code Sql 2012-11-17 2013-01-15
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in SAMEDIA LandShop 0.9.2 allow remote attackers to execute arbitrary SQL commands via the (1) OB_ID parameter in a single action to admin/action/objects.php, (2) AREA_ID parameter in a single action to admin/action/areas.php, or (3) start parameter in a show action to admin/action/pdf.php.
36 CVE-2012-5899 79 2 XSS 2012-11-17 2013-01-15
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in admin/action/objects.php in SAMEDIA LandShop 0.9.2 allows remote attackers to inject arbitrary web script or HTML via the OTR_HEADS[] parameter in an edit action. NOTE: some of these details are obtained from third party information.
37 CVE-2012-5898 352 2 CSRF 2012-11-17 2012-11-19
6.8
 None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in SAMEDIA LandShop 0.9.2 allows remote attackers to hijack the authentication of administrators for requests that change account settings.
38 CVE-2012-5897 264 1 2012-11-17 2013-01-15
9.3
 None Remote Medium Not required Complete Complete Complete
The (1) SimpleTree and (2) ReportTree classees in the ARDoc ActiveX control (ARDoc.dll) in Quest InTrust 10.4.0.853 and earlier do not properly implement the SaveToFile method, which allows remote attackers to write or overwrite arbitrary files via the bstrFileName argument.
39 CVE-2012-5896 3 Exec Code 2012-11-17 2012-11-19
10.0
 None Remote Low Not required Complete Complete Complete
The Annotation Objects Extension ActiveX control in AnnotateX.dll in Quest InTrust 10.4.0.853 and earlier does not properly implement the Add method, which allows remote attackers to execute arbitrary code via a memory address in the first argument, related to an "uninitialized pointer."
40 CVE-2012-5894 89 1 Exec Code Sql 2012-11-17 2012-11-19
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in hava_post.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the postId parameter.
41 CVE-2012-5893 1 Exec Code 2012-11-17 2012-11-19
6.8
 None Remote Medium Not required Partial Partial Partial
Unrestricted file upload vulnerability in hava_upload.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitrary code by uploading a file with a .php;.gif extension, then accessing it via a direct request to the file in tmp/files/.
42 CVE-2012-5892 264 1 2012-11-17 2012-11-19
5.0
 None Remote Low Not required Partial None None
Havalite CMS 1.1.0 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the configuration database via a direct request for data/havalite.db3.
43 CVE-2012-5891 352 2 CSRF 2012-11-17 2013-01-15
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple cross-site request forgery (CSRF) vulnerabilities in photo/pass.php in DAlbum 1.44 build 174 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add a user via an add action, (2) change user passwords via a change action, or (3) delete a user via a delete action.
44 CVE-2012-5864 264 1 2012-11-23 2013-02-02
10.0
 None Remote Low Not required Complete Complete Complete
The management web pages on the Sinapsi eSolar Light Photovoltaic System Monitor (aka Schneider Electric Ezylog photovoltaic SCADA management server), Sinapsi eSolar, and Sinapsi eSolar DUO with firmware before 2.0.2870_2.2.12 do not require authentication, which allows remote attackers to obtain administrative access via a direct request, as demonstrated by a request to ping.php.
45 CVE-2012-5863 264 1 Exec Code 2012-11-23 2013-02-02
10.0
 None Remote Low Not required Complete Complete Complete
ping.php on the Sinapsi eSolar Light Photovoltaic System Monitor (aka Schneider Electric Ezylog photovoltaic SCADA management server), Sinapsi eSolar, and Sinapsi eSolar DUO with firmware before 2.0.2870_2.2.12 allows remote attackers to execute arbitrary commands via shell metacharacters in the ip_dominio parameter.
46 CVE-2012-5862 310 1 2012-11-23 2013-02-02
10.0
 None Remote Low Not required Complete Complete Complete
login.php on the Sinapsi eSolar Light Photovoltaic System Monitor (aka Schneider Electric Ezylog photovoltaic SCADA management server), Sinapsi eSolar, and Sinapsi eSolar DUO with firmware before 2.0.2870_2.2.12 establishes multiple hardcoded accounts, which makes it easier for remote attackers to obtain administrative access by leveraging a (1) cleartext password or (2) password hash contained in this script, as demonstrated by a password of astridservice or 36e44c9b64.
47 CVE-2012-5861 89 1 Exec Code Sql 2012-11-23 2013-02-02
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities on the Sinapsi eSolar Light Photovoltaic System Monitor (aka Schneider Electric Ezylog photovoltaic SCADA management server), Sinapsi eSolar, and Sinapsi eSolar DUO with firmware before 2.0.2870_2.2.12 allow remote attackers to execute arbitrary SQL commands via (1) the inverterselect parameter in a primo action to dettagliinverter.php or (2) the lingua parameter to changelanguagesession.php.
48 CVE-2012-5859 1 DoS 2012-12-03 2012-12-04
5.0
 None Remote Low Not required None None Partial
Samsung Kies Air 2.1.207051 and 2.1.210161 allows remote attackers to cause a denial of service (crash) via a crafted request to www/apps/KiesAir/jws/ssd.php.
49 CVE-2012-5858 287 1 2012-12-03 2012-12-04
4.3
 None Remote Medium Not required Partial None None
Samsung Kies Air 2.1.207051 and 2.1.210161 relies on the IP address for authentication, which allows remote man-in-the-middle attackers to read arbitrary phone contents by spoofing or controlling the IP address.
50 CVE-2012-5856 79 1 XSS 2012-11-17 2013-02-25
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the Uk Cookie (aka uk-cookie) plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Total number of vulnerabilities : 532   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.