CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 6 and 6.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
11101 CVE-2012-3684 DoS Exec Code Mem. Corr. 2012-09-13 2017-09-18
6.8
None Remote Medium Not required Partial Partial Partial
WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-09-12-1.
11102 CVE-2012-3677 DoS Exec Code Mem. Corr. 2012-09-13 2017-09-18
6.8
None Remote Medium Not required Partial Partial Partial
WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-09-12-1.
11103 CVE-2012-3676 DoS Exec Code Mem. Corr. 2012-09-13 2017-09-18
6.8
None Remote Medium Not required Partial Partial Partial
WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-09-12-1.
11104 CVE-2012-3675 DoS Exec Code Mem. Corr. 2012-09-13 2017-09-18
6.8
None Remote Medium Not required Partial Partial Partial
WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-09-12-1.
11105 CVE-2012-3673 DoS Exec Code Mem. Corr. 2012-09-13 2017-09-18
6.8
None Remote Medium Not required Partial Partial Partial
WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-09-12-1.
11106 CVE-2012-3672 DoS Exec Code Mem. Corr. 2012-09-13 2017-09-18
6.8
None Remote Medium Not required Partial Partial Partial
WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-09-12-1.
11107 CVE-2012-3671 DoS Exec Code Mem. Corr. 2012-09-13 2017-09-18
6.8
None Remote Medium Not required Partial Partial Partial
WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-09-12-1.
11108 CVE-2012-3660 DoS Exec Code Mem. Corr. 2012-09-13 2017-09-18
6.8
None Remote Medium Not required Partial Partial Partial
WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-09-12-1.
11109 CVE-2012-3659 DoS Exec Code Mem. Corr. 2012-09-13 2017-09-18
6.8
None Remote Medium Not required Partial Partial Partial
WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-09-12-1.
11110 CVE-2012-3658 DoS Exec Code Mem. Corr. 2012-09-13 2017-09-18
6.8
None Remote Medium Not required Partial Partial Partial
WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-09-12-1.
11111 CVE-2012-3657 DoS Exec Code Mem. Corr. 2012-09-13 2017-09-18
6.8
None Remote Medium Not required Partial Partial Partial
WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-09-12-1.
11112 CVE-2012-3654 DoS Exec Code Mem. Corr. 2012-09-13 2017-09-18
6.8
None Remote Medium Not required Partial Partial Partial
WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-09-12-1.
11113 CVE-2012-3652 DoS Exec Code Mem. Corr. 2012-09-13 2017-09-18
6.8
None Remote Medium Not required Partial Partial Partial
WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-09-12-1.
11114 CVE-2012-3651 DoS Exec Code Mem. Corr. 2012-09-13 2017-09-18
6.8
None Remote Medium Not required Partial Partial Partial
WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-09-12-1.
11115 CVE-2012-3649 DoS Exec Code Mem. Corr. 2012-09-13 2017-09-18
6.8
None Remote Medium Not required Partial Partial Partial
WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-09-12-1.
11116 CVE-2012-3648 DoS Exec Code Mem. Corr. 2012-09-13 2017-09-18
6.8
None Remote Medium Not required Partial Partial Partial
WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-09-12-1.
11117 CVE-2012-3647 DoS Exec Code Mem. Corr. 2012-09-13 2017-09-18
6.8
None Remote Medium Not required Partial Partial Partial
WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-09-12-1.
11118 CVE-2012-3643 DoS Exec Code Mem. Corr. 2012-09-13 2017-09-18
6.8
None Remote Medium Not required Partial Partial Partial
WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-09-12-1.
11119 CVE-2012-3624 DoS Exec Code Mem. Corr. 2012-09-13 2017-09-18
6.8
None Remote Medium Not required Partial Partial Partial
WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-09-12-1.
11120 CVE-2012-3623 DoS Exec Code Mem. Corr. 2012-09-13 2017-09-18
6.8
None Remote Medium Not required Partial Partial Partial
WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-09-12-1.
11121 CVE-2012-3622 DoS Exec Code Mem. Corr. 2012-09-13 2017-09-18
6.8
None Remote Medium Not required Partial Partial Partial
WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-09-12-1.
11122 CVE-2012-3617 DoS Exec Code Mem. Corr. 2012-09-13 2017-09-18
6.8
None Remote Medium Not required Partial Partial Partial
WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-09-12-1.
11123 CVE-2012-3616 DoS Exec Code Mem. Corr. 2012-09-13 2017-09-18
6.8
None Remote Medium Not required Partial Partial Partial
WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-09-12-1.
11124 CVE-2012-3614 DoS Exec Code Mem. Corr. 2012-09-13 2017-09-18
6.8
None Remote Medium Not required Partial Partial Partial
WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-09-12-1.
11125 CVE-2012-3613 DoS Exec Code Mem. Corr. 2012-09-13 2017-09-18
6.8
None Remote Medium Not required Partial Partial Partial
WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-09-12-1.
11126 CVE-2012-3612 DoS Exec Code Mem. Corr. 2012-09-13 2017-09-18
6.8
None Remote Medium Not required Partial Partial Partial
WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-09-12-1.
11127 CVE-2012-3602 DoS Exec Code Mem. Corr. 2012-09-13 2017-09-18
6.8
None Remote Medium Not required Partial Partial Partial
WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-09-12-1.
11128 CVE-2012-3601 DoS Exec Code Mem. Corr. 2012-09-13 2017-09-18
6.8
None Remote Medium Not required Partial Partial Partial
WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-09-12-1.
11129 CVE-2012-3598 DoS Exec Code Mem. Corr. 2012-09-13 2017-09-18
6.8
None Remote Medium Not required Partial Partial Partial
WebKit, as used in Apple iTunes before 10.7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-09-12-1.
11130 CVE-2012-3578 264 1 Exec Code 2012-06-16 2017-08-28
6.8
None Remote Medium Not required Partial Partial Partial
Unrestricted file upload vulnerability in html/Upload.php in the FCChat Widget plugin 2.2.13.1 and earlier for WordPress allows remote attackers to execute arbitrary code by uploading a file with a file with an executable extension followed by a safe extension, then accessing it via a direct request to the file in html/images.
11131 CVE-2012-3572 20 Exec Code 2012-09-11 2012-09-12
6.0
None Remote Medium Single system Partial Partial Partial
Open Source Competency Center (OSCC) MyMeeting 3.0.1 and earlier, and MyMesyuarat 09b-1, does not properly verify uploaded documents, which allows remote authenticated users to execute arbitrary PHP code via a crafted document.
11132 CVE-2012-3571 119 DoS Overflow 2012-07-25 2016-12-30
6.1
None Local Network Low Not required None None Complete
ISC DHCP 4.1.2 through 4.2.4 and 4.1-ESV before 4.1-ESV-R6 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a malformed client identifier.
11133 CVE-2012-3547 119 DoS Exec Code Overflow 2012-09-18 2017-08-28
6.8
None Remote Medium Not required Partial Partial Partial
Stack-based buffer overflow in the cbtls_verify function in FreeRADIUS 2.1.10 through 2.1.12, when using TLS-based EAP methods, allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via a long "not after" timestamp in a client certificate.
11134 CVE-2012-3535 119 DoS Exec Code Overflow 2012-09-05 2017-08-28
6.8
None Remote Medium Not required Partial Partial Partial
Heap-based buffer overflow in OpenJPEG 1.5.0 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted JPEG2000 file.
11135 CVE-2012-3532 352 CSRF 2013-04-12 2013-04-15
6.8
None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in the GateIn Portal component in JBoss Enterprise Portal Platform 5.2.2 and earlier allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
11136 CVE-2012-3524 264 1 Exec Code +Priv 2012-09-18 2013-12-05
6.9
None Local Medium Not required Complete Complete Complete
libdbus 1.5.x and earlier, when used in setuid or other privileged programs in X.org and possibly other products, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS environment variable. NOTE: libdbus maintainers state that this is a vulnerability in the applications that do not cleanse environment variables, not in libdbus itself: "we do not support use of libdbus in setuid binaries that do not sanitize their environment before their first call into libdbus."
11137 CVE-2012-3523 264 2012-11-11 2013-02-21
6.8
None Remote Medium Not required Partial Partial Partial
The STARTTLS implementation in nnrpd in INN before 2.5.3 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.
11138 CVE-2012-3516 264 DoS +Priv 2012-11-23 2013-01-31
6.9
None Local Medium Not required Complete Complete Complete
The GNTTABOP_swap_grant_ref sub-operation in the grant table hypercall in Xen 4.2 and Citrix XenServer 6.0.2 allows local guest kernels or administrators to cause a denial of service (host crash) and possibly gain privileges via a crafted grant reference that triggers a write to an arbitrary hypervisor memory location.
11139 CVE-2012-3511 362 DoS 2012-10-03 2013-10-23
6.2
None Local High Not required Complete Complete Complete
Multiple race conditions in the madvise_remove function in mm/madvise.c in the Linux kernel before 3.4.5 allow local users to cause a denial of service (use-after-free and system crash) via vectors involving a (1) munmap or (2) close system call.
11140 CVE-2012-3503 264 2012-08-25 2013-03-21
6.5
None Remote Low Single system Partial Partial Partial
The installation script in Katello 1.0 and earlier does not properly generate the Application.config.secret_token value, which causes each default installation to have the same secret token, and allows remote attackers to authenticate to the CloudForms System Engine web interface as an arbitrary user by creating a cookie using the default secret_token.
11141 CVE-2012-3497 20 DoS Mem. Corr. 2012-11-23 2017-08-28
6.9
None Local Medium Not required Complete Complete Complete
(1) TMEMC_SAVE_GET_CLIENT_WEIGHT, (2) TMEMC_SAVE_GET_CLIENT_CAP, (3) TMEMC_SAVE_GET_CLIENT_FLAGS and (4) TMEMC_SAVE_END in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service (NULL pointer dereference or memory corruption and host crash) or possibly have other unspecified impacts via a NULL client id.
11142 CVE-2012-3495 20 DoS +Priv 2012-11-23 2017-06-30
6.1
None Local Low Not required Partial Partial Complete
The physdev_get_free_pirq hypercall in arch/x86/physdev.c in Xen 4.1.x and Citrix XenServer 6.0.2 and earlier uses the return value of the get_free_pirq function as an array index without checking that the return value indicates an error, which allows guest OS users to cause a denial of service (invalid memory write and host crash) and possibly gain privileges via unspecified vectors.
11143 CVE-2012-3492 287 2012-09-28 2012-10-03
6.4
None Remote Low Not required Partial Partial None
The filesystem authentication (condor_io/condor_auth_fs.cpp) in Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 uses authentication directories even when they have weak permissions, which allows remote attackers to impersonate users by renaming a user's authentication directory.
11144 CVE-2012-3486 264 +Priv 2012-08-26 2012-08-27
6.9
Admin Local Medium Not required Complete Complete Complete
Tunnelblick 3.3beta20 and earlier allows local users to gain privileges via an OpenVPN configuration file that specifies execution of a script upon occurrence of an OpenVPN event.
11145 CVE-2012-3483 362 +Priv 2012-08-26 2012-08-27
6.2
Admin Local High Not required Complete Complete Complete
Race condition in the runScript function in Tunnelblick 3.3beta20 and earlier allows local users to gain privileges by replacing a script file.
11146 CVE-2012-3481 189 DoS Exec Code Overflow 2012-08-25 2013-12-05
6.8
None Remote Medium Not required Partial Partial Partial
Integer overflow in the ReadImage function in plug-ins/common/file-gif-load.c in the GIF image format plug-in in GIMP 2.8.x and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted height and len properties in a GIF image file, which triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information.
11147 CVE-2012-3479 Exec Code 2012-08-25 2013-12-13
6.8
None Remote Medium Not required Partial Partial Partial
lisp/files.el in Emacs 23.2, 23.3, 23.4, and 24.1 automatically executes eval forms in local-variable sections when the enable-local-variables option is set to :safe, which allows user-assisted remote attackers to execute arbitrary Emacs Lisp code via a crafted file.
11148 CVE-2012-3473 287 2012-08-12 2012-08-13
6.4
None Remote Low Not required Partial Partial None
The (1) reports API and (2) administration feature in the comments API in the Ushahidi Platform before 2.5 do not require authentication, which allows remote attackers to generate reports and organize comments via API functions.
11149 CVE-2012-3472 287 2012-08-12 2012-08-13
6.4
None Remote Low Not required None Partial Partial
The email API in application/libraries/api/MY_Email_Api_Object.php in the Ushahidi Platform before 2.5 does not require authentication, which allows remote attackers to list, delete, or organize messages via a GET request.
11150 CVE-2012-3422 119 DoS Exec Code Overflow 2012-08-07 2014-10-04
6.8
None Remote Medium Not required Partial Partial Partial
The getFirstInTableInstance function in the IcedTea-Web plugin before 1.2.1 returns an uninitialized pointer when the instance_to_id_map hash is empty, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted web page, which causes an uninitialized memory location to be read.
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.