CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 5 and 5.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
12651 CVE-2012-3899 399 DoS Mem. Corr. 2012-09-16 2012-09-17
5.0
None Remote Low Not required None None Partial
sensorApp on Cisco IPS 4200 series sensors 6.0, 6.2, and 7.0 does not properly allocate memory, which allows remote attackers to cause a denial of service (memory corruption and process crash, and traffic-inspection outage) via network traffic, aka Bug ID CSCtn23051.
12652 CVE-2012-3888 264 Bypass 2012-07-26 2012-07-27
5.0
None Remote Low Not required None Partial None
The login implementation in AirDroid 1.0.4 beta allows remote attackers to bypass a multiple-login protection mechanism by modifying a pass value within JSON data.
12653 CVE-2012-3887 310 +Info 2012-07-26 2012-07-27
5.0
None Remote Low Not required Partial None None
AirDroid before 1.0.7 beta uses a cleartext base64 format for data transfer that is documented as an "Encrypted Transmission" feature, which allows remote attackers to obtain sensitive information by sniffing the local wireless network, as demonstrated by the SMS message content sent to the sdctl/sms/send/single/ URI.
12654 CVE-2012-3886 200 +Info 2012-07-26 2012-07-27
5.0
None Remote Low Not required Partial None None
AirDroid 1.0.4 beta uses the MD5 algorithm for values in the checklogin key parameter and 7bb cookie, which makes it easier for remote attackers to obtain cleartext data by sniffing the local wireless network and then conducting a (1) brute-force attack or (2) rainbow-table attack.
12655 CVE-2012-3884 287 2012-07-26 2012-07-27
5.0
None Remote Low Not required Partial None None
AirDroid 1.0.4 beta implements authentication through direct transmission of a password hash over HTTP, which makes it easier for remote attackers to obtain access by sniffing the local wireless network and then replaying the authentication data.
12656 CVE-2012-3847 399 DoS 2012-07-04 2012-08-13
5.0
None Remote Low Not required None None Partial
slssvc.exe in Invensys Wonderware SuiteLink in Invensys InTouch 2012 and Wonderware Application Server 2012 allows remote attackers to cause a denial of service (resource consumption) via a long Unicode string, a different vulnerability than CVE-2012-3007.
12657 CVE-2012-3845 119 1 DoS Overflow 2012-07-03 2017-08-28
5.0
None Remote Low Not required None None Partial
Buffer overflow in LAN Messenger 1.2.28 and earlier allows remote attackers to cause a denial of service (crash) via a long string in an initiation request.
12658 CVE-2012-3838 200 1 +Info 2012-07-03 2012-07-17
5.0
None Remote Low Not required Partial None None
Gekko before 1.2.0 allows remote attackers to obtain the installation path via a direct request to (1) admin/templates/babygekko/index.php or (2) templates/html5demo/index.php.
12659 CVE-2012-3829 200 1 +Info 2012-07-03 2012-07-17
5.0
None Remote Low Not required Partial None None
Joomla! 2.5.3 allows remote attackers to obtain the installation path via the Host HTTP Header.
12660 CVE-2012-3819 119 DoS Overflow 2012-10-04 2015-12-04
5.0
None Remote Low Not required None None Partial
Stack consumption vulnerability in dartwebserver.dll 1.9 and earlier, as used in Dart PowerTCP WebServer for ActiveX and other products, allows remote attackers to cause a denial of service (daemon crash) via a long request.
12661 CVE-2012-3801 264 +Info 2012-06-26 2012-08-13
5.0
None Remote Low Not required Partial None None
The Advertisement module 6.x-2.x before 6.x-2.3 for Drupal does not properly restrict access to debug information, which allows remote attackers to obtain sensitive site configuration information that is specified by the $conf variable in settings.php.
12662 CVE-2012-3799 352 XSS CSRF 2012-06-26 2017-08-28
5.1
None Remote High Not required Partial Partial Partial
Multiple cross-site request forgery (CSRF) vulnerabilities in the Maestro module 7.x-1.x before 7.x-1.2 for Drupal allow remote attackers to hijack the authentication of administrators for requests that (1) change workflows or (2) insert cross-site scripting (XSS) sequences.
12663 CVE-2012-3798 200 +Info 2012-06-26 2012-06-27
5.0
None Remote Low Not required Partial None None
The Janrain Capture module 6.x-1.0 and 7.x-1.0 for Drupal, when creating a local user account, allows attackers to obtain part of the initial input used to generate passwords, which makes it easier to conduct brute force password guessing attacks.
12664 CVE-2012-3796 200 +Info 2012-06-25 2013-05-20
5.0
None Remote Low Not required Partial None None
Pro-face WinGP PC Runtime 3.1.00 and earlier, and ProServr.exe in Pro-face Pro-Server EX 1.30.000 and earlier, allows remote attackers to obtain sensitive information from daemon memory via a crafted packet with a certain opcode.
12665 CVE-2012-3795 119 DoS Overflow 2012-06-25 2013-05-20
5.0
None Remote Low Not required None None Partial
Pro-face WinGP PC Runtime 3.1.00 and earlier, and ProServr.exe in Pro-face Pro-Server EX 1.30.000 and earlier, allows remote attackers to cause a denial of service (daemon crash) via a crafted packet with a certain opcode and a large value in a size field.
12666 CVE-2012-3794 119 DoS Overflow 2012-06-25 2017-08-28
5.0
None Remote Low Not required None None Partial
Pro-face WinGP PC Runtime 3.1.00 and earlier, and ProServr.exe in Pro-face Pro-Server EX 1.30.000 and earlier, allows remote attackers to cause a denial of service (unhandled exception and daemon crash) via a crafted packet with a certain opcode that triggers an invalid attempt to allocate a large amount of memory.
12667 CVE-2012-3793 119 DoS Overflow 2012-06-25 2017-08-28
5.0
None Remote Low Not required None None Partial
Integer overflow in Pro-face WinGP PC Runtime 3.1.00 and earlier, and ProServr.exe in Pro-face Pro-Server EX 1.30.000 and earlier, allows remote attackers to cause a denial of service (daemon crash) via a crafted packet with a certain opcode that triggers an incorrect memory allocation and a buffer overflow.
12668 CVE-2012-3792 119 DoS Overflow 2012-06-25 2013-05-20
5.0
None Remote Low Not required None None Partial
Pro-face WinGP PC Runtime 3.1.00 and earlier, and ProServr.exe in Pro-face Pro-Server EX 1.30.000 and earlier, allows remote attackers to cause a denial of service (out-of-bounds read operation) via a crafted packet that triggers a certain Find Node check attempt.
12669 CVE-2012-3789 DoS 2012-08-06 2012-08-07
5.0
None Remote Low Not required None None Partial
Unspecified vulnerability in bitcoind and Bitcoin-Qt before 0.4.7rc3, 0.5.x before 0.5.6rc3, 0.6.0.x before 0.6.0.9rc1, and 0.6.x before 0.6.3rc1 allows remote attackers to cause a denial of service (process hang) via unknown behavior on a Bitcoin network.
12670 CVE-2012-3749 200 Bypass +Info 2012-11-03 2013-08-17
5.0
None Remote Low Not required Partial None None
The extensions APIs in the kernel in Apple iOS before 6.0.1 provide kernel addresses in responses that contain an OSBundleMachOHeaders key, which makes it easier for remote attackers to bypass the ASLR protection mechanism via a crafted app.
12671 CVE-2012-3748 362 DoS Exec Code 2012-11-03 2013-09-17
5.1
None Remote High Not required Partial Partial Partial
Race condition in WebKit in Apple iOS before 6.0.1 and Safari before 6.0.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving JavaScript arrays.
12672 CVE-2012-3745 119 DoS Overflow 2012-09-20 2017-08-28
5.0
None Remote Low Not required None None Partial
Off-by-one error in Telephony in Apple iOS before 6 allows remote attackers to cause a denial of service (buffer overflow and connectivity outage) via a crafted user-data header in an SMS message.
12673 CVE-2012-3744 2012-09-20 2017-08-28
5.0
None Remote Low Not required None Partial None
Telephony in Apple iOS before 6 uses an SMS message's return address as the displayed sender address, which allows remote attackers to spoof text communication via a message in which the return address does not match the originating address.
12674 CVE-2012-3743 264 +Info 2012-09-20 2017-08-28
5.0
None Remote Low Not required Partial None None
The System Logs implementation in Apple iOS before 6 does not restrict /var/log access by sandboxed apps, which allows remote attackers to obtain sensitive information via a crafted app that reads log files.
12675 CVE-2012-3742 264 2012-09-20 2017-08-28
5.0
None Remote Low Not required None Partial None
Safari in Apple iOS before 6 does not properly restrict use of an unspecified Unicode character that looks similar to the https lock indicator, which allows remote attackers to spoof https connections by placing this character in the TITLE element of a web page.
12676 CVE-2012-3724 200 +Info 2012-09-20 2017-08-28
5.0
None Remote Low Not required Partial None None
CFNetwork in Apple iOS before 6 does not properly identify the host portion of a URL, which allows remote attackers to obtain sensitive information by leveraging the construction of an HTTP request with an incorrect hostname derived from a malformed URL.
12677 CVE-2012-3721 287 2012-09-20 2017-08-28
5.0
None Remote Low Not required Partial None None
Profile Manager in Apple Mac OS X before 10.7.5 does not properly perform authentication for the Device Management private interface, which allows attackers to enumerate managed devices via unspecified vectors.
12678 CVE-2012-3698 264 2012-07-26 2012-07-31
5.0
None Remote Low Not required Partial None None
Apple Xcode before 4.4 does not properly compose a designated requirement (DR) during signing of programs that lack bundle identifiers, which allows remote attackers to read keychain entries via a crafted app, as demonstrated by the keychain entries of a (1) helper tool or (2) command-line tool.
12679 CVE-2012-3693 2012-07-25 2012-09-21
5.0
None Remote Low Not required None Partial None
Incomplete blacklist vulnerability in WebKit in Apple Safari before 6.0 allows remote attackers to spoof domain names in URLs, and possibly conduct phishing attacks, by leveraging the availability of IDN support and Unicode fonts to construct unspecified homoglyphs.
12680 CVE-2012-3691 20 Bypass 2012-07-25 2012-09-21
5.8
None Remote Medium Not required Partial Partial None
WebKit in Apple Safari before 6.0 does not properly handle Cascading Style Sheets (CSS) property values, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
12681 CVE-2012-3689 20 Bypass 2012-07-25 2012-07-30
5.8
None Remote Medium Not required Partial Partial None
WebKit in Apple Safari before 6.0 does not properly handle drag-and-drop events, which allows user-assisted remote attackers to bypass the Same Origin Policy via a crafted web site.
12682 CVE-2012-3588 22 1 Dir. Trav. 2012-06-19 2017-08-28
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in preview.php in the Plugin Newsletter plugin 1.5 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the data parameter.
12683 CVE-2012-3570 119 DoS Overflow 2012-07-25 2016-11-28
5.7
None Local Network Medium Not required None None Complete
Buffer overflow in ISC DHCP 4.2.x before 4.2.4-P1, when DHCPv6 mode is enabled, allows remote attackers to cause a denial of service (segmentation fault and daemon exit) via a crafted client identifier parameter.
12684 CVE-2012-3568 DoS 2012-06-14 2017-08-28
5.0
None Remote Low Not required None None Partial
Opera before 12.00 Beta allows remote attackers to cause a denial of service (application crash) via crafted WebGL content, as demonstrated by a codeflow.org WebGL demo.
12685 CVE-2012-3567 DoS 2012-06-14 2017-08-28
5.0
None Remote Low Not required None None Partial
Opera before 12.00 Beta allows remote attackers to cause a denial of service (memory consumption or application hang) via an IFRAME element that uses the src="#" syntax to embed a parent document.
12686 CVE-2012-3565 DoS 2012-06-14 2017-08-28
5.0
None Remote Low Not required None None Partial
Opera before 12.00 Beta allows remote attackers to cause a denial of service (application crash) via crafted characters in domain names, as demonstrated by "IDNA2008 tests."
12687 CVE-2012-3564 DoS Overflow 2012-06-14 2017-08-28
5.0
None Remote Low Not required None None Partial
Opera before 12.00 Beta allows remote attackers to cause a denial of service (application hang) via an absolutely positioned wrap=off TEXTAREA element located next to an "overflow: auto" block element.
12688 CVE-2012-3563 DoS 2012-06-14 2017-08-28
5.0
None Remote Low Not required None None Partial
Opera before 12.00 Beta allows remote attackers to cause a denial of service (application crash) via a web page that contains invalid character encodings.
12689 CVE-2012-3557 264 +Info 2012-06-14 2012-06-15
5.0
None Remote Low Not required Partial None None
Opera before 11.65 does not properly restrict the reading of JSON strings, which allows remote attackers to perform cross-domain loading of JSON resources and consequently obtain sensitive information via a crafted web site.
12690 CVE-2012-3552 362 DoS 2012-10-03 2013-10-11
5.4
None Remote High Not required None None Complete
Race condition in the IP implementation in the Linux kernel before 3.0 might allow remote attackers to cause a denial of service (slab corruption and system crash) by sending packets to an application that sets socket options during the handling of network traffic.
12691 CVE-2012-3544 20 DoS 2013-06-01 2019-04-15
5.0
None Remote Low Not required None None Partial
Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer coding, which allows remote attackers to cause a denial of service by streaming data.
12692 CVE-2012-3540 20 2012-09-05 2017-08-28
5.8
None Remote Medium Not required Partial Partial None
Open redirect vulnerability in views/auth_forms.py in OpenStack Dashboard (Horizon) Essex (2012.1) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter to auth/login/. NOTE: this issue was originally assigned CVE-2012-3542 by mistake.
12693 CVE-2012-3534 119 DoS Overflow 2012-08-31 2018-10-30
5.0
None Remote Low Not required None None Partial
GNU Gatekeeper before 3.1 does not limit the number of connections to the status port, which allows remote attackers to cause a denial of service (connection and thread consumption) via a large number of connections.
12694 CVE-2012-3533 310 2012-08-31 2017-08-28
5.0
None Remote Low Not required None Partial None
The python SDK before 3.1.0.6 and CLI before 3.1.0.8 for oVirt 3.1 does not check the server SSL certificate against the client keys, which allows remote attackers to spoof a server via a man-in-the-middle (MITM) attack.
12695 CVE-2012-3526 DoS 2012-09-05 2017-08-28
5.0
None Remote Low Not required None None Partial
The reverse proxy add forward module (mod_rpaf) 0.5 and 0.6 for the Apache HTTP Server allows remote attackers to cause a denial of service (server or application crash) via multiple X-Forwarded-For headers in a request.
12696 CVE-2012-3525 20 2012-08-25 2013-06-14
5.8
None Remote Medium Not required Partial Partial None
s2s/out.c in jabberd2 2.2.16 and earlier does not verify that a request was made for an XMPP Server Dialback response, which allows remote XMPP servers to spoof domains via a (1) Verify Response or (2) Authorization Response.
12697 CVE-2012-3521 22 Dir. Trav. 2014-06-13 2014-06-13
5.0
None Remote Low Not required Partial None None
Multiple directory traversal vulnerabilities in the cssgen contrib module in GeSHi before 1.0.8.11 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) geshi-path or (2) geshi-lang-path parameter.
12698 CVE-2012-3519 200 +Info 2012-08-25 2013-08-21
5.0
None Remote Low Not required Partial None None
routerlist.c in Tor before 0.2.2.38 uses a different amount of time for relay-list iteration depending on which relay is chosen, which might allow remote attackers to obtain sensitive information about relay selection via a timing side-channel attack.
12699 CVE-2012-3518 119 DoS Overflow 2012-08-25 2013-08-21
5.0
None Remote Low Not required None None Partial
The networkstatus_parse_vote_from_string function in routerparse.c in Tor before 0.2.2.38 does not properly handle an invalid flavor name, which allows remote attackers to cause a denial of service (out-of-bounds read and daemon crash) via a crafted (1) vote document or (2) consensus document.
12700 CVE-2012-3517 399 DoS 2012-08-25 2013-08-21
5.0
None Remote Low Not required None None Partial
Use-after-free vulnerability in dns.c in Tor before 0.2.2.38 might allow remote attackers to cause a denial of service (daemon crash) via vectors related to failed DNS requests.
Total number of vulnerabilities : 23027   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 (This Page)255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.