CVE-2012-4981: Toshiba ConfigFree 8.0.38 has a CF7 File Remote Command Execution Vulnerability
Toshiba ConfigFree 8.0.38 has a CF7 File Remote Command Execution Vulnerability
Published Jan 23, 2020 · Updated Aug 6, 2024
CVE archive
January 2012
Browse CVE records published in January 2012, with severity, affected products, CWE, KEV, and source-backed vulnerability context.
Showing 50 of 484 matching CVEs · Page 6 of 10.
CVE-2012-4919: Gallery Plugin1.4 for WordPress has a Remote File Include Vulnerability
Gallery Plugin1.4 for WordPress has a Remote File Include Vulnerability
Published Jan 22, 2020 · Updated Aug 6, 2024
CVE-2012-4917: The TripAdvisor app 6.6 for iOS sends cleartext credentials, which allows remote attackers to obtain sensit...
The TripAdvisor app 6.6 for iOS sends cleartext credentials, which allows remote attackers to obtain sensitive information by sniffing the network.
Published Jan 26, 2013 · Updated Aug 6, 2024
CVE-2012-4900: Corel WordPerfect Office X6 16.0.0.388 has a DoS Vulnerability via untrusted pointer dereference
Corel WordPerfect Office X6 16.0.0.388 has a DoS Vulnerability via untrusted pointer dereference
Published Jan 23, 2020 · Updated Aug 6, 2024
CVE-2012-4918: Call of Duty Elite for iOS 2.0.1 does not properly validate the server SSL certificate, which allows remote...
Call of Duty Elite for iOS 2.0.1 does not properly validate the server SSL certificate, which allows remote attackers to obtain sensitive information via a Man-in-the-Middle (MITM) attack.
Published Jan 22, 2013 · Updated Aug 6, 2024
CVE-2012-4863: IBM WebSphere MQ 7.1 and 7.5: Queue manager has a DoS vulnerability
IBM WebSphere MQ 7.1 and 7.5: Queue manager has a DoS vulnerability
Published Jan 23, 2020 · Updated Aug 6, 2024
CVE-2012-4820: Unspecified vulnerability in the JRE component in IBM Java 7 SR2 and earlier, Java 6.0.1 SR3 and earlier, J...
Unspecified vulnerability in the JRE component in IBM Java 7 SR2 and earlier, Java 6.0.1 SR3 and earlier, Java 6 SR11 and earlier, Java 5 SR14 and earlier, and Java 142 SR13 FP13 and earlier; as used in IBM Rational Host On-Demand, Rational Change, Tivoli Monitoring, Smart Analytics System 5600, Tivoli Remote Control 5.1.2, WebSphere Real Time, Lotus Notes & Domino, Tivoli Storage Productivity Center, and Service Deliver Manager; and other products from other vendors such as Red Hat, when running under a security manager, allows remote attackers to gain privileges by modifying or removing the security manager via vectors related to "insecure use of the java.lang.reflect.Method invoke() method."
Published Jan 11, 2013 · Updated Aug 6, 2024
CVE-2012-4832: Information Services Framework (ISF) in IBM InfoSphere Information Server 8.1, 8.5 before FP3, and 8.7 and...
Information Services Framework (ISF) in IBM InfoSphere Information Server 8.1, 8.5 before FP3, and 8.7 and InfoSphere Business Glossary 8.1.1 and 8.1.2 does not have an off autocomplete attribute for the password field on the login page, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.
Published Jan 31, 2013 · Updated Aug 6, 2024
CVE-2012-4823: Unspecified vulnerability in the JRE component in IBM Java 7 SR2 and earlier, Java 6.0.1 SR3 and earlier, J...
Unspecified vulnerability in the JRE component in IBM Java 7 SR2 and earlier, Java 6.0.1 SR3 and earlier, Java 6 SR11 and earlier, Java 5 SR14 and earlier, and Java 142 SR13 FP13 and earlier; as used in IBM Rational Host On-Demand, Rational Change, Tivoli Monitoring, Smart Analytics System 5600, Tivoli Remote Control 5.1.2, WebSphere Real Time, Lotus Notes & Domino, Tivoli Storage Productivity Center, and Service Deliver Manager; and other products from other vendors such as Red Hat, allows remote attackers to execute arbitrary code via vectors related to "insecure use of the java.lang.ClassLoder defineClass() method."
Published Jan 11, 2013 · Updated Aug 6, 2024
CVE-2012-4819: Cross-site scripting (XSS) vulnerability in InfoSphere Business Glossary 8.1.1 and 8.1.2, InfoSphere DataSt...
Cross-site scripting (XSS) vulnerability in InfoSphere Business Glossary 8.1.1 and 8.1.2, InfoSphere DataStage Operation Console, InfoSphere Administration, and Reporting and Repository Management Web Console in IBM InfoSphere Information Server 8.1, 8.5 before FP3, and 8.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Published Jan 31, 2013 · Updated Aug 6, 2024
CVE-2012-4822: Multiple unspecified vulnerabilities in the JRE component in IBM Java 7 SR2 and earlier, Java 6.0.1 SR3 and...
Multiple unspecified vulnerabilities in the JRE component in IBM Java 7 SR2 and earlier, Java 6.0.1 SR3 and earlier, Java 6 SR11 and earlier, Java 5 SR14 and earlier, and Java 142 SR13 FP13 and earlier; as used in IBM Rational Host On-Demand, Rational Change, Tivoli Monitoring, Smart Analytics System 5600, Tivoli Remote Control 5.1.2, WebSphere Real Time, Lotus Notes & Domino, Tivoli Storage Productivity Center, and Service Deliver Manager; and other products from other vendors such as Red Hat, allow remote attackers to execute arbitrary code via vectors related to "insecure use [of] multiple methods in the java.lang.class class."
Published Jan 11, 2013 · Updated Aug 6, 2024
CVE-2012-4821: Multiple unspecified vulnerabilities in the JRE component in IBM Java 7 SR2 and earlier, Java 6.0.1 SR3 and...
Multiple unspecified vulnerabilities in the JRE component in IBM Java 7 SR2 and earlier, Java 6.0.1 SR3 and earlier, Java 6 SR11 and earlier, Java 5 SR14 and earlier, and Java 142 SR13 FP13 and earlier; as used in IBM Rational Host On-Demand, Rational Change, Tivoli Monitoring, Smart Analytics System 5600, Tivoli Remote Control 5.1.2, WebSphere Real Time, Lotus Notes & Domino, Tivoli Storage Productivity Center, and Service Deliver Manager; and other products from other vendors such as Red Hat, allow remote attackers to execute arbitrary code via "insecure use" of the (1) java.lang.Class getDeclaredMethods or nd (2) java.lang.reflect.AccessibleObject setAccessible() methods.
Published Jan 11, 2013 · Updated Aug 6, 2024
CVE-2012-4761: A Privilege Escalation vulnerability exists in the unquoted Service Binary in SDPAgent or SDBAgent in Safen...
A Privilege Escalation vulnerability exists in the unquoted Service Binary in SDPAgent or SDBAgent in Safend Data Protector Agent 3.4.5586.9772, which could let a local malicious user obtain privileges.
Published Jan 13, 2020 · Updated Aug 6, 2024
CVE-2012-4767: An issue exists in Safend Data Protector Agent 3.4.5586.9772 in the securitylayer.log file in the logs.9972...
An issue exists in Safend Data Protector Agent 3.4.5586.9772 in the securitylayer.log file in the logs.9972 directory, which could let a malicious user decrypt and potentially change the Safend security policies applied to the machine.
Published Jan 13, 2020 · Updated Aug 6, 2024
CVE-2012-4750: A Code Execution vulnerability exists in the memcpy function when processing AMF requests in Ezhometech EzS...
A Code Execution vulnerability exists in the memcpy function when processing AMF requests in Ezhometech EzServer 7.0, which could let a remote malicious user execute arbitrary code or cause a Denial of Service
Published Jan 13, 2020 · Updated Aug 6, 2024
CVE-2012-4556: The token processing system (pki-tps) in Red Hat Certificate System (RHCS) before 8.1.3 allows remote attac...
The token processing system (pki-tps) in Red Hat Certificate System (RHCS) before 8.1.3 allows remote attackers to cause a denial of service (Apache httpd web server child process restart) via certain unspecified empty search fields in a user certificate search query.
Published Jan 4, 2013 · Updated Aug 6, 2024
CVE-2012-4760: A Privilege Escalation vulnerability exists in the SDBagent service in Safend Data Protector Agent 3.4.5586...
A Privilege Escalation vulnerability exists in the SDBagent service in Safend Data Protector Agent 3.4.5586.9772, which could let a local malicious user obtain privileges.
Published Jan 13, 2020 · Updated Aug 6, 2024
CVE-2012-4543: Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Certificate System (RHCS) before 8.1.3 allow...
Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Certificate System (RHCS) before 8.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) pageStart or (2) pageSize to the displayCRL script, or (3) nonce variable to the profileProcess script.
Published Jan 4, 2013 · Updated Aug 6, 2024
CVE-2012-4555: The token processing system (pki-tps) in Red Hat Certificate System (RHCS) before 8.1.3 does not properly h...
The token processing system (pki-tps) in Red Hat Certificate System (RHCS) before 8.1.3 does not properly handle interruptions of token format operations, which allows remote attackers to cause a denial of service (NULL pointer dereference and Apache httpd web server child process crash) via unspecified vectors.
Published Jan 4, 2013 · Updated Aug 6, 2024
CVE-2012-4696: Buffer overflow in Beijer ADP 6.5.0-180_R1967 and 6.5.1-186_R2942, and H-Designer 6.5.0 B180_R1967, allows...
Buffer overflow in Beijer ADP 6.5.0-180_R1967 and 6.5.1-186_R2942, and H-Designer 6.5.0 B180_R1967, allows local users to gain privileges by inserting a long string into a DLL file.
Published Jan 28, 2013 · Updated Aug 6, 2024
CVE-2012-4574: Pulp in Red Hat CloudForms before 1.1 uses world-readable permissions for pulp.conf, which allows local use...
Pulp in Red Hat CloudForms before 1.1 uses world-readable permissions for pulp.conf, which allows local users to read the administrative password by reading this file.
Published Jan 4, 2013 · Updated Aug 6, 2024
CVE-2012-4606: Citrix XenServer 4.1, 6.0, 5.6 SP2, 5.6 Feature Pack 1, 5.6 Common Criteria, 5.6, 5.5, 5.0, and 5.0 Update...
Citrix XenServer 4.1, 6.0, 5.6 SP2, 5.6 Feature Pack 1, 5.6 Common Criteria, 5.6, 5.5, 5.0, and 5.0 Update 3 contains a Local Privilege Escalation Vulnerability which could allow local users with access to a guest operating system to gain elevated privileges.
Published Jan 23, 2020 · Updated Aug 6, 2024
CVE-2012-4603: Citrix XenApp Online Plug-in for Windows 12.1 and earlier, and Citrix Receiver for Windows 3.2 and earlier...
Citrix XenApp Online Plug-in for Windows 12.1 and earlier, and Citrix Receiver for Windows 3.2 and earlier could allow remote attackers to execute arbitrary code by convincing a target to open a specially crafted file from an SMB or WebDAV fileserver.
Published Jan 10, 2020 · Updated Aug 6, 2024
CVE-2012-4545: The http_negotiate_create_context function in protocol/http/http_negotiate.c in ELinks 0.12 before 0.12pre6...
The http_negotiate_create_context function in protocol/http/http_negotiate.c in ELinks 0.12 before 0.12pre6, when using HTTP Negotiate or GSS-Negotiate authentication, delegates user credentials through GSSAPI, which allows remote servers to authenticate as the client via the delegated credentials.
Published Jan 3, 2013 · Updated Aug 6, 2024
CVE-2012-4451: Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attac...
Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified input to (1) Debug, (2) Feed\PubSubHubbub, (3) Log\Formatter\Xml, (4) Tag\Cloud\Decorator, (5) Uri, (6) View\Helper\HeadStyle, (7) View\Helper\Navigation\Sitemap, or (8) View\Helper\Placeholder\Container\AbstractStandalone, related to Escaper.
Published Jan 3, 2020 · Updated Aug 6, 2024
CVE-2012-4434: fwknop before 2.0.3 allow remote authenticated users to cause a denial of service (server crash) or possibl...
fwknop before 2.0.3 allow remote authenticated users to cause a denial of service (server crash) or possibly execute arbitrary code.
Published Jan 9, 2020 · Updated Aug 6, 2024
CVE-2012-4461: The KVM subsystem in the Linux kernel before 3.6.9, when running on hosts that use qemu userspace without X...
The KVM subsystem in the Linux kernel before 3.6.9, when running on hosts that use qemu userspace without XSAVE, allows local users to cause a denial of service (kernel OOPS) by using the KVM_SET_SREGS ioctl to set the X86_CR4_OSXSAVE bit in the guest cr4 register, then calling the KVM_RUN ioctl.
Published Jan 22, 2013 · Updated Aug 6, 2024
CVE-2012-4414: Multiple SQL injection vulnerabilities in the replication code in Oracle MySQL possibly before 5.5.29, and...
Multiple SQL injection vulnerabilities in the replication code in Oracle MySQL possibly before 5.5.29, and MariaDB 5.1.x through 5.1.62, 5.2.x through 5.2.12, 5.3.x through 5.3.7, and 5.5.x through 5.5.25, allow remote authenticated users to execute arbitrary SQL commands via vectors related to the binary log. NOTE: as of 20130116, Oracle has not commented on claims from a downstream vendor that the fix in MySQL 5.5.29 is incomplete.
Published Jan 22, 2013 · Updated Aug 6, 2024
CVE-2012-4383: contao prior to 2.11.4 has a sql injection vulnerability
contao prior to 2.11.4 has a sql injection vulnerability
Published Jan 29, 2020 · Updated Aug 6, 2024
CVE-2012-4284: A Privilege Escalation vulnerability exists in Viscosity 1.4.1 on Mac OS X due to a path name validation is...
A Privilege Escalation vulnerability exists in Viscosity 1.4.1 on Mac OS X due to a path name validation issue in the setuid-set ViscosityHelper binary, which could let a remote malicious user execute arbitrary code
Published Jan 10, 2020 · Updated Aug 6, 2024
CVE-2012-4030: Chamilo before 1.8.8.6 does not adequately handle user supplied input by the index.php script, which could...
Chamilo before 1.8.8.6 does not adequately handle user supplied input by the index.php script, which could allow remote attackers to delete arbitrary files.
Published Jan 10, 2020 · Updated Aug 6, 2024
CVE-2012-3806: Samsung Kies before 2.5.0.12094_27_11 contains a NULL pointer dereference vulnerability which could allow r...
Samsung Kies before 2.5.0.12094_27_11 contains a NULL pointer dereference vulnerability which could allow remote attackers to perform a denial of service.
Published Jan 9, 2020 · Updated Aug 6, 2024
CVE-2012-3822: Arial Campaign Enterprise before 11.0.551 has unauthorized access to the User-Edit.asp page, which allows r...
Arial Campaign Enterprise before 11.0.551 has unauthorized access to the User-Edit.asp page, which allows remote attackers to enumerate users' credentials.
Published Jan 10, 2020 · Updated Aug 6, 2024
CVE-2012-3809: Samsung Kies before 2.5.0.12094_27_11 has arbitrary directory modification.
Samsung Kies before 2.5.0.12094_27_11 has arbitrary directory modification.
Published Jan 9, 2020 · Updated Aug 6, 2024
CVE-2012-3821: A Security Bypass vulnerability exists in the activate.asp page in Arial Software Campaign Enterprise 11.0....
A Security Bypass vulnerability exists in the activate.asp page in Arial Software Campaign Enterprise 11.0.551, which could let a remote malicious user modify the SerialNumber field.
Published Jan 10, 2020 · Updated Aug 6, 2024
CVE-2012-3807: Samsung Kies before 2.5.0.12094_27_11 has arbitrary file execution.
Samsung Kies before 2.5.0.12094_27_11 has arbitrary file execution.
Published Jan 9, 2020 · Updated Aug 6, 2024
CVE-2012-3808: Samsung Kies before 2.5.0.12094_27_11 has arbitrary file modification.
Samsung Kies before 2.5.0.12094_27_11 has arbitrary file modification.
Published Jan 9, 2020 · Updated Aug 6, 2024
CVE-2012-3810: Samsung Kies before 2.5.0.12094_27_11 has registry modification.
Samsung Kies before 2.5.0.12094_27_11 has registry modification.
Published Jan 9, 2020 · Updated Aug 6, 2024
CVE-2012-3824: In Arial Campaign Enterprise before 11.0.551, multiple pages are accessible without authentication or autho...
In Arial Campaign Enterprise before 11.0.551, multiple pages are accessible without authentication or authorization.
Published Jan 10, 2020 · Updated Aug 6, 2024
CVE-2012-3823: Arial Campaign Enterprise before 11.0.551 stores passwords in clear text and these may be retrieved.
Arial Campaign Enterprise before 11.0.551 stores passwords in clear text and these may be retrieved.
Published Jan 10, 2020 · Updated Aug 6, 2024
CVE-2012-3538: Pulp in Red Hat CloudForms before 1.1 logs administrative passwords in a world-readable file, which allows...
Pulp in Red Hat CloudForms before 1.1 logs administrative passwords in a world-readable file, which allows local users to read pulp administrative passwords by reading production.log.
Published Jan 4, 2013 · Updated Aug 6, 2024
CVE-2012-3490: The (1) my_popenv_impl and (2) my_spawnv functions in src/condor_utils/my_popen.cpp and the (3) systemComma...
The (1) my_popenv_impl and (2) my_spawnv functions in src/condor_utils/my_popen.cpp and the (3) systemCommand function in condor_vm-gahp/vmgahp_common.cpp in Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 does not properly check the return value of setuid calls, which might cause a subprocess to be created with root privileges and allow remote attackers to gain privileges via unspecified vectors.
Published Jan 9, 2020 · Updated Aug 6, 2024
CVE-2012-3364: Multiple stack-based buffer overflows in the Near Field Communication Controller Interface (NCI) in the Lin...
Multiple stack-based buffer overflows in the Near Field Communication Controller Interface (NCI) in the Linux kernel before 3.4.5 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via incoming frames with crafted length fields.
Published Jan 22, 2013 · Updated Aug 6, 2024
CVE-2012-3310: IBM Tivoli Federated Identity Manager (TFIM) before 6.1.1.14, 6.2.0 before 6.2.0.12, and 6.2.1 before 6.2.1...
IBM Tivoli Federated Identity Manager (TFIM) before 6.1.1.14, 6.2.0 before 6.2.0.12, and 6.2.1 before 6.2.1.4 allows context-dependent attackers to discover (1) a cleartext LDAP Bind Password, (2) keystore passwords, (3) a cleartext Basic Authentication password from a client, or (4) a cleartext user password by leveraging a logging configuration with a log trace setting of all.
Published Jan 17, 2013 · Updated Aug 6, 2024
CVE-2012-3192: Unspecified vulnerability in the PeopleSoft PeopleTools component in Oracle PeopleSoft Products 8.51 and 8....
Unspecified vulnerability in the PeopleSoft PeopleTools component in Oracle PeopleSoft Products 8.51 and 8.52 allows remote authenticated users to affect integrity, related to Rich Text Editor (RTE).
Published Jan 17, 2013 · Updated Aug 6, 2024
CVE-2012-3169: Unspecified vulnerability in the Siebel CRM component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote at...
Unspecified vulnerability in the Siebel CRM component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect availability via unknown vectors related to Siebel Core - Server Infrastructure, a different vulnerability than CVE-2012-3170.
Published Jan 17, 2013 · Updated Aug 6, 2024
CVE-2012-3218: Unspecified vulnerability in the Human Resources component in Oracle E-Business Suite 11.5.10.2, 12.0.6, an...
Unspecified vulnerability in the Human Resources component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.3 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Security Groups.
Published Jan 17, 2013 · Updated Aug 6, 2024
CVE-2012-3219: Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Gr...
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control EM Base Platform 10.2.0.5 and 11.1.0.1; EM DB Control 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3; and EM Plugin for DB 12.1.0.1 and 12.1.0.2 allows remote attackers to affect integrity via unknown vectors related to Storage Management.
Published Jan 17, 2013 · Updated Aug 6, 2024
CVE-2012-3190: Unspecified vulnerability in the Oracle Universal Work Queue component in Oracle E-Business Suite 11.5.10.2...
Unspecified vulnerability in the Oracle Universal Work Queue component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality and integrity, related to UWQ Server Issues.
Published Jan 17, 2013 · Updated Aug 6, 2024
CVE-2012-3170: Unspecified vulnerability in the Siebel CRM component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote at...
Unspecified vulnerability in the Siebel CRM component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect availability via unknown vectors related to Siebel Core - Server Infrastructure, a different vulnerability than CVE-2012-3169.
Published Jan 17, 2013 · Updated Aug 6, 2024