The do_tmem_get function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service (CPU hang and host crash) via unspecified vectors related to a spinlock being held in the "bad_copy…

CVE-2012-6034NONECVSS 0.0EG 0.0

2012-11-23

The (1) tmemc_save_get_next_page and (2) tmemc_save_get_next_inv functions and the (3) TMEMC_SAVE_GET_POOL_UUID sub-operation in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 "do not check incoming guest output buffer pointers," …

CVE-2012-6035NONECVSS 0.0EG 0.0

2012-11-23

The do_tmem_destroy_pool function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 does not properly validate pool ids, which allows local guest OS users to cause a denial of service (memory corruption and host crash) or execute …

CVE-2012-6044NONECVSS 0.0EG 0.0

2012-11-26

M-Player 0.4 allows remote attackers to cause a denial of service (crash) via a crafted MP3 file.

CVE-2012-6059NONECVSS 0.0EG 0.0

2012-12-05

The dissect_isakmp function in epan/dissectors/packet-isakmp.c in the ISAKMP dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 uses an incorrect data structure to determine IKEv2 decryption parameters, which allows remote a…

CVE-2012-6062NONECVSS 0.0EG 0.0

2012-12-05

The dissect_rtcp_app function in epan/dissectors/packet-rtcp.c in the RTCP dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.

CVE-2012-6070HIGHCVSS 7.5EG 7.5

2019-11-19

Falconpl before 0.9.6.9-git20120606 misuses the libcurl API which may allow remote attackers to interfere with security checks.

CVE-2012-6085NONECVSS 0.0EG 0.0

2013-01-24

The read_block function in g10/import.c in GnuPG 1.4.x before 1.4.13 and 2.0.x through 2.0.19, when importing a key, allows remote attackers to corrupt the public keyring database or cause a denial of service (application crash) via a craf…

CVE-2012-6087NONECVSS 0.0EG 0.0

2013-09-16

repository/s3/S3.php in the Amazon S3 library in Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subj…

CVE-2012-6101NONECVSS 0.0EG 0.0

2013-01-27

Multiple open redirect vulnerabilities in Moodle 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors related to (1) backup/…

CVE-2012-6111HIGHCVSS 7.5EG 7.5

2019-12-20

gnome-keyring does not discard stored secrets when using gnome_keyring_lock_all_sync function

CVE-2012-6123MEDIUMCVSS 6.5EG 6.5

2019-10-31

Chicken before 4.8.0 does not properly handle NUL bytes in certain strings, which allows an attacker to conduct "poisoned NUL byte attack."

CVE-2012-6125CRITICALCVSS 9.8EG 9.8

2019-10-31

Chicken before 4.8.0 is susceptible to algorithmic complexity attacks related to hash table collisions.

CVE-2012-6135HIGHCVSS 7.5EG 7.5

2019-11-19

RubyGems passenger 4.0.0 betas 1 and 2 allows remote attackers to delete arbitrary files during the startup process.

CVE-2012-6150NONECVSS 0.0EG 0.0

2013-12-03

The winbind_name_list_to_sid_string_list function in nsswitch/pam_winbind.c in Samba through 4.1.2 handles invalid require_membership_of group names by accepting authentication by any user, which allows remote authenticated users to bypass…

CVE-2012-6152NONECVSS 0.0EG 0.0

2014-02-06

The Yahoo! protocol plugin in libpurple in Pidgin before 2.10.8 does not properly validate UTF-8 data, which allows remote attackers to cause a denial of service (application crash) via crafted byte sequences.

CVE-2012-6301NONECVSS 0.0EG 0.0

2012-12-10

The Browser application in Android 4.0.3 allows remote attackers to cause a denial of service (application crash) via a crafted market: URI in the SRC attribute of an IFRAME element.

CVE-2012-6392NONECVSS 0.0EG 0.0

2013-01-17

Cisco Prime LAN Management Solution (LMS) 4.1 through 4.2.2 on Linux does not properly validate authentication and authorization requests in TCP sessions, which allows remote attackers to execute arbitrary commands via a crafted session, a…

CVE-2012-6395NONECVSS 0.0EG 0.0

2013-01-18

Cisco Adaptive Security Appliances (ASA) devices with firmware 8.4 do not properly validate unspecified input related to UNC share pathnames, which allows remote authenticated users to cause a denial of service (device crash) via unknown v…

CVE-2012-6399NONECVSS 0.0EG 0.0

2013-05-27

Cisco WebEx 4.1 on iOS does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an …

CVE-2012-6461NONECVSS 0.0EG 0.0

2013-01-02

The X.509 certificate-validation functionality in the https implementation in Opera before 12.10 allows remote attackers to trigger a false indication of successful revocation-status checking by causing a failure of a single checking servi…

CVE-2012-6499NONECVSS 0.0EG 0.0

2013-01-12

Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect_to par…

CVE-2012-6501NONECVSS 0.0EG 0.0

2013-01-12

The KillProcess method in the HP PKI ActiveX control (HPPKI.ocx) before 1.2.0.1 allows remote attackers to cause a denial of service (kill process) via the partial or full name of a process.

CVE-2012-6554NONECVSS 0.0EG 0.0

2013-05-23

functions/html_to_text.php in the Chat module before 1.5.2 for activeCollab allows remote authenticated users to execute arbitrary PHP code via the message[message_text] parameter to chat/add_messag, which is not properly handled when exec…

CVE-2012-6560NONECVSS 0.0EG 0.0

2013-05-23

SQL injection vulnerability in deviceadd.php in FreeNAC 3.02 allows remote attackers to execute arbitrary SQL commands via the status parameter.

CVE-2012-6567NONECVSS 0.0EG 0.0

2013-06-17

REDCap before 4.14.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the logic of a custom rule.

CVE-2012-6597NONECVSS 0.0EG 0.0

2013-08-31

Palo Alto Networks PAN-OS before 3.1.11 and 4.0.x before 4.0.9 allows remote authenticated users to cause a denial of service (management-server crash) by using the command-line interface for a crafted command, aka Ref ID 35254.

CVE-2012-6619NONECVSS 0.0EG 0.0

2014-03-06

The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to cause a denial of service (crash) or read system memory via a crafted BSON object in the column name in an insert comm…

CVE-2012-6637NONECVSS 0.0EG 0.0

2014-03-03

Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier do not anchor the end of domain-name regular expressions, which allows remote attackers to bypass a whitelist protection mechanism via a domain name that contains an acc…

CVE-2012-6647NONECVSS 0.0EG 0.0

2014-05-26

The futex_wait_requeue_pi function in kernel/futex.c in the Linux kernel before 3.5.1 does not ensure that calls have two different futex addresses, which allows local users to cause a denial of service (NULL pointer dereference and system…

CVE-2012-6656NONECVSS 0.0EG 0.0

2014-12-05

iconvdata/ibm930.c in GNU C Library (aka glibc) before 2.16 allows context-dependent attackers to cause a denial of service (out-of-bounds read) via a multibyte character value of "0xffff" to the iconv function when converting IBM930 encod…

CVE-2012-6687NONECVSS 0.0EG 0.0

2015-02-19

FastCGI (aka fcgi and libfcgi) 2.4.0 allows remote attackers to cause a denial of service (segmentation fault and crash) via a large number of connections.

CVE-2013-0004NONECVSS 0.0EG 0.0

2013-01-09

Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly validate the permissions of objects in memory, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser app…

CVE-2013-0005NONECVSS 0.0EG 0.0

2013-01-09

The WCF Replace function in the Open Data (aka OData) protocol implementation in Microsoft .NET Framework 3.5, 3.5 SP1, 3.5.1, and 4, and the Management OData IIS Extension on Windows Server 2012, allows remote attackers to cause a denial …

CVE-2013-0078NONECVSS 0.0EG 0.0

2013-04-09

The Microsoft Antimalware Client in Windows Defender on Windows 8 and Windows RT uses an incorrect pathname for MsMpEng.exe, which allows local users to gain privileges via a crafted application, aka "Microsoft Antimalware Improper Pathnam…

CVE-2013-0081NONECVSS 0.0EG 0.0

2013-09-11

Microsoft SharePoint Portal Server 2003 SP3 and SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013 do not properly process unassigned workflows, which allows remote attackers to cause a denial of service (W3WP process hang) via a craft…

CVE-2013-0120NONECVSS 0.0EG 0.0

2013-02-24

The web interface on Dell PowerConnect 6248P switches allows remote attackers to cause a denial of service (device crash) via a malformed request.

CVE-2013-0122NONECVSS 0.0EG 0.0

2013-04-22

The avast! Mobile Security application before 2.0.4400 for Android allows attackers to cause a denial of service (application crash) via a crafted application that sends an intent to com.avast.android.mobilesecurity.app.scanner.DeleteFileA…

CVE-2013-0165HIGHCVSS 7.3EG 7.3

2019-11-01

cartridges/openshift-origin-cartridge-mongodb-2.2/info/bin/dump.sh in OpenShift does not properly create files in /tmp.

CVE-2013-0178MEDIUMCVSS 5.5EG 5.5

2019-11-01

Insecure temporary file vulnerability in Redis before 2.6 related to /tmp/redis-%p.vm.

CVE-2013-0180MEDIUMCVSS 5.5EG 5.5

2019-11-01

Insecure temporary file vulnerability in Redis 2.6 related to /tmp/redis.ds.

CVE-2013-0190NONECVSS 0.0EG 0.0

2013-02-13

The xen_failsafe_callback function in Xen for the Linux kernel 2.6.23 and other versions, when running a 32-bit PVOPS guest, allows local users to cause a denial of service (guest crash) by triggering an iret fault, leading to use of an in…

CVE-2013-0198NONECVSS 0.0EG 0.0

2013-03-05

Dnsmasq before 2.66test2, when used with certain libvirt configurations, replies to queries from prohibited interfaces, which allows remote attackers to cause a denial of service (traffic amplification) via spoofed TCP based DNS queries. …

CVE-2013-0213NONECVSS 0.0EG 0.0

2013-02-02

The Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.21, 3.6.x before 3.6.12, and 4.x before 4.0.2 allows remote attackers to conduct clickjacking attacks via a (1) FRAME or (2) IFRAME element.

CVE-2013-0216NONECVSS 0.0EG 0.0

2013-02-18

The Xen netback functionality in the Linux kernel before 3.7.8 allows guest OS users to cause a denial of service (loop) by triggering ring pointer corruption.

CVE-2013-0221NONECVSS 0.0EG 0.0

2013-11-23

The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string to the sort command, when using the (1) -d or (2) -M switch, which triggers a …

CVE-2013-0238NONECVSS 0.0EG 0.0

2013-02-13

The try_parse_v4_netmask function in hostmask.c in IRCD-Hybrid before 8.0.6 does not properly validate masks, which allows remote attackers to cause a denial of service (crash) via a mask that causes a negative number to be parsed.

CVE-2013-0243HIGHCVSS 7.4EG 7.4

2019-12-05

haskell-tls-extra before 0.6.1 has Basic Constraints attribute vulnerability may lead to Man in the Middle attacks on TLS connections

CVE-2013-0252NONECVSS 0.0EG 0.0

2013-03-12

boost::locale::utf::utf_traits in the Boost.Locale library in Boost 1.48 through 1.52 does not properly detect certain invalid UTF-8 sequences, which might allow remote attackers to bypass input validation protection mechanisms via crafted…

CVE-2013-0255NONECVSS 0.0EG 0.0

2013-02-13

PostgreSQL 9.2.x before 9.2.3, 9.1.x before 9.1.8, 9.0.x before 9.0.12, 8.4.x before 8.4.16, and 8.3.x before 8.3.23 does not properly declare the enum_recv function in backend/utils/adt/enum.c, which causes it to be invoked with incorrect…

CWE-20— Improper Input Validation

CVEs classified under CWE-20page 45 of 229

Map vulnerabilities like CWE-20 to your infrastructure