Search
Total
2412 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2012-2185 | 1 Ibm | 6 Change And Configuration Management Database, Maximo Asset Management, Maximo Service Desk and 3 more | 2017-08-29 | 4.0 MEDIUM | N/A |
| IBM Maximo Asset Management 6.2 through 7.5, as used in SmartCloud Control Desk, Tivoli Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and Change and Configuration Management Database (CCMDB), allows remote authenticated users to obtain sensitive information via unspecified vectors. | |||||
| CVE-2012-2168 | 1 Ibm | 1 Rational Clearquest | 2017-08-29 | 4.0 MEDIUM | N/A |
| IBM Rational ClearQuest 7.1.x before 7.1.2.7 and 8.x before 8.0.0.3 allows remote authenticated users to obtain sensitive stack-trace information from CM server error messages via an invalid parameter. | |||||
| CVE-2012-2165 | 1 Ibm | 1 Rational Clearquest | 2017-08-29 | 3.5 LOW | N/A |
| IBM Rational ClearQuest 7.1.x before 7.1.2.7 and 8.x before 8.0.0.3, when ClearQuest Authentication is enabled, allows remote authenticated users to read password hashes via a user query. | |||||
| CVE-2012-1812 | 1 C3-ilex | 1 Eoscada | 2017-08-29 | 5.0 MEDIUM | N/A |
| eosfailoverservice.exe in C3-ilex EOScada before 11.0.19.2 allows remote attackers to obtain sensitive cleartext information via a session on TCP port 12000. | |||||
| CVE-2012-1466 | 1 Netmechanica | 1 Netdecision | 2017-08-29 | 5.0 MEDIUM | N/A |
| The Traffic Grapher Server for NetMechanica NetDecision before 4.6.1 allows remote attackers to obtain the source code of NtDecision script files with a .nd extension via an invalid version number in an HTTP request, as demonstrated using default.nd. NOTE: some of these details are obtained from third party information. | |||||
| CVE-2012-1223 | 1 Rabidhamster | 1 R2\/extreme | 2017-08-29 | 5.0 MEDIUM | N/A |
| RabidHamster R2/Extreme 1.65 and earlier uses a small search space of values for the PIN number, which allows remote attackers to obtain the PIN number via a brute force attack. | |||||
| CVE-2012-0959 | 1 Remote Login Service Hackers | 1 Remote Login Service | 2017-08-29 | 2.1 LOW | N/A |
| Remote Login Service (RLS) 1.0.0 does not properly clear account information when switching users, which might allow physically proximate users to obtain login credentials. | |||||
| CVE-2012-0949 | 1 Canonical | 1 Ubuntu Linux | 2017-08-29 | 5.0 MEDIUM | N/A |
| The Apport hook in Update Manager as used by Ubuntu 12.04 LTS, 11.10, and 11.04 uploads certain system state archive files when reporting bugs to Launchpad, which allows remote attackers to read repository credentials by viewing a public bug report. | |||||
| CVE-2012-0818 | 1 Redhat | 1 Resteasy | 2017-08-29 | 5.0 MEDIUM | N/A |
| RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DOM document, aka an XML external entity (XXE) injection attack. | |||||
| CVE-2012-0744 | 1 Ibm | 1 Rational Clearquest | 2017-08-29 | 5.0 MEDIUM | N/A |
| IBM Rational ClearQuest 7.1.x through 7.1.2.7 and 8.x through 8.0.0.3 allows remote attackers to obtain potentially sensitive information via a request to a (1) snoop, (2) hello, (3) ivt/, (4) hitcount, (5) HitCount.jsp, (6) HelloHTMLError.jsp, (7) HelloHTML.jsp, (8) HelloVXMLError.jsp, (9) HelloVXML.jsp, (10) HelloWMLError.jsp, (11) HelloWML.jsp, or (12) cqweb/j_security_check sample script. | |||||
| CVE-2012-0742 | 1 Ibm | 1 Tivoli Event Pump | 2017-08-29 | 1.9 LOW | N/A |
| IBM Tivoli Event Pump 4.2.2, when the LOG_REQUESTS and VALIDATE_SOAP_USERS options are enabled, places credentials into the AOPSCLOG (aka AOPLOG) data set, which allows local users to obtain sensitive information by reading the data. | |||||
| CVE-2012-0731 | 1 Ibm | 1 Rational Appscan | 2017-08-29 | 6.8 MEDIUM | N/A |
| IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 does not prevent service-account impersonation, which allows remote authenticated users to read arbitrary files via unspecified vectors. | |||||
| CVE-2011-4760 | 1 Parallels | 1 Parallels Plesk Small Business Panel | 2017-08-29 | 5.0 MEDIUM | N/A |
| Parallels Plesk Small Business Panel 10.2.0 has web pages containing e-mail addresses that are not intended for correspondence about the local application deployment, which allows remote attackers to obtain potentially sensitive information by reading a page, as demonstrated by smb/email-address/list and certain other files. | |||||
| CVE-2011-4759 | 1 Parallels | 1 Parallels Plesk Small Business Panel | 2017-08-29 | 5.0 MEDIUM | N/A |
| Parallels Plesk Small Business Panel 10.2.0 generates web pages containing external links in response to GET requests with query strings for client@1/domain@1/hosting/file-manager/ and certain other files, which makes it easier for remote attackers to obtain sensitive information by reading (1) web-server access logs or (2) web-server Referer logs, related to a "cross-domain Referer leakage" issue. | |||||
| CVE-2011-4756 | 1 Parallels | 1 Parallels Plesk Small Business Panel | 2017-08-29 | 5.0 MEDIUM | N/A |
| Parallels Plesk Small Business Panel 10.2.0 does not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, as demonstrated by cookies used by domains/sitebuilder_edit.php and certain other files. | |||||
| CVE-2011-4751 | 1 Smartertools | 1 Smarterstats | 2017-08-29 | 5.0 MEDIUM | N/A |
| SmarterTools SmarterStats 6.2.4100 generates web pages containing external links in response to GET requests with query strings for frmGettingStarted.aspx, which makes it easier for remote attackers to obtain sensitive information by reading (1) web-server access logs or (2) web-server Referer logs, related to a "cross-domain Referer leakage" issue. | |||||
| CVE-2011-4107 | 1 Phpmyadmin | 1 Phpmyadmin | 2017-08-29 | 4.3 MEDIUM | N/A |
| The simplexml_load_string function in the XML import plug-in (libraries/import/xml.php) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before 3.3.10.5 allows remote authenticated users to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack. | |||||
| CVE-2011-3975 | 2 Google, Htc | 4 Android, Evo 3d, Evo 4g and 1 more | 2017-08-29 | 2.6 LOW | N/A |
| A certain HTC update for Android 2.3.4 build GRJ22, when the Sense interface is used on the HTC EVO 3D, EVO 4G, ThunderBolt, and unspecified other devices, provides the HtcLoggers.apk application, which allows user-assisted remote attackers to obtain a list of telephone numbers from a log, and other sensitive information, by leveraging the android.permission.INTERNET application permission and establishing TCP sessions to 127.0.0.1 on port 65511 and a second port. | |||||
| CVE-2011-3829 | 1 Sitracker | 1 Support Incident Tracker | 2017-08-29 | 4.0 MEDIUM | N/A |
| ftp_upload_file.php in Support Incident Tracker (aka SiT!) 3.65 allows remote authenticated users to obtain sensitive information via the file name, which reveals the installation path in an error message. | |||||
| CVE-2011-3778 | 1 Phpgedview | 1 Phpgedview | 2017-08-29 | 5.0 MEDIUM | N/A |
| PhpGedView 4.2.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by serviceClientTest.php and certain other files. | |||||
| CVE-2011-3777 | 1 Phpfreechat | 1 Phpfreechat | 2017-08-29 | 5.0 MEDIUM | N/A |
| phpFreeChat 1.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by themes/zilveer/style.css.php and certain other files. | |||||
| CVE-2011-3776 | 1 Musawir Ali | 1 Phpformgenerator | 2017-08-29 | 5.0 MEDIUM | N/A |
| phpFormGenerator 2.09 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by forms/process.php. | |||||
| CVE-2011-3775 | 1 Litoweb | 1 Phpfilenavigator | 2017-08-29 | 5.0 MEDIUM | N/A |
| PHPfileNavigator 2.3.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by xestion/varios/logs.inc.php and certain other files. | |||||
| CVE-2011-3774 | 1 Bishop Bettini | 1 Phpesp | 2017-08-29 | 5.0 MEDIUM | N/A |
| php Easy Survey Package (phpESP) 2.1.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by public/landing.php and certain other files. | |||||
| CVE-2011-3773 | 1 Phpdevshell | 1 Phpdevshell | 2017-08-29 | 5.0 MEDIUM | N/A |
| PHPDevShell 3.0.0-Beta-4b allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by gzip.php. | |||||
| CVE-2011-3770 | 1 Phpalbum | 1 Phpalbum | 2017-08-29 | 5.0 MEDIUM | N/A |
| phpAlbum 0.4.1.14 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by themes/Flowing_Dark/parameters.tpl.php and certain other files. | |||||
| CVE-2011-3771 | 1 Gnu | 1 Phpbook | 2017-08-29 | 5.0 MEDIUM | N/A |
| phpBook 2.1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by doc/update_smilies_1.50-1.60.php and certain other files. | |||||
| CVE-2011-3766 | 1 Orangehrm | 1 Orangehrm | 2017-08-29 | 5.0 MEDIUM | N/A |
| OrangeHRM 2.6.0.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by themes/orange/menu/Menu.php and certain other files. | |||||
| CVE-2011-3769 | 1 Blondish | 1 Phpads | 2017-08-29 | 5.0 MEDIUM | N/A |
| PHPads 2.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by ads.inc.php. | |||||
| CVE-2011-3768 | 1 Phorum | 1 Phorum | 2017-08-29 | 5.0 MEDIUM | N/A |
| Phorum 5.2.15a allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by css.php and certain other files. | |||||
| CVE-2011-3767 | 1 Oscommerce | 1 Oscommerce | 2017-08-29 | 5.0 MEDIUM | N/A |
| osCommerce 3.0a5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by redirect.php. | |||||
| CVE-2011-3765 | 1 Open-realty | 1 Open-realty | 2017-08-29 | 5.0 MEDIUM | N/A |
| Open-Realty 2.5.8 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by install/versions/upgrade_115.inc.php and certain other files. | |||||
| CVE-2011-3764 | 1 Opendocman | 1 Opendocman | 2017-08-29 | 5.0 MEDIUM | N/A |
| OpenDocMan 1.2.6-svn-2011-01-21 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by User_Perms_class.php and certain other files. | |||||
| CVE-2011-3763 | 1 Opencart | 1 Opencart | 2017-08-29 | 5.0 MEDIUM | N/A |
| OpenCart 1.4.9.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by system/startup.php and certain other files. | |||||
| CVE-2011-3762 | 1 Open-blog | 1 Openblog | 2017-08-29 | 5.0 MEDIUM | N/A |
| OpenBlog 1.2.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by system/scaffolding/views/view.php and certain other files. | |||||
| CVE-2011-3761 | 1 Dietrich Ayala | 1 Nusoap | 2017-08-29 | 5.0 MEDIUM | N/A |
| NuSOAP 0.9.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by nuSOAP/classes/class.wsdl.php and certain other files. | |||||
| CVE-2011-3760 | 1 Nucleuscms | 1 Nucleus Cms | 2017-08-29 | 5.0 MEDIUM | N/A |
| Nucleus 3.61 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by xmlrpc/api_nucleus.inc.php and certain other files. | |||||
| CVE-2011-3713 | 1 Powerdrummer | 1 Cftp | 2017-08-29 | 5.0 MEDIUM | N/A |
| cFTP r80 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by templates/session_check.php and certain other files. | |||||
| CVE-2011-3580 | 1 Icewarp | 1 Mail Server | 2017-08-29 | 5.0 MEDIUM | N/A |
| IceWarp WebMail in IceWarp Mail Server before 10.3.3 allows remote attackers to obtain configuration information via a direct request to the /server URI, which triggers a call to the phpinfo function. | |||||
| CVE-2011-3427 | 1 Apple | 2 Apple Tv, Iphone Os | 2017-08-29 | 2.6 LOW | N/A |
| The Data Security component in Apple iOS before 5 and Apple TV before 4.4 does not properly restrict use of the MD5 hash algorithm within X.509 certificates, which makes it easier for man-in-the-middle attackers to spoof servers or obtain sensitive information via a crafted certificate. | |||||
| CVE-2011-3431 | 1 Apple | 1 Iphone Os | 2017-08-29 | 2.1 LOW | N/A |
| The Home screen component in Apple iOS before 5 does not properly support a certain application-switching gesture, which might allow physically proximate attackers to obtain sensitive state information by watching the device's screen. | |||||
| CVE-2011-3388 | 1 Opera | 1 Opera Browser | 2017-08-29 | 4.3 MEDIUM | N/A |
| Opera before 11.51 allows remote attackers to cause an insecure site to appear secure or trusted via unspecified actions related to Extended Validation and loading content from trusted sources in an unspecified sequence that causes the address field and page information dialog to contain security information based on the trusted site, instead of the insecure site. | |||||
| CVE-2011-3264 | 1 Zabbix | 1 Zabbix | 2017-08-29 | 5.0 MEDIUM | N/A |
| Zabbix before 1.8.6 allows remote attackers to obtain sensitive information via an invalid srcfld2 parameter to popup.php, which reveals the installation path in an error message. | |||||
| CVE-2011-3265 | 1 Zabbix | 1 Zabbix | 2017-08-29 | 5.0 MEDIUM | N/A |
| popup.php in Zabbix before 1.8.7 allows remote attackers to read the contents of arbitrary database tables via a modified srctbl parameter. | |||||
| CVE-2011-3246 | 1 Apple | 3 Iphone Os, Mac Os X, Mac Os X Server | 2017-08-29 | 5.0 MEDIUM | N/A |
| CFNetwork in Apple iOS before 5.0.1 and Mac OS X 10.7 before 10.7.2 does not properly parse URLs, which allows remote attackers to trigger visits to unintended web sites, and transmission of cookies to unintended web sites, via a crafted (1) http or (2) https URL. | |||||
| CVE-2011-3242 | 1 Apple | 3 Mac Os X, Mac Os X Server, Safari | 2017-08-29 | 5.0 MEDIUM | N/A |
| The Private Browsing feature in Apple Safari before 5.1.1 on Mac OS X does not properly recognize the Always value of the Block Cookies setting, which makes it easier for remote web servers to track users via a cookie. | |||||
| CVE-2011-3201 | 3 Gnome, Oracle, Redhat | 5 Evolution, Solaris, Enterprise Linux Desktop and 2 more | 2017-08-29 | 4.3 MEDIUM | N/A |
| GNOME Evolution before 3.2.3 allows user-assisted remote attackers to read arbitrary files via the attachment parameter to a mailto: URL, which attaches the file to the email. | |||||
| CVE-2011-3128 | 1 Wordpress | 1 Wordpress | 2017-08-29 | 5.0 MEDIUM | N/A |
| WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 treats unattached attachments as published, which might allow remote attackers to obtain sensitive data via vectors related to wp-includes/post.php. | |||||
| CVE-2011-3126 | 1 Wordpress | 1 Wordpress | 2017-08-29 | 5.0 MEDIUM | N/A |
| WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 allows remote attackers to determine usernames of non-authors via canonical redirects. | |||||
| CVE-2012-0328 | 1 Janetter | 1 Janetter | 2017-08-29 | 5.0 MEDIUM | N/A |
| Janetter before 3.3.0.0 (aka 3.3.0) allows remote attackers to obtain session information for twitter.com web sites via unspecified vectors. | |||||