Weekly Update: a new vulnerability is published on the National Vulnerability Database (34 items)

New vulnerabilities from the NVD: CVE-2012-5686 ZPanel 10.0.1 has insufficient entropy for its password reset process. Published at: February 04, 2020 at 04:15PM View on website February 04, 2020 at 05:48PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2012-5618 Ushahidi before 2.6.1 has insufficient entropy for forgot-password tokens. Published at: February 04, 2020 at 04:15PM View on website February 04, 2020 at 05:48PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2011-4937 Joomla! 1.7.1 has core information disclosure due to inadequate error checking. Published at: February 04, 2020 at 03:15PM View on website February 04, 2020 at 05:48PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2011-4912 Joomla! com_mailto 1.5.x through 1.5.13 has an automated mail timeout bypass. Published at: February 04, 2020 at 04:15PM View on website February 04, 2020 at 05:48PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2011-3629 Joomla! core 1.7.1 allows information disclosure due to weak encryption Published at: February 04, 2020 at 03:15PM View on website February 04, 2020 at 05:48PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2013-0507 IBM InfoSphere Information Server 8.1, 8.5, 8.7, 9.1 has a Session Fixation Vulnerability Published at: February 05, 2020 at 06:15PM View on website February 05, 2020 at 07:48PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2011-0220 Apple Bonjour before 2011 allows a crash via a crafted multicast DNS packet. Published at: February 05, 2020 at 10:15PM View on website February 06, 2020 at 12:21AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2010-5304 A NULL pointer dereference flaw was found in the way LibVNCServer before 0.9.9 handled certain ClientCutText message. A remote attacker could use this flaw to crash the VNC server by sending a specially crafted ClientCutText message from a VNC client. Published at: February 05, 2020 at 10:15PM View on website February 06, 2020 at 12:21AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2010-4815 Coppermine gallery before 1.4.26 has an input validation vulnerability that allows for code execution. Published at: February 05, 2020 at 09:15PM View on website February 06, 2020 at 12:21AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2010-4662 PmWiki before 2.2.21 has XSS. Published at: February 05, 2020 at 09:15PM View on website February 06, 2020 at 12:21AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2011-1151 Joomla! 1.6.0 is vulnerable to SQL Injection via the filter_order and filer_order_Dir parameters. Published at: February 06, 2020 at 12:15AM View on website February 06, 2020 at 02:21AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2011-1150 bbPress through 1.0.2 has XSS in /bb-login.php url via the re parameter. Published at: February 06, 2020 at 12:15AM View on website February 06, 2020 at 02:21AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2011-1069 PHPShop through 0.8.1 has XSS. Published at: February 05, 2020 at 11:15PM View on website February 06, 2020 at 02:21AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2011-1009 Vanilla Forums 2.0.17.1 through 2.0.17.5 has XSS in /vanilla/index.php via the p parameter. Published at: February 05, 2020 at 11:15PM View on website February 06, 2020 at 02:21AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2011-0525 Batavi before 1.0 has CSRF. Published at: February 05, 2020 at 11:15PM View on website February 06, 2020 at 02:21AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2011-1597 OpenVAS Manager v2.0.3 allows plugin remote code execution. Published at: February 06, 2020 at 02:15AM View on website February 06, 2020 at 04:21AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2011-1517 SAP NetWeaver 7.0 allows Remote Code Execution and Denial of Service caused by an error in the DiagTraceHex() function. By sending a specially-crafted packet, an attacker could exploit this vulnerability to cause the application to crash. Published at: February 06, 2020 at 01:15AM View on website February 06, 2020 at 04:21AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2012-2593 Cross-site scripting (XSS) vulnerability in the administrative interface in Atmail Webmail Server 6.4 allows remote attackers to inject arbitrary web script or HTML via the Date field of an email. Published at: February 06, 2020 at 04:15PM View on website February 06, 2020 at 06:21PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2010-3917 Google Chrome before 3.0 does not properly handle XML documents, which allows remote attackers to obtain sensitive information via a crafted web site. Published at: February 06, 2020 at 03:15PM View on website February 06, 2020 at 06:21PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2012-6340 An Authentication vulnerability exists in NETGEAR WGR614 v7 and v9 due to a hardcoded credential used for serial programming, a related issue to CVE-2006-1002. Published at: February 06, 2020 at 08:15PM View on website February 06, 2020 at 10:21PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2012-6309 A vulnerability exists in Arctic Torrent 1.4 via unspecified vectors in .torrent file handling, which could let a malicious user cause a Denial of Service. Published at: February 06, 2020 at 08:15PM View on website February 06, 2020 at 10:21PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2012-6307 A vulnerability exists in JPEGsnoop 1.5.2 due to an unspecified issue in JPEG file handling, which could let a malicious user execute arbitrary code Published at: February 06, 2020 at 08:15PM View on website February 06, 2020 at 10:21PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2012-6306 A vulnerability exists in HCView (aka Hardcoreview) 1.4 due to a write access violation with a GIF file. Published at: February 06, 2020 at 08:15PM View on website February 06, 2020 at 10:21PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2012-6297 Command Injection vulnerability exists via a CSRF in DD-WRT 24-sp2 from specially crafted configuration values containing shell meta-characters, which could let a remote malicious user cause a Denial of Service. Published at: February 06, 2020 at 08:15PM View on website February 06, 2020 at 10:21PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2012-1567 LinuxMint as of 2012-03-19 has temporary file creation vulnerabilities in mintUpdate. Published at: February 07, 2020 at 04:15PM View on website February 07, 2020 at 06:21PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2012-1566 LinuxMint as of 2012-03-19 has temporary file creation vulnerabilities in mintNanny. Published at: February 07, 2020 at 04:15PM View on website February 07, 2020 at 06:21PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2010-4658 statusnet through 2010 allows attackers to spoof syslog messages via newline injection attacks. Published at: February 07, 2020 at 06:15PM View on website February 07, 2020 at 08:21PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2008-3793 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2008-3792. Reason: This candidate is a duplicate of CVE-2008-3792. Notes: All CVE users should reference CVE-2008-3792 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Published at: February 07, 2020 at 06:15PM View on website February 07, 2020 at 08:21PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2011-1086 Cross-site scripting (XSS) vulnerability in admin/system.html in Openfiler 2.3 allows remote attackers to inject arbitrary web script or HTML via the device parameter. Published at: February 08, 2020 at 12:15AM View on website February 08, 2020 at 02:21AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2011-1085 CSRF vulnerability in Smoothwall Express 3. Published at: February 07, 2020 at 11:15PM View on website February 08, 2020 at 02:21AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2011-1084 A cross-site scripting (XSS) vulnerability in Smoothwall Express 3. Published at: February 07, 2020 at 11:15PM View on website February 08, 2020 at 02:21AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2011-3642 Cross-site scripting (XSS) vulnerability in Flowplayer Flash 3.2.7 through 3.2.16, as used in the News system (news) extension for TYPO3 and Mahara, allows remote attackers to inject arbitrary web script or HTML via the plugin configuration directive in a reference to an external domain plugin. Published at: February 08, 2020 at 06:15PM View on website February 08, 2020 at 08:21PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2012-4381 MediaWiki before 1.18.5, and 1.19.x before 1.19.2 saves passwords in the local database, (1) which could make it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack or, (2) when an authentication plugin returns a false in the strict function, could allow remote attackers to use old passwords for non-existing accounts in an external authentication system via unspecified vectors. Published at: February 08, 2020 at 08:15PM View on website February 08, 2020 at 09:33PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2012-4029 Cross-site scripting (XSS) vulnerability in main/dropbox/index.php in Chamilo LMS before 1.8.8.6 allows remote attackers to inject arbitrary web script or HTML via the category_name parameter in an addsentcategory action. Published at: February 08, 2020 at 08:15PM View on website February 08, 2020 at 09:33PM via National Vulnerability Database