Weekly Update: a new vulnerability is published on the National Vulnerability Database (26 items)

New vulnerabilities from the NVD: CVE-2012-5828 BlackBerry PlayBook before 2.1 has an Information Disclosure Vulnerability via a Web browser component error Published at: February 10, 2020 at 06:15PM View on website February 10, 2020 at 07:33PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2012-2204 InfoSphere Guardium aix_ktap module: DoS Published at: February 10, 2020 at 06:15PM View on website February 10, 2020 at 07:33PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2012-1994 HP Systems Insight Manager before 7.0 allows a remote user on adjacent network to access information Published at: February 10, 2020 at 06:15PM View on website February 10, 2020 at 07:33PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2011-1596 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. Published at: February 10, 2020 at 11:20PM View on website February 11, 2020 at 01:33AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2012-4519 Zenphoto before 1.4.3.4 admin-news-articles.php date parameter XSS. Published at: February 11, 2020 at 08:15PM View on website February 11, 2020 at 09:33PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2012-2517 Cross-site scripting (XSS) vulnerability in PrestaShop before 1.4.9 allows remote attackers to inject arbitrary web script or HTML via the index of the product[] parameter to ajax.php. Published at: February 11, 2020 at 10:15PM View on website February 11, 2020 at 11:33PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2012-2452 Multiple cross-site scripting (XSS) vulnerabilities in pragmaMx 1.x before 1.12.2 allow remote attackers to inject arbitrary web script or HTML via the (1) name parameter to modules.php or (2) img_url to includes/wysiwyg/spaw/editor/plugins/imgpopup/img_popup.php. Published at: February 11, 2020 at 10:15PM View on website February 11, 2020 at 11:33PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2012-2216 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-6720 and CVE-2012-6721. Reason: this candidate was intended for one issue, but the description and references inadvertently combined multiple issues. Notes: All CVE users should consult CVE-2012-6720 and CVE-2012-6721 to determine which ID is appropriate. All references and descriptions in this candidate have been removed to prevent accidental usage. Published at: February 11, 2020 at 10:15PM View on website February 11, 2020 at 11:33PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2012-1124 SQL injection vulnerability in search.php in phxEventManager 2.0 beta 5 allows remote attackers to execute arbitrary SQL commands via the search_terms parameter. Published at: February 11, 2020 at 10:15PM View on website February 11, 2020 at 11:33PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2009-4067 Buffer overflow in the auerswald_probe function in the Auerswald Linux USB driver for the Linux kernel before 2.6.27 allows physically proximate attackers to execute arbitrary code, cause a denial of service via a crafted USB device, or take full control of the system. Published at: February 11, 2020 at 09:15PM View on website February 11, 2020 at 11:33PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2011-4938 Multiple cross-site scripting (XSS) vulnerabilities in Ariadne 2.7.6 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO parameter to (1) index.php and (2) loader.php. Published at: February 11, 2020 at 11:15PM View on website February 12, 2020 at 01:33AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2012-0810 The int3 handler in the Linux kernel before 3.3 relies on a per-CPU debug stack, which allows local users to cause a denial of service (stack corruption and panic) via a crafted application that triggers certain lock contention. Published at: February 12, 2020 at 04:15PM View on website February 12, 2020 at 05:33PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2009-5140 The SIP implementation on the Linksys SPA2102 phone adapter provides hashed credentials in a response to an invalid authentication challenge, which makes it easier for remote attackers to obtain access via a brute-force attack, related to a "SIP Digest Leak" issue. Published at: February 12, 2020 at 04:15PM View on website February 12, 2020 at 05:33PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2009-5139 The SIP implementation on the Gizmo5 software phone provides hashed credentials in a response to an invalid authentication challenge, which makes it easier for remote attackers to obtain access via a brute-force attack, related to a "SIP Digest Leak" issue. Published at: February 12, 2020 at 04:15PM View on website February 12, 2020 at 05:33PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2012-0951 A Memory Corruption Vulnerability exists in NVIDIA Graphics Drivers 29549 due to an unknown function in the file proc/driver/nvidia/registry. Published at: February 12, 2020 at 07:15PM View on website February 12, 2020 at 09:33PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2011-4661 A memory leak vulnerability exists in Cisco IOS before 15.2(1)T due to a memory leak in the HTTP PROXY Server process (aka CSCtu52820), when configured with Cisco ISR Web Security with Cisco ScanSafe and User Authenticaiton NTLM configured. Published at: February 12, 2020 at 07:15PM View on website February 12, 2020 at 09:33PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2011-4338 Shaman 1.0.9: Users can add the line askforpwd=false to his shaman.conf file, without entering the root password in shaman. The next time shaman is run, root privileges are granted despite the fact that the user never entered the root password. Published at: February 12, 2020 at 09:15PM View on website February 12, 2020 at 11:33PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2011-3901 Android SQLite Journal before 4.0.1 has an information disclosure vulnerability. Published at: February 12, 2020 at 10:15PM View on website February 12, 2020 at 11:33PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2011-3336 regcomp in the BSD implementation of libc is vulnerable to denial of service due to stack exhaustion. Published at: February 12, 2020 at 10:15PM View on website February 12, 2020 at 11:33PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2011-2499 Mambo CMS through 4.6.5 has multiple XSS. Published at: February 12, 2020 at 10:15PM View on website February 12, 2020 at 11:33PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2011-2343 The Bluetooth stack in Android before 2.3.6 allows a physically proximate attacker to obtain contact information via an AT phonebook transfer. Published at: February 12, 2020 at 10:15PM View on website February 12, 2020 at 11:33PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2011-4908 TinyBrowser plugin for Joomla! before 1.5.13 allows arbitrary file upload via upload.php. Published at: February 13, 2020 at 12:15AM View on website February 13, 2020 at 01:33AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2011-4906 Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution. Published at: February 12, 2020 at 11:15PM View on website February 13, 2020 at 01:33AM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2012-1903 XSS in Telligent Community 5.6.583.20496 via a flash file and related to the allowScriptAccess parameter. Published at: February 13, 2020 at 07:15PM View on website February 13, 2020 at 09:33PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2012-1500 Stored XSS vulnerability in UpdateFieldJson.jspa in JIRA 4.4.3 and GreenHopper before 5.9.8 allows an attacker to inject arbitrary script code. Published at: February 13, 2020 at 07:15PM View on website February 13, 2020 at 09:33PM via National Vulnerability Database New vulnerabilities from the NVD: CVE-2012-5623 Squirrelmail 4.0 uses the outdated MD5 hash algorithm for passwords. Published at: February 13, 2020 at 09:15PM View on website February 13, 2020 at 11:33PM via National Vulnerability Database