Total
395466 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2012-6133 | 1 Roundup-tracker | 1 Roundup | 2026-06-16 | 4.3 MEDIUM | 6.1 MEDIUM |
| Multiple cross-site scripting (XSS) vulnerabilities in Roundup before 1.4.20 allow remote attackers to inject arbitrary web script or HTML via the (1) @ok_message or (2) @error_message parameter to issue*. | |||||
| CVE-2012-6132 | 1 Roundup-tracker | 1 Roundup | 2026-06-16 | 4.3 MEDIUM | N/A |
| Cross-site scripting (XSS) vulnerability in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the otk parameter. | |||||
| CVE-2012-6131 | 1 Roundup-tracker | 1 Roundup | 2026-06-16 | 4.3 MEDIUM | N/A |
| Cross-site scripting (XSS) vulnerability in cgi/client.py in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the @action parameter to support/issue1. | |||||
| CVE-2012-6130 | 1 Roundup-tracker | 1 Roundup | 2026-06-16 | 4.3 MEDIUM | N/A |
| Cross-site scripting (XSS) vulnerability in the history display in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via a username, related to generating a link. | |||||
| CVE-2012-6129 | 3 Canonical, Fedoraproject, Transmissionbt | 3 Ubuntu Linux, Fedora, Transmission | 2026-06-16 | 7.5 HIGH | N/A |
| Stack-based buffer overflow in utp.cpp in libutp, as used in Transmission before 2.74 and possibly other products, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted "micro transport protocol packets." | |||||
| CVE-2012-6128 | 1 Infradead | 1 Openconnect | 2026-06-16 | 5.0 MEDIUM | N/A |
| Multiple stack-based buffer overflows in http.c in OpenConnect before 4.08 allow remote VPN gateways to cause a denial of service (application crash) via a long (1) hostname, (2) path, or (3) cookie list in a response. | |||||
| CVE-2012-6125 | 1 Call-cc | 1 Chicken | 2026-06-16 | 7.5 HIGH | 9.8 CRITICAL |
| Chicken before 4.8.0 is susceptible to algorithmic complexity attacks related to hash table collisions. | |||||
| CVE-2012-6124 | 1 Call-cc | 1 Chicken | 2026-06-16 | 5.0 MEDIUM | 5.3 MEDIUM |
| A casting error in Chicken before 4.8.0 on 64-bit platform caused the random number generator to return a constant value. NOTE: the vendor states "This function wasn't used for security purposes (and is advertised as being unsuitable)." | |||||
| CVE-2012-6123 | 2 Call-cc, Debian | 2 Chicken, Debian Linux | 2026-06-16 | 5.0 MEDIUM | 6.5 MEDIUM |
| Chicken before 4.8.0 does not properly handle NUL bytes in certain strings, which allows an attacker to conduct "poisoned NUL byte attack." | |||||
| CVE-2012-6122 | 1 Call-cc | 1 Chicken | 2026-06-16 | 5.0 MEDIUM | 7.5 HIGH |
| Buffer overflow in the thread scheduler in Chicken before 4.8.0.1 allows attackers to cause a denial of service (crash) by opening a file descriptor with a large integer value. | |||||
| CVE-2012-6121 | 1 Roundcube | 1 Webmail | 2026-06-16 | 4.3 MEDIUM | N/A |
| Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 0.8.5 allows remote attackers to inject arbitrary web script or HTML via a (1) data:text or (2) vbscript link. | |||||
| CVE-2012-6120 | 1 Redhat | 2 Openstack Essex, Openstack Folsom | 2026-06-16 | 2.1 LOW | N/A |
| Red Hat OpenStack Essex and Folsom creates the /var/log/puppet directory with world-readable permissions, which allows local users to obtain sensitive information such as Puppet log files. | |||||
| CVE-2012-6119 | 2 Candlepinproject, Redhat | 2 Candlepin, Subscription Asset Manager | 2026-06-16 | 2.1 LOW | N/A |
| Candlepin before 0.7.24, as used in Red Hat Subscription Asset Manager before 1.2.1, does not properly check manifest signatures, which allows local users to modify manifests. | |||||
| CVE-2012-6118 | 1 Redhat | 1 Aeolus Conductor | 2026-06-16 | 5.5 MEDIUM | N/A |
| The Administer tab in Aeolus Conductor allows remote authenticated users to bypass intended quota restrictions by updating the Maximum Running Instances quota user setting. | |||||
| CVE-2012-6117 | 1 Redhat | 1 Cloudforms Cloud Engine | 2026-06-16 | 2.1 LOW | N/A |
| Aeolus Configuration Server, as used in Red Hat CloudForms Cloud Engine before 1.1.2, uses world-readable permissions for /var/log/aeolus-configserver/configserver.log, which allows local users to read plaintext passwords by reading the log file. | |||||
| CVE-2012-6116 | 1 Katello | 2 Katello, Katello-configure | 2026-06-16 | 2.1 LOW | N/A |
| modules/certs/manifests/config.pp in katello-configure before 1.3.3.pulpv2 in Katello uses weak permissions (666) for the Candlepin bootstrap RPM, which allows local users to modify the Candlepin CA certificate by writing to this file. | |||||
| CVE-2012-6115 | 1 Redhat | 1 Enterprise Virtualization Manager | 2026-06-16 | 2.1 LOW | N/A |
| The domain management tool (rhevm-manage-domains) in Red Hat Enterprise Virtualization Manager (RHEV-M) 3.1 and earlier, when the validate action is enabled, logs the administrative password to a world-readable log file, which allows local users to obtain sensitive information by reading this file. | |||||
| CVE-2012-6114 | 1 Git-extras Project | 1 Git-extras | 2026-06-16 | 3.6 LOW | 5.5 MEDIUM |
| The git-changelog utility in git-extras 1.7.0 allows local users to overwrite arbitrary files via a symlink attack on (1) /tmp/changelog or (2) /tmp/.git-effort. | |||||
| CVE-2012-6113 | 1 Php | 1 Php | 2026-06-16 | 5.0 MEDIUM | N/A |
| The openssl_encrypt function in ext/openssl/openssl.c in PHP 5.3.9 through 5.3.13 does not initialize a certain variable, which allows remote attackers to obtain sensitive information from process memory by providing zero bytes of input data. | |||||
| CVE-2012-6112 | 2 Moodle, Tinymce | 2 Moodle, Spellchecker Php | 2026-06-16 | 5.0 MEDIUM | N/A |
| classes/GoogleSpell.php in the PHP Spellchecker (aka Google Spellchecker) addon before 2.0.6.1 for TinyMCE, as used in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 and other products, does not properly handle control characters, which allows remote attackers to trigger arbitrary outbound HTTP requests via a crafted string. | |||||