Vulnerabilities > Medium

DATE CVE VULNERABILITY TITLE RISK
2012-11-04 CVE-2012-3446 Improper Certificate Validation vulnerability in Apache Libcloud
Apache Libcloud before 0.11.1 uses an incorrect regular expression during verification of whether the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate.
network
high complexity
apache CWE-295
5.9
2012-10-16 CVE-2012-0518 Open Redirect vulnerability in Oracle Fusion Middleware 10.1.4.3
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3.0 allows remote attackers to affect integrity via unknown vectors related to Redirects, a different vulnerability than CVE-2012-3175.
network
low complexity
oracle CWE-601
4.7
2012-10-03 CVE-2012-3489 XXE vulnerability in multiple products
The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote authenticated users to determine the existence of arbitrary files or URLs, and possibly obtain file or URL content that triggers a parsing error, via an XML value that refers to (1) a DTD or (2) an entity, related to an XML External Entity (aka XXE) issue.
6.5
2012-10-03 CVE-2012-3552 Race Condition vulnerability in multiple products
Race condition in the IP implementation in the Linux kernel before 3.0 might allow remote attackers to cause a denial of service (slab corruption and system crash) by sending packets to an application that sets socket options during the handling of network traffic.
network
high complexity
linux redhat CWE-362
5.9
2012-09-18 CVE-2012-2993 Improper Certificate Validation vulnerability in Microsoft Windows Phone 7 Firmware
Microsoft Windows Phone 7 does not verify the domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof an SSL server for the (1) POP3, (2) IMAP, or (3) SMTP protocol via an arbitrary valid certificate.
network
high complexity
microsoft CWE-295
5.9
2012-08-06 CVE-2012-1342 Incorrect Authorization vulnerability in Cisco Carrier Routing System 3.9.0/4.0.0/4.1.0
Cisco Carrier Routing System (CRS) 3.9, 4.0, and 4.1 allows remote attackers to bypass ACL entries via fragmented packets, aka Bug ID CSCtj10975.
network
low complexity
cisco CWE-863
5.8
2012-06-17 CVE-2012-0037 XXE vulnerability in multiple products
Redland Raptor (aka libraptor) before 2.0.7, as used by OpenOffice 3.3 and 3.4 Beta, LibreOffice before 3.4.6 and 3.5.x before 3.5.1, and other products, allows user-assisted remote attackers to read arbitrary files via a crafted XML external entity (XXE) declaration and reference in an RDF document.
6.5
2012-06-05 CVE-2012-1798 Out-of-bounds Read vulnerability in multiple products
The TIFFGetEXIFProperties function in coders/tiff.c in ImageMagick before 6.7.6-3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted EXIF IFD in a TIFF image.
network
low complexity
imagemagick debian redhat opensuse CWE-125
6.5
2012-06-05 CVE-2012-1186 Infinite Loop vulnerability in multiple products
Integer overflow in the SyncImageProfiles function in profile.c in ImageMagick 6.7.5-8 and earlier allows remote attackers to cause a denial of service (infinite loop) via crafted IOP tag offsets in the IFD in an image.
5.5
2012-06-05 CVE-2012-0260 Resource Exhaustion vulnerability in multiple products
The JPEGWarningHandler function in coders/jpeg.c in ImageMagick before 6.7.6-3 allows remote attackers to cause a denial of service (memory consumption) via a JPEG image with a crafted sequence of restart markers.
6.5