2012-08-11

2012-08-12

2012-08-13

All (3) Critical (2) High (12) Medium (18) Low (3)

CVE-2012-3952 Aug 12, 00:55 LOW POC Monitor

Cross-site scripting (XSS) vulnerability in admin/index.php in phpList before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via the unconfirmed parameter to the user page. Rated low severity (CVSS 2.6), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.

PHP XSS Phplist

NVD Exploit-DB

CVSS 2.0

2.6

EPSS

9.7%

CVE-2012-3476 Aug 12, 21:55 LOW POC PATCH Monitor

Multiple cross-site scripting (XSS) vulnerabilities in (1) application/views/admin/layout.php and (2) themes/default/views/header.php in the Ushahidi Platform before 2.5 allow remote authenticated. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. Public exploit code available.

PHP XSS Ushahidi Platform Ushahidi

NVD GitHub

CVSS 2.0

3.5

EPSS

0.2%

CVE-2012-3457 Aug 12, 00:55 LOW Monitor

PNP4Nagios 0.6 through 0.6.16 uses world-readable permissions for process_perfdata.cfg, which allows local users to obtain the Gearman shared secret by reading the file. Rated low severity (CVSS 2.1), this vulnerability is low attack complexity. No vendor patch available.

Privilege Escalation Pnp4Nagios

NVD

CVSS 2.0

2.1

EPSS

0.1%