CVSS: 5.0EPSS: 1%CPEs: 54EXPL: 0CVE-2012-2867
https://notcve.org/view.php?id=CVE-2012-2867
The SPDY implementation in Google Chrome before 21.0.1180.89 allows remote attackers to cause a denial of service (application crash) via unspecified vectors. La implementación SPDY en Google Chrome anterior a v21.0.1180.89 permite a atacantes remotos provocar una denegación de servicio (caída de aplicación) a través de vectores no especificados. • http://code.google.com/p/chromium/issues/detail?id=135485 http://googlechromereleases.blogspot.com/2012/08/stable-channel-update_30.html http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00030.html http://osvdb.org/85032 https://exchange.xforce.ibmcloud.com/vulnerabilities/78176 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15130 •
CVSS: 4.3EPSS: 0%CPEs: 54EXPL: 0CVE-2012-2872
https://notcve.org/view.php?id=CVE-2012-2872
Cross-site scripting (XSS) vulnerability in an SSL interstitial page in Google Chrome before 21.0.1180.89 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Una vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en una página SSL intersticial en Google Chrome antes de v21.0.1180.89 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores no especificados. • http://code.google.com/p/chromium/issues/detail?id=142956 http://googlechromereleases.blogspot.com/2012/08/stable-channel-update_30.html http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00030.html http://osvdb.org/85037 https://exchange.xforce.ibmcloud.com/vulnerabilities/78181 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15853 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 22EXPL: 0CVE-2012-3489 – postgresql: File disclosure through XXE in xmlparse by DTD validation
https://notcve.org/view.php?id=CVE-2012-3489
The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote authenticated users to determine the existence of arbitrary files or URLs, and possibly obtain file or URL content that triggers a parsing error, via an XML value that refers to (1) a DTD or (2) an entity, related to an XML External Entity (aka XXE) issue. La función xml_parse en el soporte libxml2 en el componente de servidor central en PostgreSQL v8.3 antes de v8.3.20, v8.4 antes de v8.4.13, v9.0 antes de v9.0.9, y v9.1 antes de v9.1.5, permite a atacantes remotos determinar la existencia de archivos o URLs arbitrarias y, posiblemente, obtener el archivo o el contenido de URL que desencadena un error de validación, a través de un valor XML que se refiere a (1) una DTD o (2) una entidad, relacionada con una cuestión XML External Entity (también conocido como XXE). • http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html http://lists.opensuse.org/opensuse-updates/2012-09/msg00102.html http://lists.opensuse.org/opensuse-updates/2012-10/msg00013.html http://lists.opensuse.org/opensuse-updates/2012-10/msg00024.html http://rhn.redhat.com/errata/RHSA-2012-1263.html http://secunia.com/advisories/50635 http://secunia.com/advisories/50718 http://secunia.com/advisories/50859 http://secunia.com/advisories/50946 http://www.debian.org&# • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 4.3EPSS: 0%CPEs: 31EXPL: 0CVE-2012-4291 – wireshark: DoS via excessive system resource consumption in CIP dissector (wnpa-sec-2012-20)
https://notcve.org/view.php?id=CVE-2012-4291
The CIP dissector in Wireshark 1.4.x before 1.4.15, 1.6.x before 1.6.10, and 1.8.x before 1.8.2 allows remote attackers to cause a denial of service (memory consumption) via a malformed packet. El disector CIP en Wireshark v1.4.x antes de v1.4.15, v1.6.x antes de v1.6.10 y v1.8.x antes de v1.8.2 permite a atacantes remotos causar una denegación de servicio (por excesivo consumo de memoria) a través de un paquete con formato erróneo. • http://lists.opensuse.org/opensuse-updates/2012-08/msg00033.html http://rhn.redhat.com/errata/RHSA-2013-0125.html http://secunia.com/advisories/50276 http://secunia.com/advisories/51363 http://secunia.com/advisories/54425 http://www.gentoo.org/security/en/glsa/glsa-201308-05.xml http://www.securityfocus.com/bid/55035 http://www.wireshark.org/security/wnpa-sec-2012-20.html https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_wireshark3 https://bugs.wireshark.or • CWE-399: Resource Management Errors •
CVSS: 4.3EPSS: 0%CPEs: 30EXPL: 1CVE-2012-4288 – wireshark: DoS via excessive resource consumption in XTP dissector (wnpa-sec-2012-15)
https://notcve.org/view.php?id=CVE-2012-4288
Integer overflow in the dissect_xtp_ecntl function in epan/dissectors/packet-xtp.c in the XTP dissector in Wireshark 1.4.x before 1.4.15, 1.6.x before 1.6.10, and 1.8.x before 1.8.2 allows remote attackers to cause a denial of service (loop or application crash) via a large value for a span length. Desbordamiento de entero en la función dissect_xtp_ecntl en epan/dissectors/packet-xtp.c en el (XTP dissector) en Wireshark v1.4.x anterior a v1.4.15, v1.6.x anterior a v1.6.10, y v1.8.x anterior a v1.8.2 permite a atacantes remotos causar una denegación de servicio, bucle y consumo de CPU, a través de un valor grande para un la longitud de un (SPAN). • http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-xtp.c?r1=44289&r2=44288&pathrev=44289 http://anonsvn.wireshark.org/viewvc?view=revision&revision=44289 http://lists.opensuse.org/opensuse-updates/2012-08/msg00033.html http://secunia.com/advisories/50276 http://secunia.com/advisories/51363 http://secunia.com/advisories/54425 http://www.gentoo.org/security/en/glsa/glsa-201308-05.xml http://www.securityfocus.com/bid/55035 http://www.wireshark.org/security/wnpa-sec-2012&# • CWE-189: Numeric Errors •