CVE-2012-2627

CriticalCVSS 9.4/10Last modified Jun 16, 2026

Description

d4d/uploader.php in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 allows remote attackers to create or overwrite arbitrary files in %PROGRAMFILES%\Scrutinizer\snmp\mibs\ via a multipart/form-data POST request.

Metrics

CVSS 2.0 9.4/10AV:N/AC:L/Au:N/C:N/I:C/A:C

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.plixer.com/Press-Releases/plixer-releases-9-5-2.htmlBroken Link
https://www.trustwave.com/spiderlabs/advisories/TWSL2012-014.txtThird Party Advisory
http://www.plixer.com/Press-Releases/plixer-releases-9-5-2.htmlBroken Link
https://www.trustwave.com/spiderlabs/advisories/TWSL2012-014.txtThird Party Advisory

Timeline

Published: Jul 31, 2012
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-26298.8Multiple cross-site request forgery (CSRF) and cross-site scripting (XSS) vulnerabilities in Axous 1.1.1 and earlier allow remote attackers CVE-2012-26304.3The Puella Magi Madoka Magica iP application 1.05 and earlier for Android places cleartext Twitter credentials in a log file, which allows r CVE-2012-26314.3Cross-site scripting (XSS) vulnerability in WEBLOGIC @WEB ShoppingCart before 1.5.2.0, and @WEB ShoppingCart T 1.5.0.1 and earlier, allows r CVE-2012-26322.6SEIL routers with firmware SEIL/x86 1.00 through 2.35, SEIL/X1 2.30 through 3.75, SEIL/X2 2.30 through 3.75, and SEIL/B1 2.30 through 3.75, CVE-2012-26334.3Cross-site scripting (XSS) vulnerability in wassup.php in the WassUp plugin before 1.8.3.1 for WordPress allows remote attackers to inject a CVE-2012-26342.6Cross-site scripting (XSS) vulnerability in FeedDemon before 4.0, when the feed preview option is enabled, allows remote attackers to inject CVE-2012-26354.3The Dolphin Browser HD application before 7.6 and Dolphin for Pad application before 1.0.1 for Android do not properly implement the WebView CVE-2012-26364.3Cross-site scripting (XSS) vulnerability in KENT-WEB WEB PATIO 4.04 and earlier allows remote attackers to inject arbitrary web script or HT CVE-2012-26374.3Cross-site scripting (XSS) vulnerability in KENT-WEB WEB PATIO 4.04 and earlier might allow remote attackers to inject arbitrary web script CVE-2012-26384.3Cross-site scripting (XSS) vulnerability in SmallPICT.cgi in SmallPICT before 2.7 allows remote attackers to inject arbitrary web script or CVE-2012-26405.0The NEC BIGLOBE Yome Collection application 1.8.3 and earlier for Android allows remote attackers to read the IMEI value from an SD card via CVE-2012-26414.3Cross-site scripting (XSS) vulnerability in Zenphoto before 1.4.3 allows remote attackers to inject arbitrary web script or HTML by triggeri