# CVEs published 2012-08-12

35 CVEs were published on August 12, 2012: 0 critical, 0 high. Days are UTC.

- [CVE-2012-2571](https://cve.now/CVE-2012-2571.md): Multiple cross-site scripting (XSS) vulnerabilities in WinWebMail Server 3.8.1.6 allow remote attackers to inject arbitrary web script or… (no CVSS)
- [CVE-2012-2573](https://cve.now/CVE-2012-2573.md): Multiple cross-site scripting (XSS) vulnerabilities in T-dah WebMail 3.2.0-2.3 allow remote attackers to inject arbitrary web script or… (no CVSS)
- [CVE-2012-2585](https://cve.now/CVE-2012-2585.md): Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine ServiceDesk Plus 8.1 allow remote attackers to inject arbitrary web… (no CVSS)
- [CVE-2012-2587](https://cve.now/CVE-2012-2587.md): Multiple cross-site scripting (XSS) vulnerabilities in AfterLogic MailSuite Pro 6.3 allow remote attackers to inject arbitrary web script… (no CVSS)
- [CVE-2012-2590](https://cve.now/CVE-2012-2590.md): Multiple cross-site scripting (XSS) vulnerabilities in ESCON SupportPortal Professional Edition 3.0 allow remote attackers to inject… (no CVSS)
- [CVE-2012-3468](https://cve.now/CVE-2012-3468.md): Multiple SQL injection vulnerabilities in the Ushahidi Platform before 2.5 allow remote attackers to execute arbitrary SQL commands via… (no CVSS)
- [CVE-2012-3469](https://cve.now/CVE-2012-3469.md): Multiple SQL injection vulnerabilities in the Ushahidi Platform before 2.5 allow remote attackers to execute arbitrary SQL commands via… (no CVSS)
- [CVE-2012-3470](https://cve.now/CVE-2012-3470.md): Multiple SQL injection vulnerabilities in application/libraries/api/MY\_Countries\_Api\_Object.php in the Ushahidi Platform before 2.5 allow… (no CVSS)
- [CVE-2012-3471](https://cve.now/CVE-2012-3471.md): Multiple SQL injection vulnerabilities in the edit functions in (1) application/controllers/admin/reports.php and (2)… (no CVSS)
- [CVE-2012-3472](https://cve.now/CVE-2012-3472.md): The email API in application/libraries/api/MY\_Email\_Api\_Object.php in the Ushahidi Platform before 2.5 does not require authentication… (no CVSS)
- [CVE-2012-3473](https://cve.now/CVE-2012-3473.md): The (1) reports API and (2) administration feature in the comments API in the Ushahidi Platform before 2.5 do not require authentication… (no CVSS)
- [CVE-2012-3474](https://cve.now/CVE-2012-3474.md): The comments API in application/libraries/api/MY\_Comments\_Api\_Object.php in the Ushahidi Platform before 2.5 allows remote attackers to… (no CVSS)
- [CVE-2012-3475](https://cve.now/CVE-2012-3475.md): The installer in the Ushahidi Platform before 2.5 omits certain calls to the exit function, which allows remote attackers to obtain… (no CVSS)
- [CVE-2012-3476](https://cve.now/CVE-2012-3476.md): Multiple cross-site scripting (XSS) vulnerabilities in (1) application/views/admin/layout.php and (2) themes/default/views/header.php in… (no CVSS)
- [CVE-2012-2584](https://cve.now/CVE-2012-2584.md): Multiple cross-site scripting (XSS) vulnerabilities in Alt-N MDaemon Free 12.5.4 allow remote attackers to inject arbitrary web script or… (no CVSS)
- [CVE-2012-4069](https://cve.now/CVE-2012-4069.md): Dir2web 3.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download… (no CVSS)
- [CVE-2012-4070](https://cve.now/CVE-2012-4070.md): SQL injection vulnerability in system/src/dispatcher.php in Dir2web 3.0 allows remote attackers to execute arbitrary SQL commands via the… (no CVSS)
- [CVE-2012-4248](https://cve.now/CVE-2012-4248.md): The Amazon Kindle Touch before 5.1.2 does not properly restrict access to the libkindleplugin.so NPAPI plugin interface, which might allow… (no CVSS)
- [CVE-2012-4249](https://cve.now/CVE-2012-4249.md): The Amazon Lab126 com.lab126.system sendEvent implementation on the Kindle Touch before 5.1.2 allows context-dependent attackers to… (no CVSS)
- [CVE-2012-2577](https://cve.now/CVE-2012-2577.md): Multiple cross-site scripting (XSS) vulnerabilities in SolarWinds Orion Network Performance Monitor (NPM) before 10.3.1 allow remote… (no CVSS)
- [CVE-2012-2602](https://cve.now/CVE-2012-2602.md): Multiple cross-site request forgery (CSRF) vulnerabilities in SolarWinds Orion Network Performance Monitor (NPM) before 10.3.1 allow… (no CVSS)
- [CVE-2012-2963](https://cve.now/CVE-2012-2963.md): The administrative interface in the embedded web server on the BreakingPoint Storm appliance before 3.0 does not require authentication… (no CVSS)
- [CVE-2012-2964](https://cve.now/CVE-2012-2964.md): The BreakingPoint Storm appliance before 3.0 requires cleartext credentials for establishing a session from a GUI administrative client… (no CVSS)
- [CVE-2012-2965](https://cve.now/CVE-2012-2965.md): Caucho Quercus, as distributed in Resin before 4.0.29, does not properly handle unspecified characters in the names of variables, which… (no CVSS, com.caucho:resin)
- [CVE-2012-2966](https://cve.now/CVE-2012-2966.md): Caucho Quercus, as distributed in Resin before 4.0.29, overwrites entries in the SERVER superglobal array on the basis of POST parameters… (no CVSS, com.caucho:resin)
- [CVE-2012-2967](https://cve.now/CVE-2012-2967.md): Caucho Quercus, as distributed in Resin before 4.0.29, does not properly implement the == (equals sign equals sign) operator for… (no CVSS, com.caucho:resin)
- [CVE-2012-2968](https://cve.now/CVE-2012-2968.md): Directory traversal vulnerability in Caucho Quercus, as distributed in Resin before 4.0.29, allows remote attackers to create files in… (no CVSS)
- [CVE-2012-2969](https://cve.now/CVE-2012-2969.md): Caucho Quercus, as distributed in Resin before 4.0.29, allows remote attackers to bypass intended restrictions on filename extensions for… (no CVSS)
- [CVE-2012-3457](https://cve.now/CVE-2012-3457.md): PNP4Nagios 0.6 through 0.6.16 uses world-readable permissions for process\_perfdata.cfg, which allows local users to obtain the Gearman… (no CVSS)
- [CVE-2012-3952](https://cve.now/CVE-2012-3952.md): Cross-site scripting (XSS) vulnerability in admin/index.php in phpList before 2.10.19 allows remote attackers to inject arbitrary web… (no CVSS)
- [CVE-2012-3953](https://cve.now/CVE-2012-3953.md): SQL injection vulnerability in admin/index.php in phpList before 2.10.19 allows remote administrators to execute arbitrary SQL commands… (no CVSS)
- [CVE-2012-4034](https://cve.now/CVE-2012-4034.md): Multiple SQL injection vulnerabilities in PBBoard 2.1.4 allow remote attackers to execute arbitrary SQL commands via the (1) username… (no CVSS)
- [CVE-2012-4035](https://cve.now/CVE-2012-4035.md): The new\_password page in PBBoard 2.1.4 allows remote attackers to change the password of arbitrary user accounts via the member\_id and… (no CVSS)
- [CVE-2012-4246](https://cve.now/CVE-2012-4246.md): Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject… (no CVSS)
- [CVE-2012-4247](https://cve.now/CVE-2012-4247.md): Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2012-08-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.