# CVEs published 2012-09-20

60 CVEs were published on September 20, 2012: 0 critical, 0 high. Days are UTC.

- [CVE-2012-0650](https://cve.now/CVE-2012-0650.md): Buffer overflow in the DirectoryService Proxy in DirectoryService in Apple Mac OS X through 10.6.8 allows remote attackers to execute… (no CVSS)
- [CVE-2012-3713](https://cve.now/CVE-2012-3713.md): Apple Safari before 6.0.1 does not properly handle the Quarantine attribute of HTML documents, which allows user-assisted remote attackers… (no CVSS)
- [CVE-2012-3714](https://cve.now/CVE-2012-3714.md): The Form Autofill feature in Apple Safari before 6.0.1 does not restrict the filled fields to the set of fields contained in an Autofill… (no CVSS)
- [CVE-2012-3715](https://cve.now/CVE-2012-3715.md): Apple Safari before 6.0.1 makes http requests for https URIs in certain circumstances involving a paste into the address bar, which allows… (no CVSS)
- [CVE-2012-3716](https://cve.now/CVE-2012-3716.md): CoreText in Apple Mac OS X 10.7.x before 10.7.5 allows remote attackers to execute arbitrary code or cause a denial of service… (no CVSS)
- [CVE-2012-3718](https://cve.now/CVE-2012-3718.md): Apple Mac OS X before 10.7.5 and 10.8.x before 10.8.2 allows local users to read passwords entered into Login Window (aka LoginWindow) or… (no CVSS)
- [CVE-2012-3719](https://cve.now/CVE-2012-3719.md): Mail in Apple Mac OS X before 10.7.5 does not properly handle embedded web plugins, which allows remote attackers to execute arbitrary… (no CVSS)
- [CVE-2012-3720](https://cve.now/CVE-2012-3720.md): Mobile Accounts in Apple Mac OS X before 10.7.5 and 10.8.x before 10.8.2 saves password hashes for external-account use even if external… (no CVSS)
- [CVE-2012-3721](https://cve.now/CVE-2012-3721.md): Profile Manager in Apple Mac OS X before 10.7.5 does not properly perform authentication for the Device Management private interface… (no CVSS)
- [CVE-2012-3722](https://cve.now/CVE-2012-3722.md): The Sorenson codec in QuickTime in Apple Mac OS X before 10.7.5, and in CoreMedia in iOS before 6, accesses uninitialized memory… (no CVSS)
- [CVE-2012-3723](https://cve.now/CVE-2012-3723.md): Apple Mac OS X before 10.7.5 does not properly handle the bNbrPorts field of a USB hub descriptor, which allows physically proximate… (no CVSS)
- [CVE-2012-3724](https://cve.now/CVE-2012-3724.md): CFNetwork in Apple iOS before 6 does not properly identify the host portion of a URL, which allows remote attackers to obtain sensitive… (no CVSS)
- [CVE-2012-3725](https://cve.now/CVE-2012-3725.md): The DNAv4 protocol implementation in the DHCP component in Apple iOS before 6 sends Wi-Fi packets containing a MAC address of a host on a… (no CVSS)
- [CVE-2012-3726](https://cve.now/CVE-2012-3726.md): Double free vulnerability in ImageIO in Apple iOS before 6 allows remote attackers to execute arbitrary code or cause a denial of service… (no CVSS)
- [CVE-2012-3727](https://cve.now/CVE-2012-3727.md): Buffer overflow in the IPsec component in Apple iOS before 6 allows remote attackers to execute arbitrary code via a crafted racoon… (no CVSS)
- [CVE-2012-3728](https://cve.now/CVE-2012-3728.md): The kernel in Apple iOS before 6 dereferences invalid pointers during the handling of packet-filter data structures, which allows local… (no CVSS)
- [CVE-2012-3729](https://cve.now/CVE-2012-3729.md): The Berkeley Packet Filter (BPF) interpreter implementation in the kernel in Apple iOS before 6 accesses uninitialized memory locations… (no CVSS)
- [CVE-2012-3730](https://cve.now/CVE-2012-3730.md): Mail in Apple iOS before 6 does not properly handle reuse of Content-ID header values, which allows remote attackers to spoof attachments… (no CVSS)
- [CVE-2012-3731](https://cve.now/CVE-2012-3731.md): Mail in Apple iOS before 6 does not properly implement the Data Protection feature for e-mail attachments, which allows physically… (no CVSS)
- [CVE-2012-3732](https://cve.now/CVE-2012-3732.md): Mail in Apple iOS before 6 uses an S/MIME message's From address as the displayed sender address, which allows remote attackers to spoof… (no CVSS)
- [CVE-2012-3733](https://cve.now/CVE-2012-3733.md): Messages in Apple iOS before 6, when multiple iMessage e-mail addresses are configured, does not ensure that a reply's sender address… (no CVSS)
- [CVE-2012-3734](https://cve.now/CVE-2012-3734.md): Office Viewer in Apple iOS before 6 writes cleartext document data to a temporary file, which might allow local users to bypass a… (no CVSS)
- [CVE-2012-3735](https://cve.now/CVE-2012-3735.md): The Passcode Lock implementation in Apple iOS before 6 does not properly interact with the "Slide to Power Off" feature, which allows… (no CVSS)
- [CVE-2012-3736](https://cve.now/CVE-2012-3736.md): The Passcode Lock implementation in Apple iOS before 6 allows physically proximate attackers to bypass an intended passcode requirement… (no CVSS)
- [CVE-2012-3737](https://cve.now/CVE-2012-3737.md): The Passcode Lock implementation in Apple iOS before 6 does not properly restrict photo viewing, which allows physically proximate… (no CVSS)
- [CVE-2012-3738](https://cve.now/CVE-2012-3738.md): The Emergency Dialer screen in the Passcode Lock implementation in Apple iOS before 6 does not properly limit the dialing methods, which… (no CVSS)
- [CVE-2012-3739](https://cve.now/CVE-2012-3739.md): The Passcode Lock implementation in Apple iOS before 6 allows physically proximate attackers to bypass an intended passcode requirement… (no CVSS)
- [CVE-2012-3740](https://cve.now/CVE-2012-3740.md): The Passcode Lock implementation in Apple iOS before 6 does not properly manage the lock state, which allows physically proximate… (no CVSS)
- [CVE-2012-3741](https://cve.now/CVE-2012-3741.md): The Restrictions (aka Parental Controls) implementation in Apple iOS before 6 does not properly handle purchase attempts after a Disable… (no CVSS)
- [CVE-2012-3742](https://cve.now/CVE-2012-3742.md): Safari in Apple iOS before 6 does not properly restrict use of an unspecified Unicode character that looks similar to the https lock… (no CVSS)
- [CVE-2012-3743](https://cve.now/CVE-2012-3743.md): The System Logs implementation in Apple iOS before 6 does not restrict /var/log access by sandboxed apps, which allows remote attackers to… (no CVSS)
- [CVE-2012-3744](https://cve.now/CVE-2012-3744.md): Telephony in Apple iOS before 6 uses an SMS message's return address as the displayed sender address, which allows remote attackers to… (no CVSS)
- [CVE-2012-3745](https://cve.now/CVE-2012-3745.md): Off-by-one error in Telephony in Apple iOS before 6 allows remote attackers to cause a denial of service (buffer overflow and connectivity… (no CVSS)
- [CVE-2012-3746](https://cve.now/CVE-2012-3746.md): UIWebView in UIKit in Apple iOS before 6 does not properly use the Data Protection feature, which allows context-dependent attackers to… (no CVSS)
- [CVE-2012-3747](https://cve.now/CVE-2012-3747.md): WebKit, as used in Apple iOS before 6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption… (no CVSS)
- [CVE-2011-5177](https://cve.now/CVE-2011-5177.md): Multiple cross-site scripting (XSS) vulnerabilities in admin/controller.php in eSyndiCat Pro 2.3.05 allow remote attackers to inject… (no CVSS)
- [CVE-2011-5178](https://cve.now/CVE-2011-5178.md): Multiple cross-site scripting (XSS) vulnerabilities in netmri/config/userAdmin/login.tdf in Infoblox NetMRI 6.0.2.42, 6.1.2, 6.2.1 and… (no CVSS)
- [CVE-2011-5179](https://cve.now/CVE-2011-5179.md): Cross-site scripting (XSS) vulnerability in skysa-official/skysa.php in Skysa App Bar Integration plugin, possibly before 1.04, for… (no CVSS)
- [CVE-2011-5180](https://cve.now/CVE-2011-5180.md): Cross-site scripting (XSS) vulnerability in wp-1pluginjquery.php in the ZooEffect plugin 1.01 for WordPress allows remote attackers to… (no CVSS)
- [CVE-2011-5181](https://cve.now/CVE-2011-5181.md): Cross-site scripting (XSS) vulnerability in clickdesk.php in ClickDesk Live Support - Live Chat plugin 2.0 for WordPress allows remote… (no CVSS)
- [CVE-2011-5182](https://cve.now/CVE-2011-5182.md): Cross-site scripting (XSS) vulnerability in lanoba-social-plugin/index.php in the Lanoba Social plugin 1.0 for WordPress allows remote… (no CVSS)
- [CVE-2011-5183](https://cve.now/CVE-2011-5183.md): Multiple SQL injection vulnerabilities in OrderSys 1.6.4 and earlier allow remote attackers to execute arbitrary SQL commands via the… (no CVSS)
- [CVE-2011-5184](https://cve.now/CVE-2011-5184.md): Multiple cross-site scripting (XSS) vulnerabilities in HP Network Node Manager i 9.10 allow remote attackers to inject arbitrary web… (no CVSS)
- [CVE-2011-5185](https://cve.now/CVE-2011-5185.md): Cross-site scripting (XSS) vulnerability in video\_comments.php in Online Subtitles Workshop before 2.0 rev 131 allows remote attackers to… (no CVSS)
- [CVE-2011-5186](https://cve.now/CVE-2011-5186.md): Cross-site scripting (XSS) vulnerability in jbshop.php in the jbShop plugin for e107 7 allows remote attackers to inject arbitrary web… (no CVSS)
- [CVE-2011-5187](https://cve.now/CVE-2011-5187.md): Cross-site scripting (XSS) vulnerability in the Support Ticketing System module 6.x-1.x before 6.x-1.7 for Drupal allows remote… (no CVSS)
- [CVE-2011-5188](https://cve.now/CVE-2011-5188.md): Cross-site scripting (XSS) vulnerability in the Support Timer module 6.x-1.x before 6.x-1.4 for Drupal allows remote authenticated users… (no CVSS)
- [CVE-2011-5189](https://cve.now/CVE-2011-5189.md): Cross-site scripting (XSS) vulnerability in the Webform Validation module 6.x-1.x before 6.x-1.5 and 7.x-1.x before 7.x-1.1 for Drupal… (no CVSS)
- [CVE-2011-5190](https://cve.now/CVE-2011-5190.md): Multiple cross-site scripting (XSS) vulnerabilities in Social Book Facebook Clone 2010 allow remote attackers to inject arbitrary web… (no CVSS)
- [CVE-2012-1625](https://cve.now/CVE-2012-1625.md): Eval injection vulnerability in the fillpdf\_form\_export\_decode function in fillpdf.admin.inc in the Fill PDF module 6.x-1.x before… (no CVSS)
- [CVE-2012-1626](https://cve.now/CVE-2012-1626.md): SQL injection vulnerability in the conversion form for Events in the Date module 6.x-2.x before 6.x-2.8 for Drupal allows remote… (no CVSS)
- [CVE-2012-1628](https://cve.now/CVE-2012-1628.md): Cross-site scripting (XSS) vulnerability in the SuperCron module for Drupal allows remote authenticated users to inject arbitrary web… (no CVSS)
- [CVE-2012-1629](https://cve.now/CVE-2012-1629.md): Cross-site scripting (XSS) vulnerability in the Taxotouch module for Drupal allows remote authenticated users with certain permissions to… (no CVSS)
- [CVE-2012-1630](https://cve.now/CVE-2012-1630.md): Cross-site scripting (XSS) vulnerability in the Taxonomy Navigator module for Drupal allows remote authenticated users with certain… (no CVSS)
- [CVE-2012-1631](https://cve.now/CVE-2012-1631.md): Cross-site request forgery (CSRF) vulnerability in the Admin:hover module for Drupal allows remote attackers to hijack the authentication… (no CVSS)
- [CVE-2012-5007](https://cve.now/CVE-2012-5007.md): The Fill PDF module 7.x-1.x before 7.x-1.2 for Drupal allows remote attackers to write to arbitrary PDF files via unspecified vectors… (no CVSS)
- [CVE-2012-0988](https://cve.now/CVE-2012-0988.md): Multiple cross-site scripting (XSS) vulnerabilities in config/dmsDefaults.php in KnowledgeTree 3.7.0.2 and possibly earlier allow remote… (no CVSS)
- [CVE-2012-1627](https://cve.now/CVE-2012-1627.md): Cross-site scripting (XSS) vulnerability in vud\_term.module in the Vote Up/Down module 6.x-2.x before 6.x-2.8 and 6.x-3.x before 6.x-3.1… (no CVSS)
- [CVE-2012-1632](https://cve.now/CVE-2012-1632.md): Cross-site scripting (XSS) vulnerability in password\_policy.admin.inc in the Password Policy module before 6.x-1.4 and 7.x-1.0 beta3 for… (no CVSS)
- [CVE-2012-1633](https://cve.now/CVE-2012-1633.md): Cross-site request forgery (CSRF) vulnerability in the Password Policy module before 6.x-1.4 and 7.x-1.0 beta3 for Drupal allows remote… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2012-09-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.