# CVEs published 2013-01-24

44 CVEs were published on January 24, 2013: 1 critical, 4 high. Days are UTC.

- [CVE-2012-5668](https://cve.now/CVE-2012-5668.md): FreeType before 2.4.11 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors… (no CVSS)
- [CVE-2012-5669](https://cve.now/CVE-2012-5669.md): The \_bdf\_parse\_glyphs function in FreeType before 2.4.11 allows context-dependent attackers to cause a denial of service (crash) and… (no CVSS)
- [CVE-2012-5670](https://cve.now/CVE-2012-5670.md): The \_bdf\_parse\_glyphs function in FreeType before 2.4.11 allows context-dependent attackers to cause a denial of service (out-of-bounds… (no CVSS)
- [CVE-2012-6095](https://cve.now/CVE-2012-6095.md): ProFTPD before 1.3.5rc1, when using the UserOwner directive, allows local users to modify the ownership of arbitrary files via a race… (no CVSS)
- [CVE-2012-6435](https://cve.now/CVE-2012-6435.md): Rockwell Automation ControlLogix PLC Improper Access Control (CVSS 7.5, Rockwell Automation 1756-ENBT, 1756-EWEB, 1768-ENBT, 176… +6)
- [CVE-2012-6436](https://cve.now/CVE-2012-6436.md): Rockwell Automation ControlLogix PLC Improper Input Validation (CVSS 7.5, Rockwell Automation 1756-ENBT, 1756-EWEB, 1768-ENBT, 176… +6)
- [CVE-2012-6437](https://cve.now/CVE-2012-6437.md): Rockwell Automation ControlLogix PLC Improper Authentication (CVSS 9.8, Rockwell Automation 1756-ENBT, 1756-EWEB, 1768-ENBT, 176… +6)
- [CVE-2012-6438](https://cve.now/CVE-2012-6438.md): Rockwell Automation ControlLogix PLC Improper Input Validation (CVSS 7.5, Rockwell Automation 1756-ENBT, 1756-EWEB, 1768-ENBT, 176… +6)
- [CVE-2012-6439](https://cve.now/CVE-2012-6439.md): Rockwell Automation ControlLogix PLC Improper Access Control (no CVSS, Rockwell Automation 1756-ENBT, 1756-EWEB, 1768-ENBT, 176… +6)
- [CVE-2012-6440](https://cve.now/CVE-2012-6440.md): Rockwell Automation ControlLogix PLC Improper Input Validation (CVSS 4.8, Rockwell Automation 1756-ENBT, 1756-EWEB, 1768-ENBT, 176… +6)
- [CVE-2012-6441](https://cve.now/CVE-2012-6441.md): Rockwell Automation ControlLogix PLC Information Exposure (no CVSS, Rockwell Automation 1756-ENBT, 1756-EWEB, 1768-ENBT, 176… +6)
- [CVE-2012-6442](https://cve.now/CVE-2012-6442.md): Rockwell Automation ControlLogix PLC Improper Access Control (CVSS 7.5, Rockwell Automation 1756-ENBT, 1756-EWEB, 1768-ENBT, 176… +6)
- [CVE-2013-0839](https://cve.now/CVE-2013-0839.md): Use-after-free vulnerability in Google Chrome before 24.0.1312.56 allows remote attackers to cause a denial of service or possibly have… (no CVSS)
- [CVE-2013-0840](https://cve.now/CVE-2013-0840.md): Google Chrome before 24.0.1312.56 does not validate URLs during the opening of new windows, which has unspecified impact and remote attack… (no CVSS)
- [CVE-2013-0841](https://cve.now/CVE-2013-0841.md): Array index error in the content-blocking functionality in Google Chrome before 24.0.1312.56 allows remote attackers to cause a denial of… (no CVSS)
- [CVE-2013-0842](https://cve.now/CVE-2013-0842.md): Google Chrome before 24.0.1312.56 does not properly handle %00 characters in pathnames, which has unspecified impact and attack vectors. (no CVSS)
- [CVE-2013-0843](https://cve.now/CVE-2013-0843.md): content/renderer/media/webrtc\_audio\_renderer.cc in Google Chrome before 24.0.1312.56 on Mac OS X does not use an appropriate buffer size… (no CVSS)
- [CVE-2013-1102](https://cve.now/CVE-2013-1102.md): The Wireless Intrusion Prevention System (wIPS) component on Cisco Wireless LAN Controller (WLC) devices with software 7.0 before… (no CVSS)
- [CVE-2013-1103](https://cve.now/CVE-2013-1103.md): Cisco Wireless LAN Controller (WLC) devices with software 7.0 before 7.0.220.0, 7.1 before 7.1.91.0, and 7.2 before 7.2.103.0 allow remote… (no CVSS)
- [CVE-2013-1104](https://cve.now/CVE-2013-1104.md): The HTTP Profiling functionality on Cisco Wireless LAN Controller (WLC) devices with software 7.3.101.0 allows remote authenticated users… (no CVSS)
- [CVE-2013-1105](https://cve.now/CVE-2013-1105.md): Cisco Wireless LAN Controller (WLC) devices with software 7.0 before 7.0.235.3, 7.1 and 7.2 before 7.2.111.3, and 7.3 before 7.3.101.0… (no CVSS)
- [CVE-2011-4618](https://cve.now/CVE-2011-4618.md): Cross-site scripting (XSS) vulnerability in advancedtext.php in Advanced Text Widget plugin before 2.0.2 for WordPress allows remote… (no CVSS)
- [CVE-2012-1922](https://cve.now/CVE-2012-1922.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Sitecom WLM-2501 allow remote attackers to hijack the authentication of… (no CVSS)
- [CVE-2012-2099](https://cve.now/CVE-2012-2099.md): Multiple cross-site scripting (XSS) vulnerabilities in Wikidforum 2.10 allow remote attackers to inject arbitrary web script or HTML via… (no CVSS)
- [CVE-2012-6085](https://cve.now/CVE-2012-6085.md): The read\_block function in g10/import.c in GnuPG 1.4.x before 1.4.13 and 2.0.x through 2.0.19, when importing a key, allows remote… (no CVSS)
- [CVE-2012-6503](https://cve.now/CVE-2012-6503.md): Unspecified vulnerability in the NinjaXplorer component before 1.0.7 for Joomla! has unknown impact and attack vectors. (no CVSS)
- [CVE-2012-6504](https://cve.now/CVE-2012-6504.md): SQL injection vulnerability in mods/hours/data/get\_hours.php in PHP Volunteer Management 1.0.2 allows remote attackers to execute… (no CVSS)
- [CVE-2012-6505](https://cve.now/CVE-2012-6505.md): Cross-site scripting (XSS) vulnerability in mods/hours/data/get\_hours.php in PHP Volunteer Management 1.0.2 allows remote attackers to… (no CVSS)
- [CVE-2012-6506](https://cve.now/CVE-2012-6506.md): Multiple cross-site scripting (XSS) vulnerabilities in the Zingiri Web Shop plugin 2.4.0 for WordPress allow remote attackers to inject… (no CVSS)
- [CVE-2012-6507](https://cve.now/CVE-2012-6507.md): Multiple SQL injection vulnerabilities in admin.php in ChurchCMS 0.0.1 allow remote attackers to execute arbitrary SQL commands via the… (no CVSS)
- [CVE-2012-6508](https://cve.now/CVE-2012-6508.md): Multiple cross-site request forgery (CSRF) vulnerabilities in NetArt Media Car Portal 3.0 allow remote attackers to hijack the… (no CVSS)
- [CVE-2012-6509](https://cve.now/CVE-2012-6509.md): Unrestricted file upload vulnerability in NetArt Media Car Portal 3.0 allows remote attackers to execute arbitrary PHP code by uploading a… (no CVSS)
- [CVE-2012-6510](https://cve.now/CVE-2012-6510.md): Multiple cross-site scripting (XSS) vulnerabilities in NetArt Media Car Portal 3.0 allow remote attackers to inject arbitrary web script… (no CVSS)
- [CVE-2012-6511](https://cve.now/CVE-2012-6511.md): Multiple cross-site scripting (XSS) vulnerabilities in organizer/page/users.php in the Organizer plugin 1.2.1 for WordPress allow remote… (no CVSS)
- [CVE-2012-6512](https://cve.now/CVE-2012-6512.md): The Organizer plugin 1.2.1 for WordPress allows remote attackers to obtain the installation path via unspecified vectors to (1)… (no CVSS)
- [CVE-2012-6513](https://cve.now/CVE-2012-6513.md): Cross-site scripting (XSS) vulnerability in index.php/Admin\_Preferences in gpEasy CMS 2.3.3 allows remote attackers to inject arbitrary… (no CVSS)
- [CVE-2012-6514](https://cve.now/CVE-2012-6514.md): Cross-site scripting (XSS) vulnerability in the nBill (com\_nbill) component 2.3.2 for Joomla! allows remote attackers to inject arbitrary… (no CVSS)
- [CVE-2012-6515](https://cve.now/CVE-2012-6515.md): eFront 3.6.10, 3.6.11 build 15059, and earlier allows remote attackers to obtain sensitive information via invalid courses\_ID parameter in… (no CVSS)
- [CVE-2012-6516](https://cve.now/CVE-2012-6516.md): SQL injection vulnerability in PHP Ticket System Beta 1 allows remote attackers to execute arbitrary SQL commands via the q parameter to… (no CVSS)
- [CVE-2012-6517](https://cve.now/CVE-2012-6517.md): Multiple cross-site scripting (XSS) vulnerabilities in DiY-CMS 1.0 allow remote attackers to inject arbitrary web script or HTML via the… (no CVSS)
- [CVE-2012-6518](https://cve.now/CVE-2012-6518.md): Cross-site request forgery (CSRF) vulnerability in mod.php in DiY-CMS 1.0 allows remote attackers to hijack the authentication of… (no CVSS)
- [CVE-2012-6519](https://cve.now/CVE-2012-6519.md): SQL injection vulnerability in modules/poll/index.php in DIY-CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the… (no CVSS)
- [CVE-2012-6520](https://cve.now/CVE-2012-6520.md): Multiple SQL injection vulnerabilities in the advanced search in Wikidforum 2.10 allow remote attackers to execute arbitrary SQL commands… (no CVSS)
- [CVE-2012-6521](https://cve.now/CVE-2012-6521.md): Cross-site scripting (XSS) vulnerability in apps/admin/handlers/versions.php in Elefant CMS 1.2.0 allows remote attackers to inject… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2013-01-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.