# CVEs published 2012-02-14

59 CVEs were published on February 14, 2012: 0 critical, 1 high. Days are UTC.

- [CVE-2012-0010](https://cve.now/CVE-2012-0010.md): Microsoft Internet Explorer 6 through 9 does not properly perform copy-and-paste operations, which allows user-assisted remote attackers to (no CVSS)
- [CVE-2012-0011](https://cve.now/CVE-2012-0011.md): Microsoft Internet Explorer 7 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code (no CVSS)
- [CVE-2012-0012](https://cve.now/CVE-2012-0012.md): Microsoft Internet Explorer 9 does not properly handle the creation and initialization of string objects, which allows remote attackers to r (no CVSS)
- [CVE-2012-0014](https://cve.now/CVE-2012-0014.md): Microsoft .NET Framework 2.0 SP2, 3.5.1, and 4, and Silverlight 4 before 4.1.10111, does not properly restrict access to memory associated w (CVSS 7.8)
- [CVE-2012-0015](https://cve.now/CVE-2012-0015.md): Microsoft .NET Framework 2.0 SP2 and 3.5.1 does not properly calculate the length of an unspecified buffer, which allows remote attackers to (no CVSS)
- [CVE-2012-0017](https://cve.now/CVE-2012-0017.md): Cross-site scripting (XSS) vulnerability in inplview.aspx in Microsoft SharePoint Foundation 2010 Gold and SP1 allows remote attackers to in (no CVSS)
- [CVE-2012-0019](https://cve.now/CVE-2012-0019.md): Microsoft Visio Viewer 2010 Gold and SP1 does not properly handle memory during the parsing of files, which allows remote attackers to execu (no CVSS)
- [CVE-2012-0020](https://cve.now/CVE-2012-0020.md): Microsoft Visio Viewer 2010 Gold and SP1 does not properly handle memory during the parsing of files, which allows remote attackers to execu (no CVSS)
- [CVE-2012-0136](https://cve.now/CVE-2012-0136.md): Microsoft Visio Viewer 2010 Gold and SP1 does not properly handle memory during the parsing of files, which allows remote attackers to execu (no CVSS)
- [CVE-2012-0137](https://cve.now/CVE-2012-0137.md): Microsoft Visio Viewer 2010 Gold and SP1 does not properly handle memory during the parsing of files, which allows remote attackers to execu (no CVSS)
- [CVE-2012-0138](https://cve.now/CVE-2012-0138.md): Microsoft Visio Viewer 2010 Gold and SP1 does not properly handle memory during the parsing of files, which allows remote attackers to execu (no CVSS)
- [CVE-2012-0144](https://cve.now/CVE-2012-0144.md): Cross-site scripting (XSS) vulnerability in themeweb.aspx in Microsoft Office SharePoint Server 2010 Gold and SP1 and SharePoint Foundation (no CVSS)
- [CVE-2012-0145](https://cve.now/CVE-2012-0145.md): Cross-site scripting (XSS) vulnerability in wizardlist.aspx in Microsoft Office SharePoint Server 2010 Gold and SP1 and SharePoint Foundatio (no CVSS)
- [CVE-2012-0148](https://cve.now/CVE-2012-0148.md): afd.sys in the Ancillary Function Driver in Microsoft Windows XP SP2, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R (no CVSS)
- [CVE-2012-0149](https://cve.now/CVE-2012-0149.md): afd.sys in the Ancillary Function Driver in Microsoft Windows Server 2003 SP2 does not properly validate user-mode input passed to kernel mo (no CVSS)
- [CVE-2012-0150](https://cve.now/CVE-2012-0150.md): Buffer overflow in msvcrt.dll in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows rem (no CVSS)
- [CVE-2012-0154](https://cve.now/CVE-2012-0154.md): Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows (no CVSS)
- [CVE-2012-0155](https://cve.now/CVE-2012-0155.md): Microsoft Internet Explorer 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessi (no CVSS)
- [CVE-2010-5083](https://cve.now/CVE-2010-5083.md): SQL injection vulnerability in the Web\_Links module for PHP-Nuke 8.0 allows remote attackers to execute arbitrary SQL commands via the url p (no CVSS)
- [CVE-2010-5084](https://cve.now/CVE-2010-5084.md): The cross-site request forgery (CSRF) protection mechanism in e107 before 0.7.23 uses a predictable random token based on the creation date (no CVSS)
- [CVE-2010-5085](https://cve.now/CVE-2010-5085.md): Multiple cross-site request forgery (CSRF) vulnerabilities in admin/update\_user in Hulihan Amethyst 0.1.5, and possibly earlier, allow remot (no CVSS)
- [CVE-2011-5079](https://cve.now/CVE-2011-5079.md): Open redirect vulnerability in the Modern FAQ (irfaq) extension 1.1.2 and other versions before 1.1.4 for TYPO3 allows remote attackers to r (no CVSS)
- [CVE-2011-5080](https://cve.now/CVE-2011-5080.md): Cross-site scripting (XSS) vulnerability in lib/class.tx\_jftcaforms\_tceFunc.php in the Additional TCA Forms (jftcaforms) extension before 0. (no CVSS)
- [CVE-2012-1009](https://cve.now/CVE-2012-1009.md): NetSarang Xlpd 4 Build 0100 and NetSarang Xmanager Enterprise 4 Build 0186 allow remote attackers to cause a denial of service (daemon crash (no CVSS)
- [CVE-2012-1065](https://cve.now/CVE-2012-1065.md): Insecure method vulnerability in TuxScripting.dll in the TuxSystem ActiveX control in 2X ApplicationServer 10.1 Build 1224 allows remote att (no CVSS)
- [CVE-2012-1066](https://cve.now/CVE-2012-1066.md): Cross-site scripting (XSS) vulnerability in the template module in SmartyCMS 0.9.4 allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2012-1067](https://cve.now/CVE-2012-1067.md): SQL injection vulnerability in the WP-RecentComments plugin 2.0.7 for WordPress allows remote attackers to execute arbitrary SQL commands vi (no CVSS)
- [CVE-2012-1068](https://cve.now/CVE-2012-1068.md): Cross-site scripting (XSS) vulnerability in the rc\_ajax function in core.php in the WP-RecentComments plugin before 2.0.7 for WordPress allo (no CVSS)
- [CVE-2012-1069](https://cve.now/CVE-2012-1069.md): Cross-site scripting (XSS) vulnerability in module/kb/search\_word in the search module in lknSupport allows remote attackers to inject arbit (no CVSS)
- [CVE-2012-1070](https://cve.now/CVE-2012-1070.md): Cross-site scripting (XSS) vulnerability in the Modern FAQ (irfaq) extension 1.1.2 and other versions before 1.1.4 for TYPO3 allows remote a (no CVSS)
- [CVE-2012-1071](https://cve.now/CVE-2012-1071.md): SQL injection vulnerability in the Kitchen recipe (mv\_cooking) extension before 0.4.1 for TYPO3 allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2012-1072](https://cve.now/CVE-2012-1072.md): SQL injection vulnerability in the Category-System (toi\_category) extension 0.6.0 and earlier for TYPO3 allows remote attackers to execute a (no CVSS)
- [CVE-2012-1073](https://cve.now/CVE-2012-1073.md): Cross-site scripting (XSS) vulnerability in the Category-System (toi\_category) extension 0.6.0 and earlier for TYPO3 allows remote attackers (no CVSS)
- [CVE-2012-1074](https://cve.now/CVE-2012-1074.md): SQL injection vulnerability in the White Papers (mm\_whtppr) extension 0.0.4 and earlier for TYPO3 allows remote attackers to execute arbitra (no CVSS)
- [CVE-2012-1075](https://cve.now/CVE-2012-1075.md): SQL injection vulnerability in the Documents download (rtg\_files) extension before 1.5.2 for TYPO3 allows remote attackers to execute arbitr (no CVSS)
- [CVE-2012-1076](https://cve.now/CVE-2012-1076.md): Cross-site scripting (XSS) vulnerability in the Documents download (rtg\_files) extension before 1.5.2 for TYPO3 allows remote attackers to i (no CVSS)
- [CVE-2012-1077](https://cve.now/CVE-2012-1077.md): SQL injection vulnerability in the Post data records to facebook (bc\_post2facebook) extension before 0.2.2 for TYPO3 allows remote attackers (no CVSS)
- [CVE-2012-1078](https://cve.now/CVE-2012-1078.md): The System Utilities (sysutils) extension 1.0.3 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unspecifie (no CVSS)
- [CVE-2012-1079](https://cve.now/CVE-2012-1079.md): Unspecified vulnerability in the Webservices for TYPO3 (typo3\_webservice) extension before 0.3.8 for TYPO3 allows remote authenticated users (no CVSS)
- [CVE-2012-1080](https://cve.now/CVE-2012-1080.md): Cross-site scripting (XSS) vulnerability in the Euro Calculator (skt\_eurocalc) extension 0.0.1 allows remote attackers to inject arbitrary w (no CVSS)
- [CVE-2012-1081](https://cve.now/CVE-2012-1081.md): Cross-site scripting (XSS) vulnerability in the Yet another Google search (ya\_googlesearch) extension before 0.3.10 for TYPO3 allows remote (no CVSS)
- [CVE-2012-1082](https://cve.now/CVE-2012-1082.md): Cross-site scripting (XSS) vulnerability in the Terminal PHP Shell (terminal) extension 0.3.2 and earlier for TYPO3 allows remote authentica (no CVSS)
- [CVE-2012-1083](https://cve.now/CVE-2012-1083.md): Cross-site request forgery (CSRF) vulnerability in the Terminal PHP Shell (terminal) extension 0.3.2 and earlier for TYPO3 allows remote att (no CVSS)
- [CVE-2012-1084](https://cve.now/CVE-2012-1084.md): Cross-site scripting (XSS) vulnerability in the BE User Switch (beuserswitch) extension 0.0.1 for TYPO3 allows remote attackers to inject ar (no CVSS)
- [CVE-2012-1085](https://cve.now/CVE-2012-1085.md): Unspecified vulnerability in the BE User Switch (beuserswitch) extension 0.0.1 for TYPO3 allows remote attackers to obtain sensitive informa (no CVSS)
- [CVE-2012-1086](https://cve.now/CVE-2012-1086.md): Cross-site scripting (XSS) vulnerability in the UrlTool (aeurltool) extension 0.1.0 for TYPO3 allows remote attackers to inject arbitrary we (no CVSS)
- [CVE-2012-1087](https://cve.now/CVE-2012-1087.md): Cross-site scripting (XSS) vulnerability in the Post data records to facebook (bc\_post2facebook) extension before 0.2.2 for TYPO3 allows rem (no CVSS)
- [CVE-2012-0788](https://cve.now/CVE-2012-0788.md): The PDORow implementation in PHP before 5.3.9 does not properly interact with the session feature, which allows remote attackers to cause a (no CVSS)
- [CVE-2012-0789](https://cve.now/CVE-2012-0789.md): Memory leak in the timezone functionality in PHP before 5.3.9 allows remote attackers to cause a denial of service (memory consumption) by t (no CVSS)
- [CVE-2012-0829](https://cve.now/CVE-2012-0829.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Mibew Messenger 1.6.4 and earlier allow remote attackers to hijack the authent (no CVSS)
- [CVE-2012-1055](https://cve.now/CVE-2012-1055.md): Heap-based buffer overflow in PhotoLine 17.01 and possibly other versions before 17.02 allows remote attackers to execute arbitrary code via (no CVSS)
- [CVE-2012-1056](https://cve.now/CVE-2012-1056.md): The Forward module 6.x-1.x before 6.x-1.21 and 7.x-1.x before 7.x-1.3 for Drupal does not properly enforce permissions for (1) Recent forwar (no CVSS)
- [CVE-2012-1057](https://cve.now/CVE-2012-1057.md): Cross-site request forgery (CSRF) vulnerability in the clickthrough tracking functionality in the Forward module 6.x-1.x before 6.x-1.21 and (no CVSS)
- [CVE-2012-1058](https://cve.now/CVE-2012-1058.md): Cross-site request forgery (CSRF) vulnerability in Flyspray 0.9.9.6 allows remote attackers to hijack the authentication of admins for reque (no CVSS)
- [CVE-2012-1059](https://cve.now/CVE-2012-1059.md): Cross-site scripting (XSS) vulnerability in osCommerce/OM/Core/Site/Shop/Application/Cart/pages/main.php in OSCommerce Online Merchant 3.0.2 (no CVSS)
- [CVE-2012-1060](https://cve.now/CVE-2012-1060.md): Multiple cross-site scripting (XSS) vulnerabilities in revisioning\_theme.inc in the Taxonomy module in the Revisioning module 6.x-3.13 and o (no CVSS)
- [CVE-2012-1061](https://cve.now/CVE-2012-1061.md): SQL injection vulnerability in GForge Advanced Server 6.0.0 and other versions before 6.0.1 allows remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2012-1062](https://cve.now/CVE-2012-1062.md): Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Applications Manager 9.x and 10.x allow remote attackers to inject arbit (no CVSS)
- [CVE-2012-1063](https://cve.now/CVE-2012-1063.md): Multiple SQL injection vulnerabilities in ManageEngine Applications Manager 9.x and 10.x allow remote attackers to execute arbitrary SQL com (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2012-02-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.