# CVEs published 2012-04-04

17 CVEs were published on April 4, 2012: 0 critical, 0 high. Days are UTC.

- [CVE-2012-0128](https://cve.now/CVE-2012-0128.md): HP Onboard Administrator (OA) before 3.50 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via (no CVSS)
- [CVE-2012-0129](https://cve.now/CVE-2012-0129.md): HP Onboard Administrator (OA) before 3.50 allows remote attackers to bypass intended access restrictions and execute arbitrary code via unsp (no CVSS)
- [CVE-2012-0130](https://cve.now/CVE-2012-0130.md): HP Onboard Administrator (OA) before 3.50 allows remote attackers to obtain sensitive information via unspecified vectors. (no CVSS)
- [CVE-2008-7309](https://cve.now/CVE-2008-7309.md): Insoshi before 20080920 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attacke (no CVSS)
- [CVE-2008-7310](https://cve.now/CVE-2008-7310.md): Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set th (no CVSS, spree)
- [CVE-2008-7311](https://cve.now/CVE-2008-7311.md): The session cookie store implementation in Spree 0.2.0 uses a hardcoded config.action\_controller\_session hash value (aka secret key), which (no CVSS, spree)
- [CVE-2012-0132](https://cve.now/CVE-2012-0132.md): Cross-site scripting (XSS) vulnerability in HP Business Availability Center (BAC) 9.01 allows remote attackers to inject arbitrary web scrip (no CVSS)
- [CVE-2012-1335](https://cve.now/CVE-2012-1335.md): Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 L through SP11 EP26, T27 LB through SP21 EP10, T27 LC before SP25 EP10, (no CVSS)
- [CVE-2012-1336](https://cve.now/CVE-2012-1336.md): Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 L through SP11 EP26, T27 LB through SP21 EP10, T27 LC before SP25 EP10, (no CVSS)
- [CVE-2012-1337](https://cve.now/CVE-2012-1337.md): Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 L through SP11 EP26, T27 LB through SP21 EP10, T27 LC before SP25 EP10, (no CVSS)
- [CVE-2011-5000](https://cve.now/CVE-2011-5000.md): The ssh\_gssapi\_parse\_ename function in gss-serv.c in OpenSSH 5.8 and earlier, when gssapi-with-mic authentication is enabled, allows remote (no CVSS)
- [CVE-2012-0327](https://cve.now/CVE-2012-0327.md): Cross-site scripting (XSS) vulnerability in Redmine before 1.3.2 allows remote attackers to inject arbitrary web script or HTML via unspecif (no CVSS)
- [CVE-2012-1777](https://cve.now/CVE-2012-1777.md): SQL injection vulnerability in my.activation.php3 in F5 FirePass 6.0.0 through 6.1.0 and 7.0.0 allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2012-1982](https://cve.now/CVE-2012-1982.md): Cross-site scripting (XSS) vulnerability in my\_admin/admin1\_list\_pages.php in SocialCMS 1.0.2 and earlier allows remote authenticated users (no CVSS)
- [CVE-2012-2053](https://cve.now/CVE-2012-2053.md): The sudoers file in the Linux system configuration in F5 FirePass 6.0.0 through 6.1.0 and 7.0.0 does not require a password for executing co (no CVSS)
- [CVE-2012-2054](https://cve.now/CVE-2012-2054.md): Redmine before 1.3.2 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers (no CVSS)
- [CVE-2012-2055](https://cve.now/CVE-2012-2055.md): GitHub Enterprise before 20120304 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remo (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2012-04-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.