# CVEs published 2012-05-21

43 CVEs were published on May 21, 2012: 0 critical, 0 high. Days are UTC.

- [CVE-2012-2918](https://cve.now/CVE-2012-2918.md): Cross-site scripting (XSS) vulnerability in Upload/engine.php in Chevereto 1.91 allows remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2012-2919](https://cve.now/CVE-2012-2919.md): Directory traversal vulnerability in Upload/engine.php in Chevereto 1.9.1 allows remote attackers to determine the existence of arbitrary fi (no CVSS)
- [CVE-2012-2920](https://cve.now/CVE-2012-2920.md): Cross-site scripting (XSS) vulnerability in the userphoto\_options\_page function in user-photo.php in the User Photo plugin before 0.9.5.2 fo (no CVSS)
- [CVE-2012-2921](https://cve.now/CVE-2012-2921.md): Universal Feed Parser (aka feedparser or python-feedparser) before 5.1.2 allows remote attackers to cause a denial of service (memory consum (no CVSS, feedparser)
- [CVE-2012-2922](https://cve.now/CVE-2012-2922.md): The request\_path function in includes/bootstrap.inc in Drupal 7.14 and earlier allows remote attackers to obtain sensitive information via t (no CVSS)
- [CVE-2012-2923](https://cve.now/CVE-2012-2923.md): SQL injection vulnerability in news.php4 in Hypermethod eLearning Server 4G allows remote attackers to execute arbitrary SQL commands via th (no CVSS)
- [CVE-2012-2924](https://cve.now/CVE-2012-2924.md): PHP remote file inclusion vulnerability in admin/setup.inc.php in Hypermethod eLearning Server 4G allows remote attackers to execute arbitra (no CVSS)
- [CVE-2012-2925](https://cve.now/CVE-2012-2925.md): SQL injection vulnerability in engine.php in Simple PHP Agenda 2.2.8 allows remote attackers to execute arbitrary SQL commands via the prior (no CVSS)
- [CVE-2010-5097](https://cve.now/CVE-2010-5097.md): Cross-site scripting (XSS) vulnerability in the click enlarge functionality in TYPO3 4.3.x before 4.3.9 and 4.4.x before 4.4.5 when the cach (no CVSS, typo3/cms-frontend)
- [CVE-2010-5098](https://cve.now/CVE-2010-5098.md): Cross-site scripting (XSS) vulnerability in the FORM content object in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 (no CVSS, typo3/cms-frontend)
- [CVE-2010-5100](https://cve.now/CVE-2010-5100.md): Multiple cross-site scripting (XSS) vulnerabilities in the Install Tool in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4 (no CVSS, typo3/cms-install)
- [CVE-2010-5101](https://cve.now/CVE-2010-5101.md): Directory traversal vulnerability in the TypoScript setup in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows re (no CVSS, typo3/cms)
- [CVE-2010-5102](https://cve.now/CVE-2010-5102.md): Directory traversal vulnerability in mod/tools/em/class.em\_unzip.php in the unzip library in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, (no CVSS)
- [CVE-2010-5103](https://cve.now/CVE-2010-5103.md): SQL injection vulnerability in the list module in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows remote authen (no CVSS, typo3/cms)
- [CVE-2010-5104](https://cve.now/CVE-2010-5104.md): The escapeStrForLike method in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly escape input when the (no CVSS, typo3/cms-core)
- [CVE-2012-0296](https://cve.now/CVE-2012-0296.md): Multiple cross-site scripting (XSS) vulnerabilities in the management GUI in Symantec Web Gateway 5.0.x before 5.0.3 allow remote attackers (no CVSS)
- [CVE-2012-0297](https://cve.now/CVE-2012-0297.md): The management GUI in Symantec Web Gateway 5.0.x before 5.0.3 does not properly restrict access to application scripts, which allows remote (no CVSS)
- [CVE-2012-0298](https://cve.now/CVE-2012-0298.md): The file-management scripts in the management GUI in Symantec Web Gateway 5.0.x before 5.0.3 allow remote attackers to (1) read or (2) delet (no CVSS)
- [CVE-2012-0299](https://cve.now/CVE-2012-0299.md): The file-management scripts in the management GUI in Symantec Web Gateway 5.0.x before 5.0.3 allow remote attackers to upload arbitrary code (no CVSS)
- [CVE-2012-1249](https://cve.now/CVE-2012-1249.md): The iLunascape application 1.0.4.0 and earlier for Android does not properly implement the WebView class, which allows remote attackers to o (no CVSS)
- [CVE-2012-2271](https://cve.now/CVE-2012-2271.md): Buffer overflow in the InitLicenKeys function in a certain ActiveX control in SkinCrafter3\_vs2005.dll in SkinCrafter 3.0 allows remote attac (no CVSS)
- [CVE-2012-2338](https://cve.now/CVE-2012-2338.md): SQL injection vulnerability in includes/picture.class.php in Galette 0.63, 0.63.1, 0.63.2, 0.63.3, and 0.64rc1 allows remote attackers to ex (no CVSS)
- [CVE-2012-2339](https://cve.now/CVE-2012-2339.md): Cross-site scripting (XSS) vulnerability in the Glossary module 6.x-1.x before 6.x-1.8 for Drupal allows remote attackers to inject arbitrar (no CVSS)
- [CVE-2012-2340](https://cve.now/CVE-2012-2340.md): The Contact Forms module 7.x-1.x before 7.x-1.2 for Drupal does not specify sufficiently restrictive permissions, which allows remote authen (no CVSS)
- [CVE-2012-2561](https://cve.now/CVE-2012-2561.md): HP Business Service Management (BSM) 9.12 does not properly restrict the uploading of .war files, which allows remote attackers to execute a (no CVSS)
- [CVE-2012-2901](https://cve.now/CVE-2012-2901.md): Cross-site scripting (XSS) vulnerability in the Profile List in the Joomla Content Editor (JCE) component before 2.1 for Joomla! allows remo (no CVSS)
- [CVE-2012-2902](https://cve.now/CVE-2012-2902.md): Unrestricted file upload vulnerability in editor/extensions/browser/file.php in the Joomla Content Editor (JCE) component before 2.1 for Joo (no CVSS)
- [CVE-2012-2903](https://cve.now/CVE-2012-2903.md): Multiple cross-site scripting (XSS) vulnerabilities in PHP Address Book 7.0 and earlier allow remote attackers to inject arbitrary web scrip (no CVSS)
- [CVE-2012-2904](https://cve.now/CVE-2012-2904.md): player.swf in LongTail JW Player 5.9 allows remote attackers to conduct cross-site scripting (XSS) attacks to inject arbitrary web script or (no CVSS)
- [CVE-2012-2905](https://cve.now/CVE-2012-2905.md): Artiphp CMS 5.5.0 Neo (r422) stores database backups with predictable names under the web root with insufficient access control, which allow (no CVSS)
- [CVE-2012-2906](https://cve.now/CVE-2012-2906.md): Multiple cross-site scripting (XSS) vulnerabilities in artpublic/recommandation/index.php in Artiphp CMS 5.5.0 Neo (r422) allow remote attac (no CVSS)
- [CVE-2012-2907](https://cve.now/CVE-2012-2907.md): Cross-site scripting (XSS) vulnerability in the aberdeen\_breadcrumb function in template.php in the Aberdeen theme 6.x-1.x before 6.x-1.11 f (no CVSS)
- [CVE-2012-2908](https://cve.now/CVE-2012-2908.md): Multiple SQL injection vulnerabilities in admin/bbcodes.php in Viscacha 0.8.1.1 allow remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2012-2909](https://cve.now/CVE-2012-2909.md): Multiple cross-site scripting (XSS) vulnerabilities in Viscacha 0.8.1.1 allow remote attackers to inject arbitrary web script or HTML via th (no CVSS)
- [CVE-2012-2910](https://cve.now/CVE-2012-2910.md): Multiple cross-site scripting (XSS) vulnerabilities in SiliSoftware phpThumb() 1.7.11 allow remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2012-2911](https://cve.now/CVE-2012-2911.md): Cross-site scripting (XSS) vulnerability in backupDB.php in SiliSoftware backupDB() 1.2.7a allows remote attackers to inject arbitrary web s (no CVSS)
- [CVE-2012-2912](https://cve.now/CVE-2012-2912.md): Multiple cross-site scripting (XSS) vulnerabilities in the LeagueManager plugin 3.7 for WordPress allow remote attackers to inject arbitrary (no CVSS)
- [CVE-2012-2913](https://cve.now/CVE-2012-2913.md): Multiple cross-site scripting (XSS) vulnerabilities in the Leaflet plugin 0.0.1 for WordPress allow remote attackers to inject arbitrary web (no CVSS)
- [CVE-2012-2914](https://cve.now/CVE-2012-2914.md): Cross-site scripting (XSS) vulnerability in captchademo.php in Unijimpe Captcha allows remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2012-2915](https://cve.now/CVE-2012-2915.md): Stack-based buffer overflow in Lattice Semiconductor PAC-Designer 6.2.1344 allows remote attackers to execute arbitrary code via a long stri (no CVSS)
- [CVE-2012-2916](https://cve.now/CVE-2012-2916.md): Cross-site scripting (XSS) vulnerability in sabre\_class\_admin.php in the SABRE plugin before 2.1 for WordPress allows remote attackers to in (no CVSS)
- [CVE-2012-2917](https://cve.now/CVE-2012-2917.md): Cross-site scripting (XSS) vulnerability in the Share and Follow plugin 1.80.3 for WordPress allows remote attackers to inject arbitrary web (no CVSS)
- [CVE-2012-2376](https://cve.now/CVE-2012-2376.md): Buffer overflow in the com\_print\_typeinfo function in PHP 5.4.3 and earlier on Windows allows remote attackers to execute arbitrary code via (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2012-05-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.