# CVEs published 2012-05-29

11 CVEs were published on May 29, 2012: 0 critical, 0 high. Days are UTC.

- [CVE-2011-3048](https://cve.now/CVE-2011-3048.md): The png\_set\_text\_2 function in pngset.c in libpng 1.0.x before 1.0.59, 1.2.x before 1.2.49, 1.4.x before 1.4.11, and 1.5.x before 1.5.10 all (no CVSS)
- [CVE-2012-0220](https://cve.now/CVE-2012-0220.md): Multiple cross-site scripting (XSS) vulnerabilities in the meta plugin (Plugin/meta.pm) in ikiwiki before 3.20120516 allow remote attackers (no CVSS)
- [CVE-2012-0804](https://cve.now/CVE-2012-0804.md): Heap-based buffer overflow in the proxy\_connect function in src/client.c in CVS 1.11 and 1.12 allows remote HTTP proxy servers to cause a de (no CVSS)
- [CVE-2012-1053](https://cve.now/CVE-2012-1053.md): The change\_user method in the SUIDManager (lib/puppet/util/suidmanager.rb) in Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet (no CVSS, puppet)
- [CVE-2012-1054](https://cve.now/CVE-2012-1054.md): Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3, when managing a us (no CVSS)
- [CVE-2012-1906](https://cve.now/CVE-2012-1906.md): Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses pre (no CVSS, puppet)
- [CVE-2012-1986](https://cve.now/CVE-2012-1986.md): Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows r (no CVSS)
- [CVE-2012-1987](https://cve.now/CVE-2012-1987.md): Unspecified vulnerability in Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, an (no CVSS, puppet)
- [CVE-2012-1988](https://cve.now/CVE-2012-1988.md): Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows r (no CVSS, puppet)
- [CVE-2012-2952](https://cve.now/CVE-2012-2952.md): SQL injection vulnerability in add\_ons.php in Jaow 2.4.5 and earlier allows remote attackers to execute arbitrary SQL commands via the add\_o (no CVSS)
- [CVE-2012-2949](https://cve.now/CVE-2012-2949.md): The ZTE sync\_agent program for Android 2.3.4 on the Score M device uses a hardcoded ztex1609523 password to control access to commands, whic (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2012-05-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.