# CVEs published 2012-06-27

63 CVEs were published on June 27, 2012: 0 critical, 0 high. Days are UTC.

- [CVE-2012-2742](https://cve.now/CVE-2012-2742.md): Revelation 0.4.13-2 and earlier uses only the first 32 characters of a password followed by a sequence of zeros, which reduces the entropy a (no CVSS)
- [CVE-2012-2743](https://cve.now/CVE-2012-2743.md): Revelation 0.4.13-2 and earlier does not iterate through SHA hashing algorithms for AES encryption, which makes it easier for context-depend (no CVSS)
- [CVE-2012-3231](https://cve.now/CVE-2012-3231.md): Multiple cross-site request forgery (CSRF) vulnerabilities in web@all 2.0, as downloaded before May 30, 2012, allow remote attackers to hija (no CVSS)
- [CVE-2011-4956](https://cve.now/CVE-2011-4956.md): Cross-site scripting (XSS) vulnerability in WordPress before 3.1.1 allows remote attackers to inject arbitrary web script or HTML via unspec (no CVSS)
- [CVE-2011-4957](https://cve.now/CVE-2011-4957.md): The make\_clickable function in wp-includes/formatting.php in WordPress before 3.1.1 does not properly check URLs before passing them to the (no CVSS)
- [CVE-2012-2388](https://cve.now/CVE-2012-2388.md): The GMP Plugin in strongSwan 4.2.0 through 4.6.3 allows remote attackers to bypass authentication via a (1) empty or (2) zeroed RSA signatur (no CVSS)
- [CVE-2012-2451](https://cve.now/CVE-2012-2451.md): The Config::IniFiles module before 2.71 for Perl creates temporary files with predictable names, which allows local users to overwrite arbit (no CVSS)
- [CVE-2012-2717](https://cve.now/CVE-2012-2717.md): Multiple cross-site scripting (XSS) vulnerabilities in the Mobile Tools module 6.x-2.x before 6.x-2.3 for Drupal allow remote attackers to i (no CVSS)
- [CVE-2012-3814](https://cve.now/CVE-2012-3814.md): Unrestricted file upload vulnerability in font-upload.php in the Font Uploader plugin 1.2.4 for WordPress allows remote attackers to execute (no CVSS)
- [CVE-2012-3815](https://cve.now/CVE-2012-3815.md): Buffer overflow in RunTime.exe in Sielco Sistemi Winlog Pro SCADA before 2.07.18 and Winlog Lite SCADA before 2.07.18 allows remote attacker (no CVSS)
- [CVE-2012-3816](https://cve.now/CVE-2012-3816.md): WinRadius Server 2009 allows remote attackers to cause a denial of service (crash) via a long password in an Access-Request packet. (no CVSS)
- [CVE-2012-1989](https://cve.now/CVE-2012-1989.md): telnet.rb in Puppet 2.7.x before 2.7.13 and Puppet Enterprise (PE) 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows local users to overwrite arbi (no CVSS, puppet)
- [CVE-2012-3802](https://cve.now/CVE-2012-3802.md): Unspecified vulnerability in the Post Affiliate Pro (PAP) module for Drupal allows remote authenticated users to read the commissions of oth (no CVSS)
- [CVE-2011-4940](https://cve.now/CVE-2011-4940.md): The list\_directory function in Lib/SimpleHTTPServer.py in SimpleHTTPServer in Python before 2.5.6c1, 2.6.x before 2.6.7 rc2, and 2.7.x befor (no CVSS)
- [CVE-2012-2200](https://cve.now/CVE-2012-2200.md): The default configuration of sendmail in IBM AIX 6.1 and 7.1, and VIOS 2.2.1.4-FP-25 SP-02, allows local users to gain privileges by enterin (no CVSS)
- [CVE-2012-2764](https://cve.now/CVE-2012-2764.md): Untrusted search path vulnerability in Google Chrome before 20.0.1132.43 on Windows might allow local users to gain privileges via a Trojan (no CVSS)
- [CVE-2012-2807](https://cve.now/CVE-2012-2807.md): Multiple integer overflows in libxml2, as used in Google Chrome before 20.0.1132.43 and other products, on 64-bit Linux platforms allow remo (no CVSS)
- [CVE-2012-2815](https://cve.now/CVE-2012-2815.md): Google Chrome before 20.0.1132.43 allows remote attackers to obtain potentially sensitive information from a fragment identifier by leveragi (no CVSS)
- [CVE-2012-2816](https://cve.now/CVE-2012-2816.md): Google Chrome before 20.0.1132.43 on Windows does not properly isolate sandboxed processes, which might allow remote attackers to cause a de (no CVSS)
- [CVE-2012-2817](https://cve.now/CVE-2012-2817.md): Use-after-free vulnerability in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service or possibly have unsp (no CVSS)
- [CVE-2012-2818](https://cve.now/CVE-2012-2818.md): Use-after-free vulnerability in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service or possibly have unsp (no CVSS)
- [CVE-2012-2819](https://cve.now/CVE-2012-2819.md): The texSubImage2D implementation in the WebGL subsystem in Google Chrome before 20.0.1132.43 does not properly handle uploads to floating-po (no CVSS)
- [CVE-2012-2820](https://cve.now/CVE-2012-2820.md): Google Chrome before 20.0.1132.43 does not properly implement SVG filters, which allows remote attackers to cause a denial of service (out-o (no CVSS)
- [CVE-2012-2821](https://cve.now/CVE-2012-2821.md): The autofill implementation in Google Chrome before 20.0.1132.43 does not properly display text, which has unspecified impact and remote att (no CVSS)
- [CVE-2012-2822](https://cve.now/CVE-2012-2822.md): The PDF functionality in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service (out-of-bounds read) via uns (no CVSS)
- [CVE-2012-2823](https://cve.now/CVE-2012-2823.md): Use-after-free vulnerability in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service or possibly have unsp (no CVSS)
- [CVE-2012-2824](https://cve.now/CVE-2012-2824.md): Use-after-free vulnerability in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service or possibly have unsp (no CVSS)
- [CVE-2012-2825](https://cve.now/CVE-2012-2825.md): The XSL implementation in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service (incorrect read operation) (no CVSS)
- [CVE-2012-2826](https://cve.now/CVE-2012-2826.md): Google Chrome before 20.0.1132.43 does not properly implement texture conversion, which allows remote attackers to cause a denial of service (no CVSS)
- [CVE-2012-2827](https://cve.now/CVE-2012-2827.md): Use-after-free vulnerability in the UI in Google Chrome before 20.0.1132.43 on Mac OS X allows attackers to cause a denial of service or pos (no CVSS)
- [CVE-2012-2828](https://cve.now/CVE-2012-2828.md): Multiple integer overflows in the PDF functionality in Google Chrome before 20.0.1132.43 allow remote attackers to cause a denial of service (no CVSS)
- [CVE-2012-2829](https://cve.now/CVE-2012-2829.md): Use-after-free vulnerability in the Cascading Style Sheets (CSS) implementation in Google Chrome before 20.0.1132.43 allows remote attackers (no CVSS)
- [CVE-2012-2830](https://cve.now/CVE-2012-2830.md): Google Chrome before 20.0.1132.43 does not properly set array values, which allows remote attackers to cause a denial of service (incorrect (no CVSS)
- [CVE-2012-2831](https://cve.now/CVE-2012-2831.md): Use-after-free vulnerability in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service or possibly have unsp (no CVSS)
- [CVE-2012-2832](https://cve.now/CVE-2012-2832.md): The image-codec implementation in the PDF functionality in Google Chrome before 20.0.1132.43 does not initialize an unspecified pointer, whi (no CVSS)
- [CVE-2012-2833](https://cve.now/CVE-2012-2833.md): Buffer overflow in the JS API in the PDF functionality in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of ser (no CVSS)
- [CVE-2012-2834](https://cve.now/CVE-2012-2834.md): Integer overflow in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service or possibly have unspecified othe (no CVSS)
- [CVE-2012-2702](https://cve.now/CVE-2012-2702.md): The Ubercart Product Keys module 6.x-1.x before 6.x-1.1 for Drupal does not properly check access for product keys, which allows remote atta (no CVSS)
- [CVE-2012-2703](https://cve.now/CVE-2012-2703.md): Cross-site scripting (XSS) vulnerability in the Advertisement module 6.x-2.x before 6.x-2.3 for Drupal, when debug mode is enabled, allows r (no CVSS)
- [CVE-2012-2705](https://cve.now/CVE-2012-2705.md): The filter\_titles function in the Smart Breadcrumb module 6.x-1.x before 6.x-1.3 for Drupal does not properly convert a title to plain-text, (no CVSS)
- [CVE-2012-2706](https://cve.now/CVE-2012-2706.md): Cross-site scripting (XSS) vulnerability in the Post Affiliate Pro (PAP) module for Drupal allows remote attackers to inject arbitrary web s (no CVSS)
- [CVE-2012-2707](https://cve.now/CVE-2012-2707.md): The Hostmaster (Aegir) module 6.x-1.x before 6.x-1.9 for Drupal does not properly exit when users do not have access to package/task nodes, (no CVSS)
- [CVE-2012-2708](https://cve.now/CVE-2012-2708.md): Cross-site scripting (XSS) vulnerability in the \_hosting\_task\_log\_table function in modules/hosting/task/hosting\_task.module in the Hostmast (no CVSS)
- [CVE-2012-2710](https://cve.now/CVE-2012-2710.md): Cross-site scripting (XSS) vulnerability in the Zen module 6.x-1.x before 6.x-1.1 for Drupal, when "Append the content title to the end of t (no CVSS)
- [CVE-2012-2711](https://cve.now/CVE-2012-2711.md): Multiple cross-site scripting (XSS) vulnerabilities in the Taxonomy List module 6.x-1.x before 6.x-1.4 for Drupal allow remote authenticated (no CVSS)
- [CVE-2012-2712](https://cve.now/CVE-2012-2712.md): Multiple cross-site scripting (XSS) vulnerabilities in the Search API module 7.x-1.x before 7.x-1.1 for Drupal, when supporting manual entry (no CVSS)
- [CVE-2012-2713](https://cve.now/CVE-2012-2713.md): Cross-site request forgery (CSRF) vulnerability in the BrowserID (Mozilla Persona) module 7.x-1.x before 7.x-1.3 for Drupal allows remote at (no CVSS)
- [CVE-2012-2715](https://cve.now/CVE-2012-2715.md): Cross-site scripting (XSS) vulnerability in the themes\_links function in template.php in the Amadou theme module 6.x-1.x before 6.x-1.3 for (no CVSS)
- [CVE-2012-2719](https://cve.now/CVE-2012-2719.md): The filedepot module 6.x-1.x before 6.x-1.3 for Drupal, when accessed using multiple different browsers from the same IP address, causes Int (no CVSS)
- [CVE-2012-2720](https://cve.now/CVE-2012-2720.md): The Token Authentication (tokenauth) module 6.x-1.x before 6.x-1.7 for Drupal does not properly revert user sessions, which might allow remo (no CVSS)
- [CVE-2012-2721](https://cve.now/CVE-2012-2721.md): The default views in the Organic Groups (OG) module 6.x-2.x before 6.x-2.4 for Drupal do not properly check permissions when all users have (no CVSS)
- [CVE-2012-2722](https://cve.now/CVE-2012-2722.md): The node selection interface in the WYSIWYG editor (CKEditor) in the Node Embed module 6.x-1.x before 6.x-1.5 and 7.x-1.x before 7.x-1.0 for (no CVSS)
- [CVE-2012-2723](https://cve.now/CVE-2012-2723.md): Cross-site scripting (XSS) vulnerability in the Maestro module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with maes (no CVSS)
- [CVE-2012-2725](https://cve.now/CVE-2012-2725.md): classes/Filter/WhitelistedExternalFilter.php in the Authoring HTML module 6.x-1.x before 6.x-1.1 for Drupal does not properly validate sourc (no CVSS)
- [CVE-2012-2726](https://cve.now/CVE-2012-2726.md): Cross-site scripting (XSS) vulnerability in the Protest module 6.x-1.x before 6.x-1.2 or 7.x-1.x before 7.x-1.2 for Drupal allows remote aut (no CVSS)
- [CVE-2012-2727](https://cve.now/CVE-2012-2727.md): Open redirect vulnerability in the Janrain Capture module 6.x-1.0 and 7.x-1.0 for Drupal, when synchronizing user data, allows remote attack (no CVSS)
- [CVE-2012-2728](https://cve.now/CVE-2012-2728.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Node Hierarchy module 6.x-1.x before 6.x-1.5 for Drupal allow remote attac (no CVSS)
- [CVE-2012-2729](https://cve.now/CVE-2012-2729.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the SimpleMeta module 6.x-1.x before 6.x-2.0 for Drupal allow remote attackers (no CVSS)
- [CVE-2012-2730](https://cve.now/CVE-2012-2730.md): The Protected Node module 6.x-1.x before 6.x-1.6 for Drupal does not properly "protect node access when nodes are accessed outside of the st (no CVSS)
- [CVE-2012-2731](https://cve.now/CVE-2012-2731.md): The Ubercart AJAX Cart 6.x-2.x before 6.x-2.1 for Drupal stores the PHP session id in the JavaScript settings array in page loads, which mig (no CVSS)
- [CVE-2012-3798](https://cve.now/CVE-2012-3798.md): The Janrain Capture module 6.x-1.0 and 7.x-1.0 for Drupal, when creating a local user account, allows attackers to obtain part of the initia (no CVSS)
- [CVE-2012-3799](https://cve.now/CVE-2012-3799.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Maestro module 7.x-1.x before 7.x-1.2 for Drupal allow remote attackers to (no CVSS)
- [CVE-2012-3800](https://cve.now/CVE-2012-3800.md): Cross-site scripting (XSS) vulnerability in og.js in the Organic Groups (OG) module 6.x-2.x before 6.x-2.4 for Drupal, when used with the Ve (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2012-06-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.