# CVEs published 2012-07-03

45 CVEs were published on July 3, 2012: 0 critical, 0 high. Days are UTC.

- [CVE-2012-3828](https://cve.now/CVE-2012-3828.md): Cross-site scripting (XSS) vulnerability in Joomla! 2.5.3 allows remote attackers to inject arbitrary web script or HTML via the Host HTTP H (no CVSS)
- [CVE-2012-3829](https://cve.now/CVE-2012-3829.md): Joomla! 2.5.3 allows remote attackers to obtain the installation path via the Host HTTP Header. (no CVSS)
- [CVE-2012-3830](https://cve.now/CVE-2012-3830.md): Cross-site scripting (XSS) vulnerability in decoda/templates/video.php in Decoda before 3.3.3 allows remote attackers to inject arbitrary we (no CVSS)
- [CVE-2012-3831](https://cve.now/CVE-2012-3831.md): Cross-site scripting (XSS) vulnerability in decoda/templates/video.php in Decoda before 3.3.1 allows remote attackers to inject arbitrary we (no CVSS)
- [CVE-2012-3832](https://cve.now/CVE-2012-3832.md): Cross-site scripting (XSS) vulnerability in decoda/Decoda.php in Decoda before 3.2 allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2012-3833](https://cve.now/CVE-2012-3833.md): Cross-site scripting (XSS) vulnerability in the default index page in admin/ in Quick.CMS 4.0 allows remote attackers to inject arbitrary we (no CVSS)
- [CVE-2012-3834](https://cve.now/CVE-2012-3834.md): SQL injection vulnerability in forensics/base\_qry\_main.php in AlienVault Open Source Security Information Management (OSSIM) 3.1 allows remo (no CVSS)
- [CVE-2012-3835](https://cve.now/CVE-2012-3835.md): Multiple cross-site scripting (XSS) vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) 3.1 allow remote attac (no CVSS)
- [CVE-2012-3836](https://cve.now/CVE-2012-3836.md): Multiple cross-site scripting (XSS) vulnerabilities in Baby Gekko before 1.2.0 allow remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2012-3837](https://cve.now/CVE-2012-3837.md): Multiple cross-site scripting (XSS) vulnerabilities in apps/users/registration.template.php in Baby Gekko 1.2.0 and earlier allow remote att (no CVSS)
- [CVE-2012-3838](https://cve.now/CVE-2012-3838.md): Gekko before 1.2.0 allows remote attackers to obtain the installation path via a direct request to (1) admin/templates/babygekko/index.php o (no CVSS)
- [CVE-2012-3839](https://cve.now/CVE-2012-3839.md): Multiple SQL injection vulnerabilities in application/core/MY\_Model.php in MyClientBase 0.12 allow remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2012-3840](https://cve.now/CVE-2012-3840.md): Multiple cross-site scripting (XSS) vulnerabilities in index.php/users/form/user\_id in MyClientBase 0.12 allow remote attackers to inject ar (no CVSS)
- [CVE-2012-3841](https://cve.now/CVE-2012-3841.md): Untrusted search path vulnerability in KMPlayer 3.2.0.19 allows local users to execute arbitrary code and conduct DLL hijacking attacks via (no CVSS)
- [CVE-2012-3842](https://cve.now/CVE-2012-3842.md): Multiple cross-site scripting (XSS) vulnerabilities in CMD\_DOMAIN in JBMC Software DirectAdmin 1.403 allow remote authenticated users with c (no CVSS)
- [CVE-2012-3843](https://cve.now/CVE-2012-3843.md): Cross-site scripting (XSS) vulnerability in the registration page in e107, probably 1.0.1, allows remote attackers to inject arbitrary web s (no CVSS)
- [CVE-2012-3844](https://cve.now/CVE-2012-3844.md): Cross-site scripting (XSS) vulnerability in vBulletin 4.1.12 allows remote attackers to inject arbitrary web script or HTML via a long strin (no CVSS)
- [CVE-2012-3845](https://cve.now/CVE-2012-3845.md): Buffer overflow in LAN Messenger 1.2.28 and earlier allows remote attackers to cause a denial of service (crash) via a long string in an ini (no CVSS)
- [CVE-2012-3846](https://cve.now/CVE-2012-3846.md): Cross-site scripting (XSS) vulnerability in index.php in PHP-pastebin 2.1 allows remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2011-5096](https://cve.now/CVE-2011-5096.md): Stack-based buffer overflow in cstore.exe in the Media Application Server (MAS) in Avaya Aura Application Server 5300 (formerly Nortel Media (no CVSS)
- [CVE-2012-2181](https://cve.now/CVE-2012-2181.md): Directory traversal vulnerability in the Dojo module in IBM WebSphere Portal 7.0.0.1 and 7.0.0.2 before CF14, and 8.0, allows remote attacke (no CVSS)
- [CVE-2012-3368](https://cve.now/CVE-2012-3368.md): Integer signedness error in attach.c in dtach 0.8 allows remote attackers to obtain sensitive information from daemon stack memory in opport (no CVSS)
- [CVE-2011-4028](https://cve.now/CVE-2011-4028.md): The LockServer function in os/utils.c in X.Org xserver before 1.11.2 allows local users to determine the existence of arbitrary files via a (no CVSS)
- [CVE-2011-4029](https://cve.now/CVE-2011-4029.md): The LockServer function in os/utils.c in X.Org xserver before 1.11.2 allows local users to change the permissions of arbitrary files to 444, (no CVSS)
- [CVE-2012-0876](https://cve.now/CVE-2012-0876.md): The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictabl (no CVSS)
- [CVE-2012-1147](https://cve.now/CVE-2012-1147.md): readfilemap.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service (file descriptor consumption) via a larg (no CVSS)
- [CVE-2012-1148](https://cve.now/CVE-2012-1148.md): Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of s (no CVSS)
- [CVE-2012-2214](https://cve.now/CVE-2012-2214.md): proxy.c in libpurple in Pidgin before 2.10.4 does not properly handle canceled SOCKS5 connection attempts, which allows user-assisted remote (no CVSS)
- [CVE-2012-2318](https://cve.now/CVE-2012-2318.md): msg.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.4 does not properly handle crafted characters, which allows remote serve (no CVSS)
- [CVE-2012-2747](https://cve.now/CVE-2012-2747.md): Unspecified vulnerability in Joomla! 2.5.x before 2.5.5 allows remote attackers to gain privileges via unknown attack vectors related to "In (no CVSS)
- [CVE-2012-2748](https://cve.now/CVE-2012-2748.md): Unspecified vulnerability in Joomla! 2.5.x before 2.5.5 allows remote attackers to obtain sensitive information via vectors related to "Inad (no CVSS)
- [CVE-2012-3811](https://cve.now/CVE-2012-3811.md): Unrestricted file upload vulnerability in ImageUpload.ashx in the Wallboard application in Avaya IP Office Customer Call Reporter 7.0 before (no CVSS)
- [CVE-2011-2485](https://cve.now/CVE-2011-2485.md): The gdk\_pixbuf\_\_gif\_image\_load function in gdk-pixbuf/io-gif.c in gdk-pixbuf before 2.23.5 does not properly handle certain return values, w (no CVSS)
- [CVE-2011-2716](https://cve.now/CVE-2011-2716.md): The DHCP client (udhcpc) in BusyBox before 1.20.0 allows remote DHCP servers to execute arbitrary commands via shell metacharacters in the ( (no CVSS)
- [CVE-2011-4086](https://cve.now/CVE-2011-4086.md): The journal\_unmap\_buffer function in fs/jbd2/transaction.c in the Linux kernel before 3.3.1 does not properly handle the \_Delay and \_Unwritt (no CVSS)
- [CVE-2011-4127](https://cve.now/CVE-2011-4127.md): The Linux kernel before 3.2.2 does not properly restrict SG\_IO ioctl calls, which allows local users to bypass intended restrictions on disk (no CVSS)
- [CVE-2012-0045](https://cve.now/CVE-2012-0045.md): The em\_syscall function in arch/x86/kvm/emulate.c in the KVM implementation in the Linux kernel before 3.2.14 does not properly handle the 0 (no CVSS)
- [CVE-2012-0833](https://cve.now/CVE-2012-0833.md): The acllas\_\_handle\_group\_entry function in servers/plugins/acl/acllas.c in 389 Directory Server before 1.2.10 does not properly handled acce (no CVSS)
- [CVE-2012-1106](https://cve.now/CVE-2012-1106.md): The C handler plug-in in Automatic Bug Reporting Tool (ABRT), possibly 2.0.8 and earlier, does not properly set the group (GID) permissions (no CVSS)
- [CVE-2012-2100](https://cve.now/CVE-2012-2100.md): The ext4\_fill\_flex\_info function in fs/ext4/super.c in the Linux kernel before 3.2.2, on the x86 platform and unspecified other platforms, a (no CVSS)
- [CVE-2012-2133](https://cve.now/CVE-2012-2133.md): Use-after-free vulnerability in the Linux kernel before 3.3.6, when huge pages are enabled, allows local users to cause a denial of service (no CVSS)
- [CVE-2012-2678](https://cve.now/CVE-2012-2678.md): 389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), after the password for a LDAP user has been changed and (no CVSS)
- [CVE-2012-2746](https://cve.now/CVE-2012-2746.md): 389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), when the password of a LDAP user has been changed and a (no CVSS)
- [CVE-2012-3366](https://cve.now/CVE-2012-3366.md): The Trigger plugin in bcfg2 1.2.x before 1.2.3 allows remote attackers with root access to the client to execute arbitrary commands via shel (no CVSS)
- [CVE-2012-2314](https://cve.now/CVE-2012-2314.md): The bootloader configuration module (pyanaconda/bootloader.py) in Anaconda uses 755 permissions for /etc/grub.d, which allows local users to (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2012-07-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.