# CVEs published 2012-07-12

34 CVEs were published on July 12, 2012: 0 critical, 0 high. Days are UTC.

- [CVE-2012-1661](https://cve.now/CVE-2012-1661.md): ESRI ArcMap 9 and ArcGIS 10.0.2.3200 and earlier does not properly prompt users before executing embedded VBA macros, which allows user-assi (no CVSS)
- [CVE-2012-2614](https://cve.now/CVE-2012-2614.md): Buffer overflow in programmer.exe in Lattice Diamond Programmer 1.4.2 allows user-assisted remote attackers to cause a denial of service (ap (no CVSS)
- [CVE-2012-2842](https://cve.now/CVE-2012-2842.md): Use-after-free vulnerability in Google Chrome before 20.0.1132.57 allows remote attackers to cause a denial of service or possibly have unsp (no CVSS)
- [CVE-2012-2843](https://cve.now/CVE-2012-2843.md): Use-after-free vulnerability in Google Chrome before 20.0.1132.57 allows remote attackers to cause a denial of service or possibly have unsp (no CVSS)
- [CVE-2012-2844](https://cve.now/CVE-2012-2844.md): The PDF functionality in Google Chrome before 20.0.1132.57 does not properly handle JavaScript code, which allows remote attackers to cause (no CVSS)
- [CVE-2012-3236](https://cve.now/CVE-2012-3236.md): fits-io.c in GIMP before 2.8.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a m (no CVSS)
- [CVE-2012-3350](https://cve.now/CVE-2012-3350.md): SQL injection vulnerability in index.php in Webmatic 3.1.1 allows remote attackers to execute arbitrary SQL commands via the Referer HTTP he (no CVSS)
- [CVE-2012-3377](https://cve.now/CVE-2012-3377.md): Heap-based buffer overflow in the Ogg\_DecodePacket function in the OGG demuxer (modules/demux/ogg.c) in VideoLAN VLC media player before 2.0 (no CVSS)
- [CVE-2012-3382](https://cve.now/CVE-2012-3382.md): Cross-site scripting (XSS) vulnerability in the ProcessRequest function in mcs/class/System.Web/System.Web/HttpForbiddenHandler.cs in Mono 2 (no CVSS)
- [CVE-2012-3997](https://cve.now/CVE-2012-3997.md): Multiple cross-site scripting (XSS) vulnerabilities in Sticky Notes before 0.2.27052012.5 allow remote attackers to inject arbitrary web scr (no CVSS)
- [CVE-2012-3998](https://cve.now/CVE-2012-3998.md): Multiple SQL injection vulnerabilities in Sticky Notes before 0.2.27052012.5 allow remote attackers to execute arbitrary SQL commands via th (no CVSS)
- [CVE-2012-3999](https://cve.now/CVE-2012-3999.md): Cross-site scripting (XSS) vulnerability in admin/login.php in Sticky Notes 0.3.09062012.4 and earlier allows remote attackers to inject arb (no CVSS)
- [CVE-2012-4000](https://cve.now/CVE-2012-4000.md): Cross-site scripting (XSS) vulnerability in the print\_textinputs\_var function in editor/dialog/fck\_spellerpages/spellerpages/server-scripts/ (no CVSS)
- [CVE-2012-0215](https://cve.now/CVE-2012-0215.md): model/modelstorage.py in the Tryton application framework (trytond) before 2.4.0 for Python does not properly restrict access to the Many2Ma (no CVSS, trytond)
- [CVE-2012-1037](https://cve.now/CVE-2012-1037.md): PHP remote file inclusion vulnerability in front/popup.php in GLPI 0.78 through 0.80.61 allows remote authenticated users to execute arbitra (no CVSS)
- [CVE-2012-1162](https://cve.now/CVE-2012-1162.md): Heap-based buffer overflow in the \_zip\_readcdir function in zip\_open.c in libzip 0.10 allows remote attackers to cause a denial of service ( (no CVSS)
- [CVE-2012-1163](https://cve.now/CVE-2012-1163.md): Integer overflow in the \_zip\_readcdir function in zip\_open.c in libzip 0.10 allows remote attackers to execute arbitrary code via the size a (no CVSS)
- [CVE-2012-1174](https://cve.now/CVE-2012-1174.md): The rm\_rf\_children function in util.c in the systemd-logind login manager in systemd before 44, when logging out, allows local users to dele (no CVSS)
- [CVE-2012-2351](https://cve.now/CVE-2012-2351.md): The default configuration of the auth/saml plugin in Mahara before 1.4.2 sets the "Match username attribute to Remote username" option to fa (no CVSS)
- [CVE-2012-2653](https://cve.now/CVE-2012-2653.md): arpwatch 2.1a15, as used by Red Hat, Debian, Fedora, and possibly others, does not properly drop supplementary groups, which might allow att (no CVSS)
- [CVE-2012-3362](https://cve.now/CVE-2012-3362.md): Cross-site request forgery (CSRF) vulnerability in eXtplorer 2.1 RC3 and earlier allows remote attackers to hijack the authentication of adm (no CVSS)
- [CVE-2012-0911](https://cve.now/CVE-2012-0911.md): TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows remote attackers to execute arbitrary PHP code via a crafted serialized object i (no CVSS)
- [CVE-2012-1620](https://cve.now/CVE-2012-1620.md): slock 0.9 does not properly handle the XRaiseWindow event when the screen is locked, which might allow physically proximate attackers to obt (no CVSS)
- [CVE-2012-2763](https://cve.now/CVE-2012-2763.md): Buffer overflow in the readstr\_upto function in plug-ins/script-fu/tinyscheme/scheme.c in GIMP 2.6.12 and earlier, and possibly 2.6.13, allo (no CVSS)
- [CVE-2012-3376](https://cve.now/CVE-2012-3376.md): DataNodes in Apache Hadoop 2.0.0 alpha does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out t (no CVSS, org.apache.hadoop:hadoop-client)
- [CVE-2012-3399](https://cve.now/CVE-2012-3399.md): Config/diff.php in Basilic 1.5.14 allows remote attackers to execute arbitrary commands via shell metacharacters in the file parameter. (no CVSS)
- [CVE-2012-3805](https://cve.now/CVE-2012-3805.md): Multiple cross-site scripting (XSS) vulnerabilities in the getAllPassedParams function in system/functions.php in Kajona before 3.4.2 allow (no CVSS)
- [CVE-2012-3881](https://cve.now/CVE-2012-3881.md): Multiple SQL injection vulnerabilities in RTG 0.7.4 and RTG2 0.9.2 allow remote attackers to execute arbitrary SQL commands via unspecified (no CVSS)
- [CVE-2012-3996](https://cve.now/CVE-2012-3996.md): TikiWiki CMS/Groupware 8.3 and earlier allows remote attackers to obtain the installation path via a direct request to (1) admin/include\_cal (no CVSS)
- [CVE-2012-2486](https://cve.now/CVE-2012-2486.md): The Cisco Discovery Protocol (CDP) implementation on Cisco TelePresence Multipoint Switch before 1.9.0, Cisco TelePresence Immersive Endpoin (no CVSS)
- [CVE-2012-3073](https://cve.now/CVE-2012-3073.md): The IP implementation on Cisco TelePresence Multipoint Switch before 1.8.1, Cisco TelePresence Manager before 1.9.0, and Cisco TelePresence (no CVSS)
- [CVE-2012-3074](https://cve.now/CVE-2012-3074.md): An unspecified API on Cisco TelePresence Immersive Endpoint Devices before 1.9.1 allows remote attackers to execute arbitrary commands by le (no CVSS)
- [CVE-2012-3075](https://cve.now/CVE-2012-3075.md): The administrative web interface on Cisco TelePresence Immersive Endpoint Devices before 1.7.4 allows remote authenticated users to execute (no CVSS)
- [CVE-2012-3076](https://cve.now/CVE-2012-3076.md): The administrative web interface on Cisco TelePresence Recording Server before 1.8.0 allows remote authenticated users to execute arbitrary (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2012-07-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.