# CVEs published 2012-07-16 28 CVEs were published on July 16, 2012: 0 critical, 0 high. Days are UTC. - [CVE-2012-2282](https://cve.now/CVE-2012-2282.md): EMC Celerra Network Server 6.x before 6.0.61.0, VNX 7.x before 7.0.53.2, and VNXe 2.0 and 2.1 before 2.1.3.19077 (aka MR1 SP3.2) and 2.2 bef (no CVSS) - [CVE-2012-4027](https://cve.now/CVE-2012-4027.md): Directory traversal vulnerability in Tridium Niagara AX Framework allows remote attackers to read files outside of the intended images, nav, (no CVSS) - [CVE-2012-4028](https://cve.now/CVE-2012-4028.md): Tridium Niagara AX Framework does not properly store credential data, which allows context-dependent attackers to bypass intended access res (no CVSS) - [CVE-2012-2021](https://cve.now/CVE-2012-2021.md): Multiple cross-site scripting (XSS) vulnerabilities in HP AssetManager 5.20, 5.21, 5.22, and 9.30 allow remote authenticated users to inject (no CVSS) - [CVE-2012-2607](https://cve.now/CVE-2012-2607.md): The Johnson Controls CK721-A controller with firmware before SSM4388\_03.1.0.14\_BB allows remote attackers to perform arbitrary actions via c (no CVSS) - [CVE-2012-2645](https://cve.now/CVE-2012-2645.md): The Yahoo! Japan Yahoo! Browser application 1.2.0 and earlier for Android does not properly implement the WebView class, which allows remote (no CVSS) - [CVE-2012-4026](https://cve.now/CVE-2012-4026.md): The Johnson Controls Pegasys P2000 server with software before 3.11 allows remote attackers to trigger false alerts via crafted packets to T (no CVSS) - [CVE-2011-4133](https://cve.now/CVE-2011-4133.md): Cross-site request forgery (CSRF) vulnerability in Moodle 1.9.x before 1.9.11 allows remote attackers to hijack the authentication of unspec (no CVSS, moodle/moodle) - [CVE-2011-4278](https://cve.now/CVE-2011-4278.md): Cross-site scripting (XSS) vulnerability in the tag autocomplete functionality in Moodle 1.9.x before 1.9.11 and 2.0.x before 2.0.2 allows r (no CVSS, moodle/moodle) - [CVE-2011-4279](https://cve.now/CVE-2011-4279.md): Moodle 2.0.x before 2.0.2 does not use the forceloginforprofiles setting for course-profiles access control, which makes it easier for remot (no CVSS, moodle/moodle) - [CVE-2011-4280](https://cve.now/CVE-2011-4280.md): Cross-site scripting (XSS) vulnerability in the Spike PHPCoverage (aka spikephpcoverage) library, as used in Moodle 2.0.x before 2.0.2 and o (no CVSS, moodle/moodle) - [CVE-2011-4281](https://cve.now/CVE-2011-4281.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Moodle 2.0.x before 2.0.2 allow remote attackers to hijack the authentication (no CVSS, moodle/moodle) - [CVE-2011-4282](https://cve.now/CVE-2011-4282.md): Multiple cross-site scripting (XSS) vulnerabilities in the course-tags functionality in tag/coursetags\_more.php in Moodle 2.0.x before 2.0.2 (no CVSS, moodle/moodle) - [CVE-2011-4283](https://cve.now/CVE-2011-4283.md): Moodle 1.9.x before 1.9.11 and 2.0.x before 2.0.2 places an IMS enterprise enrolment file in the course-files area, which allows remote atta (no CVSS, moodle/moodle) - [CVE-2011-4284](https://cve.now/CVE-2011-4284.md): Moodle 2.0.x before 2.0.2 allows remote attackers to obtain sensitive information from a myprofile (aka My profile) block by visiting a user (no CVSS, moodle/moodle) - [CVE-2011-4285](https://cve.now/CVE-2011-4285.md): The default configuration of Moodle 2.0.x before 2.0.2 has an incorrect setting of the moodle/course:delete capability, which allows remote (no CVSS, moodle/moodle) - [CVE-2011-4286](https://cve.now/CVE-2011-4286.md): Multiple cross-site scripting (XSS) vulnerabilities in the media-filter implementation in filter/mediaplugin/filter.php in Moodle 1.9.x befo (no CVSS, moodle/moodle) - [CVE-2011-4287](https://cve.now/CVE-2011-4287.md): admin/uploaduser\_form.php in Moodle 2.0.x before 2.0.3 does not force password changes for autosubscribed users, which makes it easier for r (no CVSS, moodle/moodle) - [CVE-2011-4288](https://cve.now/CVE-2011-4288.md): Moodle 1.9.x before 1.9.12 and 2.0.x before 2.0.3 does not properly implement associations between teachers and groups, which allows remote (no CVSS) - [CVE-2011-4289](https://cve.now/CVE-2011-4289.md): Moodle 2.0.x before 2.0.3 does not recognize the configuration setting that makes e-mail addresses visible only to course members, which all (no CVSS, moodle/moodle) - [CVE-2011-4290](https://cve.now/CVE-2011-4290.md): Multiple cross-site scripting (XSS) vulnerabilities in lib/weblib.php in Moodle 1.9.x before 1.9.12 allow remote attackers to inject arbitra (no CVSS) - [CVE-2011-4291](https://cve.now/CVE-2011-4291.md): Moodle 2.0.x before 2.0.3 allows remote authenticated users to cause a denial of service (invalid database records) via a series of crafted (no CVSS, moodle/moodle) - [CVE-2011-4292](https://cve.now/CVE-2011-4292.md): Moodle 2.0.x before 2.0.3 allows remote authenticated users to cause a denial of service (invalid database records) via a series of crafted (no CVSS, moodle/moodle) - [CVE-2011-4293](https://cve.now/CVE-2011-4293.md): The theme implementation in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 triggers duplicate caching of Cascading Style Sheets (CSS) and (no CVSS, moodle/moodle) - [CVE-2011-4294](https://cve.now/CVE-2011-4294.md): The error-message functionality in Moodle 1.9.x before 1.9.13, 2.0.x before 2.0.4, and 2.1.x before 2.1.1 does not ensure that a continuatio (no CVSS, moodle/moodle) - [CVE-2011-4295](https://cve.now/CVE-2011-4295.md): The moodle\_enrol\_external:role\_assign function in enrol/externallib.php in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 does not have an (no CVSS) - [CVE-2011-4296](https://cve.now/CVE-2011-4296.md): lib/db/access.php in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 assigns incorrect capabilities to the course-creator role, which allow (no CVSS) - [CVE-2011-4297](https://cve.now/CVE-2011-4297.md): comment/lib.php in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 does not properly restrict comment capabilities, which allows remote att (no CVSS, moodle/moodle) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2012-07-16 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.