# CVEs published 2012-08-12

35 CVEs were published on August 12, 2012: 0 critical, 0 high. Days are UTC.

- [CVE-2012-2571](https://cve.now/CVE-2012-2571.md): Multiple cross-site scripting (XSS) vulnerabilities in WinWebMail Server 3.8.1.6 allow remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2012-2573](https://cve.now/CVE-2012-2573.md): Multiple cross-site scripting (XSS) vulnerabilities in T-dah WebMail 3.2.0-2.3 allow remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2012-2585](https://cve.now/CVE-2012-2585.md): Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine ServiceDesk Plus 8.1 allow remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2012-2587](https://cve.now/CVE-2012-2587.md): Multiple cross-site scripting (XSS) vulnerabilities in AfterLogic MailSuite Pro 6.3 allow remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2012-2590](https://cve.now/CVE-2012-2590.md): Multiple cross-site scripting (XSS) vulnerabilities in ESCON SupportPortal Professional Edition 3.0 allow remote attackers to inject arbitra (no CVSS)
- [CVE-2012-3468](https://cve.now/CVE-2012-3468.md): Multiple SQL injection vulnerabilities in the Ushahidi Platform before 2.5 allow remote attackers to execute arbitrary SQL commands via vect (no CVSS)
- [CVE-2012-3469](https://cve.now/CVE-2012-3469.md): Multiple SQL injection vulnerabilities in the Ushahidi Platform before 2.5 allow remote attackers to execute arbitrary SQL commands via vect (no CVSS)
- [CVE-2012-3470](https://cve.now/CVE-2012-3470.md): Multiple SQL injection vulnerabilities in application/libraries/api/MY\_Countries\_Api\_Object.php in the Ushahidi Platform before 2.5 allow re (no CVSS)
- [CVE-2012-3471](https://cve.now/CVE-2012-3471.md): Multiple SQL injection vulnerabilities in the edit functions in (1) application/controllers/admin/reports.php and (2) application/controller (no CVSS)
- [CVE-2012-3472](https://cve.now/CVE-2012-3472.md): The email API in application/libraries/api/MY\_Email\_Api\_Object.php in the Ushahidi Platform before 2.5 does not require authentication, whic (no CVSS)
- [CVE-2012-3473](https://cve.now/CVE-2012-3473.md): The (1) reports API and (2) administration feature in the comments API in the Ushahidi Platform before 2.5 do not require authentication, wh (no CVSS)
- [CVE-2012-3474](https://cve.now/CVE-2012-3474.md): The comments API in application/libraries/api/MY\_Comments\_Api\_Object.php in the Ushahidi Platform before 2.5 allows remote attackers to obta (no CVSS)
- [CVE-2012-3475](https://cve.now/CVE-2012-3475.md): The installer in the Ushahidi Platform before 2.5 omits certain calls to the exit function, which allows remote attackers to obtain administ (no CVSS)
- [CVE-2012-3476](https://cve.now/CVE-2012-3476.md): Multiple cross-site scripting (XSS) vulnerabilities in (1) application/views/admin/layout.php and (2) themes/default/views/header.php in the (no CVSS)
- [CVE-2012-2584](https://cve.now/CVE-2012-2584.md): Multiple cross-site scripting (XSS) vulnerabilities in Alt-N MDaemon Free 12.5.4 allow remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2012-4069](https://cve.now/CVE-2012-4069.md): Dir2web 3.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the (no CVSS)
- [CVE-2012-4070](https://cve.now/CVE-2012-4070.md): SQL injection vulnerability in system/src/dispatcher.php in Dir2web 3.0 allows remote attackers to execute arbitrary SQL commands via the oi (no CVSS)
- [CVE-2012-4248](https://cve.now/CVE-2012-4248.md): The Amazon Kindle Touch before 5.1.2 does not properly restrict access to the libkindleplugin.so NPAPI plugin interface, which might allow r (no CVSS)
- [CVE-2012-4249](https://cve.now/CVE-2012-4249.md): The Amazon Lab126 com.lab126.system sendEvent implementation on the Kindle Touch before 5.1.2 allows context-dependent attackers to execute (no CVSS)
- [CVE-2012-2577](https://cve.now/CVE-2012-2577.md): Multiple cross-site scripting (XSS) vulnerabilities in SolarWinds Orion Network Performance Monitor (NPM) before 10.3.1 allow remote attacke (no CVSS)
- [CVE-2012-2602](https://cve.now/CVE-2012-2602.md): Multiple cross-site request forgery (CSRF) vulnerabilities in SolarWinds Orion Network Performance Monitor (NPM) before 10.3.1 allow remote (no CVSS)
- [CVE-2012-2963](https://cve.now/CVE-2012-2963.md): The administrative interface in the embedded web server on the BreakingPoint Storm appliance before 3.0 does not require authentication for (no CVSS)
- [CVE-2012-2964](https://cve.now/CVE-2012-2964.md): The BreakingPoint Storm appliance before 3.0 requires cleartext credentials for establishing a session from a GUI administrative client, whi (no CVSS)
- [CVE-2012-2965](https://cve.now/CVE-2012-2965.md): Caucho Quercus, as distributed in Resin before 4.0.29, does not properly handle unspecified characters in the names of variables, which has (no CVSS, com.caucho:resin)
- [CVE-2012-2966](https://cve.now/CVE-2012-2966.md): Caucho Quercus, as distributed in Resin before 4.0.29, overwrites entries in the SERVER superglobal array on the basis of POST parameters, w (no CVSS, com.caucho:resin)
- [CVE-2012-2967](https://cve.now/CVE-2012-2967.md): Caucho Quercus, as distributed in Resin before 4.0.29, does not properly implement the == (equals sign equals sign) operator for comparisons (no CVSS, com.caucho:resin)
- [CVE-2012-2968](https://cve.now/CVE-2012-2968.md): Directory traversal vulnerability in Caucho Quercus, as distributed in Resin before 4.0.29, allows remote attackers to create files in arbit (no CVSS)
- [CVE-2012-2969](https://cve.now/CVE-2012-2969.md): Caucho Quercus, as distributed in Resin before 4.0.29, allows remote attackers to bypass intended restrictions on filename extensions for cr (no CVSS)
- [CVE-2012-3457](https://cve.now/CVE-2012-3457.md): PNP4Nagios 0.6 through 0.6.16 uses world-readable permissions for process\_perfdata.cfg, which allows local users to obtain the Gearman share (no CVSS)
- [CVE-2012-3952](https://cve.now/CVE-2012-3952.md): Cross-site scripting (XSS) vulnerability in admin/index.php in phpList before 2.10.19 allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2012-3953](https://cve.now/CVE-2012-3953.md): SQL injection vulnerability in admin/index.php in phpList before 2.10.19 allows remote administrators to execute arbitrary SQL commands via (no CVSS)
- [CVE-2012-4034](https://cve.now/CVE-2012-4034.md): Multiple SQL injection vulnerabilities in PBBoard 2.1.4 allow remote attackers to execute arbitrary SQL commands via the (1) username parame (no CVSS)
- [CVE-2012-4035](https://cve.now/CVE-2012-4035.md): The new\_password page in PBBoard 2.1.4 allows remote attackers to change the password of arbitrary user accounts via the member\_id and new\_p (no CVSS)
- [CVE-2012-4246](https://cve.now/CVE-2012-4246.md): Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbi (no CVSS)
- [CVE-2012-4247](https://cve.now/CVE-2012-4247.md): Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbi (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2012-08-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.