# CVEs published 2012-08-13

56 CVEs were published on August 13, 2012: 0 critical, 1 high. Days are UTC.

- [CVE-2010-5096](https://cve.now/CVE-2010-5096.md): Multiple SQL injection vulnerabilities in MyBB (aka MyBulletinBoard) before 1.6.1 allow remote attackers to execute arbitrary SQL commands v (no CVSS)
- [CVE-2012-2274](https://cve.now/CVE-2012-2274.md): Cross-site scripting (XSS) vulnerability in pivotx/ajaxhelper.php in PivotX 2.3.2 and earlier allows remote attackers to inject arbitrary we (no CVSS)
- [CVE-2012-2330](https://cve.now/CVE-2012-2330.md): The Update method in src/node\_http\_parser.cc in Node.js before 0.6.17 and 0.7 before 0.7.8 does not properly check the length of a string, w (no CVSS)
- [CVE-2012-2331](https://cve.now/CVE-2012-2331.md): Cross-site scripting (XSS) vulnerability in serendipity/serendipity\_admin\_image\_selector.php in Serendipity before 1.6.1 allows remote attac (no CVSS)
- [CVE-2012-2332](https://cve.now/CVE-2012-2332.md): SQL injection vulnerability in serendipity/serendipity\_admin.php in Serendipity before 1.6.1 allows remote attackers to execute arbitrary SQ (no CVSS)
- [CVE-2012-4282](https://cve.now/CVE-2012-4282.md): SQL injection vulnerability in photo.php in Trombinoscope 3.5 allows remote attackers to execute arbitrary SQL commands via the id parameter (no CVSS)
- [CVE-2012-4283](https://cve.now/CVE-2012-4283.md): Cross-site scripting (XSS) vulnerability in the Login With Ajax plugin before 3.0.4.1 for WordPress allows remote attackers to inject arbitr (no CVSS)
- [CVE-2012-4263](https://cve.now/CVE-2012-4263.md): Cross-site scripting (XSS) vulnerability in inc/admin/content.php in the Better WP Security (better\_wp\_security) plugin before 3.2.5 for Wor (no CVSS)
- [CVE-2012-4264](https://cve.now/CVE-2012-4264.md): Multiple cross-site scripting (XSS) vulnerabilities in the Better WP Security (better\_wp\_security) plugin before 3.2.5 for WordPress allow r (no CVSS)
- [CVE-2012-4265](https://cve.now/CVE-2012-4265.md): SQL injection vulnerability in category\_edit.php in Proman Xpress 5.0.1 allows remote attackers to execute arbitrary SQL commands via the ci (no CVSS)
- [CVE-2012-4266](https://cve.now/CVE-2012-4266.md): Cross-site scripting (XSS) vulnerability in client\_details.php in Proman Xpress 5.0.1 allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2012-4267](https://cve.now/CVE-2012-4267.md): Cross-site scripting (XSS) vulnerability in user/register in Sockso 1.5 and earlier allows remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2012-4268](https://cve.now/CVE-2012-4268.md): Cross-site scripting (XSS) vulnerability in bulletproof-security/admin/options.php in the BulletProof Security plugin before .47.1 for WordP (no CVSS)
- [CVE-2012-4269](https://cve.now/CVE-2012-4269.md): Unrestricted file upload vulnerability in eFront 3.6.11 allows remote authenticated users to execute arbitrary code by uploading a file with (no CVSS)
- [CVE-2012-4270](https://cve.now/CVE-2012-4270.md): Cross-site scripting (XSS) vulnerability in eFront 3.6.11 allows remote authenticated users to inject arbitrary web script or HTML via the s (no CVSS)
- [CVE-2012-4271](https://cve.now/CVE-2012-4271.md): Multiple cross-site scripting (XSS) vulnerabilities in bad-behavior-wordpress-admin.php in the Bad Behavior plugin before 2.0.47 and 2.2.x b (no CVSS)
- [CVE-2012-4272](https://cve.now/CVE-2012-4272.md): Multiple cross-site scripting (XSS) vulnerabilities in the 2 Click Social Media Buttons plugin before 0.34 for WordPress allow remote attack (no CVSS)
- [CVE-2012-4273](https://cve.now/CVE-2012-4273.md): Cross-site scripting (XSS) vulnerability in libs/xing.php in the 2 Click Social Media Buttons plugin before 0.34 for WordPress allows remote (no CVSS)
- [CVE-2012-4274](https://cve.now/CVE-2012-4274.md): Unspecified vulnerability in Hitachi Cobol GUI Option 06-00, 06-01 through 06-01-/A, 07-00, 07-01 before 07-01-/B, and 08-00 before 08-00-/B (no CVSS)
- [CVE-2012-4275](https://cve.now/CVE-2012-4275.md): Cross-site scripting (XSS) vulnerability in Hitachi IT Operations Director 02-50-01 through 02-50-07, 03-00 before 03-00-08 allows remote at (no CVSS)
- [CVE-2012-4276](https://cve.now/CVE-2012-4276.md): Unspecified vulnerability in Hitachi IT Operations Director 02-50-01 through 02-50-07, 03-00 before 03-00-08 allows attackers to cause a den (no CVSS)
- [CVE-2012-4277](https://cve.now/CVE-2012-4277.md): Cross-site scripting (XSS) vulnerability in the smarty\_function\_html\_options\_optoutput function in distribution/libs/plugins/function.html\_o (no CVSS)
- [CVE-2012-4278](https://cve.now/CVE-2012-4278.md): Multiple cross-site scripting (XSS) vulnerabilities in Free Realty 3.1-0.6 allow remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2012-4279](https://cve.now/CVE-2012-4279.md): Multiple SQL injection vulnerabilities in Free Realty 3.1-0.6 allow remote attackers to execute arbitrary SQL commands via the (1) view para (no CVSS)
- [CVE-2012-4280](https://cve.now/CVE-2012-4280.md): Multiple cross-site request forgery (CSRF) vulnerabilities in admin/agenteditor.php in Free Realty 3.1-0.6 allow remote attackers to hijack (no CVSS)
- [CVE-2012-4281](https://cve.now/CVE-2012-4281.md): Multiple SQL injection vulnerabilities in Travelon Express 6.2.2 allow remote attackers to execute arbitrary SQL commands via the hid parame (no CVSS)
- [CVE-2009-5066](https://cve.now/CVE-2009-5066.md): twiddle.sh in JBoss AS 5.0 and EAP 5.0 and earlier accepts credentials as command-line arguments, which allows local users to read the crede (no CVSS)
- [CVE-2011-0523](https://cve.now/CVE-2011-0523.md): gypsy 0.8 does not properly restrict the files that can be read while running with root privileges, which allows local users to read otherwi (no CVSS)
- [CVE-2011-0524](https://cve.now/CVE-2011-0524.md): Multiple buffer overflows in the NMEA parser (nmea-gen.c) in gypsy 0.8 allow local users to cause a denial of service (crash) via unspecifie (no CVSS)
- [CVE-2012-2368](https://cve.now/CVE-2012-2368.md): Bytemark Symbiosis before Revision 1322 does not properly validate passwords, which allows remote attackers to gain access to email accounts (no CVSS)
- [CVE-2012-2370](https://cve.now/CVE-2012-2370.md): Multiple integer overflows in the read\_bitmap\_file\_data function in io-xbm.c in gdk-pixbuf before 2.26.1 allow remote attackers to cause a d (no CVSS)
- [CVE-2012-2371](https://cve.now/CVE-2012-2371.md): Cross-site scripting (XSS) vulnerability in index.php in the WP-FaceThumb plugin 0.1 for WordPress allows remote attackers to inject arbitra (no CVSS)
- [CVE-2012-2662](https://cve.now/CVE-2012-2662.md): Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Certificate System (RHCS) before 8.1.1 and Dogtag Certificate System allow re (no CVSS)
- [CVE-2012-2806](https://cve.now/CVE-2012-2806.md): Heap-based buffer overflow in the get\_sos function in jdmarker.c in libjpeg-turbo 1.2.0 allows remote attackers to cause a denial of service (CVSS 8.8)
- [CVE-2012-3367](https://cve.now/CVE-2012-3367.md): Red Hat Certificate System (RHCS) before 8.1.1 and Dogtag Certificate System does not properly check certificate revocation requests made th (no CVSS)
- [CVE-2012-3401](https://cve.now/CVE-2012-3401.md): The t2p\_read\_tiff\_init function in tiff2pdf (tools/tiff2pdf.c) in LibTIFF 4.0.2 and earlier does not properly initialize the T2P context str (no CVSS)
- [CVE-2012-3417](https://cve.now/CVE-2012-3417.md): The good\_client function in rquotad (rquota\_svc.c) in Linux DiskQuota (aka quota) before 3.17 invokes the hosts\_ctl function the first time (no CVSS)
- [CVE-2012-3425](https://cve.now/CVE-2012-3425.md): The png\_push\_read\_zTXt function in pngpread.c in libpng 1.0.x before 1.0.58, 1.2.x before 1.2.48, 1.4.x before 1.4.10, and 1.5.x before 1.5. (no CVSS)
- [CVE-2012-3869](https://cve.now/CVE-2012-3869.md): Cross-site scripting (XSS) vulnerability in include/classes/class.rex\_list.inc.php in REDAXO 4.3.x and 4.4 allows remote attackers to inject (no CVSS)
- [CVE-2012-2324](https://cve.now/CVE-2012-2324.md): Multiple SQL injection vulnerabilities in MyBB (aka MyBulletinBoard) before 1.6.7 allow remote administrators to execute arbitrary SQL comma (no CVSS)
- [CVE-2012-2325](https://cve.now/CVE-2012-2325.md): SQL injection vulnerability in the User Inline Moderation feature in the Admin Control Panel (ACP) in MyBB (aka MyBulletinBoard) before 1.6. (no CVSS)
- [CVE-2012-2326](https://cve.now/CVE-2012-2326.md): Cross-site scripting (XSS) vulnerability in the Admin Control Panel (ACP) in MyBB (aka MyBulletinBoard) before 1.6.7 allows remote administr (no CVSS)
- [CVE-2012-2327](https://cve.now/CVE-2012-2327.md): MyBB (aka MyBulletinBoard) before 1.6.7 allows remote attackers to obtain sensitive information via a malformed forumread cookie, which reve (no CVSS)
- [CVE-2012-4250](https://cve.now/CVE-2012-4250.md): Stack-based buffer overflow in the RequestScreenOptimization function in the XProcessControl.ocx ActiveX control in msls31.dll in Samsung NE (no CVSS)
- [CVE-2012-4251](https://cve.now/CVE-2012-4251.md): Multiple cross-site scripting (XSS) vulnerabilities in MySQLDumper 1.24.4 allow remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2012-4252](https://cve.now/CVE-2012-4252.md): Multiple cross-site request forgery (CSRF) vulnerabilities in MySQLDumper 1.24.4 allow remote attackers to hijack the authentication of admi (no CVSS)
- [CVE-2012-4253](https://cve.now/CVE-2012-4253.md): Multiple directory traversal vulnerabilities in MySQLDumper 1.24.4 allow remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2012-4254](https://cve.now/CVE-2012-4254.md): MySQLDumper 1.24.4 allows remote attackers to obtain sensitive information (Notices) via a direct request to (1) learn/cubemail/restore.php (no CVSS)
- [CVE-2012-4255](https://cve.now/CVE-2012-4255.md): MySQLDumper 1.24.4 allows remote attackers to obtain sensitive information via a direct request to learn/cubemail/refresh\_dblist.php, which (no CVSS)
- [CVE-2012-4256](https://cve.now/CVE-2012-4256.md): The jNews (com\_jnews) component 7.5.1 for Joomla! allows remote attackers to obtain sensitive information via the emailsearch parameter, whi (no CVSS)
- [CVE-2012-4257](https://cve.now/CVE-2012-4257.md): Yaqas (Yet Another Question & Answer System) 1.0 Alpha 1 allows remote attackers to obtain sensitive information via an invalid character in (no CVSS)
- [CVE-2012-4258](https://cve.now/CVE-2012-4258.md): Multiple SQL injection vulnerabilities in MYRE Real Estate Software (2012 Q2) allow remote attackers to execute arbitrary SQL commands via t (no CVSS)
- [CVE-2012-4259](https://cve.now/CVE-2012-4259.md): Cross-site scripting (XSS) vulnerability in the contacts in (1) XPhone UC Web and the (2) web frontend for XPhone Virtual Directory in C4B X (no CVSS)
- [CVE-2012-4260](https://cve.now/CVE-2012-4260.md): Multiple SQL injection vulnerabilities in myCare2x allow remote attackers to execute arbitrary SQL commands via the (1) aktion or (2) callur (no CVSS)
- [CVE-2012-4261](https://cve.now/CVE-2012-4261.md): SQL injection vulnerability in modules/patient/mycare2x\_pat\_info.php in myCare2x allows remote attackers to execute arbitrary SQL commands v (no CVSS)
- [CVE-2012-4262](https://cve.now/CVE-2012-4262.md): Multiple cross-site scripting (XSS) vulnerabilities in myCare2x allow remote attackers to inject arbitrary web script or HTML via the (1) na (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2012-08-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.