# CVEs published 2012-08-26

65 CVEs were published on August 26, 2012: 0 critical, 0 high. Days are UTC.

- [CVE-2012-2103](https://cve.now/CVE-2012-2103.md): The qmailscan plugin for Munin 1.4.5 allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictabl (no CVSS)
- [CVE-2012-2104](https://cve.now/CVE-2012-2104.md): cgi-bin/munin-cgi-graph in Munin 2.x writes data to a log file without sanitizing non-printable characters, which might allow user-assisted (no CVSS)
- [CVE-2012-2146](https://cve.now/CVE-2012-2146.md): Elixir 0.8.0 uses Blowfish in CFB mode without constructing a unique initialization vector (IV), which makes it easier for context-dependent (no CVSS, elixir)
- [CVE-2012-2147](https://cve.now/CVE-2012-2147.md): munin-cgi-graph in Munin 2.0 rc4 allows remote attackers to cause a denial of service (disk or memory consumption) via many image requests w (no CVSS)
- [CVE-2012-2297](https://cve.now/CVE-2012-2297.md): Multiple cross-site scripting (XSS) vulnerabilities in the Creative Commons module 6.x-1.x before 6.x-1.1 for Drupal allow remote authentica (no CVSS)
- [CVE-2012-4678](https://cve.now/CVE-2012-4678.md): munin-cgi-graph for Munin 2.0 rc4 does not delete temporary files, which allows remote attackers to cause a denial of service (disk consumpt (no CVSS)
- [CVE-2012-1175](https://cve.now/CVE-2012-1175.md): Integer overflow in the GnashImage::size method in libbase/GnashImage.h in GNU Gnash 0.8.10 allows remote attackers to cause a denial of ser (no CVSS)
- [CVE-2012-1176](https://cve.now/CVE-2012-1176.md): Buffer overflow in the fribidi\_utf8\_to\_unicode function in PyFriBidi before 0.11.0 allows remote attackers to cause a denial of service (app (no CVSS, pyfribidi)
- [CVE-2012-1177](https://cve.now/CVE-2012-1177.md): libgdata before 0.10.2 and 0.11.x before 0.11.1 does not validate SSL certificates, which allows remote attackers to obtain user names and p (no CVSS)
- [CVE-2012-1296](https://cve.now/CVE-2012-1296.md): Multiple cross-site scripting (XSS) vulnerabilities in apps/admin/handlers/preview.php in Elefant CMS 1.0.x before 1.0.2-Beta and 1.1.x befo (no CVSS, elefant/cms)
- [CVE-2012-1921](https://cve.now/CVE-2012-1921.md): Cross-site request forgery (CSRF) vulnerability in goform/admin/formWlEncrypt in Sitecom WLM-2501 allows remote attackers to hijack the auth (no CVSS)
- [CVE-2009-5128](https://cve.now/CVE-2009-5128.md): The Websense V10000 appliance before 1.0.1 allows remote attackers to cause a denial of service (memory consumption and process crash) via a (no CVSS)
- [CVE-2009-5129](https://cve.now/CVE-2009-5129.md): The Websense V10000 appliance before 1.0.1 allows remote attackers to cause a denial of service (intermittent LDAP authentication outage) vi (no CVSS)
- [CVE-2009-5130](https://cve.now/CVE-2009-5130.md): The Rules Service in Websense Email Security before 7.1 allows remote attackers to cause a denial of service (service crash) via an attachme (no CVSS)
- [CVE-2009-5131](https://cve.now/CVE-2009-5131.md): The Receive Service in Websense Email Security before 7.1 does not recognize domain extensions in the blacklist, which allows remote attacke (no CVSS)
- [CVE-2009-5132](https://cve.now/CVE-2009-5132.md): The Filtering Service in Websense Web Security and Web Filter before 6.3.1 Hotfix 106 and 7.x before 7.1 allow remote attackers to cause a d (no CVSS)
- [CVE-2010-5189](https://cve.now/CVE-2010-5189.md): Blue Coat ProxySG before SGOS 4.3.4.1, 5.x before SGOS 5.4.5.1, 5.5 before SGOS 5.5.4.1, and 6.x before SGOS 6.1.1.1 allows remote authentic (no CVSS)
- [CVE-2010-5190](https://cve.now/CVE-2010-5190.md): The Active Content Transformation functionality in Blue Coat ProxySG before SGOS 4.3.4.2, 5.x before SGOS 5.4.5.1, 5.5 before SGOS 5.5.4.1, (no CVSS)
- [CVE-2010-5191](https://cve.now/CVE-2010-5191.md): Multiple cross-site request forgery (CSRF) vulnerabilities on the Blue Coat ProxyAV appliance before 3.2.6.1 allow remote attackers to hijac (no CVSS)
- [CVE-2010-5192](https://cve.now/CVE-2010-5192.md): Cross-site scripting (XSS) vulnerability in the Java Management Console in Blue Coat ProxySG before SGOS 4.3.4.1, 5.x before SGOS 5.4.5.1, 5 (no CVSS)
- [CVE-2011-5124](https://cve.now/CVE-2011-5124.md): Stack-based buffer overflow in the BCAAA component before build 60258, as used by Blue Coat ProxySG 4.2.3 through 6.1 and ProxyOne, allows r (no CVSS)
- [CVE-2011-5125](https://cve.now/CVE-2011-5125.md): Cross-site scripting (XSS) vulnerability in Blue Coat Director before 5.5.2.3 allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2011-5126](https://cve.now/CVE-2011-5126.md): Blue Coat ProxySG 6.1 before SGOS 6.1.5.1 and 6.2 before SGOS 6.2.2.1 writes the secure heap to core images, which allows context-dependent (no CVSS)
- [CVE-2011-5127](https://cve.now/CVE-2011-5127.md): Directory traversal vulnerability in Blue Coat Reporter 9.x before 9.2.4.13, 9.2.5.x before 9.2.5.1, and 9.3 before 9.3.1.2 on Windows allow (no CVSS)
- [CVE-2012-3483](https://cve.now/CVE-2012-3483.md): Race condition in the runScript function in Tunnelblick 3.3beta20 and earlier allows local users to gain privileges by replacing a script fi (no CVSS)
- [CVE-2012-3484](https://cve.now/CVE-2012-3484.md): Tunnelblick 3.3beta20 and earlier relies on a test for specific ownership and permissions to determine whether a program can be safely execu (no CVSS)
- [CVE-2012-3485](https://cve.now/CVE-2012-3485.md): Tunnelblick 3.3beta20 and earlier relies on argv\[0\] to determine the name of an appropriate (1) kernel module pathname or (2) executable fil (no CVSS)
- [CVE-2012-3486](https://cve.now/CVE-2012-3486.md): Tunnelblick 3.3beta20 and earlier allows local users to gain privileges via an OpenVPN configuration file that specifies execution of a scri (no CVSS)
- [CVE-2012-3487](https://cve.now/CVE-2012-3487.md): Race condition in Tunnelblick 3.3beta20 and earlier allows local users to kill unintended processes by waiting for a specific PID value to b (no CVSS)
- [CVE-2012-4676](https://cve.now/CVE-2012-4676.md): The errorExitIfAttackViaString function in Tunnelblick 3.3beta20 and earlier allows local users to delete arbitrary files by constructing a (no CVSS)
- [CVE-2012-4677](https://cve.now/CVE-2012-4677.md): Tunnelblick 3.3beta20 and earlier allows local users to gain privileges by using a crafted Info.plist file to control the gOkIfNotSecure val (no CVSS)
- [CVE-2010-5080](https://cve.now/CVE-2010-5080.md): The Security/changepassword URL action in SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 passes a token as a GET parameter while ch (no CVSS)
- [CVE-2010-5087](https://cve.now/CVE-2010-5087.md): SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 allows remote attackers to bypass the cross-site request forgery (CSRF) protection m (no CVSS)
- [CVE-2010-5088](https://cve.now/CVE-2010-5088.md): Multiple cross-site request forgery (CSRF) vulnerabilities in SilverStripe 2.3.x before 2.3.9 and 2.4.x before 2.4.3 allow remote attackers (no CVSS)
- [CVE-2010-5089](https://cve.now/CVE-2010-5089.md): SilverStripe before 2.4.2 does not properly restrict access to pages in draft mode, which allows remote attackers to obtain sensitive inform (no CVSS)
- [CVE-2010-5090](https://cve.now/CVE-2010-5090.md): SilverStripe before 2.4.2 allows remote authenticated users to change administrator passwords via vectors related to admin/security. (no CVSS)
- [CVE-2010-5091](https://cve.now/CVE-2010-5091.md): The setName function in filesystem/File.php in SilverStripe 2.3.x before 2.3.8 and 2.4.x before 2.4.1 allows remote authenticated users with (no CVSS)
- [CVE-2010-5092](https://cve.now/CVE-2010-5092.md): The Add Member dialog in the Security admin page in SilverStripe 2.4.0 saves user passwords in plaintext, which allows local users to obtain (no CVSS)
- [CVE-2010-5093](https://cve.now/CVE-2010-5093.md): Member\_ProfileForm in security/Member.php in SilverStripe 2.3.x before 2.3.7 allows remote attackers to hijack user accounts by saving data (no CVSS)
- [CVE-2010-5094](https://cve.now/CVE-2010-5094.md): The deleteinstallfiles function in control/ContentController.php in SilverStripe 2.3.x before 2.3.7 does not require ADMIN permissions, whic (no CVSS)
- [CVE-2010-5095](https://cve.now/CVE-2010-5095.md): Cross-site scripting (XSS) vulnerability in SilverStripe 2.3.x before 2.3.6 allows remote attackers to inject arbitrary web script or HTML v (no CVSS)
- [CVE-2010-5187](https://cve.now/CVE-2010-5187.md): SilverStripe 2.3.x before 2.3.8 and 2.4.x before 2.4.1, when running on servers with certain configurations, allows remote attackers to obta (no CVSS)
- [CVE-2010-5188](https://cve.now/CVE-2010-5188.md): SilverStripe 2.3.x before 2.3.6 allows remote attackers to obtain sensitive information via the (1) debug\_memory parameter to core/control/D (no CVSS)
- [CVE-2012-2227](https://cve.now/CVE-2012-2227.md): Directory traversal vulnerability in update/index.php in PluXml before 5.1.6 allows remote attackers to include and execute arbitrary local (no CVSS)
- [CVE-2012-4674](https://cve.now/CVE-2012-4674.md): PluXml before 5.1.6 allows remote attackers to obtain the installation path via the PHPSESSID. (no CVSS)
- [CVE-2012-4675](https://cve.now/CVE-2012-4675.md): Cross-site scripting (XSS) vulnerability in PluXml 5.1.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vect (no CVSS)
- [CVE-2009-5123](https://cve.now/CVE-2009-5123.md): The Antivirus component in Comodo Internet Security before 3.11.108364.552 allows remote attackers to cause a denial of service (memory cons (no CVSS)
- [CVE-2009-5124](https://cve.now/CVE-2009-5124.md): The Antivirus component in Comodo Internet Security before 3.11.108364.552 allows remote attackers to cause a denial of service (application (no CVSS)
- [CVE-2009-5125](https://cve.now/CVE-2009-5125.md): Comodo Internet Security before 3.9.95478.509 allows remote attackers to bypass malware detection in an RAR archive via an unspecified manip (no CVSS)
- [CVE-2009-5126](https://cve.now/CVE-2009-5126.md): The Antivirus component in Comodo Internet Security before 3.8.65951.477 allows remote attackers to cause a denial of service (application c (no CVSS)
- [CVE-2009-5127](https://cve.now/CVE-2009-5127.md): The Antivirus component in Comodo Internet Security before 3.8.64739.471 allows remote attackers to cause a denial of service (application c (no CVSS)
- [CVE-2010-5185](https://cve.now/CVE-2010-5185.md): The Antivirus component in Comodo Internet Security before 5.3.174622.1216 does not check whether X.509 certificates in signed executable fi (no CVSS)
- [CVE-2010-5186](https://cve.now/CVE-2010-5186.md): The Antivirus component in Comodo Internet Security before 4.1.150349.920 allows remote attackers to cause a denial of service (application (no CVSS)
- [CVE-2011-5118](https://cve.now/CVE-2011-5118.md): Multiple race conditions in Comodo Internet Security before 5.8.213334.2131 allow local users to bypass the Defense+ feature via unspecified (no CVSS)
- [CVE-2011-5119](https://cve.now/CVE-2011-5119.md): Multiple race conditions in Comodo Internet Security before 5.8.211697.2124 allow local users to bypass the Defense+ feature via unspecified (no CVSS)
- [CVE-2011-5120](https://cve.now/CVE-2011-5120.md): The Antivirus component in Comodo Internet Security before 5.4.189822.1355 allows remote attackers to cause a denial of service (application (no CVSS)
- [CVE-2011-5121](https://cve.now/CVE-2011-5121.md): The Antivirus component in Comodo Internet Security before 5.3.175888.1227 does not properly check whether unspecified X.509 certificates ar (no CVSS)
- [CVE-2011-5122](https://cve.now/CVE-2011-5122.md): The Antivirus component in Comodo Internet Security before 5.3.175888.1227 allows remote attackers to cause a denial of service (application (no CVSS)
- [CVE-2011-5123](https://cve.now/CVE-2011-5123.md): The Antivirus component in Comodo Internet Security before 5.3.175888.1227 does not check whether X.509 certificates in signed executable fi (no CVSS)
- [CVE-2012-2289](https://cve.now/CVE-2012-2289.md): EMC ApplicationXtender Desktop before 6.5 SP2 and ApplicationXtender Web Access .NET before 6.5 SP2 allow remote attackers to upload files t (no CVSS)
- [CVE-2012-3477](https://cve.now/CVE-2012-3477.md): SQL injection vulnerability in signup\_check.php in NeoInvoice allows remote attackers to execute arbitrary SQL commands via the value parame (no CVSS)
- [CVE-2012-3517](https://cve.now/CVE-2012-3517.md): Use-after-free vulnerability in dns.c in Tor before 0.2.2.38 might allow remote attackers to cause a denial of service (daemon crash) via ve (no CVSS)
- [CVE-2012-3518](https://cve.now/CVE-2012-3518.md): The networkstatus\_parse\_vote\_from\_string function in routerparse.c in Tor before 0.2.2.38 does not properly handle an invalid flavor name, w (no CVSS)
- [CVE-2012-3519](https://cve.now/CVE-2012-3519.md): routerlist.c in Tor before 0.2.2.38 uses a different amount of time for relay-list iteration depending on which relay is chosen, which might (no CVSS)
- [CVE-2012-4673](https://cve.now/CVE-2012-4673.md): SQL injection vulnerability in application/controllers/invoice.php in NeoInvoice might allow remote attackers to execute arbitrary SQL comma (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2012-08-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.