# CVEs published 2012-08-28

12 CVEs were published on August 28, 2012: 1 critical, 0 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2012-1635](https://cve.now/CVE-2012-1635.md): The hook\_node\_access function in the revisioning module 7.x-1.x before 7.x-1.3 for Drupal checks the permissions of the current user even wh (no CVSS)
- [CVE-2012-1641](https://cve.now/CVE-2012-1641.md): The finder\_import function in the Finder module 6.x-1.x before 6.x-1.26, 7.x-1.x, and 7.x-2.x before 7.x-2.0-alpha8 for Drupal allows remote (no CVSS)
- [CVE-2012-1642](https://cve.now/CVE-2012-1642.md): includes/linkchecker.pages.inc in the Link checker module 6.x-2.x before 6.x-2.5 for Drupal does not properly enforce access permissions on (no CVSS)
- [CVE-2012-1643](https://cve.now/CVE-2012-1643.md): The Faster Permissions module 7.x-2.x before 7.x-1.2 for Drupal does not check the "administer permissions" permission, which allows remote (no CVSS)
- [CVE-2012-1644](https://cve.now/CVE-2012-1644.md): The Organic Groups (OG) Vocabulary module 6.x-1.x before 6.x-1.2 for Drupal allows remote authenticated users with certain administrator per (no CVSS)
- [CVE-2012-1645](https://cve.now/CVE-2012-1645.md): The CDN module 6.x-2.2 and 7.x-2.2 for Drupal, when running in Origin Pull mode with the "Far Future expiration" option enabled, allows remo (no CVSS)
- [CVE-2012-1647](https://cve.now/CVE-2012-1647.md): Multiple cross-site scripting (XSS) vulnerabilities in the "stand alone PHP application for the OSM Player," as used in the MediaFront modul (no CVSS)
- [CVE-2012-1650](https://cve.now/CVE-2012-1650.md): The ZipCart module 6.x before 6.x-1.4 for Drupal checks the "access content" permission instead of the "access ZipCart downloads" permission (no CVSS)
- [CVE-2012-2085](https://cve.now/CVE-2012-2085.md): The exec\_command function in common/helpers.py in Gajim before 0.15 allows user-assisted remote attackers to execute arbitrary commands via (no CVSS)
- [CVE-2012-4685](https://cve.now/CVE-2012-4685.md): Cross-site scripting (XSS) vulnerability in Arbor Networks Peakflow SP 5.1.1 before patch 6, 5.5 before patch 4, and 5.6.0 before patch 1 al (no CVSS)
- [CVE-2012-4686](https://cve.now/CVE-2012-4686.md): SQL injection vulnerability in announcement.php in vBulletin 4.1.10 allows remote attackers to execute arbitrary SQL commands via the announ (no CVSS)
- [CVE-2012-4681](https://cve.now/CVE-2012-4681.md): Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to (CVSS 9.8, KEV)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2012-08-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.