# CVEs published 2012-08-31

58 CVEs were published on August 31, 2012: 0 critical, 0 high. Days are UTC.

- [CVE-2011-4946](https://cve.now/CVE-2011-4946.md): SQL injection vulnerability in e107\_admin/users\_extended.php in e107 before 0.7.26 allows remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2011-4947](https://cve.now/CVE-2011-4947.md): Cross-site request forgery (CSRF) vulnerability in e107\_admin/users\_extended.php in e107 before 0.7.26 allows remote attackers to hijack the (no CVSS)
- [CVE-2011-4948](https://cve.now/CVE-2011-4948.md): Directory traversal vulnerability in admin/remote.php in EGroupware Enterprise Line (EPL) before 11.1.20110804-1 and EGroupware Community Ed (no CVSS)
- [CVE-2011-4949](https://cve.now/CVE-2011-4949.md): SQL injection vulnerability in phpgwapi/js/dhtmlxtree/samples/with\_db/loaddetails.php in EGroupware Enterprise Line (EPL) before 11.1.201108 (no CVSS)
- [CVE-2011-4950](https://cve.now/CVE-2011-4950.md): Cross-site scripting (XSS) vulnerability in phpgwapi/js/jscalendar/test.php in EGroupware Enterprise Line (EPL) before 11.1.20110804-1 and E (no CVSS)
- [CVE-2011-4951](https://cve.now/CVE-2011-4951.md): Open redirect vulnerability in phpgwapi/ntlm/index.php in EGroupware Enterprise Line (EPL) before 11.1.20110804-1 and EGroupware Community E (no CVSS)
- [CVE-2012-2083](https://cve.now/CVE-2012-2083.md): Cross-site scripting (XSS) vulnerability in the fusion\_core\_preprocess\_page function in fusion\_core/template.php in the Fusion module before (no CVSS)
- [CVE-2012-2114](https://cve.now/CVE-2012-2114.md): Stack-based buffer overflow in fprintf in musl before 0.8.8 and earlier allows context-dependent attackers to cause a denial of service (cra (no CVSS)
- [CVE-2012-2116](https://cve.now/CVE-2012-2116.md): Cross-site request forgery (CSRF) vulnerability in the Commerce Reorder module before 7.x-1.1 for Drupal allows remote attackers to hijack t (no CVSS)
- [CVE-2012-2117](https://cve.now/CVE-2012-2117.md): Cross-site scripting (XSS) vulnerability in the Gigya - Social optimization module 6.x before 6.x-3.2 for Drupal allows remote attackers to (no CVSS)
- [CVE-2012-4740](https://cve.now/CVE-2012-4740.md): Cross-site scripting (XSS) vulnerability in the captive portal in PacketFence before 3.3.0 allows remote attackers to inject arbitrary web s (no CVSS)
- [CVE-2012-4741](https://cve.now/CVE-2012-4741.md): The RADIUS extension in PacketFence before 3.3.0 uses a different user name than is used for authentication for users with custom VLAN assig (no CVSS)
- [CVE-2012-4742](https://cve.now/CVE-2012-4742.md): The web\_node\_register function in web.pm in PacketFence before 3.0.2 might allow remote attackers to execute arbitrary code via unspecified (no CVSS)
- [CVE-2012-4743](https://cve.now/CVE-2012-4743.md): Multiple SQL injection vulnerabilities in ssearch.php in Siche search module 0.5 for Zeroboard allow remote attackers to execute arbitrary S (no CVSS)
- [CVE-2012-4744](https://cve.now/CVE-2012-4744.md): Cross-site scripting (XSS) vulnerability in ssearch.php in the Siche search module 0.5 for Zeroboard allows remote attackers to inject arbit (no CVSS)
- [CVE-2012-4745](https://cve.now/CVE-2012-4745.md): Cross-site scripting (XSS) vulnerability in admin/login.asp in Acuity CMS 2.6.2 allows remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2012-4746](https://cve.now/CVE-2012-4746.md): Cross-site request forgery (CSRF) vulnerability in accessaccount.cgi in ZTE ZXDSL 831IIV7.5.0a\_Z29\_OV allows remote attackers to hijack the (no CVSS)
- [CVE-2010-5193](https://cve.now/CVE-2010-5193.md): Stack-based buffer overflow in the TIFMergeMultiFiles function in the SCRIBBLE.ScribbleCtrl.1 ActiveX control (ImageViewer2.ocx) in Viscom I (no CVSS)
- [CVE-2010-5194](https://cve.now/CVE-2010-5194.md): Stack-based buffer overflow in the Image2PDF function in the SCRIBBLE.ScribbleCtrl.1 ActiveX control (ImageViewer2.ocx) in Viscom Image View (no CVSS)
- [CVE-2011-5137](https://cve.now/CVE-2011-5137.md): Multiple SQL injection vulnerabilities in tForum b0.915 allow remote attackers to execute arbitrary SQL commands via the (1) TopicID paramet (no CVSS)
- [CVE-2011-5138](https://cve.now/CVE-2011-5138.md): Cross-site scripting (XSS) vulnerability in member.php in tForum b0.915 allows remote attackers to inject arbitrary web script or HTML via t (no CVSS)
- [CVE-2011-5139](https://cve.now/CVE-2011-5139.md): SQL injection vulnerability in page.php in Pre Studio Business Cards Designer allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2011-5140](https://cve.now/CVE-2011-5140.md): Multiple SQL injection vulnerabilities in the blog module 1.0 for DiY-CMS allow remote attackers to execute arbitrary SQL commands via the ( (no CVSS)
- [CVE-2011-5141](https://cve.now/CVE-2011-5141.md): Directory traversal vulnerability in exportcsv/exportcsv\_index.php in Open Business Management (OBM) 2.4.0-rc13 and earlier allows remote au (no CVSS)
- [CVE-2011-5142](https://cve.now/CVE-2011-5142.md): Multiple cross-site scripting (XSS) vulnerabilities in Open Business Management (OBM) 2.4.0-rc13 and probably earlier allow remote attackers (no CVSS)
- [CVE-2011-5143](https://cve.now/CVE-2011-5143.md): Multiple cross-site scripting (XSS) vulnerabilities in Open Business Management (OBM) 2.3.20 and probably earlier allow remote attackers to (no CVSS)
- [CVE-2011-5144](https://cve.now/CVE-2011-5144.md): Open Business Management (OBM) 2.4.0-rc13 and earlier allows remote attackers to obtain configuration information via a direct request to te (no CVSS)
- [CVE-2011-5145](https://cve.now/CVE-2011-5145.md): Multiple SQL injection vulnerabilities in Open Business Management (OBM) 2.4.0-rc13 and probably earlier allow remote authenticated users to (no CVSS)
- [CVE-2011-5146](https://cve.now/CVE-2011-5146.md): Bokken before 1.6 and 1.5-x before 1.5-3 for Debian allows local users to overwrite arbitrary files via a symlink attack on /tmp/graph.dot. (no CVSS)
- [CVE-2011-5147](https://cve.now/CVE-2011-5147.md): Static code injection vulnerability in ajax\_save\_name.php in the Ajax File Manager module in the tinymce plugin in FreeWebshop 2.2.9 R2 and (no CVSS)
- [CVE-2011-5148](https://cve.now/CVE-2011-5148.md): Multiple incomplete blacklist vulnerabilities in the Simple File Upload (mod\_simplefileuploadv1.3) module before 1.3.5 for Joomla! allow rem (no CVSS)
- [CVE-2011-5149](https://cve.now/CVE-2011-5149.md): Multiple cross-site scripting (XSS) vulnerabilities in SpamTitan 5.08 and earlier allow remote attackers to inject arbitrary web script or H (no CVSS)
- [CVE-2011-5150](https://cve.now/CVE-2011-5150.md): Multiple cross-site scripting (XSS) vulnerabilities in SpamTitan 5.07 and possibly earlier allow remote attackers or authenticated users to (no CVSS)
- [CVE-2012-2704](https://cve.now/CVE-2012-2704.md): The Advertisement module 6.x-2.x before 6.x-2.3 for Drupal does not properly restrict access to debug information, which allows remote attac (no CVSS)
- [CVE-2012-3533](https://cve.now/CVE-2012-3533.md): The python SDK before 3.1.0.6 and CLI before 3.1.0.8 for oVirt 3.1 does not check the server SSL certificate against the client keys, which (no CVSS)
- [CVE-2012-3534](https://cve.now/CVE-2012-3534.md): GNU Gatekeeper before 3.1 does not limit the number of connections to the status port, which allows remote attackers to cause a denial of se (no CVSS)
- [CVE-2012-4739](https://cve.now/CVE-2012-4739.md): Multiple cross-site scripting (XSS) vulnerabilities in Barracuda SSL VPN before 2.2.2.203 (2012-07-05) allow remote attackers to inject arbi (no CVSS)
- [CVE-2012-2865](https://cve.now/CVE-2012-2865.md): Google Chrome before 21.0.1180.89 does not properly perform line breaking, which allows remote attackers to cause a denial of service (out-o (no CVSS)
- [CVE-2012-2866](https://cve.now/CVE-2012-2866.md): Google Chrome before 21.0.1180.89 does not properly perform a cast of an unspecified variable during handling of run-in elements, which allo (no CVSS)
- [CVE-2012-2867](https://cve.now/CVE-2012-2867.md): The SPDY implementation in Google Chrome before 21.0.1180.89 allows remote attackers to cause a denial of service (application crash) via un (no CVSS)
- [CVE-2012-2868](https://cve.now/CVE-2012-2868.md): Race condition in Google Chrome before 21.0.1180.89 allows remote attackers to cause a denial of service or possibly have unspecified other (no CVSS)
- [CVE-2012-2869](https://cve.now/CVE-2012-2869.md): Google Chrome before 21.0.1180.89 does not properly load URLs, which allows remote attackers to cause a denial of service or possibly have u (no CVSS)
- [CVE-2012-2870](https://cve.now/CVE-2012-2870.md): libxslt 1.1.26 and earlier, as used in Google Chrome before 21.0.1180.89, does not properly manage memory, which might allow remote attacker (no CVSS)
- [CVE-2012-2871](https://cve.now/CVE-2012-2871.md): libxml2 2.9.0-rc1 and earlier, as used in Google Chrome before 21.0.1180.89, does not properly support a cast of an unspecified variable dur (no CVSS)
- [CVE-2012-2872](https://cve.now/CVE-2012-2872.md): Cross-site scripting (XSS) vulnerability in an SSL interstitial page in Google Chrome before 21.0.1180.89 allows remote attackers to inject (no CVSS)
- [CVE-2012-4171](https://cve.now/CVE-2012-4171.md): Adobe Flash Player before 10.3.183.23 and 11.x before 11.4.402.265 on Windows and Mac OS X, before 10.3.183.23 and 11.x before 11.2.202.238 (no CVSS)
- [CVE-2012-3378](https://cve.now/CVE-2012-3378.md): The register\_application function in atk-adaptor/bridge.c in GNOME at-spi2-atk 2.5.2 does not seed the random number generator and generates (no CVSS)
- [CVE-2012-3380](https://cve.now/CVE-2012-3380.md): Directory traversal vulnerability in naxsi-ui/nx\_extract.py in the Naxsi module before 0.46-1 for Nginx allows local users to read arbitrary (no CVSS)
- [CVE-2012-3478](https://cve.now/CVE-2012-3478.md): rssh 2.3.3 and earlier allows local users to bypass intended restricted shell access via crafted environment variables in the command line. (no CVSS)
- [CVE-2012-4245](https://cve.now/CVE-2012-4245.md): The scriptfu network server in GIMP 2.6 does not require authentication, which allows remote attackers to execute arbitrary commands via the (no CVSS)
- [CVE-2012-2186](https://cve.now/CVE-2012-2186.md): Incomplete blacklist vulnerability in main/manager.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x before 10.7.1, Certified Asteris (no CVSS)
- [CVE-2012-4008](https://cve.now/CVE-2012-4008.md): The Cybozu Live application 1.0.4 and earlier for Android allows remote attackers to execute arbitrary Java methods, and obtain sensitive in (no CVSS)
- [CVE-2012-4009](https://cve.now/CVE-2012-4009.md): The WebView class in the Cybozu Live application 1.0.4 and earlier for Android allows remote attackers to execute arbitrary JavaScript code, (no CVSS)
- [CVE-2012-4170](https://cve.now/CVE-2012-4170.md): Buffer overflow in Adobe Photoshop CS6 13.x before 13.0.1 allows remote attackers to execute arbitrary code via a crafted file. (no CVSS)
- [CVE-2012-4600](https://cve.now/CVE-2012-4600.md): Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.14, 3.0.x before 3.0.16, and 3.1.x (no CVSS)
- [CVE-2012-4737](https://cve.now/CVE-2012-4737.md): channels/chan\_iax2.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x before 10.7.1, Certified Asterisk 1.8.11 before 1.8.11-cert7, As (no CVSS)
- [CVE-2012-2657](https://cve.now/CVE-2012-2657.md): Buffer overflow in the SQLDriverConnect function in unixODBC 2.0.10, 2.3.1, and earlier allows local users to cause a denial of service (cra (no CVSS)
- [CVE-2012-2658](https://cve.now/CVE-2012-2658.md): Buffer overflow in the SQLDriverConnect function in unixODBC 2.3.1 allows local users to cause a denial of service (crash) via a long string (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2012-08-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.