# CVEs published 2012-09-05

40 CVEs were published on September 5, 2012: 0 critical, 0 high. Days are UTC.

- [CVE-2010-4818](https://cve.now/CVE-2010-4818.md): The GLX extension in X.Org xserver 1.7.7 allows remote authenticated users to cause a denial of service (server crash) and possibly execute (no CVSS)
- [CVE-2010-4819](https://cve.now/CVE-2010-4819.md): The ProcRenderAddGlyphs function in the Render extension (render/render.c) in X.Org xserver 1.7.7 and earlier allows local users to read arb (no CVSS)
- [CVE-2011-3146](https://cve.now/CVE-2011-3146.md): librsvg before 2.34.1 uses the node name to identify the type of node, which allows context-dependent attackers to cause a denial of service (no CVSS)
- [CVE-2012-3509](https://cve.now/CVE-2012-3509.md): Multiple integer overflows in the (1) \_objalloc\_alloc function in objalloc.c and (2) objalloc\_alloc macro in include/objalloc.h in GNU libib (no CVSS)
- [CVE-2012-3526](https://cve.now/CVE-2012-3526.md): The reverse proxy add forward module (mod\_rpaf) 0.5 and 0.6 for the Apache HTTP Server allows remote attackers to cause a denial of service (no CVSS)
- [CVE-2012-3527](https://cve.now/CVE-2012-3527.md): view\_help.php in the backend help system in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticate (no CVSS, typo3/cms)
- [CVE-2012-3528](https://cve.now/CVE-2012-3528.md): Multiple cross-site scripting (XSS) vulnerabilities in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 (no CVSS, typo3/cms)
- [CVE-2012-3529](https://cve.now/CVE-2012-3529.md): The configuration module in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated (no CVSS, typo3/cms)
- [CVE-2012-3530](https://cve.now/CVE-2012-3530.md): Incomplete blacklist vulnerability in the t3lib\_div::quoteJSvalue API function in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x b (no CVSS, typo3/cms)
- [CVE-2012-3531](https://cve.now/CVE-2012-3531.md): Cross-site scripting (XSS) vulnerability in the Install Tool in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows (no CVSS, typo3/cms)
- [CVE-2012-3535](https://cve.now/CVE-2012-3535.md): Heap-based buffer overflow in OpenJPEG 1.5.0 and earlier allows remote attackers to cause a denial of service (application crash) and possib (no CVSS)
- [CVE-2012-3537](https://cve.now/CVE-2012-3537.md): The Crowbar Ohai plugin (chef/cookbooks/ohai/files/default/plugins/crowbar.rb) in the Deployer Barclamp in Crowbar, possibly 1.4 and earlier (no CVSS)
- [CVE-2012-3540](https://cve.now/CVE-2012-3540.md): Open redirect vulnerability in views/auth\_forms.py in OpenStack Dashboard (Horizon) Essex (2012.1) allows remote attackers to redirect users (no CVSS, horizon)
- [CVE-2012-3542](https://cve.now/CVE-2012-3542.md): OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), allows remote attackers to add an arbitrary (no CVSS, keystone)
- [CVE-2012-3551](https://cve.now/CVE-2012-3551.md): Cross-site scripting (XSS) vulnerability in crowbar\_framework/app/views/support/index.html.haml in the Crowbar barclamp in Crowbar, possibly (no CVSS)
- [CVE-2012-4386](https://cve.now/CVE-2012-4386.md): The token check mechanism in Apache Struts 2.0.0 through 2.3.4 does not properly validate the token name configuration parameter, which allo (no CVSS, org.apache.struts:struts2-core)
- [CVE-2012-4387](https://cve.now/CVE-2012-4387.md): Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is (no CVSS, org.apache.struts.xwork:xwork-core)
- [CVE-2012-4389](https://cve.now/CVE-2012-4389.md): Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.0.7 allows remote attackers to execute arbitrary code by uploadin (no CVSS)
- [CVE-2012-4390](https://cve.now/CVE-2012-4390.md): (1) apps/calendar/appinfo/remote.php and (2) apps/contacts/appinfo/remote.php in ownCloud before 4.0.7 allows remote authenticated users to (no CVSS)
- [CVE-2012-4391](https://cve.now/CVE-2012-4391.md): Cross-site request forgery (CSRF) vulnerability in core/ajax/appconfig.php in ownCloud before 4.0.7 allows remote attackers to hijack the au (no CVSS)
- [CVE-2012-4392](https://cve.now/CVE-2012-4392.md): index.php in ownCloud 4.0.7 does not properly validate the oc\_token cookie, which allows remote attackers to bypass authentication via a cra (no CVSS)
- [CVE-2012-4393](https://cve.now/CVE-2012-4393.md): Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud before 4.0.6 allow remote attackers to hijack the authentication of a (no CVSS)
- [CVE-2012-4394](https://cve.now/CVE-2012-4394.md): Cross-site scripting (XSS) vulnerability in apps/files/js/filelist.js in ownCloud before 4.0.5 allows remote attackers to inject arbitrary w (no CVSS)
- [CVE-2012-4395](https://cve.now/CVE-2012-4395.md): Cross-site scripting (XSS) vulnerability in index.php in ownCloud before 4.0.3 allows remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2012-4396](https://cve.now/CVE-2012-4396.md): Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.2 allow remote attackers to inject arbitrary web script or HTML v (no CVSS)
- [CVE-2012-4397](https://cve.now/CVE-2012-4397.md): Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.1 allow remote attackers to inject arbitrary web script or HTML v (no CVSS)
- [CVE-2012-4752](https://cve.now/CVE-2012-4752.md): appconfig.php in ownCloud before 4.0.6 does not properly restrict access, which allows remote authenticated users to edit app configurations (no CVSS)
- [CVE-2012-4753](https://cve.now/CVE-2012-4753.md): Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud before 4.0.5 allow remote attackers to hijack the authentication of u (no CVSS)
- [CVE-2011-4448](https://cve.now/CVE-2011-4448.md): SQL injection vulnerability in actions/usersettings/usersettings.php in WikkaWiki 1.3.1 and 1.3.2 allows remote attackers to execute arbitra (no CVSS)
- [CVE-2011-4449](https://cve.now/CVE-2011-4449.md): actions/files/files.php in WikkaWiki 1.3.1 and 1.3.2, when INTRANET\_MODE is enabled, supports file uploads for file extensions that are typi (no CVSS)
- [CVE-2011-4450](https://cve.now/CVE-2011-4450.md): Directory traversal vulnerability in handlers/files.xml/files.xml.php in WikkaWiki 1.3.1 and 1.3.2 allows remote attackers to read or delete (no CVSS)
- [CVE-2011-4451](https://cve.now/CVE-2011-4451.md): libs/Wakka.class.php in WikkaWiki 1.3.1 and 1.3.2, when the spam\_logging option is enabled, allows remote attackers to write arbitrary PHP c (no CVSS)
- [CVE-2011-4452](https://cve.now/CVE-2011-4452.md): Cross-site request forgery (CSRF) vulnerability in the AdminUsers component in WikkaWiki 1.3.1 and 1.3.2 allows remote attackers to hijack t (no CVSS)
- [CVE-2012-3012](https://cve.now/CVE-2012-3012.md): The Arbiter Power Sentinel 1133A device with firmware before 11Jun2012 Rev 421 allows remote attackers to cause a denial of service (Etherne (no CVSS)
- [CVE-2012-2063](https://cve.now/CVE-2012-2063.md): The Slidebox module before 7.x-1.4 for Drupal does not properly check permissions, which allows remote attackers to obtain sensitive informa (no CVSS)
- [CVE-2012-2064](https://cve.now/CVE-2012-2064.md): Cross-site scripting (XSS) vulnerability in theme/views\_lang\_switch.theme.inc in the Views Language Switcher module before 7.x-1.2 for Drupa (no CVSS)
- [CVE-2012-2065](https://cve.now/CVE-2012-2065.md): Cross-site scripting (XSS) vulnerability in the Language Icons module 6.x-2.x before 6.x-2.1 and 7.x-1.x before 7.x-1.0 for Drupal allows re (no CVSS)
- [CVE-2012-2066](https://cve.now/CVE-2012-2066.md): Cross-site scripting (XSS) vulnerability in the FCKeditor module 6.x-2.x before 6.x-2.3 and the CKEditor module 6.x-1.x before 6.x-1.9 and 7 (no CVSS)
- [CVE-2012-2067](https://cve.now/CVE-2012-2067.md): Unspecified vulnerability in the CKeditor module 6.x-2.x before 6.x-2.3 and the CKEditor module 6.x-1.x before 6.x-1.9 and 7.x-1.x before 7. (no CVSS)
- [CVE-2012-2068](https://cve.now/CVE-2012-2068.md): Multiple cross-site scripting (XSS) vulnerabilities in fancy\_slide.module in the Fancy Slide module before 6.x-2.7 for Drupal allow remote a (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2012-09-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.