# CVEs published 2012-09-17

21 CVEs were published on September 17, 2012: 0 critical, 0 high. Days are UTC.

- [CVE-2012-1899](https://cve.now/CVE-2012-1899.md): Multiple cross-site scripting (XSS) vulnerabilities in webfolio/admin/users/edit in Webfolio CMS 1.1.4 and earlier allow remote attackers to (no CVSS)
- [CVE-2012-2056](https://cve.now/CVE-2012-2056.md): Cross-site request forgery (CSRF) vulnerability in the Content Lock module for Drupal allows remote attackers to hijack the authentication o (no CVSS)
- [CVE-2012-2057](https://cve.now/CVE-2012-2057.md): Cross-site request forgery (CSRF) vulnerability in the Ubercart Bulk Stock Updater module for Drupal allows remote attackers to hijack the a (no CVSS)
- [CVE-2012-2058](https://cve.now/CVE-2012-2058.md): The Ubercart Payflow module for Drupal does not use a secure token, which allows remote attackers to forge payments via unspecified vectors. (no CVSS)
- [CVE-2012-2059](https://cve.now/CVE-2012-2059.md): Cross-site scripting (XSS) vulnerability in the ticketyboo News Ticker module for Drupal allows remote attackers to inject arbitrary web scr (no CVSS)
- [CVE-2012-2060](https://cve.now/CVE-2012-2060.md): Cross-site scripting (XSS) vulnerability in the Admin tools module for Drupal allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2012-2061](https://cve.now/CVE-2012-2061.md): Cross-site request forgery (CSRF) vulnerability in the Admin tools module for Drupal allows remote attackers to hijack the authentication of (no CVSS)
- [CVE-2012-2062](https://cve.now/CVE-2012-2062.md): Open redirect vulnerability in the Redirecting click bouncer module for Drupal allows remote attackers to redirect users to arbitrary web si (no CVSS)
- [CVE-2010-4822](https://cve.now/CVE-2010-4822.md): core/model/MySQLDatabase.php in SilverStripe 2.4.x before 2.4.4, when the site is running in "live mode," allows remote attackers to obtain (no CVSS)
- [CVE-2010-4823](https://cve.now/CVE-2010-4823.md): Cross-site scripting (XSS) vulnerability in the httpError method in sapphire/core/control/RequestHandler.php in SilverStripe 2.3.x before 2. (no CVSS)
- [CVE-2010-4824](https://cve.now/CVE-2010-4824.md): SQL injection vulnerability in the augmentSQL method in core/model/Translatable.php in SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4 (no CVSS)
- [CVE-2010-5078](https://cve.now/CVE-2010-5078.md): SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 stores sensitive information under the web root with insufficient access control, wh (no CVSS)
- [CVE-2010-5079](https://cve.now/CVE-2010-5079.md): SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 uses weak entropy when generating tokens for (1) the CSRF protection mechanism, (2) (no CVSS)
- [CVE-2011-4959](https://cve.now/CVE-2011-4959.md): SQL injection vulnerability in the addslashes method in SilverStripe 2.3.x before 2.3.12 and 2.4.x before 2.4.6, when connected to a MySQL d (no CVSS)
- [CVE-2011-4960](https://cve.now/CVE-2011-4960.md): SQL injection vulnerability in the Folder::findOrMake method in SilverStripe 2.3.x before 2.3.12 and 2.4.x before 2.4.6 allows remote attack (no CVSS)
- [CVE-2011-4961](https://cve.now/CVE-2011-4961.md): SilverStripe 2.3.x before 2.3.12 and 2.4.x before 2.4.6 allows remote authenticated users with the EDIT\_PERMISSIONS permission to gain admin (no CVSS)
- [CVE-2011-4962](https://cve.now/CVE-2011-4962.md): code/sitefeatures/PageCommentInterface.php in SilverStripe 2.4.x before 2.4.6 might allow remote attackers to execute arbitrary code via a c (no CVSS, silverstripe/cms)
- [CVE-2012-4968](https://cve.now/CVE-2012-4968.md): Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe 2.3.x before 2.3.13 and 2.4.x before 2.4.7 allow remote attackers to inj (no CVSS, silverstripe/framework)
- [CVE-2012-2575](https://cve.now/CVE-2012-2575.md): Cross-site scripting (XSS) vulnerability in NetWin SurgeMail 6.0a4 allows remote attackers to inject arbitrary web script or HTML via the SR (no CVSS)
- [CVE-2012-2995](https://cve.now/CVE-2012-2995.md): Multiple cross-site scripting (XSS) vulnerabilities in Trend Micro InterScan Messaging Security Suite 7.1-Build\_Win32\_1394 allow remote atta (no CVSS)
- [CVE-2012-2996](https://cve.now/CVE-2012-2996.md): Cross-site request forgery (CSRF) vulnerability in saveAccountSubTab.imss in Trend Micro InterScan Messaging Security Suite 7.1-Build\_Win32\_ (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2012-09-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.