# CVEs published 2012-09-18 24 CVEs were published on September 18, 2012: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2012-1654](https://cve.now/CVE-2012-1654.md): Multiple cross-site scripting (XSS) vulnerabilities in the Data module 6.x-1.x before 6.x-1.0 and 7.x-1.x before 7.x-1.0-alpha3 for Drupal a (no CVSS) - [CVE-2012-1655](https://cve.now/CVE-2012-1655.md): Unspecified vulnerability in the UC PayDutchGroup / WeDeal payment module 6.x-1.0 for Drupal allows remote authenticated users to obtain acc (no CVSS) - [CVE-2012-1656](https://cve.now/CVE-2012-1656.md): SQL injection vulnerability in the Multisite Search module 6.x-2.2 for Drupal allows remote authenticated users with certain permissions to (no CVSS) - [CVE-2012-1657](https://cve.now/CVE-2012-1657.md): Cross-site scripting (XSS) vulnerability in block\_class.module in the Block Class module before 7.x-1.1 for Drupal allows remote authenticat (no CVSS) - [CVE-2012-1658](https://cve.now/CVE-2012-1658.md): Cross-site scripting (XSS) vulnerability in the Read More Link module 6.x-3.x before 6.x-3.1 for Drupal allows remote authenticated users wi (no CVSS) - [CVE-2012-1659](https://cve.now/CVE-2012-1659.md): Cross-site scripting (XSS) vulnerability in the Node Recommendation module 6.x-1.x before 6.x-1.1 for Drupal allows remote authenticated use (no CVSS) - [CVE-2012-1660](https://cve.now/CVE-2012-1660.md): Multiple cross-site scripting (XSS) vulnerabilities in components/select.inc in the Webform module 6.x-3.x before 6.x-3.17 and 7.x-3.x befor (no CVSS) - [CVE-2011-4941](https://cve.now/CVE-2011-4941.md): Unspecified vulnerability in Piwik 1.2 through 1.4 allows remote attackers with the view permission to execute arbitrary code via unknown at (no CVSS, piwik/piwik ยท matomo/matomo) - [CVE-2012-1183](https://cve.now/CVE-2012-1183.md): Stack-based buffer overflow in the milliwatt\_generate function in the Miliwatt application in Asterisk 1.4.x before 1.4.44, 1.6.x before 1.6 (no CVSS) - [CVE-2012-1184](https://cve.now/CVE-2012-1184.md): Stack-based buffer overflow in the ast\_parse\_digest function in main/utils.c in Asterisk 1.8.x before 1.8.10.1 and 10.x before 10.2.1 allows (no CVSS) - [CVE-2012-1901](https://cve.now/CVE-2012-1901.md): Multiple cross-site request forgery (CSRF) vulnerabilities in FlexCMS 3.2.1 and earlier allow remote attackers to (1) hijack the authenticat (no CVSS) - [CVE-2012-3524](https://cve.now/CVE-2012-3524.md): libdbus 1.5.x and earlier, when used in setuid or other privileged programs in X.org and possibly other products, allows local users to gain (no CVSS) - [CVE-2012-3547](https://cve.now/CVE-2012-3547.md): Stack-based buffer overflow in the cbtls\_verify function in FreeRADIUS 2.1.10 through 2.1.12, when using TLS-based EAP methods, allows remot (no CVSS) - [CVE-2012-4405](https://cve.now/CVE-2012-4405.md): Multiple integer underflows in the icmLut\_allocate function in International Color Consortium (ICC) Format library (icclib), as used in Ghos (no CVSS) - [CVE-2012-4413](https://cve.now/CVE-2012-4413.md): OpenStack Keystone 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to (no CVSS, keystone) - [CVE-2012-4425](https://cve.now/CVE-2012-4425.md): libgio, when used in setuid or other privileged programs in spice-gtk and possibly other products, allows local users to gain privileges and (no CVSS) - [CVE-2012-3028](https://cve.now/CVE-2012-3028.md): Cross-site request forgery (CSRF) vulnerability in WebNavigator in Siemens WinCC 7.0 SP3 and earlier, as used in SIMATIC PCS7 and other prod (no CVSS) - [CVE-2012-3030](https://cve.now/CVE-2012-3030.md): WebNavigator in Siemens WinCC 7.0 SP3 and earlier, as used in SIMATIC PCS7 and other products, stores sensitive information under the web ro (no CVSS) - [CVE-2012-3031](https://cve.now/CVE-2012-3031.md): Multiple cross-site scripting (XSS) vulnerabilities in WebNavigator in Siemens WinCC 7.0 SP3 and earlier, as used in SIMATIC PCS7 and other (no CVSS) - [CVE-2012-3032](https://cve.now/CVE-2012-3032.md): SQL injection vulnerability in WebNavigator in Siemens WinCC 7.0 SP3 and earlier, as used in SIMATIC PCS7 and other products, allows remote (no CVSS) - [CVE-2012-3034](https://cve.now/CVE-2012-3034.md): WebNavigator in Siemens WinCC 7.0 SP3 and earlier, as used in SIMATIC PCS7 and other products, allows remote attackers to discover a usernam (no CVSS) - [CVE-2012-4969](https://cve.now/CVE-2012-4969.md): Use-after-free vulnerability in the CMshtmlEd::Exec function in mshtml.dll in Microsoft Internet Explorer 6 through 9 allows remote attacker (CVSS 8.1, KEV) - [CVE-2012-2993](https://cve.now/CVE-2012-2993.md): Microsoft Windows Phone 7 does not verify the domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man- (CVSS 5.9) - [CVE-2012-2994](https://cve.now/CVE-2012-2994.md): The CoSoSys Endpoint Protector 4 appliance establishes an EPProot password based entirely on the appliance serial number, which makes it eas (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2012-09-18 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.