# CVEs published 2012-09-19

35 CVEs were published on September 19, 2012: 0 critical, 0 high. Days are UTC.

- [CVE-2012-1638](https://cve.now/CVE-2012-1638.md): SQL injection vulnerability in the Search Autocomplete module before 7.x-2.1 for Drupal allows remote authenticated users with the "use sear (no CVSS)
- [CVE-2012-1640](https://cve.now/CVE-2012-1640.md): Multiple cross-site scripting (XSS) vulnerabilities in the Managesite module 6.x-1.x before 6.1-1.1 for Drupal allow remote authenticated us (no CVSS)
- [CVE-2012-5003](https://cve.now/CVE-2012-5003.md): nxapplet.jar in No Machine NX Web Companion 3.x and earlier does not properly verify the authenticity of updates, which allows user-assisted (no CVSS)
- [CVE-2012-5004](https://cve.now/CVE-2012-5004.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Parallels H-Sphere 3.3 Patch 1 allow remote attackers to hijack the authentica (no CVSS)
- [CVE-2012-5005](https://cve.now/CVE-2012-5005.md): Cross-site request forgery (CSRF) vulnerability in admin/admin\_options.php in VR GPub 4.0 allows remote attackers to hijack the authenticati (no CVSS)
- [CVE-2012-5006](https://cve.now/CVE-2012-5006.md): Heap-based buffer overflow in npdjvu.dll in Caminova DjVu Browser Plug-in 6.1.4 Build 27351 and other versions before 6.1.4.27993 allows rem (no CVSS)
- [CVE-2012-1651](https://cve.now/CVE-2012-1651.md): Cross-site scripting (XSS) vulnerability in the Submenu Tree module before 6.x-1.5 for Drupal allows remote authenticated users to inject ar (no CVSS)
- [CVE-2012-1652](https://cve.now/CVE-2012-1652.md): Cross-site scripting (XSS) vulnerability in the Hierarchical Select module 6.x-3.x before 6.x-3.8 for Drupal allows remote authenticated use (no CVSS)
- [CVE-2012-1653](https://cve.now/CVE-2012-1653.md): Cross-site scripting (XSS) vulnerability in the Taxonomy Views Integrator (TVI) module 6.x-1.x before 6.x-1.3 for Drupal allows remote authe (no CVSS)
- [CVE-2012-2105](https://cve.now/CVE-2012-2105.md): Multiple SQL injection vulnerabilities in login.php in Timesheet Next Gen 1.5.2 allow remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2012-2991](https://cve.now/CVE-2012-2991.md): The PayPal (aka MODULE\_PAYMENT\_PAYPAL\_STANDARD) module before 1.1 in osCommerce Online Merchant before 2.3.4 allows remote attackers to set (no CVSS)
- [CVE-2012-3373](https://cve.now/CVE-2012-3373.md): Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.21 and 1.5.x before 1.5.8 allows remote attackers to inject arbit (no CVSS)
- [CVE-2012-4992](https://cve.now/CVE-2012-4992.md): Multiple buffer overflows in FlashFXP.exe in FlashFXP 4.2 allow remote authenticated users to execute arbitrary code via a long unicode stri (no CVSS)
- [CVE-2012-4993](https://cve.now/CVE-2012-4993.md): torrent\_functions.php in RivetTracker 1.03 and earlier does not properly restrict access, which allows remote attackers to have an unspecifi (no CVSS)
- [CVE-2012-4994](https://cve.now/CVE-2012-4994.md): SQL injection vulnerability in admin/admin.php in LimeSurvey before 1.91+ Build 120224 allows remote authenticated users to execute arbitrar (no CVSS)
- [CVE-2012-4995](https://cve.now/CVE-2012-4995.md): Cross-site scripting (XSS) vulnerability in admin/userrighthandling.php in LimeSurvey before 1.91+ Build 120224 allows remote attackers to i (no CVSS)
- [CVE-2012-4996](https://cve.now/CVE-2012-4996.md): Multiple SQL injection vulnerabilities in RivetTracker 1.03 and earlier allow remote attackers to execute arbitrary SQL commands via the has (no CVSS)
- [CVE-2012-4997](https://cve.now/CVE-2012-4997.md): Directory traversal vulnerability in acp/index.php in AneCMS allows remote attackers to include and execute arbitrary local files via a .. (no CVSS)
- [CVE-2012-4998](https://cve.now/CVE-2012-4998.md): Cross-site scripting (XSS) vulnerability in index.php in starCMS allows remote attackers to inject arbitrary web script or HTML via the q pa (no CVSS)
- [CVE-2012-4999](https://cve.now/CVE-2012-4999.md): Mercury MR804 Router 8.0 3.8.1 Build 101220 Rel.53006nB allows remote attackers to cause a denial of service (service hang) via a crafted st (no CVSS)
- [CVE-2012-5000](https://cve.now/CVE-2012-5000.md): SQL injection vulnerability in jokes/index.php in the Witze addon 0.9 for deV!L'z Clanportal allows remote attackers to execute arbitrary SQ (no CVSS)
- [CVE-2012-5001](https://cve.now/CVE-2012-5001.md): Multiple unspecified vulnerabilities in Hitachi JP1/Cm2/Network Node Manager i before 09-50-03 allow remote attackers to cause a denial of s (no CVSS)
- [CVE-2012-5002](https://cve.now/CVE-2012-5002.md): Stack-based buffer overflow in SR10 FTP server (SR10.exe) 1.1.0.6 in Ricoh DC Software DL-10 4.5.0.1, when the Log file name option is enabl (no CVSS)
- [CVE-2011-3827](https://cve.now/CVE-2011-3827.md): The iCalendar component in gwwww1.dll in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before Support Pack 3 allows remote attacke (no CVSS)
- [CVE-2012-0271](https://cve.now/CVE-2012-0271.md): Integer overflow in the WebConsole component in gwia.exe in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before 8.0.3 HP1 and 201 (no CVSS)
- [CVE-2012-0272](https://cve.now/CVE-2012-0272.md): Cross-site scripting (XSS) vulnerability in the WebAccess component in Novell GroupWise 8.0 before Support Pack 3 allows remote attackers to (no CVSS)
- [CVE-2012-2578](https://cve.now/CVE-2012-2578.md): Multiple cross-site scripting (XSS) vulnerabilities in SmarterMail 9.2 allow remote attackers to inject arbitrary web script or HTML via an (no CVSS)
- [CVE-2012-2586](https://cve.now/CVE-2012-2586.md): Multiple cross-site scripting (XSS) vulnerabilities in Mailtraq 2.17.3.3150 allow remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2012-4400](https://cve.now/CVE-2012-4400.md): repository/repository\_ajax.php in Moodle 2.2.x before 2.2.5 and 2.3.x before 2.3.2 allows remote authenticated users to bypass intended uplo (no CVSS)
- [CVE-2012-4401](https://cve.now/CVE-2012-4401.md): Moodle 2.2.x before 2.2.5 and 2.3.x before 2.3.2 allows remote authenticated users to bypass intended capability restrictions and perform ce (no CVSS)
- [CVE-2012-4402](https://cve.now/CVE-2012-4402.md): webservice/lib.php in Moodle 2.1.x before 2.1.8, 2.2.x before 2.2.5, and 2.3.x before 2.3.2 does not properly restrict the use of web-servic (no CVSS)
- [CVE-2012-4403](https://cve.now/CVE-2012-4403.md): theme/yui\_combo.php in Moodle 2.3.x before 2.3.2 does not properly construct error responses for the drag-and-drop script, which allows remo (no CVSS)
- [CVE-2012-4407](https://cve.now/CVE-2012-4407.md): lib/filelib.php in Moodle 2.1.x before 2.1.8, 2.2.x before 2.2.5, and 2.3.x before 2.3.2 does not properly check the publication state of bl (no CVSS)
- [CVE-2012-4408](https://cve.now/CVE-2012-4408.md): course/reset.php in Moodle 2.1.x before 2.1.8, 2.2.x before 2.2.5, and 2.3.x before 2.3.2 checks an update capability instead of a reset cap (no CVSS)
- [CVE-2012-3258](https://cve.now/CVE-2012-3258.md): Unspecified vulnerability in HP Operations Orchestration 9.0 before 9.03 allows remote attackers to execute arbitrary code via unknown vecto (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2012-09-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.