# CVEs published 2012-09-20

60 CVEs were published on September 20, 2012: 0 critical, 0 high. Days are UTC.

- [CVE-2012-0650](https://cve.now/CVE-2012-0650.md): Buffer overflow in the DirectoryService Proxy in DirectoryService in Apple Mac OS X through 10.6.8 allows remote attackers to execute arbitr (no CVSS)
- [CVE-2012-3713](https://cve.now/CVE-2012-3713.md): Apple Safari before 6.0.1 does not properly handle the Quarantine attribute of HTML documents, which allows user-assisted remote attackers t (no CVSS)
- [CVE-2012-3714](https://cve.now/CVE-2012-3714.md): The Form Autofill feature in Apple Safari before 6.0.1 does not restrict the filled fields to the set of fields contained in an Autofill pop (no CVSS)
- [CVE-2012-3715](https://cve.now/CVE-2012-3715.md): Apple Safari before 6.0.1 makes http requests for https URIs in certain circumstances involving a paste into the address bar, which allows u (no CVSS)
- [CVE-2012-3716](https://cve.now/CVE-2012-3716.md): CoreText in Apple Mac OS X 10.7.x before 10.7.5 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bound (no CVSS)
- [CVE-2012-3718](https://cve.now/CVE-2012-3718.md): Apple Mac OS X before 10.7.5 and 10.8.x before 10.8.2 allows local users to read passwords entered into Login Window (aka LoginWindow) or Sc (no CVSS)
- [CVE-2012-3719](https://cve.now/CVE-2012-3719.md): Mail in Apple Mac OS X before 10.7.5 does not properly handle embedded web plugins, which allows remote attackers to execute arbitrary plugi (no CVSS)
- [CVE-2012-3720](https://cve.now/CVE-2012-3720.md): Mobile Accounts in Apple Mac OS X before 10.7.5 and 10.8.x before 10.8.2 saves password hashes for external-account use even if external acc (no CVSS)
- [CVE-2012-3721](https://cve.now/CVE-2012-3721.md): Profile Manager in Apple Mac OS X before 10.7.5 does not properly perform authentication for the Device Management private interface, which (no CVSS)
- [CVE-2012-3722](https://cve.now/CVE-2012-3722.md): The Sorenson codec in QuickTime in Apple Mac OS X before 10.7.5, and in CoreMedia in iOS before 6, accesses uninitialized memory locations, (no CVSS)
- [CVE-2012-3723](https://cve.now/CVE-2012-3723.md): Apple Mac OS X before 10.7.5 does not properly handle the bNbrPorts field of a USB hub descriptor, which allows physically proximate attacke (no CVSS)
- [CVE-2012-3724](https://cve.now/CVE-2012-3724.md): CFNetwork in Apple iOS before 6 does not properly identify the host portion of a URL, which allows remote attackers to obtain sensitive info (no CVSS)
- [CVE-2012-3725](https://cve.now/CVE-2012-3725.md): The DNAv4 protocol implementation in the DHCP component in Apple iOS before 6 sends Wi-Fi packets containing a MAC address of a host on a pr (no CVSS)
- [CVE-2012-3726](https://cve.now/CVE-2012-3726.md): Double free vulnerability in ImageIO in Apple iOS before 6 allows remote attackers to execute arbitrary code or cause a denial of service (a (no CVSS)
- [CVE-2012-3727](https://cve.now/CVE-2012-3727.md): Buffer overflow in the IPsec component in Apple iOS before 6 allows remote attackers to execute arbitrary code via a crafted racoon configur (no CVSS)
- [CVE-2012-3728](https://cve.now/CVE-2012-3728.md): The kernel in Apple iOS before 6 dereferences invalid pointers during the handling of packet-filter data structures, which allows local user (no CVSS)
- [CVE-2012-3729](https://cve.now/CVE-2012-3729.md): The Berkeley Packet Filter (BPF) interpreter implementation in the kernel in Apple iOS before 6 accesses uninitialized memory locations, whi (no CVSS)
- [CVE-2012-3730](https://cve.now/CVE-2012-3730.md): Mail in Apple iOS before 6 does not properly handle reuse of Content-ID header values, which allows remote attackers to spoof attachments vi (no CVSS)
- [CVE-2012-3731](https://cve.now/CVE-2012-3731.md): Mail in Apple iOS before 6 does not properly implement the Data Protection feature for e-mail attachments, which allows physically proximate (no CVSS)
- [CVE-2012-3732](https://cve.now/CVE-2012-3732.md): Mail in Apple iOS before 6 uses an S/MIME message's From address as the displayed sender address, which allows remote attackers to spoof sig (no CVSS)
- [CVE-2012-3733](https://cve.now/CVE-2012-3733.md): Messages in Apple iOS before 6, when multiple iMessage e-mail addresses are configured, does not ensure that a reply's sender address matche (no CVSS)
- [CVE-2012-3734](https://cve.now/CVE-2012-3734.md): Office Viewer in Apple iOS before 6 writes cleartext document data to a temporary file, which might allow local users to bypass a document's (no CVSS)
- [CVE-2012-3735](https://cve.now/CVE-2012-3735.md): The Passcode Lock implementation in Apple iOS before 6 does not properly interact with the "Slide to Power Off" feature, which allows physic (no CVSS)
- [CVE-2012-3736](https://cve.now/CVE-2012-3736.md): The Passcode Lock implementation in Apple iOS before 6 allows physically proximate attackers to bypass an intended passcode requirement via (no CVSS)
- [CVE-2012-3737](https://cve.now/CVE-2012-3737.md): The Passcode Lock implementation in Apple iOS before 6 does not properly restrict photo viewing, which allows physically proximate attackers (no CVSS)
- [CVE-2012-3738](https://cve.now/CVE-2012-3738.md): The Emergency Dialer screen in the Passcode Lock implementation in Apple iOS before 6 does not properly limit the dialing methods, which all (no CVSS)
- [CVE-2012-3739](https://cve.now/CVE-2012-3739.md): The Passcode Lock implementation in Apple iOS before 6 allows physically proximate attackers to bypass an intended passcode requirement via (no CVSS)
- [CVE-2012-3740](https://cve.now/CVE-2012-3740.md): The Passcode Lock implementation in Apple iOS before 6 does not properly manage the lock state, which allows physically proximate attackers (no CVSS)
- [CVE-2012-3741](https://cve.now/CVE-2012-3741.md): The Restrictions (aka Parental Controls) implementation in Apple iOS before 6 does not properly handle purchase attempts after a Disable Res (no CVSS)
- [CVE-2012-3742](https://cve.now/CVE-2012-3742.md): Safari in Apple iOS before 6 does not properly restrict use of an unspecified Unicode character that looks similar to the https lock indicat (no CVSS)
- [CVE-2012-3743](https://cve.now/CVE-2012-3743.md): The System Logs implementation in Apple iOS before 6 does not restrict /var/log access by sandboxed apps, which allows remote attackers to o (no CVSS)
- [CVE-2012-3744](https://cve.now/CVE-2012-3744.md): Telephony in Apple iOS before 6 uses an SMS message's return address as the displayed sender address, which allows remote attackers to spoof (no CVSS)
- [CVE-2012-3745](https://cve.now/CVE-2012-3745.md): Off-by-one error in Telephony in Apple iOS before 6 allows remote attackers to cause a denial of service (buffer overflow and connectivity o (no CVSS)
- [CVE-2012-3746](https://cve.now/CVE-2012-3746.md): UIWebView in UIKit in Apple iOS before 6 does not properly use the Data Protection feature, which allows context-dependent attackers to obta (no CVSS)
- [CVE-2012-3747](https://cve.now/CVE-2012-3747.md): WebKit, as used in Apple iOS before 6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and (no CVSS)
- [CVE-2011-5177](https://cve.now/CVE-2011-5177.md): Multiple cross-site scripting (XSS) vulnerabilities in admin/controller.php in eSyndiCat Pro 2.3.05 allow remote attackers to inject arbitra (no CVSS)
- [CVE-2011-5178](https://cve.now/CVE-2011-5178.md): Multiple cross-site scripting (XSS) vulnerabilities in netmri/config/userAdmin/login.tdf in Infoblox NetMRI 6.0.2.42, 6.1.2, 6.2.1 and earli (no CVSS)
- [CVE-2011-5179](https://cve.now/CVE-2011-5179.md): Cross-site scripting (XSS) vulnerability in skysa-official/skysa.php in Skysa App Bar Integration plugin, possibly before 1.04, for WordPres (no CVSS)
- [CVE-2011-5180](https://cve.now/CVE-2011-5180.md): Cross-site scripting (XSS) vulnerability in wp-1pluginjquery.php in the ZooEffect plugin 1.01 for WordPress allows remote attackers to injec (no CVSS)
- [CVE-2011-5181](https://cve.now/CVE-2011-5181.md): Cross-site scripting (XSS) vulnerability in clickdesk.php in ClickDesk Live Support - Live Chat plugin 2.0 for WordPress allows remote attac (no CVSS)
- [CVE-2011-5182](https://cve.now/CVE-2011-5182.md): Cross-site scripting (XSS) vulnerability in lanoba-social-plugin/index.php in the Lanoba Social plugin 1.0 for WordPress allows remote attac (no CVSS)
- [CVE-2011-5183](https://cve.now/CVE-2011-5183.md): Multiple SQL injection vulnerabilities in OrderSys 1.6.4 and earlier allow remote attackers to execute arbitrary SQL commands via the where\_ (no CVSS)
- [CVE-2011-5184](https://cve.now/CVE-2011-5184.md): Multiple cross-site scripting (XSS) vulnerabilities in HP Network Node Manager i 9.10 allow remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2011-5185](https://cve.now/CVE-2011-5185.md): Cross-site scripting (XSS) vulnerability in video\_comments.php in Online Subtitles Workshop before 2.0 rev 131 allows remote attackers to in (no CVSS)
- [CVE-2011-5186](https://cve.now/CVE-2011-5186.md): Cross-site scripting (XSS) vulnerability in jbshop.php in the jbShop plugin for e107 7 allows remote attackers to inject arbitrary web scrip (no CVSS)
- [CVE-2011-5187](https://cve.now/CVE-2011-5187.md): Cross-site scripting (XSS) vulnerability in the Support Ticketing System module 6.x-1.x before 6.x-1.7 for Drupal allows remote authenticate (no CVSS)
- [CVE-2011-5188](https://cve.now/CVE-2011-5188.md): Cross-site scripting (XSS) vulnerability in the Support Timer module 6.x-1.x before 6.x-1.4 for Drupal allows remote authenticated users wit (no CVSS)
- [CVE-2011-5189](https://cve.now/CVE-2011-5189.md): Cross-site scripting (XSS) vulnerability in the Webform Validation module 6.x-1.x before 6.x-1.5 and 7.x-1.x before 7.x-1.1 for Drupal allow (no CVSS)
- [CVE-2011-5190](https://cve.now/CVE-2011-5190.md): Multiple cross-site scripting (XSS) vulnerabilities in Social Book Facebook Clone 2010 allow remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2012-1625](https://cve.now/CVE-2012-1625.md): Eval injection vulnerability in the fillpdf\_form\_export\_decode function in fillpdf.admin.inc in the Fill PDF module 6.x-1.x before 6.x-1.16 (no CVSS)
- [CVE-2012-1626](https://cve.now/CVE-2012-1626.md): SQL injection vulnerability in the conversion form for Events in the Date module 6.x-2.x before 6.x-2.8 for Drupal allows remote authenticat (no CVSS)
- [CVE-2012-1628](https://cve.now/CVE-2012-1628.md): Cross-site scripting (XSS) vulnerability in the SuperCron module for Drupal allows remote authenticated users to inject arbitrary web script (no CVSS)
- [CVE-2012-1629](https://cve.now/CVE-2012-1629.md): Cross-site scripting (XSS) vulnerability in the Taxotouch module for Drupal allows remote authenticated users with certain permissions to in (no CVSS)
- [CVE-2012-1630](https://cve.now/CVE-2012-1630.md): Cross-site scripting (XSS) vulnerability in the Taxonomy Navigator module for Drupal allows remote authenticated users with certain permissi (no CVSS)
- [CVE-2012-1631](https://cve.now/CVE-2012-1631.md): Cross-site request forgery (CSRF) vulnerability in the Admin:hover module for Drupal allows remote attackers to hijack the authentication of (no CVSS)
- [CVE-2012-5007](https://cve.now/CVE-2012-5007.md): The Fill PDF module 7.x-1.x before 7.x-1.2 for Drupal allows remote attackers to write to arbitrary PDF files via unspecified vectors relate (no CVSS)
- [CVE-2012-0988](https://cve.now/CVE-2012-0988.md): Multiple cross-site scripting (XSS) vulnerabilities in config/dmsDefaults.php in KnowledgeTree 3.7.0.2 and possibly earlier allow remote att (no CVSS)
- [CVE-2012-1627](https://cve.now/CVE-2012-1627.md): Cross-site scripting (XSS) vulnerability in vud\_term.module in the Vote Up/Down module 6.x-2.x before 6.x-2.8 and 6.x-3.x before 6.x-3.1 for (no CVSS)
- [CVE-2012-1632](https://cve.now/CVE-2012-1632.md): Cross-site scripting (XSS) vulnerability in password\_policy.admin.inc in the Password Policy module before 6.x-1.4 and 7.x-1.0 beta3 for Dru (no CVSS)
- [CVE-2012-1633](https://cve.now/CVE-2012-1633.md): Cross-site request forgery (CSRF) vulnerability in the Password Policy module before 6.x-1.4 and 7.x-1.0 beta3 for Drupal allows remote atta (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2012-09-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.