# CVEs published 2012-10-01

49 CVEs were published on October 1, 2012: 0 critical, 0 high. Days are UTC.

- [CVE-2011-4945](https://cve.now/CVE-2011-4945.md): PolicyKit 0.103 sets the AdminIdentities to "wheel" by default, which allows local users in the wheel group to gain root privileges without (no CVSS)
- [CVE-2012-1470](https://cve.now/CVE-2012-1470.md): Multiple cross-site scripting (XSS) vulnerabilities in code\_editor.php in ocPortal before 7.1.6 allow remote attackers to inject arbitrary w (no CVSS)
- [CVE-2012-1471](https://cve.now/CVE-2012-1471.md): Directory traversal vulnerability in catalogue\_file.php in ocPortal before 7.1.6 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2012-1602](https://cve.now/CVE-2012-1602.md): user.php in NextBBS 0.6 allows remote attackers to bypass authentication and gain administrator access by setting the userkey cookie to 1. (no CVSS)
- [CVE-2012-1603](https://cve.now/CVE-2012-1603.md): Multiple SQL injection vulnerabilities in ajaxserver.php in NextBBS 0.6 allow remote attackers to execute arbitrary SQL commands via the (1) (no CVSS)
- [CVE-2012-1604](https://cve.now/CVE-2012-1604.md): Cross-site scripting (XSS) vulnerability in NextBBS 0.6 allows remote attackers to inject arbitrary web script or HTML via the do parameter (no CVSS)
- [CVE-2012-4063](https://cve.now/CVE-2012-4063.md): The Apache Santuario configuration in Eucalyptus before 3.1.1 does not properly restrict applying XML Signature transforms to documents, whi (no CVSS)
- [CVE-2012-4064](https://cve.now/CVE-2012-4064.md): Eucalyptus before 3.1.1 does not properly restrict the binding of external SOAP web-services messages, which allows remote authenticated use (no CVSS)
- [CVE-2012-4065](https://cve.now/CVE-2012-4065.md): Eucalyptus before 3.1.1 does not properly restrict the binding of external SOAP web-services messages, which allows remote authenticated use (no CVSS)
- [CVE-2012-4242](https://cve.now/CVE-2012-4242.md): Cross-site scripting (XSS) vulnerability in the MF Gig Calendar plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web s (no CVSS)
- [CVE-2012-5234](https://cve.now/CVE-2012-5234.md): Open redirect vulnerability in index.php in ocPortal before 7.1.6 allows remote attackers to redirect users to arbitrary web sites and condu (no CVSS)
- [CVE-2012-0989](https://cve.now/CVE-2012-0989.md): Cross-site scripting (XSS) vulnerability in OneOrZero AIMS 2.8.0 Trial Edition build231211 and possibly earlier allows remote attackers to i (no CVSS)
- [CVE-2012-1636](https://cve.now/CVE-2012-1636.md): Cross-site request forgery (CSRF) vulnerability in the stickynote module before 7.x-1.1 for Drupal allows remote attackers to hijack the aut (no CVSS)
- [CVE-2012-5233](https://cve.now/CVE-2012-5233.md): Cross-site scripting (XSS) vulnerability in the stickynote module before 7.x-1.1 for Drupal allows remote authenticated users with edit stic (no CVSS)
- [CVE-2011-5202](https://cve.now/CVE-2011-5202.md): BazisVirtualCDBus.sys in WinCDEmu 3.6 allows local users to cause a denial of service (system crash) via the unmount command to batchmnt.exe (no CVSS)
- [CVE-2012-1576](https://cve.now/CVE-2012-1576.md): The myuser\_delete function in libathemecore/account.c in Atheme 5.x before 5.2.7, 6.x before 6.0.10, and 7.x before 7.0.0-beta2 does not pro (no CVSS)
- [CVE-2012-1639](https://cve.now/CVE-2012-1639.md): Multiple cross-site scripting (XSS) vulnerabilities in product/commerce\_product.module in the Drupal Commerce module for Drupal before 7.x-1 (no CVSS)
- [CVE-2012-1897](https://cve.now/CVE-2012-1897.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Wolf CMS 0.75 and earlier allow remote attackers to hijack the authentication (no CVSS)
- [CVE-2012-1898](https://cve.now/CVE-2012-1898.md): Multiple cross-site scripting (XSS) vulnerabilities in wolfcms/admin/user/add in Wolf CMS 0.75 and earlier allow remote attackers to inject (no CVSS)
- [CVE-2012-5223](https://cve.now/CVE-2012-5223.md): The proc\_deutf function in includes/functions\_vbseocp\_abstract.php in vBSEO 3.5.0, 3.5.1, 3.5.2, 3.6.0, and earlier allows remote attackers (no CVSS)
- [CVE-2012-5224](https://cve.now/CVE-2012-5224.md): PHP remote file inclusion vulnerability in vb/includes/vba\_cmps\_include\_bottom.php in vBadvanced CMPS 3.2.2 and earlier allows remote attack (no CVSS)
- [CVE-2012-5225](https://cve.now/CVE-2012-5225.md): Cross-site scripting (XSS) vulnerability in webscr.php in xClick Cart 1.0.1 and 1.0.2 allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2012-5226](https://cve.now/CVE-2012-5226.md): Multiple cross-site scripting (XSS) vulnerabilities in Peel SHOPPING 2.8 and 2.9 allow remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2012-5227](https://cve.now/CVE-2012-5227.md): SQL injection vulnerability in administrer/tva.php in Peel SHOPPING 2.8 and 2.9 allows remote attackers to execute arbitrary SQL commands vi (no CVSS)
- [CVE-2012-5228](https://cve.now/CVE-2012-5228.md): Cross-site scripting (XSS) vulnerability in admin/index.php in phplist 2.10.9, 2.10.17, and possibly other versions before 2.10.19 allows re (no CVSS)
- [CVE-2012-5229](https://cve.now/CVE-2012-5229.md): Cross-site scripting (XSS) vulnerability in css/gallery-css.php in the Slideshow Gallery2 plugin for WordPress allows remote attackers to in (no CVSS)
- [CVE-2012-5230](https://cve.now/CVE-2012-5230.md): Unspecified vulnerability in the JE Story Submit (com\_jesubmit) component before 1.9 for Joomla! has unknown impact and attack vectors. (no CVSS)
- [CVE-2012-5231](https://cve.now/CVE-2012-5231.md): miniCMS 1.0 and 2.0 allows remote attackers to execute arbitrary PHP code via a crafted (1) pagename or (2) area variable containing an exec (no CVSS)
- [CVE-2012-5232](https://cve.now/CVE-2012-5232.md): Cross-site scripting (XSS) vulnerability in the Quickl Form component for Joomla! allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2012-0748](https://cve.now/CVE-2012-0748.md): Multiple cross-site request forgery (CSRF) vulnerabilities in unspecified services in IBM Rational Team Concert (RTC) 4.x before 4.0.0.1 all (no CVSS)
- [CVE-2012-3035](https://cve.now/CVE-2012-3035.md): Buffer overflow in Emerson DeltaV 9.3.1 and 10.3 through 11.3.1 allows remote attackers to cause a denial of service (daemon crash) via a lo (no CVSS)
- [CVE-2012-3319](https://cve.now/CVE-2012-3319.md): IBM Rational Business Developer 8.x before 8.0.1.4 allows remote attackers to obtain potentially sensitive information via a connection to a (no CVSS)
- [CVE-2012-4830](https://cve.now/CVE-2012-4830.md): Unspecified vulnerability in IBM WebSphere Commerce 6.0 through 6.0.0.11 and 7.0 through 7.0.0.6 allows remote attackers to obtain users' pe (no CVSS)
- [CVE-2012-4833](https://cve.now/CVE-2012-4833.md): fuser in IBM AIX 6.1 and 7.1, and VIOS 2.2.1.4-FP-25 SP-02, does not properly restrict the -k option, which allows local users to kill arbit (no CVSS)
- [CVE-2012-4415](https://cve.now/CVE-2012-4415.md): Stack-based buffer overflow in the guac\_client\_plugin\_open function in libguac in Guacamole before 0.6.3 allows remote attackers to cause a (no CVSS)
- [CVE-2012-4427](https://cve.now/CVE-2012-4427.md): The gnome-shell plugin 3.4.1 in GNOME allows remote attackers to force the download and installation of arbitrary extensions from extensions (no CVSS)
- [CVE-2012-4432](https://cve.now/CVE-2012-4432.md): Use-after-free vulnerability in opngreduc.c in OptiPNG Hg and 0.7.x before 0.7.3 might allow remote attackers to execute arbitrary code via (no CVSS)
- [CVE-2012-4437](https://cve.now/CVE-2012-4437.md): Cross-site scripting (XSS) vulnerability in the SmartyException class in Smarty (aka smarty-php) before 3.1.12 allows remote attackers to in (no CVSS, smarty/smarty)
- [CVE-2012-4450](https://cve.now/CVE-2012-4450.md): 389 Directory Server 1.2.10 does not properly update the ACL when a DN entry is moved by a modrdn operation, which allows remote authenticat (no CVSS)
- [CVE-2011-4551](https://cve.now/CVE-2011-4551.md): Cross-site scripting (XSS) vulnerability in tiki-cookie-jar.php in TikiWiki CMS/Groupware before 8.2 and LTS before 6.5 allows remote attack (no CVSS)
- [CVE-2012-1588](https://cve.now/CVE-2012-1588.md): Algorithmic complexity vulnerability in the \_filter\_url function in the text filtering system (modules/filter/filter.module) in Drupal 7.x b (no CVSS)
- [CVE-2012-1590](https://cve.now/CVE-2012-1590.md): The forum list in Drupal 7.x before 7.14 does not properly check user permissions for unpublished forum posts, which allows remote authentic (no CVSS)
- [CVE-2012-1591](https://cve.now/CVE-2012-1591.md): The image module in Drupal 7.x before 7.14 does not properly check permissions when caching derivative image styles of private images, which (no CVSS)
- [CVE-2012-2153](https://cve.now/CVE-2012-2153.md): Drupal 7.x before 7.14 does not properly restrict access to nodes in a list when using a "contributed node access module," which allows remo (no CVSS, drupal/drupal)
- [CVE-2012-2240](https://cve.now/CVE-2012-2240.md): scripts/dscverify.pl in devscripts before 2.12.3 allows remote attackers to execute arbitrary commands via unspecified vectors related to "a (no CVSS)
- [CVE-2012-2241](https://cve.now/CVE-2012-2241.md): scripts/dget.pl in devscripts before 2.12.3 allows remote attackers to delete arbitrary files via a crafted (1) .dsc or (2) .changes file, p (no CVSS)
- [CVE-2012-2242](https://cve.now/CVE-2012-2242.md): scripts/dget.pl in devscripts before 2.10.73 allows remote attackers to execute arbitrary commands via a crafted (1) .dsc or (2) .changes fi (no CVSS)
- [CVE-2012-3500](https://cve.now/CVE-2012-3500.md): scripts/annotate-output.sh in devscripts before 2.12.2, as used in rpmdevtools before 8.3, allows local users to modify arbitrary files via (no CVSS)
- [CVE-2012-4429](https://cve.now/CVE-2012-4429.md): Vino 2.28, 2.32, 3.4.2, and earlier allows remote attackers to read clipboard activity by listening on TCP port 5900. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2012-10-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.