# CVEs published 2012-10-04 25 CVEs were published on October 4, 2012: 0 critical, 0 high. Days are UTC. - [CVE-2012-2999](https://cve.now/CVE-2012-2999.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface in Cerberus FTP Server before 5.0.5.0 allow remote attackers (no CVSS) - [CVE-2012-5237](https://cve.now/CVE-2012-5237.md): The dissect\_hsrp function in epan/dissectors/packet-hsrp.c in the HSRP dissector in Wireshark 1.8.x before 1.8.3 allows remote attackers to (no CVSS) - [CVE-2012-5238](https://cve.now/CVE-2012-5238.md): epan/dissectors/packet-ppp.c in the PPP dissector in Wireshark 1.8.x before 1.8.3 uses incorrect OUI data structures during the decoding of (no CVSS) - [CVE-2012-5240](https://cve.now/CVE-2012-5240.md): Buffer overflow in the dissect\_tlv function in epan/dissectors/packet-ldp.c in the LDP dissector in Wireshark 1.8.x before 1.8.3 allows remo (no CVSS) - [CVE-2012-5301](https://cve.now/CVE-2012-5301.md): The default configuration of Cerberus FTP Server before 5.0.4.0 supports the DES cipher for SSH sessions, which makes it easier for remote a (no CVSS) - [CVE-2011-5203](https://cve.now/CVE-2011-5203.md): SQL injection vulnerability in WB/Default.asp in Akiva WebBoard before 8 SR 1 allows remote attackers to execute arbitrary SQL commands via (no CVSS) - [CVE-2011-5204](https://cve.now/CVE-2011-5204.md): Akiva WebBoard 8.x stores passwords in plaintext, which allows local users to obtain sensitive information by reading from the database. (no CVSS) - [CVE-2011-5205](https://cve.now/CVE-2011-5205.md): Cross-site scripting (XSS) vulnerability in audl.php in Rapidleech 2.3 rev42 SVN r358, rev43 SVN r397, and earlier allows remote attackers t (no CVSS) - [CVE-2011-5206](https://cve.now/CVE-2011-5206.md): Cross-site scripting (XSS) vulnerability in notes.php in Rapidleech before 2.3 rev42 SVN r399 allows remote attackers to inject arbitrary we (no CVSS) - [CVE-2011-5207](https://cve.now/CVE-2011-5207.md): Cross-site scripting (XSS) vulnerability in admin/OptionsPostsList.php in the TheCartPress plugin for WordPress before 1.1.6 before 2011-12- (no CVSS) - [CVE-2012-5294](https://cve.now/CVE-2012-5294.md): SQL injection vulnerability in art\_detalle.php in MyStore Xpress Tienda Virtual allows remote attackers to execute arbitrary SQL commands vi (no CVSS) - [CVE-2012-5295](https://cve.now/CVE-2012-5295.md): Cross-site scripting (XSS) vulnerability in login.cfm in FuseTalk Forums 3.2 and earlier allows remote attackers to inject arbitrary web scr (no CVSS) - [CVE-2012-5296](https://cve.now/CVE-2012-5296.md): Multiple cross-site scripting (XSS) vulnerabilities in Mavili Guestbook, as released in November 2007, allow remote attackers to inject arbi (no CVSS) - [CVE-2012-5297](https://cve.now/CVE-2012-5297.md): SQL injection vulnerability in edit.asp in Mavili Guestbook, as released in November 2007, allows remote attackers to execute arbitrary SQL (no CVSS) - [CVE-2012-5298](https://cve.now/CVE-2012-5298.md): Mavili Guestbook, as released in November 2007, stores guestbook.mdb under the web root with insufficient access control, which allows remot (no CVSS) - [CVE-2012-5299](https://cve.now/CVE-2012-5299.md): Mavili Guestbook, as released in November 2007, allows remote attackers to edit, delete, and approve arbitrary messages via a direct request (no CVSS) - [CVE-2012-5300](https://cve.now/CVE-2012-5300.md): SQL injection vulnerability in art\_catalogo.php in MyStore Xpress Tienda Virtual 2.0 allows remote attackers to execute arbitrary SQL comman (no CVSS) - [CVE-2012-5288](https://cve.now/CVE-2012-5288.md): SQL injection vulnerability in page.php in phpMyDirectory 1.3.3 allows remote attackers to execute arbitrary SQL commands via the id paramet (no CVSS) - [CVE-2012-5289](https://cve.now/CVE-2012-5289.md): Multiple SQL injection vulnerabilities in Plogger 1.0 RC1 allow remote attackers to execute arbitrary SQL commands via the id parameter to ( (no CVSS) - [CVE-2012-5290](https://cve.now/CVE-2012-5290.md): Multiple SQL injection vulnerabilities in EasyWebRealEstate allow remote attackers to execute arbitrary SQL commands via the (1) lstid param (no CVSS) - [CVE-2012-5291](https://cve.now/CVE-2012-5291.md): SQL injection vulnerability in team.php in Posse Softball Director CMS allows remote attackers to execute arbitrary SQL commands via the idt (no CVSS) - [CVE-2012-5292](https://cve.now/CVE-2012-5292.md): Multiple SQL injection vulnerabilities in Atar2b CMS 4.0.1 allow remote attackers to execute arbitrary SQL commands via the id parameter to (no CVSS) - [CVE-2012-5293](https://cve.now/CVE-2012-5293.md): Multiple PHP remote file inclusion vulnerabilities in SAPID CMS 1.2.3 Stable allow remote attackers to execute arbitrary PHP code via a URL (no CVSS) - [CVE-2012-3267](https://cve.now/CVE-2012-3267.md): Unspecified vulnerability in HP Network Node Manager i (NNMi) 9.20 allows remote attackers to obtain sensitive information via unknown vecto (no CVSS) - [CVE-2012-3819](https://cve.now/CVE-2012-3819.md): Stack consumption vulnerability in dartwebserver.dll 1.9 and earlier, as used in Dart PowerTCP WebServer for ActiveX and other products, all (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2012-10-04 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.