# CVEs published 2012-10-08

50 CVEs were published on October 8, 2012: 0 critical, 0 high. Days are UTC.

- [CVE-2012-1671](https://cve.now/CVE-2012-1671.md): Directory traversal vulnerability in index.php in phpPaleo 4.8b155 and earlier allows remote attackers to include and execute arbitrary loca (no CVSS)
- [CVE-2012-5329](https://cve.now/CVE-2012-5329.md): Buffer overflow in TYPSoft FTP Server 1.1 allows remote authenticated users to cause a denial of service (application crash) via a long stri (no CVSS)
- [CVE-2012-5330](https://cve.now/CVE-2012-5330.md): Multiple cross-site scripting (XSS) vulnerabilities in asaanCart 0.9 allow remote attackers to inject arbitrary web script or HTML via the ( (no CVSS)
- [CVE-2012-5331](https://cve.now/CVE-2012-5331.md): Directory traversal vulnerability in asaanCart 0.9 allows remote attackers to include arbitrary local files via a .. (no CVSS)
- [CVE-2012-5332](https://cve.now/CVE-2012-5332.md): at32 Reverse Proxy 1.060.310 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a lon (no CVSS)
- [CVE-2012-5333](https://cve.now/CVE-2012-5333.md): SQL injection vulnerability in page.php in Pre Printing Press allows remote attackers to execute arbitrary SQL commands via the id parameter (no CVSS)
- [CVE-2012-5334](https://cve.now/CVE-2012-5334.md): SQL injection vulnerability in product\_desc.php in Pre Printing Press allows remote attackers to execute arbitrary SQL commands via the pid (no CVSS)
- [CVE-2012-5335](https://cve.now/CVE-2012-5335.md): Directory traversal vulnerability in Tiny Server 1.1.5 allows remote authenticated users to read arbitrary files via a .. (no CVSS)
- [CVE-2012-0846](https://cve.now/CVE-2012-0846.md): Cross-site scripting (XSS) vulnerability in Craig Knudsen WebCalendar 1.2.4 allows remote attackers to inject arbitrary web script or HTML v (no CVSS)
- [CVE-2012-5324](https://cve.now/CVE-2012-5324.md): Multiple buffer overflows in the Pdf Printer Preferences ActiveX Control in pdfxctrl.dll in Tracker Software PDF-XChange 3.60.0128 allow rem (no CVSS)
- [CVE-2012-5325](https://cve.now/CVE-2012-5325.md): Multiple cross-site scripting (XSS) vulnerabilities in the scr\_do\_redirect function in scr.php in the Shortcode Redirect plugin 1.0.01 and e (no CVSS)
- [CVE-2012-5326](https://cve.now/CVE-2012-5326.md): Cross-site request forgery (CSRF) vulnerability in admin/function.php in IDevSpot iSupport 1.x allows remote attackers to hijack the authent (no CVSS)
- [CVE-2012-5327](https://cve.now/CVE-2012-5327.md): Multiple SQL injection vulnerabilities in fs-admin/fs-admin.php in the Mingle Forum plugin 1.0.32.1 and other versions before 1.0.33 for Wor (no CVSS)
- [CVE-2012-5328](https://cve.now/CVE-2012-5328.md): Multiple SQL injection vulnerabilities in the Mingle Forum plugin 1.0.32.1 and other versions before 1.0.33 for WordPress might allow remote (no CVSS)
- [CVE-2011-4342](https://cve.now/CVE-2011-4342.md): PHP remote file inclusion vulnerability in wp\_xml\_export.php in the BackWPup plugin before 1.7.2 for WordPress allows remote attackers to ex (no CVSS)
- [CVE-2011-4927](https://cve.now/CVE-2011-4927.md): Unspecified vulnerability in the bazaar repository adapter in Redmine 1.0.x before 1.0.5 allows remote authenticated users to obtain sensiti (no CVSS)
- [CVE-2011-4928](https://cve.now/CVE-2011-4928.md): Cross-site scripting (XSS) vulnerability in the textile formatter in Redmine before 1.0.5 allows remote attackers to inject arbitrary web sc (no CVSS)
- [CVE-2011-4929](https://cve.now/CVE-2011-4929.md): Unspecified vulnerability in the bazaar repository adapter in Redmine 0.9.x and 1.0.x before 1.0.5 allows remote attackers to execute arbitr (no CVSS)
- [CVE-2011-5208](https://cve.now/CVE-2011-5208.md): Multiple directory traversal vulnerabilities in the BackWPup plugin before 1.4.1 for WordPress allow remote attackers to read arbitrary file (no CVSS)
- [CVE-2012-1189](https://cve.now/CVE-2012-1189.md): Stack-based buffer overflow in modules/graphic/ssgraph/grsound.cpp in The Open Racing Car Simulator (TORCS) before 1.3.3 and Speed Dreams al (no CVSS)
- [CVE-2012-1308](https://cve.now/CVE-2012-1308.md): Cross-site request forgery (CSRF) vulnerability in redpass.cgi in D-Link DSL-2640B Firmware EU\_4.00 allows remote attackers to hijack the au (no CVSS)
- [CVE-2012-1416](https://cve.now/CVE-2012-1416.md): Multiple cross-site request forgery (CSRF) vulnerabilities in SocialCMS 1.0.2 allow remote attackers to hijack the authentication of adminis (no CVSS)
- [CVE-2012-5319](https://cve.now/CVE-2012-5319.md): Cross-site request forgery (CSRF) vulnerability in setup/security.cgi in D-Link DCS-900, DCS-2000, and DCS-5300 allows remote attackers to h (no CVSS)
- [CVE-2012-5320](https://cve.now/CVE-2012-5320.md): Cross-site request forgery (CSRF) vulnerability in password.cgi in Sagem F@ST 2604 253180972B allows remote attackers to hijack the authenti (no CVSS)
- [CVE-2012-5321](https://cve.now/CVE-2012-5321.md): tiki-featured\_link.php in TikiWiki CMS/Groupware 8.3 allows remote attackers to load arbitrary web site pages into frames and conduct phishi (no CVSS)
- [CVE-2012-5322](https://cve.now/CVE-2012-5322.md): Multiple cross-site scripting (XSS) vulnerabilities in Xavi X7968 allow remote attackers to inject arbitrary web script or HTML via the (1) (no CVSS)
- [CVE-2012-5323](https://cve.now/CVE-2012-5323.md): Cross-site request forgery (CSRF) vulnerability in webconfig/admin\_passwd/passwd.html/admin\_passwd in Xavi X7968 allows remote attackers to (no CVSS)
- [CVE-2012-1125](https://cve.now/CVE-2012-1125.md): Unrestricted file upload vulnerability in uploadify/scripts/uploadify.php in the Kish Guest Posting plugin before 1.2 for WordPress allows r (no CVSS)
- [CVE-2012-5310](https://cve.now/CVE-2012-5310.md): SQL injection vulnerability in the WP e-Commerce plugin before 3.8.7.6 for WordPress allows remote attackers to execute arbitrary SQL comman (no CVSS)
- [CVE-2012-5312](https://cve.now/CVE-2012-5312.md): SQL injection vulnerability in Tribiq CMS allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php. (no CVSS)
- [CVE-2012-5313](https://cve.now/CVE-2012-5313.md): SQL injection vulnerability in forum.asp in Snitz Forums 2000 allows remote attackers to execute arbitrary SQL commands via the TOPIC\_ID par (no CVSS)
- [CVE-2012-5314](https://cve.now/CVE-2012-5314.md): Cross-site scripting (XSS) vulnerability in ViewGit 0.0.6 and earlier allows remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2012-5315](https://cve.now/CVE-2012-5315.md): Multiple cross-site scripting (XSS) vulnerabilities in php ireport 1.0 allow remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2012-5316](https://cve.now/CVE-2012-5316.md): Multiple cross-site scripting (XSS) vulnerabilities in Barracuda Spam & Virus Firewall 600 Firmware 4.0.1.009 and earlier allow remote authe (no CVSS)
- [CVE-2012-5317](https://cve.now/CVE-2012-5317.md): SQL injection vulnerability in main\_bigware\_43.php in Bigware Shop before 2.1.5 allows remote attackers to execute arbitrary SQL commands vi (no CVSS)
- [CVE-2012-5318](https://cve.now/CVE-2012-5318.md): Unrestricted file upload vulnerability in uploadify/scripts/uploadify.php in the Kish Guest Posting plugin 1.2 for WordPress allows remote a (no CVSS)
- [CVE-2010-5063](https://cve.now/CVE-2010-5063.md): SQL injection vulnerability in article.php in Virtual War (aka VWar) 1.6.1 R2 allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2010-5064](https://cve.now/CVE-2010-5064.md): Multiple cross-site scripting (XSS) vulnerabilities in Virtual War (aka VWar) 1.6.1 R2 allow remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2010-5065](https://cve.now/CVE-2010-5065.md): popup.php in Virtual War (aka VWar) 1.6.1 R2 allows remote attackers to bypass intended member restrictions and read news posts via a modifi (no CVSS)
- [CVE-2010-5066](https://cve.now/CVE-2010-5066.md): The createRandomPassword function in includes/functions\_common.php in Virtual War (aka VWar) 1.6.1 R2 uses a small range of values to select (no CVSS)
- [CVE-2010-5067](https://cve.now/CVE-2010-5067.md): Virtual War (aka VWar) 1.6.1 R2 uses static session cookies that depend only on a user's password, which makes it easier for remote attacker (no CVSS)
- [CVE-2010-5279](https://cve.now/CVE-2010-5279.md): article.php in Virtual War (aka VWar) 1.6.1 R2 allows remote attackers to cause a denial of service (memory consumption) via a large integer (no CVSS)
- [CVE-2011-4638](https://cve.now/CVE-2011-4638.md): Multiple SQL injection vulnerabilities in SpamTitan WebTitan before 3.60 allow remote attackers to execute arbitrary SQL commands via (1) th (no CVSS)
- [CVE-2011-4639](https://cve.now/CVE-2011-4639.md): The (1) Traceroute and (2) Ping implementations in tools.php in SpamTitan WebTitan before 3.60 allow remote authenticated users to execute a (no CVSS)
- [CVE-2011-4640](https://cve.now/CVE-2011-4640.md): Directory traversal vulnerability in logs-x.php in SpamTitan WebTitan before 3.60 allows remote authenticated users to read arbitrary files (no CVSS)
- [CVE-2012-4824](https://cve.now/CVE-2012-4824.md): Open redirect vulnerability in servlet/traveler in IBM Lotus Notes Traveler 8.5.3 before 8.5.3.3 Interim Fix 1 allows remote attackers to re (no CVSS)
- [CVE-2012-4825](https://cve.now/CVE-2012-4825.md): Multiple cross-site scripting (XSS) vulnerabilities in servlet/traveler/ILNT.mobileconfig in IBM Lotus Notes Traveler before 8.5.3.2 allow r (no CVSS)
- [CVE-2012-5307](https://cve.now/CVE-2012-5307.md): Cross-site scripting (XSS) vulnerability in servlet/traveler in IBM Lotus Notes Traveler before 8.5.3.3 Interim Fix 1, when Firefox is used, (no CVSS)
- [CVE-2012-5308](https://cve.now/CVE-2012-5308.md): Cross-site request forgery (CSRF) vulnerability in servlet/traveler in IBM Lotus Notes Traveler through 8.5.3.3 Interim Fix 1 allows remote (no CVSS)
- [CVE-2012-5309](https://cve.now/CVE-2012-5309.md): servlet/traveler in IBM Lotus Notes Traveler through 8.5.3.3 Interim Fix 1 does not properly restrict invalid authentication attempts, which (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2012-10-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.