# CVEs published 2012-10-22

33 CVEs were published on October 22, 2012: 0 critical, 0 high. Days are UTC.

- [CVE-2010-4821](https://cve.now/CVE-2010-4821.md): Cross-site scripting (XSS) vulnerability in phpMyFAQ before 2.6.9 allows remote attackers to inject arbitrary web script or HTML via the PAT (no CVSS)
- [CVE-2011-4129](https://cve.now/CVE-2011-4129.md): (1) services/twitter/twitter-contact-view.c and (2) services/twitter/twitter-item-view.c in libsocialweb before 0.25.20 automatically connec (no CVSS)
- [CVE-2011-5211](https://cve.now/CVE-2011-5211.md): Cross-site scripting (XSS) vulnerability in the poll module in Subrion CMS 2.0.4 allows remote attackers to inject arbitrary web script or H (no CVSS)
- [CVE-2011-5212](https://cve.now/CVE-2011-5212.md): SQL injection vulnerability in admin/index.php in Subrion CMS 2.0.4 allows remote attackers to execute arbitrary SQL commands via the (1) us (no CVSS)
- [CVE-2012-1154](https://cve.now/CVE-2012-1154.md): mod\_cluster 1.0.10 before 1.0.10 CP03 and 1.1.x before 1.1.4, as used in JBoss Enterprise Application Platform 5.1.2, when "ROOT" is set to (no CVSS, org.jboss.mod\_cluster:mod\_cluster)
- [CVE-2012-1900](https://cve.now/CVE-2012-1900.md): Cross-site request forgery (CSRF) vulnerability in admin/index.php in RazorCMS 1.2.1 and earlier allows remote attackers to hijack the authe (no CVSS)
- [CVE-2012-2679](https://cve.now/CVE-2012-2679.md): Red Hat Network (RHN) Configuration Client (rhncfg-client) in rhncfg before 5.10.27-8 uses weak permissions (world-readable) for /var/log/rh (no CVSS)
- [CVE-2012-3466](https://cve.now/CVE-2012-3466.md): GNOME gnome-keyring 3.4.0 through 3.4.1, when gpg-cache-method is set to "idle" or "timeout," does not properly limit the amount of time a p (no CVSS)
- [CVE-2012-4231](https://cve.now/CVE-2012-4231.md): Cross-site scripting (XSS) vulnerability in admin/index.php in jCore before 1.0pre2 allows remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2012-4232](https://cve.now/CVE-2012-4232.md): SQL injection vulnerability in admin/index.php in jCore before 1.0pre2 allows remote attackers to execute arbitrary SQL commands via the mem (no CVSS)
- [CVE-2012-4406](https://cve.now/CVE-2012-4406.md): OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata (no CVSS, swift)
- [CVE-2012-4435](https://cve.now/CVE-2012-4435.md): fwknop before 2.0.3 does not properly validate IP addresses, which allows remote authenticated users to cause a denial of service (server cr (no CVSS)
- [CVE-2012-4436](https://cve.now/CVE-2012-4436.md): Buffer overflow in the run\_last\_args function in client/fwknop.c in fwknop before 2.0.3, when processing --last, might allow local users to (no CVSS)
- [CVE-2012-4506](https://cve.now/CVE-2012-4506.md): Directory traversal vulnerability in gitolite 3.x before 3.1, when wild card repositories and a pattern matching "../" are enabled, allows r (no CVSS)
- [CVE-2012-4507](https://cve.now/CVE-2012-4507.md): The strchr function in procmime.c in Claws Mail (aka claws-mail) 3.8.1 allows remote attackers to cause a denial of service (NULL pointer de (no CVSS)
- [CVE-2012-4511](https://cve.now/CVE-2012-4511.md): services/flickr/flickr.c in libsocialweb before 0.25.21 automatically connects to Flickr when no Flickr account is set, which might allow re (no CVSS)
- [CVE-2012-4516](https://cve.now/CVE-2012-4516.md): librdmacm 1.0.16, when ibacm.port is not specified, connects to port 6125, which allows remote attackers to specify the address resolution i (no CVSS)
- [CVE-2012-4517](https://cve.now/CVE-2012-4517.md): ibacm before 1.0.6 does not properly manage reference counts for multicast connections, which allows remote attackers to cause a denial of s (no CVSS)
- [CVE-2012-4518](https://cve.now/CVE-2012-4518.md): ibacm 1.0.7 creates files with world-writable permissions, which allows local users to overwrite the ib\_acm daemon log or ibacm.port file. (no CVSS)
- [CVE-2012-4771](https://cve.now/CVE-2012-4771.md): Multiple cross-site scripting (XSS) vulnerabilities in Subrion CMS before 2.2.3 allow remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2012-4772](https://cve.now/CVE-2012-4772.md): SQL injection vulnerability in register/ in Subrion CMS before 2.2.3 allows remote attackers to execute arbitrary SQL commands via the plan\_ (no CVSS)
- [CVE-2012-4773](https://cve.now/CVE-2012-4773.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Subrion CMS before 2.2.3 allow remote attackers to hijack the authentication o (no CVSS)
- [CVE-2012-4989](https://cve.now/CVE-2012-4989.md): Cross-site scripting (XSS) vulnerability in admin/plugin-index.php in OpenX 2.8.10 before revision 81823 allows remote attackers to inject a (no CVSS)
- [CVE-2012-4990](https://cve.now/CVE-2012-4990.md): SQL injection vulnerability in admin/campaign-zone-link.php in OpenX 2.8.10 before revision 81823 allows remote attackers to execute arbitra (no CVSS)
- [CVE-2012-5167](https://cve.now/CVE-2012-5167.md): Multiple SQL injection vulnerabilities in ATutor AContent before 1.2-1 allow remote attackers to execute arbitrary SQL commands via the (1) (no CVSS)
- [CVE-2012-5168](https://cve.now/CVE-2012-5168.md): ATutor AContent before 1.2-1 allows remote attackers to modify arbitrary user passwords or category names via a direct request to (1) user/i (no CVSS)
- [CVE-2012-5169](https://cve.now/CVE-2012-5169.md): Multiple cross-site scripting (XSS) vulnerabilities in file\_manager/preview\_top.php in ATutor AContent before 1.2-2 allow remote attackers t (no CVSS)
- [CVE-2012-5452](https://cve.now/CVE-2012-5452.md): Multiple cross-site scripting (XSS) vulnerabilities in Subrion CMS 2.2.1 allow remote attackers to inject arbitrary web script or HTML via t (no CVSS)
- [CVE-2012-5453](https://cve.now/CVE-2012-5453.md): SQL injection vulnerability in user/index\_inline\_editor\_submit.php in ATutor AContent 1.2-1 allows remote authenticated users to execute arb (no CVSS)
- [CVE-2012-5454](https://cve.now/CVE-2012-5454.md): user/index\_inline\_editor\_submit.php in ATutor AContent 1.2-1 does not properly restrict access, which allows remote authenticated users to m (no CVSS)
- [CVE-2012-5455](https://cve.now/CVE-2012-5455.md): Cross-site scripting (XSS) vulnerability in the language search component in Joomla! before 3.0.1 allows remote attackers to inject arbitrar (no CVSS)
- [CVE-2012-3001](https://cve.now/CVE-2012-3001.md): Mutiny Standard before 4.5-1.12 allows remote attackers to execute arbitrary commands via the network-interface menu, related to a "command (no CVSS)
- [CVE-2012-4751](https://cve.now/CVE-2012-4751.md): Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.15, 3.0.x before 3.0.17, and 3.1.x (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2012-10-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.