# CVEs published 2012-10-25

31 CVEs were published on October 25, 2012: 0 critical, 0 high. Days are UTC.

- [CVE-2011-5213](https://cve.now/CVE-2011-5213.md): Multiple SQL injection vulnerabilities in BrowserCRM 5.100.01 and earlier allow remote attackers to execute arbitrary SQL commands via the ( (no CVSS)
- [CVE-2011-5214](https://cve.now/CVE-2011-5214.md): Multiple cross-site scripting (XSS) vulnerabilities in BrowserCRM 5.100.01 and earlier allow remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2011-5215](https://cve.now/CVE-2011-5215.md): SQL injection vulnerability in index.php in Video Community Portal allows remote attackers to execute arbitrary SQL commands via the id para (no CVSS)
- [CVE-2011-5216](https://cve.now/CVE-2011-5216.md): SQL injection vulnerability in ajax.php in SCORM Cloud For WordPress plugin before 1.0.7 for WordPress allows remote attackers to execute ar (no CVSS)
- [CVE-2011-5217](https://cve.now/CVE-2011-5217.md): Directory traversal vulnerability in the PXE Mtftp service in Hitachi JP1/ServerConductor/DeploymentManager before 08-55 Japanese and before (no CVSS)
- [CVE-2011-5218](https://cve.now/CVE-2011-5218.md): SQL injection vulnerability in DotA OpenStats 1.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the id paramet (no CVSS)
- [CVE-2011-5219](https://cve.now/CVE-2011-5219.md): Directory traversal vulnerability in examples/show\_code.php in mPDF 5.3 and earlier allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2011-5220](https://cve.now/CVE-2011-5220.md): Cross-site scripting (XSS) vulnerability in templates/default/Admin/Login.html in PHP-SCMS 1.6.8 and earlier allows remote attackers to inje (no CVSS)
- [CVE-2011-5221](https://cve.now/CVE-2011-5221.md): Cross-site scripting (XSS) vulnerability in the getLog function in svnlook.php in WebSVN before 2.3.1 allows remote attackers to inject arbi (no CVSS)
- [CVE-2011-5222](https://cve.now/CVE-2011-5222.md): SQL injection vulnerability in rub2\_w.php in PHP Flirt-Projekt 4.8 and possibly earlier allows remote attackers to execute arbitrary SQL com (no CVSS)
- [CVE-2011-5223](https://cve.now/CVE-2011-5223.md): Cross-site request forgery (CSRF) vulnerability in logout.php in Cacti before 0.8.7i allows remote attackers to hijack the authentication of (no CVSS)
- [CVE-2011-5224](https://cve.now/CVE-2011-5224.md): SQL injection vulnerability in the Sentinel plugin 1.0.0 for WordPress allows remote attackers to execute arbitrary SQL commands via unspeci (no CVSS)
- [CVE-2011-5225](https://cve.now/CVE-2011-5225.md): Cross-site scripting (XSS) vulnerability in wordpress\_sentinel.php in the Sentinel plugin 1.0.0 for WordPress allows remote attackers to inj (no CVSS)
- [CVE-2011-5226](https://cve.now/CVE-2011-5226.md): Cross-site request forgery (CSRF) vulnerability in wordpress\_sentinel.php in the Sentinel plugin 1.0.0 for WordPress allows remote attackers (no CVSS)
- [CVE-2011-5227](https://cve.now/CVE-2011-5227.md): Stack-based buffer overflow in the Syslog service (nssyslogd.exe) in Enterasys Network Management Suite (NMS) before 4.1.0.80 allows remote (no CVSS)
- [CVE-2011-5228](https://cve.now/CVE-2011-5228.md): Cross-site scripting (XSS) vulnerability in the Search module (quickstart/search) in appRain CMF 0.1.5 allows remote attackers to inject arb (no CVSS)
- [CVE-2011-5229](https://cve.now/CVE-2011-5229.md): SQL injection vulnerability in quickstart/profile/index.php in the Forum module in appRain CMF 0.1.5 allows remote attackers to execute arbi (no CVSS)
- [CVE-2011-5230](https://cve.now/CVE-2011-5230.md): Multiple SQL injection vulnerabilities in the selectUserIdByLoginPass function in seotoaster\_core/application/models/LoginModel.php in Seoto (no CVSS)
- [CVE-2011-5233](https://cve.now/CVE-2011-5233.md): Heap-based buffer overflow in IrfanView before 4.32 allows remote attackers to execute arbitrary code via crafted "Rows Per Strip" and "Samp (no CVSS)
- [CVE-2011-5234](https://cve.now/CVE-2011-5234.md): SQL injection vulnerability in user.php in Social Network Community 2 allows remote attackers to execute arbitrary SQL commands via the user (no CVSS)
- [CVE-2011-5235](https://cve.now/CVE-2011-5235.md): SQL injection vulnerability in mnoGoSearch before 3.3.12 allows remote attackers to execute arbitrary SQL commands via the hostname in a hyp (no CVSS)
- [CVE-2012-3936](https://cve.now/CVE-2012-3936.md): Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 before LD SP32 EP10 and T28 before T28.4 allows remote attackers to exe (no CVSS)
- [CVE-2012-3937](https://cve.now/CVE-2012-3937.md): Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 before LD SP32 EP10 and T28 before T28.4 allows remote attackers to exe (no CVSS)
- [CVE-2012-3938](https://cve.now/CVE-2012-3938.md): Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 before LD SP32 EP10 and T28 before T28.4 allows remote attackers to exe (no CVSS)
- [CVE-2012-3939](https://cve.now/CVE-2012-3939.md): Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 before LD SP32 EP10 and T28 before T28.4 allows remote attackers to exe (no CVSS)
- [CVE-2012-3940](https://cve.now/CVE-2012-3940.md): Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 before LD SP32 EP10 and T28 before T28.4 allows remote attackers to exe (no CVSS)
- [CVE-2012-3941](https://cve.now/CVE-2012-3941.md): Heap-based buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 before LD SP32 EP10 and T28 before T28.4 allows remote attac (no CVSS)
- [CVE-2012-3506](https://cve.now/CVE-2012-3506.md): Unspecified vulnerability in the Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.03 has unknown impact and attack vectors. (no CVSS)
- [CVE-2012-5339](https://cve.now/CVE-2012-5339.md): Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.3 allow remote authenticated users to inject arbitrary we (no CVSS, phpmyadmin/phpmyadmin)
- [CVE-2012-5368](https://cve.now/CVE-2012-5368.md): phpMyAdmin 3.5.x before 3.5.3 uses JavaScript code that is obtained through an HTTP session to phpmyadmin.net without SSL, which allows man- (no CVSS, phpmyadmin/phpmyadmin)
- [CVE-2012-5672](https://cve.now/CVE-2012-5672.md): Microsoft Excel Viewer (aka Xlview.exe) and Excel in Microsoft Office 2007 (aka Office 12) allow remote attackers to cause a denial of servi (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2012-10-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.