# CVEs published 2012-11-11 19 CVEs were published on November 11, 2012: 0 critical, 0 high. Days are UTC. - [CVE-2012-3523](https://cve.now/CVE-2012-3523.md): The STARTTLS implementation in nnrpd in INN before 2.5.3 does not properly restrict I/O buffering, which allows man-in-the-middle attackers (no CVSS) - [CVE-2012-4504](https://cve.now/CVE-2012-4504.md): Stack-based buffer overflow in the url::get\_pac function in url.cpp in libproxy 0.4.x before 0.4.9 allows remote servers to have an unspecif (no CVSS) - [CVE-2012-4505](https://cve.now/CVE-2012-4505.md): Heap-based buffer overflow in the px\_pac\_reload function in lib/pac.c in libproxy 0.2.x and 0.3.x allows remote servers to have an unspecifi (no CVSS) - [CVE-2012-4513](https://cve.now/CVE-2012-4513.md): khtml/imload/scaledimageplane.h in Konqueror in KDE 4.7.3 allows remote attackers to cause a denial of service (crash) and possibly read mem (no CVSS) - [CVE-2012-4514](https://cve.now/CVE-2012-4514.md): rendering/render\_replaced.cpp in Konqueror in KDE before 4.9.3 allows remote attackers to cause a denial of service (NULL pointer dereferenc (no CVSS) - [CVE-2012-4515](https://cve.now/CVE-2012-4515.md): Use-after-free vulnerability in khtml/rendering/render\_replaced.cpp in Konqueror in KDE 4.7.3, when the context menu is shown, allows remote (no CVSS) - [CVE-2012-4540](https://cve.now/CVE-2012-4540.md): Off-by-one error in the invoke function in IcedTeaScriptablePluginObject.cc in IcedTea-Web 1.1.x before 1.1.7, 1.2.x before 1.2.2, 1.3.x bef (no CVSS) - [CVE-2012-4548](https://cve.now/CVE-2012-4548.md): Argument injection vulnerability in syntax-highlighting.sh in cgit 9.0.3 and earlier allows remote authenticated users with permissions to a (no CVSS) - [CVE-2012-4553](https://cve.now/CVE-2012-4553.md): Drupal 7.x before 7.16 allows remote attackers to obtain sensitive information and possibly re-install Drupal and execute arbitrary PHP code (no CVSS) - [CVE-2012-4554](https://cve.now/CVE-2012-4554.md): The OpenID module in Drupal 7.x before 7.16 allows remote OpenID servers to read arbitrary files via a crafted DOCTYPE declaration in an XRD (no CVSS) - [CVE-2012-4564](https://cve.now/CVE-2012-4564.md): ppm2tiff does not check the return value of the TIFFScanlineSize function, which allows remote attackers to cause a denial of service (crash (no CVSS) - [CVE-2012-4573](https://cve.now/CVE-2012-4573.md): The v1 API in OpenStack Glance Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to delete arbitrary non-protec (no CVSS, glance) - [CVE-2012-4730](https://cve.now/CVE-2012-4730.md): Request Tracker (RT) 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote authenticated users with ModifySelf or AdminUser privileges to (no CVSS) - [CVE-2012-4731](https://cve.now/CVE-2012-4731.md): FAQ manager for Request Tracker (RTFM) before 2.4.5 does not properly check user rights, which allows remote authenticated users to create a (no CVSS) - [CVE-2012-4732](https://cve.now/CVE-2012-4732.md): Cross-site request forgery (CSRF) vulnerability in Request Tracker (RT) 3.8.12 and other versions before 3.8.15, and 4.0.6 and other version (no CVSS) - [CVE-2012-4734](https://cve.now/CVE-2012-4734.md): Request Tracker (RT) 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote attackers to conduct a "confused deputy" attack to bypass the (no CVSS) - [CVE-2012-4884](https://cve.now/CVE-2012-4884.md): Argument injection vulnerability in Request Tracker (RT) 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote attackers to create arbitr (no CVSS) - [CVE-2012-5482](https://cve.now/CVE-2012-5482.md): The v2 API in OpenStack Glance Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to delete arbitrary non-protec (no CVSS, glance) - [CVE-2012-5827](https://cve.now/CVE-2012-5827.md): Joomla! 2.5.x before 2.5.8 and 3.0.x before 3.0.2 allows remote attackers to conduct clickjacking attacks via unspecified vectors involving (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2012-11-11 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.