# CVEs published 2012-11-14

31 CVEs were published on November 14, 2012: 0 critical, 2 high. Days are UTC.

- [CVE-2012-2619](https://cve.now/CVE-2012-2619.md): The Broadcom BCM4325 and BCM4329 Wi-Fi chips, as used in certain Acer, Apple, Asus, Ford, HTC, Kyocera, LG, Malata, Motorola, Nokia, Pantech (no CVSS)
- [CVE-2012-3330](https://cve.now/CVE-2012-3330.md): The proxy server in IBM WebSphere Application Server 7.0 before 7.0.0.27, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1, and WebSphere Virtual (no CVSS)
- [CVE-2012-3569](https://cve.now/CVE-2012-3569.md): Format string vulnerability in VMware OVF Tool 2.1 on Windows, as used in VMware Workstation 8.x before 8.0.5, VMware Player 4.x before 4.0. (no CVSS)
- [CVE-2012-4847](https://cve.now/CVE-2012-4847.md): IBM Cognos Business Intelligence (BI) 8.4 and 8.4.1 allows remote authenticated users to cause a denial of service (CPU consumption) via a c (no CVSS)
- [CVE-2012-4850](https://cve.now/CVE-2012-4850.md): IBM WebSphere Application Server 8.5 Liberty Profile before 8.5.0.1, when JAX-RS is used, does not properly validate requests, which allows (no CVSS)
- [CVE-2012-4851](https://cve.now/CVE-2012-4851.md): Cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server 8.5 Liberty Profile before 8.5.0.1 allows remote attackers to i (no CVSS)
- [CVE-2012-4853](https://cve.now/CVE-2012-4853.md): Cross-site request forgery (CSRF) vulnerability in IBM WebSphere Application Server 6.1 before 6.1.0.45, 7.0 before 7.0.0.25, 8.0 before 8.0 (no CVSS)
- [CVE-2012-4948](https://cve.now/CVE-2012-4948.md): The default configuration of Fortinet Fortigate UTM appliances uses the same Certification Authority certificate and same private key across (no CVSS)
- [CVE-2012-4949](https://cve.now/CVE-2012-4949.md): SQL injection vulnerability in ESRI ArcGIS 10.1 allows remote authenticated users to execute arbitrary SQL commands via the where parameter (no CVSS)
- [CVE-2012-4953](https://cve.now/CVE-2012-4953.md): The decomposer engine in Symantec Endpoint Protection (SEP) 11.0, Symantec Endpoint Protection Small Business Edition 12.0, Symantec AntiVir (no CVSS)
- [CVE-2012-5458](https://cve.now/CVE-2012-5458.md): VMware Workstation 8.x before 8.0.5 and VMware Player 4.x before 4.0.5 on Windows use weak permissions for unspecified process threads, whic (no CVSS)
- [CVE-2012-5459](https://cve.now/CVE-2012-5459.md): Untrusted search path vulnerability in VMware Workstation 8.x before 8.0.5 and VMware Player 4.x before 4.0.5 on Windows allows host OS user (no CVSS)
- [CVE-2012-5860](https://cve.now/CVE-2012-5860.md): Unspecified vulnerability on Oberthur ID-One COSMO 5.2, 5.2a, and 64 smart cards makes it easier for attackers to defeat cryptographic prote (no CVSS)
- [CVE-2012-1527](https://cve.now/CVE-2012-1527.md): Integer underflow in Windows Shell in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, (no CVSS)
- [CVE-2012-1528](https://cve.now/CVE-2012-1528.md): Integer overflow in Windows Shell in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, (no CVSS)
- [CVE-2012-1538](https://cve.now/CVE-2012-1538.md): Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site, aka (no CVSS)
- [CVE-2012-1539](https://cve.now/CVE-2012-1539.md): Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site, aka (CVSS 8.1)
- [CVE-2012-1885](https://cve.now/CVE-2012-1885.md): Heap-based buffer overflow in Microsoft Excel 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Office 2008 and 2011 for Mac; and Office Compatibili (no CVSS)
- [CVE-2012-1886](https://cve.now/CVE-2012-1886.md): Microsoft Excel 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Excel Viewer; and Office Compatibility Pack SP2 and SP3 allow remote attackers to (no CVSS)
- [CVE-2012-1887](https://cve.now/CVE-2012-1887.md): Use-after-free vulnerability in Microsoft Excel 2003 SP3, 2007 SP2 and SP3, and 2010 SP1, and Office 2008 and 2011 for Mac, allows remote at (no CVSS)
- [CVE-2012-1895](https://cve.now/CVE-2012-1895.md): The reflection implementation in Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5.1, and 4 does not properly enforce object permissio (no CVSS)
- [CVE-2012-1896](https://cve.now/CVE-2012-1896.md): Microsoft .NET Framework 2.0 SP2 and 3.5.1 does not properly consider trust levels during construction of output data, which allows remote a (no CVSS)
- [CVE-2012-2519](https://cve.now/CVE-2012-2519.md): Untrusted search path vulnerability in Entity Framework in ADO.NET in Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, and 4 (no CVSS)
- [CVE-2012-2530](https://cve.now/CVE-2012-2530.md): Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows (no CVSS)
- [CVE-2012-2531](https://cve.now/CVE-2012-2531.md): Microsoft Internet Information Services (IIS) 7.5 uses weak permissions for the Operational log, which allows local users to discover creden (no CVSS)
- [CVE-2012-2532](https://cve.now/CVE-2012-2532.md): Microsoft FTP Service 7.0 and 7.5 for Internet Information Services (IIS) processes unspecified commands before TLS is enabled for a session (no CVSS)
- [CVE-2012-2543](https://cve.now/CVE-2012-2543.md): Stack-based buffer overflow in Microsoft Excel 2007 SP2 and SP3 and 2010 SP1; Office 2011 for Mac; Excel Viewer; and Office Compatibility Pa (no CVSS)
- [CVE-2012-2553](https://cve.now/CVE-2012-2553.md): Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP3, Windows Server 2003 SP2, Windows Vista SP (no CVSS)
- [CVE-2012-4775](https://cve.now/CVE-2012-4775.md): Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site, aka (CVSS 8.8)
- [CVE-2012-4776](https://cve.now/CVE-2012-4776.md): The Web Proxy Auto-Discovery (WPAD) functionality in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not validate configuratio (no CVSS)
- [CVE-2012-4777](https://cve.now/CVE-2012-4777.md): The code-optimization feature in the reflection implementation in Microsoft .NET Framework 4 and 4.5 does not properly enforce object permis (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2012-11-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.