# CVEs published 2012-11-16

15 CVEs were published on November 16, 2012: 0 critical, 0 high. Days are UTC.

- [CVE-2012-2733](https://cve.now/CVE-2012-2733.md): java/org/apache/coyote/http11/InternalNioInputBuffer.java in the HTTP NIO connector in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28 (no CVSS)
- [CVE-2012-5172](https://cve.now/CVE-2012-5172.md): The Asial Monaca Debugger application before 1.4.2 for Android allows remote attackers to obtain sensitive (1) account or (2) session ID inf (no CVSS)
- [CVE-2012-4189](https://cve.now/CVE-2012-4189.md): Cross-site scripting (XSS) vulnerability in Bugzilla 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1, allows remote attacker (no CVSS)
- [CVE-2012-4197](https://cve.now/CVE-2012-4197.md): Bugzilla/Attachment.pm in attachment.cgi in Bugzilla 2.x and 3.x before 3.6.12, 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, (no CVSS)
- [CVE-2012-4198](https://cve.now/CVE-2012-4198.md): The User.get method in Bugzilla/WebService/User.pm in Bugzilla 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4 (no CVSS)
- [CVE-2012-4199](https://cve.now/CVE-2012-4199.md): template/en/default/bug/field-events.js.tmpl in Bugzilla 3.x before 3.6.12, 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and (no CVSS)
- [CVE-2012-5881](https://cve.now/CVE-2012-5881.md): Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.4.0 through 2.9.0 allows remote attackers to inject (no CVSS, yui2)
- [CVE-2012-5882](https://cve.now/CVE-2012-5882.md): Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.5.0 through 2.9.0 allows remote attackers to inject (no CVSS)
- [CVE-2012-5883](https://cve.now/CVE-2012-5883.md): Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.8.0 through 2.9.0, as used in Bugzilla 3.7.x and 4.0 (no CVSS)
- [CVE-2012-5884](https://cve.now/CVE-2012-5884.md): The User.get method in Bugzilla/WebService/User.pm in Bugzilla 4.3.2 allows remote attackers to obtain sensitive information about the saved (no CVSS)
- [CVE-2012-4612](https://cve.now/CVE-2012-4612.md): Cross-site scripting (XSS) vulnerability in EMC RSA Data Protection Manager Appliance and Software Server 2.7.x and 3.x before 3.2.1 allows (no CVSS)
- [CVE-2012-4613](https://cve.now/CVE-2012-4613.md): EMC RSA Data Protection Manager Appliance 2.7.x and 3.x before 3.2.1 does not properly restrict the number of authentication attempts by a u (no CVSS)
- [CVE-2012-5522](https://cve.now/CVE-2012-5522.md): MantisBT before 1.2.12 does not use an expected default value during decisions about whether a user may modify the status of a bug, which al (no CVSS)
- [CVE-2012-5523](https://cve.now/CVE-2012-5523.md): core/email\_api.php in MantisBT before 1.2.12 does not properly manage the sending of e-mail notifications about restricted bugs, which might (no CVSS)
- [CVE-2012-5777](https://cve.now/CVE-2012-5777.md): Eval injection vulnerability in the ReplaceListVars function in the template parser in e/class/connect.php in EmpireCMS 6.6 allows user-assi (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2012-11-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.