CVEs published November 17, 2012
34 CVEs were published on November 17, 2012: 0 critical, 0 high.
- Published
- 34
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 34
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- org.apache.tomcat:tomcat
- 2
- b13/seo_basics
- 1
- in2code/powermail
- 1
- org.apache.tomcat:tomcat-catalina
- 1
- sjbr/sr-feuser-register
- 1
Medium, low and unrated 34
- CVE-2012-5888Cross-site scripting (XSS) vulnerability in Basic SEO Features (seo_basics) extension before 0.8.2 for TYPO3 allows remote attackers to injeb13/seo_basics
- CVE-2012-5889Cross-site scripting (XSS) vulnerability in the powermail extension before 1.6.5 for TYPO3 allows remote attackers to inject arbitrary web sin2code/powermail
- CVE-2012-5890The Front End User Registration (sr_feuser_register) extension before 2.6.2 for TYPO3 allows remote attackers to obtain user names and passwsjbr/sr-feuser-register
- CVE-2012-5891Multiple cross-site request forgery (CSRF) vulnerabilities in photo/pass.php in DAlbum 1.44 build 174 and earlier allow remote attackers to
- CVE-2012-5892Havalite CMS 1.1.0 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attacke
- CVE-2012-5893Unrestricted file upload vulnerability in hava_upload.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitrary cod
- CVE-2012-5894SQL injection vulnerability in hava_post.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitrary SQL commands via
- CVE-2012-5895Multiple unspecified vulnerabilities in iRODS before 3.1 have unknown impact and attack vectors.
- CVE-2012-5896The Annotation Objects Extension ActiveX control in AnnotateX.dll in Quest InTrust 10.4.0.853 and earlier does not properly implement the Ad
- CVE-2012-5897The (1) SimpleTree and (2) ReportTree classes in the ARDoc ActiveX control (ARDoc.dll) in Quest InTrust 10.4.0.853 and earlier do not proper
- CVE-2012-5898Cross-site request forgery (CSRF) vulnerability in SAMEDIA LandShop 0.9.2 allows remote attackers to hijack the authentication of administra
- CVE-2012-5899Cross-site scripting (XSS) vulnerability in admin/action/objects.php in SAMEDIA LandShop 0.9.2 allows remote attackers to inject arbitrary w
- CVE-2012-5900Multiple SQL injection vulnerabilities in SAMEDIA LandShop 0.9.2 allow remote attackers to execute arbitrary SQL commands via the (1) OB_ID
- CVE-2012-5901DFLabs PTK 1.0.5 stores data files with predictable names under the web document root with insufficient access control, which allows remote
- CVE-2012-5902Cross-site scripting (XSS) vulnerability in ptk/lib/modal_bookmark.php in DFLabs PTK 1.0.5 allows remote attackers to inject arbitrary web s
- CVE-2012-5903Cross-site scripting (XSS) vulnerability in Simple Machines Forum (SMF) 2.0.2 allows remote attackers to inject arbitrary web script or HTML
- CVE-2012-5904Heap-based buffer overflow in IrfanView before 4.33 allows remote attackers to execute arbitrary code via a crafted RLE compressed bitmap fi
- CVE-2012-5905Buffer overflow in KnFTPd 1.0.0 allows remote authenticated users to cause a denial of service (crash) via a long string in a FEAT command.
- CVE-2012-5906Multiple cross-site scripting (XSS) vulnerabilities in GreenBrowser 6.1.0117 and 6.1.0216 allow remote attackers to inject arbitrary web scr
- CVE-2012-5907Directory traversal vulnerability in json.php in TomatoCart 1.2.0 Alpha 2 and possibly earlier allows remote attackers to read arbitrary fil
- CVE-2012-5908Cross-site scripting (XSS) vulnerability in admin/modules/user/users.php in MyBB (aka MyBulletinBoard) 1.6.6 allows remote attackers to inje
- CVE-2012-5909SQL injection vulnerability in admin/modules/user/users.php in MyBB (aka MyBulletinBoard) 1.6.6 allows remote attackers to execute arbitrary
- CVE-2012-5910SQL injection vulnerability in blogs/htsrv/viewfile.php in b2evolution 4.1.3 allows remote authenticated users to execute arbitrary SQL comm
- CVE-2012-5911Cross-site scripting (XSS) vulnerability in blogs/blog1.php in b2evolution 4.1.3 allows remote attackers to inject arbitrary web script or H
- CVE-2012-5912Multiple SQL injection vulnerabilities in PicoPublisher 2.0 allow remote attackers to execute arbitrary SQL commands via the id parameter to
- CVE-2012-5913Cross-site scripting (XSS) vulnerability in wp-integrator.php in the WordPress Integrator module 1.32 for WordPress allows remote attackers
- CVE-2012-5914Multiple cross-site scripting (XSS) vulnerabilities in the sed_import function in system/functions.php in Neocrome Seditio build 160 and 161
- CVE-2012-5915Neocrome Seditio build 161 and earlier allows remote attackers to obtain sensitive information via direct request to (1) view.php, (2) plugi
- CVE-2012-5916Neocrome Seditio build 161 allows remote attackers to obtain sensitive information via a direct request to (1) docs/new/seditio-createnew-16
- CVE-2012-5917SnackAmp 3.1.3 allows remote attackers to cause a denial of service (application crash) via a long string in an aiff file.
- CVE-2012-5856Cross-site scripting (XSS) vulnerability in the Uk Cookie (aka uk-cookie) plugin for WordPress allows remote attackers to inject arbitrary w
- CVE-2012-5885The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x beorg.apache.tomcat:tomcat
- CVE-2012-5886The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches iorg.apache.tomcat:tomcat-catalina
- CVE-2012-5887The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does notorg.apache.tomcat:tomcat