# CVEs published 2012-11-17

34 CVEs were published on November 17, 2012: 0 critical, 0 high. Days are UTC.

- [CVE-2012-5888](https://cve.now/CVE-2012-5888.md): Cross-site scripting (XSS) vulnerability in Basic SEO Features (seo\_basics) extension before 0.8.2 for TYPO3 allows remote attackers to inje (no CVSS, b13/seo\_basics)
- [CVE-2012-5889](https://cve.now/CVE-2012-5889.md): Cross-site scripting (XSS) vulnerability in the powermail extension before 1.6.5 for TYPO3 allows remote attackers to inject arbitrary web s (no CVSS, in2code/powermail)
- [CVE-2012-5890](https://cve.now/CVE-2012-5890.md): The Front End User Registration (sr\_feuser\_register) extension before 2.6.2 for TYPO3 allows remote attackers to obtain user names and passw (no CVSS, sjbr/sr-feuser-register)
- [CVE-2012-5891](https://cve.now/CVE-2012-5891.md): Multiple cross-site request forgery (CSRF) vulnerabilities in photo/pass.php in DAlbum 1.44 build 174 and earlier allow remote attackers to (no CVSS)
- [CVE-2012-5892](https://cve.now/CVE-2012-5892.md): Havalite CMS 1.1.0 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attacke (no CVSS)
- [CVE-2012-5893](https://cve.now/CVE-2012-5893.md): Unrestricted file upload vulnerability in hava\_upload.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitrary cod (no CVSS)
- [CVE-2012-5894](https://cve.now/CVE-2012-5894.md): SQL injection vulnerability in hava\_post.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2012-5895](https://cve.now/CVE-2012-5895.md): Multiple unspecified vulnerabilities in iRODS before 3.1 have unknown impact and attack vectors. (no CVSS)
- [CVE-2012-5896](https://cve.now/CVE-2012-5896.md): The Annotation Objects Extension ActiveX control in AnnotateX.dll in Quest InTrust 10.4.0.853 and earlier does not properly implement the Ad (no CVSS)
- [CVE-2012-5897](https://cve.now/CVE-2012-5897.md): The (1) SimpleTree and (2) ReportTree classes in the ARDoc ActiveX control (ARDoc.dll) in Quest InTrust 10.4.0.853 and earlier do not proper (no CVSS)
- [CVE-2012-5898](https://cve.now/CVE-2012-5898.md): Cross-site request forgery (CSRF) vulnerability in SAMEDIA LandShop 0.9.2 allows remote attackers to hijack the authentication of administra (no CVSS)
- [CVE-2012-5899](https://cve.now/CVE-2012-5899.md): Cross-site scripting (XSS) vulnerability in admin/action/objects.php in SAMEDIA LandShop 0.9.2 allows remote attackers to inject arbitrary w (no CVSS)
- [CVE-2012-5900](https://cve.now/CVE-2012-5900.md): Multiple SQL injection vulnerabilities in SAMEDIA LandShop 0.9.2 allow remote attackers to execute arbitrary SQL commands via the (1) OB\_ID (no CVSS)
- [CVE-2012-5901](https://cve.now/CVE-2012-5901.md): DFLabs PTK 1.0.5 stores data files with predictable names under the web document root with insufficient access control, which allows remote (no CVSS)
- [CVE-2012-5902](https://cve.now/CVE-2012-5902.md): Cross-site scripting (XSS) vulnerability in ptk/lib/modal\_bookmark.php in DFLabs PTK 1.0.5 allows remote attackers to inject arbitrary web s (no CVSS)
- [CVE-2012-5903](https://cve.now/CVE-2012-5903.md): Cross-site scripting (XSS) vulnerability in Simple Machines Forum (SMF) 2.0.2 allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2012-5904](https://cve.now/CVE-2012-5904.md): Heap-based buffer overflow in IrfanView before 4.33 allows remote attackers to execute arbitrary code via a crafted RLE compressed bitmap fi (no CVSS)
- [CVE-2012-5905](https://cve.now/CVE-2012-5905.md): Buffer overflow in KnFTPd 1.0.0 allows remote authenticated users to cause a denial of service (crash) via a long string in a FEAT command. (no CVSS)
- [CVE-2012-5906](https://cve.now/CVE-2012-5906.md): Multiple cross-site scripting (XSS) vulnerabilities in GreenBrowser 6.1.0117 and 6.1.0216 allow remote attackers to inject arbitrary web scr (no CVSS)
- [CVE-2012-5907](https://cve.now/CVE-2012-5907.md): Directory traversal vulnerability in json.php in TomatoCart 1.2.0 Alpha 2 and possibly earlier allows remote attackers to read arbitrary fil (no CVSS)
- [CVE-2012-5908](https://cve.now/CVE-2012-5908.md): Cross-site scripting (XSS) vulnerability in admin/modules/user/users.php in MyBB (aka MyBulletinBoard) 1.6.6 allows remote attackers to inje (no CVSS)
- [CVE-2012-5909](https://cve.now/CVE-2012-5909.md): SQL injection vulnerability in admin/modules/user/users.php in MyBB (aka MyBulletinBoard) 1.6.6 allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2012-5910](https://cve.now/CVE-2012-5910.md): SQL injection vulnerability in blogs/htsrv/viewfile.php in b2evolution 4.1.3 allows remote authenticated users to execute arbitrary SQL comm (no CVSS)
- [CVE-2012-5911](https://cve.now/CVE-2012-5911.md): Cross-site scripting (XSS) vulnerability in blogs/blog1.php in b2evolution 4.1.3 allows remote attackers to inject arbitrary web script or H (no CVSS)
- [CVE-2012-5912](https://cve.now/CVE-2012-5912.md): Multiple SQL injection vulnerabilities in PicoPublisher 2.0 allow remote attackers to execute arbitrary SQL commands via the id parameter to (no CVSS)
- [CVE-2012-5913](https://cve.now/CVE-2012-5913.md): Cross-site scripting (XSS) vulnerability in wp-integrator.php in the WordPress Integrator module 1.32 for WordPress allows remote attackers (no CVSS)
- [CVE-2012-5914](https://cve.now/CVE-2012-5914.md): Multiple cross-site scripting (XSS) vulnerabilities in the sed\_import function in system/functions.php in Neocrome Seditio build 160 and 161 (no CVSS)
- [CVE-2012-5915](https://cve.now/CVE-2012-5915.md): Neocrome Seditio build 161 and earlier allows remote attackers to obtain sensitive information via direct request to (1) view.php, (2) plugi (no CVSS)
- [CVE-2012-5916](https://cve.now/CVE-2012-5916.md): Neocrome Seditio build 161 allows remote attackers to obtain sensitive information via a direct request to (1) docs/new/seditio-createnew-16 (no CVSS)
- [CVE-2012-5917](https://cve.now/CVE-2012-5917.md): SnackAmp 3.1.3 allows remote attackers to cause a denial of service (application crash) via a long string in an aiff file. (no CVSS)
- [CVE-2012-5856](https://cve.now/CVE-2012-5856.md): Cross-site scripting (XSS) vulnerability in the Uk Cookie (aka uk-cookie) plugin for WordPress allows remote attackers to inject arbitrary w (no CVSS)
- [CVE-2012-5885](https://cve.now/CVE-2012-5885.md): The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x be (no CVSS, org.apache.tomcat:tomcat)
- [CVE-2012-5886](https://cve.now/CVE-2012-5886.md): The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches i (no CVSS, org.apache.tomcat:tomcat-catalina)
- [CVE-2012-5887](https://cve.now/CVE-2012-5887.md): The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not (no CVSS, org.apache.tomcat:tomcat)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2012-11-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.