# CVEs published 2012-11-23

36 CVEs were published on November 23, 2012: 0 critical, 0 high. Days are UTC.

- [CVE-2011-1096](https://cve.now/CVE-2011-1096.md): The W3C XML Encryption Standard, as used in the JBoss Web Services (JBossWS) component in JBoss Enterprise Portal Platform before 5.2.2 and (no CVSS)
- [CVE-2011-2908](https://cve.now/CVE-2011-2908.md): Cross-site request forgery (CSRF) vulnerability in the JMX Console (jmx-console) in JBoss Enterprise Portal Platform before 5.2.2, BRMS Plat (no CVSS)
- [CVE-2011-4085](https://cve.now/CVE-2011-4085.md): The servlets invoked by httpha-invoker in JBoss Enterprise Application Platform before 5.1.2, SOA Platform before 5.2.0, BRMS Platform befor (no CVSS)
- [CVE-2011-4605](https://cve.now/CVE-2011-4605.md): The (1) JNDI service, (2) HA-JNDI service, and (3) HAJNDIFactory invoker servlet in JBoss Enterprise Application Platform 4.3.0 CP10 and 5.1 (no CVSS)
- [CVE-2011-5245](https://cve.now/CVE-2011-5245.md): The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an (no CVSS, org.jboss.resteasy:resteasy-jaxb-provider)
- [CVE-2012-0818](https://cve.now/CVE-2012-0818.md): RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DOM document, aka an XML externa (no CVSS, org.jboss.resteasy:resteasy-client)
- [CVE-2012-1167](https://cve.now/CVE-2012-1167.md): The JBoss Server in JBoss Enterprise Application Platform 5.1.x before 5.1.2 and 5.2.x before 5.2.2, Web Platform before 5.1.2, BRMS Platfor (no CVSS)
- [CVE-2012-2086](https://cve.now/CVE-2012-2086.md): SQL injection vulnerability in the get\_last\_conversation\_lines function in common/logger.py in Gajim before 0.15 allows remote attackers to (no CVSS)
- [CVE-2012-2377](https://cve.now/CVE-2012-2377.md): JGroups diagnostics service in JBoss Enterprise Portal Platform before 5.2.2, SOA Platform before 5.3.0, and BRMS Platform before 5.3.0, is (no CVSS)
- [CVE-2012-3431](https://cve.now/CVE-2012-3431.md): The Teiid Java Database Connectivity (JDBC) socket, as used in JBoss Enterprise Data Services Platform before 5.3.0, does not encrypt login (no CVSS)
- [CVE-2012-3494](https://cve.now/CVE-2012-3494.md): The set\_debugreg hypercall in include/asm-x86/debugreg.h in Xen 4.0, 4.1, and 4.2, and Citrix XenServer 6.0.2 and earlier, when running on x (no CVSS)
- [CVE-2012-3495](https://cve.now/CVE-2012-3495.md): The physdev\_get\_free\_pirq hypercall in arch/x86/physdev.c in Xen 4.1.x and Citrix XenServer 6.0.2 and earlier uses the return value of the g (no CVSS)
- [CVE-2012-3496](https://cve.now/CVE-2012-3496.md): XENMEM\_populate\_physmap in Xen 4.0, 4.1, and 4.2, and Citrix XenServer 6.0.2 and earlier, when translating paging mode is not used, allows l (no CVSS)
- [CVE-2012-3497](https://cve.now/CVE-2012-3497.md): (1) TMEMC\_SAVE\_GET\_CLIENT\_WEIGHT, (2) TMEMC\_SAVE\_GET\_CLIENT\_CAP, (3) TMEMC\_SAVE\_GET\_CLIENT\_FLAGS and (4) TMEMC\_SAVE\_END in the Transcendent (no CVSS)
- [CVE-2012-3498](https://cve.now/CVE-2012-3498.md): PHYSDEVOP\_map\_pirq in Xen 4.1 and 4.2 and Citrix XenServer 6.0.2 and earlier allows local HVM guest OS kernels to cause a denial of service (no CVSS)
- [CVE-2012-3515](https://cve.now/CVE-2012-3515.md): Qemu, as used in Xen 4.0, 4.1 and possibly other products, when emulating certain devices with a virtual console backend, allows local OS gu (no CVSS)
- [CVE-2012-3516](https://cve.now/CVE-2012-3516.md): The GNTTABOP\_swap\_grant\_ref sub-operation in the grant table hypercall in Xen 4.2 and Citrix XenServer 6.0.2 allows local guest kernels or a (no CVSS)
- [CVE-2012-4411](https://cve.now/CVE-2012-4411.md): The graphical console in Xen 4.0, 4.1 and 4.2 allows local OS guest administrators to obtain sensitive host resource information via the qem (no CVSS)
- [CVE-2012-4601](https://cve.now/CVE-2012-4601.md): Multiple SQL injection vulnerabilities in Nicola Asuni TCExam before 11.3.009 allow remote authenticated users with level 5 or greater permi (no CVSS)
- [CVE-2012-4602](https://cve.now/CVE-2012-4602.md): Multiple cross-site scripting (XSS) vulnerabilities in admin/code/tce\_select\_users\_popup.php in Nicola Asuni TCExam before 11.3.009 allow re (no CVSS)
- [CVE-2012-6030](https://cve.now/CVE-2012-6030.md): The do\_tmem\_op function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service ( (no CVSS)
- [CVE-2012-6031](https://cve.now/CVE-2012-6031.md): The do\_tmem\_get function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service (no CVSS)
- [CVE-2012-6032](https://cve.now/CVE-2012-6032.md): Multiple integer overflows in the (1) tmh\_copy\_from\_client and (2) tmh\_copy\_to\_client functions in the Transcendent Memory (TMEM) in Xen 4.0 (no CVSS)
- [CVE-2012-6033](https://cve.now/CVE-2012-6033.md): The do\_tmem\_control function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 does not properly check privileges, which allows loc (no CVSS)
- [CVE-2012-6034](https://cve.now/CVE-2012-6034.md): The (1) tmemc\_save\_get\_next\_page and (2) tmemc\_save\_get\_next\_inv functions and the (3) TMEMC\_SAVE\_GET\_POOL\_UUID sub-operation in the Transce (no CVSS)
- [CVE-2012-6035](https://cve.now/CVE-2012-6035.md): The do\_tmem\_destroy\_pool function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 does not properly validate pool ids, which allo (no CVSS)
- [CVE-2012-6036](https://cve.now/CVE-2012-6036.md): The (1) memc\_save\_get\_next\_page, (2) tmemc\_restore\_put\_page and (3) tmemc\_restore\_flush\_page functions in the Transcendent Memory (TMEM) in (no CVSS)
- [CVE-2010-1330](https://cve.now/CVE-2010-1330.md): The regular expression engine in JRuby before 1.4.1, when $KCODE is set to 'u', does not properly handle characters immediately after a UTF- (no CVSS, org.jruby:jruby-core)
- [CVE-2012-5173](https://cve.now/CVE-2012-5173.md): Session fixation vulnerability in BIGACE before 2.7.8 allows remote attackers to hijack web sessions via unspecified vectors. (no CVSS)
- [CVE-2012-5756](https://cve.now/CVE-2012-5756.md): The IBM WebSphere DataPower XC10 Appliance 2.0.0.0 through 2.0.0.3 and 2.1.0.0 through 2.1.0.2, when a collective configuration is enabled, (no CVSS)
- [CVE-2012-5758](https://cve.now/CVE-2012-5758.md): The IBM WebSphere DataPower XC10 Appliance 2.0.0.0 through 2.0.0.3 and 2.1.0.0 through 2.1.0.2 does not require authentication for an unspec (no CVSS)
- [CVE-2012-5759](https://cve.now/CVE-2012-5759.md): The IBM WebSphere DataPower XC10 Appliance 2.0.0.0 through 2.0.0.3 and 2.1.0.0 through 2.1.0.2 allows remote authenticated users to bypass i (no CVSS)
- [CVE-2012-5861](https://cve.now/CVE-2012-5861.md): Sinapsi eSolar SQL Injection (no CVSS, Sinapsi eSolar)
- [CVE-2012-5862](https://cve.now/CVE-2012-5862.md): Sinapsi eSolar Hard-Coded Password (no CVSS, Sinapsi eSolar)
- [CVE-2012-5863](https://cve.now/CVE-2012-5863.md): Sinapsi eSolar OS Command Injection (no CVSS, Sinapsi eSolar)
- [CVE-2012-5864](https://cve.now/CVE-2012-5864.md): Sinapsi eSolar Improper Authentication (no CVSS, Sinapsi eSolar)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2012-11-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.