# CVEs published 2012-11-30 26 CVEs were published on November 30, 2012: 0 critical, 0 high. Days are UTC. - [CVE-2012-4468](https://cve.now/CVE-2012-4468.md): Cross-site scripting (XSS) vulnerability in the Privatemsg module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to inject arbitr (no CVSS) - [CVE-2012-4469](https://cve.now/CVE-2012-4469.md): Cross-site scripting (XSS) vulnerability in the Hashcash module 6.x-2.x before 6.x-2.6 and 7.x-2.x before 7.x-2.2 for Drupal, when "Log fail (no CVSS) - [CVE-2012-4470](https://cve.now/CVE-2012-4470.md): The Listhandler module 6.x-1.x before 6.x-1.1 for Drupal does not properly check permissions when importing emails, which allows remote comm (no CVSS) - [CVE-2012-4471](https://cve.now/CVE-2012-4471.md): The Search Autocomplete module 7.x-2.x before 7.x-2.4 for Drupal does not properly restrict access to the module admin page, which allows re (no CVSS) - [CVE-2012-4472](https://cve.now/CVE-2012-4472.md): Unrestricted file upload vulnerability in upload.php in the Drag & Drop Gallery module 6.x-1.5 and earlier for Drupal allows remote attacker (no CVSS) - [CVE-2012-4473](https://cve.now/CVE-2012-4473.md): The Restrict node page view module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the "view any node page" or "vie (no CVSS) - [CVE-2012-4474](https://cve.now/CVE-2012-4474.md): Multiple cross-site scripting (XSS) vulnerabilities in the Colorbox Node module 7.x-2.x before 7.x-2.2 for Drupal allow remote attackers to (no CVSS) - [CVE-2012-4475](https://cve.now/CVE-2012-4475.md): The Security Questions module for Drupal 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.1 does not properly restrict access, which allows r (no CVSS) - [CVE-2012-4476](https://cve.now/CVE-2012-4476.md): Cross-site scripting (XSS) vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to inject arbitrary web sc (no CVSS) - [CVE-2012-4477](https://cve.now/CVE-2012-4477.md): Unspecified vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to bypass access restrictions via unknown (no CVSS) - [CVE-2012-4478](https://cve.now/CVE-2012-4478.md): Cross-site request forgery (CSRF) vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to hijack the authe (no CVSS) - [CVE-2012-4479](https://cve.now/CVE-2012-4479.md): SQL injection vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to execute arbitrary SQL commands via u (no CVSS) - [CVE-2012-4551](https://cve.now/CVE-2012-4551.md): Use-after-free vulnerability in libunity-webapps before 2.4.1 allows remote attackers to cause a denial of service (memory corruption and cr (no CVSS) - [CVE-2012-4559](https://cve.now/CVE-2012-4559.md): Multiple double free vulnerabilities in the (1) agent\_sign\_data function in agent.c, (2) channel\_request function in channels.c, (3) ssh\_use (no CVSS) - [CVE-2012-4560](https://cve.now/CVE-2012-4560.md): Multiple buffer overflows in libssh before 0.5.3 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary c (no CVSS) - [CVE-2012-4561](https://cve.now/CVE-2012-4561.md): The (1) publickey\_make\_dss, (2) publickey\_make\_rsa, (3) signature\_from\_string, (4) ssh\_do\_sign, and (5) ssh\_sign\_session\_id functions in key (no CVSS) - [CVE-2012-4562](https://cve.now/CVE-2012-4562.md): Multiple integer overflows in libssh before 0.5.3 allow remote attackers to cause a denial of service (infinite loop or crash) and possibly (no CVSS) - [CVE-2012-4571](https://cve.now/CVE-2012-4571.md): Python Keyring 0.9.1 does not securely initialize the cipher when encrypting passwords for CryptedFileKeyring files, which makes it easier f (no CVSS, keyring) - [CVE-2012-6063](https://cve.now/CVE-2012-6063.md): Double free vulnerability in the sftp\_mkdir function in sftp.c in libssh before 0.5.3 allows remote attackers to cause a denial of service ( (no CVSS) - [CVE-2012-4557](https://cve.now/CVE-2012-4557.md): The mod\_proxy\_ajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker node into an error state upon detection of a long r (no CVSS) - [CVE-2012-4834](https://cve.now/CVE-2012-4834.md): Directory traversal vulnerability in LayerLoader.jsp in the theme component in IBM WebSphere Portal 7.0.0.1 and 7.0.0.2 before CF19 and 8.0 (no CVSS) - [CVE-2012-5568](https://cve.now/CVE-2012-5568.md): Apache Tomcat through 7.0.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated (no CVSS) - [CVE-2012-4220](https://cve.now/CVE-2012-4220.md): diagchar\_core.c in the Qualcomm Innovation Center (QuIC) Diagnostics (aka DIAG) kernel-mode driver for Android 2.3 through 4.2 allows attack (no CVSS) - [CVE-2012-4221](https://cve.now/CVE-2012-4221.md): Integer overflow in diagchar\_core.c in the Qualcomm Innovation Center (QuIC) Diagnostics (aka DIAG) kernel-mode driver for Android 2.3 throu (no CVSS) - [CVE-2012-4222](https://cve.now/CVE-2012-4222.md): drivers/gpu/msm/kgsl.c in the Qualcomm Innovation Center (QuIC) Graphics KGSL kernel-mode driver for Android 2.3 through 4.2 allows attacker (no CVSS) - [CVE-2012-5174](https://cve.now/CVE-2012-5174.md): The KYOCERA AH-K3001V, AH-K3002V, WX300K, WX310K, WX320K, and WX320KR devices allow remote attackers to cause a denial of service (persisten (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2012-11-30 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.