# CVEs published 2012-12-03

38 CVEs were published on December 3, 2012: 0 critical, 0 high. Days are UTC.

- [CVE-2012-0218](https://cve.now/CVE-2012-0218.md): Xen 3.4, 4.0, and 4.1, when the guest OS has not registered a handler for a syscall or sysenter instruction, does not properly clear a flag (no CVSS)
- [CVE-2012-1598](https://cve.now/CVE-2012-1598.md): Joomla! 1.5.x before 1.5.26 has unspecified impact and attack vectors related to "insufficient randomness" and a "password reset vulnerabili (no CVSS)
- [CVE-2012-1599](https://cve.now/CVE-2012-1599.md): Joomla! 1.5.x before 1.5.26 does not properly check permissions, which allows attackers to obtain sensitive "administrative back end informa (no CVSS)
- [CVE-2012-2934](https://cve.now/CVE-2012-2934.md): Xen 4.0, and 4.1, when running a 64-bit PV guest on "older" AMD CPUs, does not properly protect against a certain AMD processor bug, which a (no CVSS)
- [CVE-2012-3432](https://cve.now/CVE-2012-3432.md): The handle\_mmio function in arch/x86/hvm/io.c in the MMIO operations emulator for Xen 3.3 and 4.x, when running an HVM guest, does not prope (no CVSS)
- [CVE-2012-5367](https://cve.now/CVE-2012-5367.md): Multiple SQL injection vulnerabilities in OrangeHRM 2.7.1 RC 1 allow remote authenticated administrators to execute arbitrary SQL commands v (no CVSS)
- [CVE-2012-5450](https://cve.now/CVE-2012-5450.md): Cross-site request forgery (CSRF) vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple (CMSMS) 1.11.2 and earlier all (no CVSS)
- [CVE-2012-5534](https://cve.now/CVE-2012-5534.md): The hook\_process function in the plugin API for WeeChat 0.3.0 through 0.3.9.1 allows remote attackers to execute arbitrary commands via shel (no CVSS)
- [CVE-2012-5537](https://cve.now/CVE-2012-5537.md): The Simplenews Scheduler module 6.x-2.x before 6.x-2.4 for Drupal allows remote authenticated users with the "send scheduled newsletters" pe (no CVSS)
- [CVE-2012-5538](https://cve.now/CVE-2012-5538.md): Cross-site scripting (XSS) vulnerability in the FileField Sources module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.6 for Drupal, when (no CVSS)
- [CVE-2012-5539](https://cve.now/CVE-2012-5539.md): The Organic Groups (OG) module 7.x-1.x before 7.x-1.5 for Drupal does not properly maintain pending group memberships, which allows remote a (no CVSS)
- [CVE-2012-5540](https://cve.now/CVE-2012-5540.md): Multiple cross-site scripting (XSS) vulnerabilities in the Hostip module 6.x-2.x before 6.x-2.2 and 7.x-2.x before 7.x-2.2 for Drupal allow (no CVSS)
- [CVE-2012-5541](https://cve.now/CVE-2012-5541.md): Cross-site scripting (XSS) vulnerability in the Twitter Pull module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.0-rc3 for Drupal allows (no CVSS)
- [CVE-2012-5542](https://cve.now/CVE-2012-5542.md): Cross-site request forgery (CSRF) vulnerability in the Commerce Extra Panes module 7.x-1.x before 7.x-1.1 in Drupal allows remote attackers (no CVSS)
- [CVE-2012-5543](https://cve.now/CVE-2012-5543.md): The Feeds module 7.x-2.x before 7.x-2.0-alpha6 for Drupal, when a field is mapped to the node's author, does not properly check permissions, (no CVSS)
- [CVE-2012-5544](https://cve.now/CVE-2012-5544.md): The Mandrill module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users to obtain password reset links by reading the logs i (no CVSS)
- [CVE-2012-5545](https://cve.now/CVE-2012-5545.md): Multiple cross-site scripting (XSS) vulnerabilities in the ShareThis module 7.x-2.x before 7.x-2.5 for Drupal allow remote authenticated use (no CVSS)
- [CVE-2012-5547](https://cve.now/CVE-2012-5547.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Search API module 7.x-1.x before 7.x-1.3 for Drupal allow remote attackers (no CVSS)
- [CVE-2012-5548](https://cve.now/CVE-2012-5548.md): Cross-site scripting (XSS) vulnerability in the Time Spent module 6.x and 7.x for Drupal allows remote attackers to inject arbitrary web scr (no CVSS)
- [CVE-2012-5549](https://cve.now/CVE-2012-5549.md): Cross-site request forgery (CSRF) vulnerability in the Time Spent module 6.x and 7.x for Drupal allows remote attackers to hijack the authen (no CVSS)
- [CVE-2012-5550](https://cve.now/CVE-2012-5550.md): SQL injection vulnerability in the Time Spent module 6.x and 7.x for Drupal allows remote attackers to execute arbitrary SQL commands via un (no CVSS)
- [CVE-2012-5551](https://cve.now/CVE-2012-5551.md): Multiple cross-site scripting (XSS) vulnerabilities in the MailChimp module 7.x-2.x before 7.x-2.7 for Drupal allow remote attackers to inje (no CVSS)
- [CVE-2012-5552](https://cve.now/CVE-2012-5552.md): The Password policy module 6.x-1.x before 6.x-1.5 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to obtain password hashes by (no CVSS)
- [CVE-2012-5553](https://cve.now/CVE-2012-5553.md): Multiple cross-site scripting (XSS) vulnerabilities in the OM Maximenu module 6.x-1.x before 6.x-1.44 and 7.x-1.x before 7.x-1.44 for Drupal (no CVSS)
- [CVE-2012-5554](https://cve.now/CVE-2012-5554.md): The default configuration for the Webform CiviCRM Integration module 7.x-3.x before 7.x-3.2 has "Enforce Permissions" disabled, which allows (no CVSS)
- [CVE-2012-5556](https://cve.now/CVE-2012-5556.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the RESTful Web Services (RESTWS) module 7.x-1.x before 7.x-1.1 and 7.x-2.x be (no CVSS)
- [CVE-2012-5557](https://cve.now/CVE-2012-5557.md): The User Read-Only module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.4 for Drupal, does not properly assign roles when there are more t (no CVSS)
- [CVE-2012-5559](https://cve.now/CVE-2012-5559.md): Cross-site scripting (XSS) vulnerability in the page manager node view task in the Chaos tool suite (ctools) module 6.x-1.x before 6.x-1.10 (no CVSS)
- [CVE-2012-5569](https://cve.now/CVE-2012-5569.md): Multiple cross-site scripting (XSS) vulnerabilities in the Basic webmail module 6.x-1.x before 6.x-1.2 for Drupal allow remote attackers to (no CVSS)
- [CVE-2012-5858](https://cve.now/CVE-2012-5858.md): Samsung Kies Air 2.1.207051 and 2.1.210161 relies on the IP address for authentication, which allows remote man-in-the-middle attackers to r (no CVSS)
- [CVE-2012-5859](https://cve.now/CVE-2012-5859.md): Samsung Kies Air 2.1.207051 and 2.1.210161 allows remote attackers to cause a denial of service (crash) via a crafted request to www/apps/Ki (no CVSS)
- [CVE-2012-6064](https://cve.now/CVE-2012-6064.md): Directory traversal vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple (CMSMS) before 1.11.2.1 allows remote authen (no CVSS)
- [CVE-2012-6065](https://cve.now/CVE-2012-6065.md): The OM Maximenu module 6.x-1.43 and earlier for Drupal, when the "Title has PHP" option is enabled, allows remote authenticated users with t (no CVSS)
- [CVE-2012-5611](https://cve.now/CVE-2012-5611.md): Stack-based buffer overflow in the acl\_get function in Oracle MySQL 5.5.19 and other versions through 5.5.28, and 5.1.53 and other versions (no CVSS)
- [CVE-2012-5612](https://cve.now/CVE-2012-5612.md): Heap-based buffer overflow in Oracle MySQL 5.5.19 and other versions through 5.5.28, and MariaDB 5.5.28a and possibly other versions, allows (no CVSS)
- [CVE-2012-5614](https://cve.now/CVE-2012-5614.md): Oracle MySQL 5.1.67 and earlier and 5.5.29 and earlier, and MariaDB 5.5.28a and possibly other versions, allows remote authenticated users t (no CVSS)
- [CVE-2012-5615](https://cve.now/CVE-2012-5615.md): Oracle MySQL 5.5.38 and earlier, 5.6.19 and earlier, and MariaDB 5.5.28a, 5.3.11, 5.2.13, 5.1.66, and possibly other versions, generates dif (no CVSS)
- [CVE-2012-5613](https://cve.now/CVE-2012-5613.md): MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the FILE privilege to u (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2012-12-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.