# CVEs published 2012-12-05 24 CVEs were published on December 5, 2012: 0 critical, 0 high. Days are UTC. - [CVE-2009-2899](https://cve.now/CVE-2009-2899.md): The monitor perl script in the Sybase database plug-in in SpringSource Hyperic HQ before 4.3 allows local users to obtain the database passw (no CVSS) - [CVE-2011-2730](https://cve.now/CVE-2011-2730.md): VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (E (no CVSS, org.springframework:spring-core) - [CVE-2011-2731](https://cve.now/CVE-2011-2731.md): Race condition in the RunAsManager mechanism in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 stores the Authentic (no CVSS, org.springframework.security:spring-security-core) - [CVE-2011-2732](https://cve.now/CVE-2011-2732.md): CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows r (no CVSS, org.springframework.security:spring-security-core) - [CVE-2012-5055](https://cve.now/CVE-2012-5055.md): DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the (no CVSS, org.springframework.security:spring-security-core) - [CVE-2012-3317](https://cve.now/CVE-2012-3317.md): IBM WebSphere Message Broker 6.1 before 6.1.0.11, 7.0 before 7.0.0.5, and 8.0 before 8.0.0.2 has incorrect ownership of certain uninstaller (no CVSS) - [CVE-2012-4347](https://cve.now/CVE-2012-4347.md): Multiple directory traversal vulnerabilities in the management console in Symantec Messaging Gateway (SMG) 9.5.x allow remote authenticated (no CVSS) - [CVE-2012-4608](https://cve.now/CVE-2012-4608.md): Cross-site request forgery (CSRF) vulnerability in the web interface in EMC RSA NetWitness Informer before 2.0.5.6 allows remote attackers t (no CVSS) - [CVE-2012-4609](https://cve.now/CVE-2012-4609.md): The web interface in EMC RSA NetWitness Informer before 2.0.5.6 allows remote attackers to conduct clickjacking attacks via unspecified vect (no CVSS) - [CVE-2012-4862](https://cve.now/CVE-2012-4862.md): The Host Connect emulator in IBM Rational Developer for System z 7.1 through 8.5.1 does not properly store the SSL certificate password, whi (no CVSS) - [CVE-2012-4982](https://cve.now/CVE-2012-4982.md): Open redirect vulnerability in assets/login on the Forescout CounterACT NAC device before 7.0 allows remote attackers to redirect users to a (no CVSS) - [CVE-2012-4983](https://cve.now/CVE-2012-4983.md): Multiple cross-site scripting (XSS) vulnerabilities on the Forescout CounterACT NAC device before 7.0 allow remote attackers to inject arbit (no CVSS) - [CVE-2012-4985](https://cve.now/CVE-2012-4985.md): The Forescout CounterACT NAC device 6.3.4.1 does not block ARP and ICMP traffic from unrecognized clients, which allows remote attackers to (no CVSS) - [CVE-2012-6052](https://cve.now/CVE-2012-6052.md): Wireshark 1.8.x before 1.8.4 allows remote attackers to obtain sensitive hostname information by reading pcap-ng files. (no CVSS) - [CVE-2012-6053](https://cve.now/CVE-2012-6053.md): epan/dissectors/packet-usb.c in the USB dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 relies on a length field to calcul (no CVSS) - [CVE-2012-6054](https://cve.now/CVE-2012-6054.md): The dissect\_sflow\_245\_address\_type function in epan/dissectors/packet-sflow.c in the sFlow dissector in Wireshark 1.8.x before 1.8.4 does no (no CVSS) - [CVE-2012-6055](https://cve.now/CVE-2012-6055.md): epan/dissectors/packet-3g-a11.c in the 3GPP2 A11 dissector in Wireshark 1.8.x before 1.8.4 allows remote attackers to cause a denial of serv (no CVSS) - [CVE-2012-6056](https://cve.now/CVE-2012-6056.md): Integer overflow in the dissect\_sack\_chunk function in epan/dissectors/packet-sctp.c in the SCTP dissector in Wireshark 1.8.x before 1.8.4 a (no CVSS) - [CVE-2012-6057](https://cve.now/CVE-2012-6057.md): The dissect\_eigrp\_metric\_comm function in epan/dissectors/packet-eigrp.c in the EIGRP dissector in Wireshark 1.8.x before 1.8.4 uses the wro (no CVSS) - [CVE-2012-6058](https://cve.now/CVE-2012-6058.md): Integer overflow in the dissect\_icmpv6 function in epan/dissectors/packet-icmpv6.c in the ICMPv6 dissector in Wireshark 1.6.x before 1.6.12 (no CVSS) - [CVE-2012-6059](https://cve.now/CVE-2012-6059.md): The dissect\_isakmp function in epan/dissectors/packet-isakmp.c in the ISAKMP dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8 (no CVSS) - [CVE-2012-6060](https://cve.now/CVE-2012-6060.md): Integer overflow in the dissect\_iscsi\_pdu function in epan/dissectors/packet-iscsi.c in the iSCSI dissector in Wireshark 1.6.x before 1.6.12 (no CVSS) - [CVE-2012-6061](https://cve.now/CVE-2012-6061.md): The dissect\_wtp\_common function in epan/dissectors/packet-wtp.c in the WTP dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 (no CVSS) - [CVE-2012-6062](https://cve.now/CVE-2012-6062.md): The dissect\_rtcp\_app function in epan/dissectors/packet-rtcp.c in the RTCP dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2012-12-05 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.