# CVEs published 2012-12-12 26 CVEs were published on December 12, 2012: 1 critical, 1 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2012-4971](https://cve.now/CVE-2012-4971.md): Multiple SQL injection vulnerabilities in Layton Helpbox 4.4.0 allow remote attackers to execute arbitrary SQL commands via the (1) reqclass (no CVSS) - [CVE-2012-4972](https://cve.now/CVE-2012-4972.md): Multiple cross-site scripting (XSS) vulnerabilities in Layton Helpbox 4.4.0 allow remote attackers to inject arbitrary web script or HTML vi (no CVSS) - [CVE-2012-4974](https://cve.now/CVE-2012-4974.md): Layton Helpbox 4.4.0 allows remote authenticated users to change the login context and gain privileges via a modified (1) loggedinenduser, ( (no CVSS) - [CVE-2012-4975](https://cve.now/CVE-2012-4975.md): editrequestuser.asp in Layton Helpbox 4.4.0 allows remote authenticated users to change arbitrary support-ticket data via a modified sys\_req (no CVSS) - [CVE-2012-4976](https://cve.now/CVE-2012-4976.md): selectawasset.asp in Layton Helpbox 4.4.0 allows remote attackers to discover ODBC database credentials via an element=sys\_asset\_id request, (no CVSS) - [CVE-2012-4977](https://cve.now/CVE-2012-4977.md): Layton Helpbox 4.4.0 allows remote attackers to discover cleartext credentials for the login page by sniffing the network. (no CVSS) - [CVE-2012-5139](https://cve.now/CVE-2012-5139.md): Use-after-free vulnerability in Google Chrome before 23.0.1271.97 allows remote attackers to cause a denial of service or possibly have unsp (no CVSS) - [CVE-2012-5140](https://cve.now/CVE-2012-5140.md): Use-after-free vulnerability in Google Chrome before 23.0.1271.97 allows remote attackers to cause a denial of service or possibly have unsp (no CVSS) - [CVE-2012-5141](https://cve.now/CVE-2012-5141.md): Google Chrome before 23.0.1271.97 does not properly restrict instantiation of the Chromoting client plug-in, which has unspecified impact an (no CVSS) - [CVE-2012-5142](https://cve.now/CVE-2012-5142.md): Google Chrome before 23.0.1271.97 does not properly handle history navigation, which allows remote attackers to execute arbitrary code or ca (no CVSS) - [CVE-2012-5143](https://cve.now/CVE-2012-5143.md): Integer overflow in Google Chrome before 23.0.1271.97 allows remote attackers to cause a denial of service or possibly have unspecified othe (no CVSS) - [CVE-2012-5144](https://cve.now/CVE-2012-5144.md): Google Chrome before 23.0.1271.97, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.5, do not properly perform AAC decoding, which allows r (no CVSS) - [CVE-2012-5675](https://cve.now/CVE-2012-5675.md): Adobe ColdFusion 9.0 through 9.0.2, and 10, allows local users to bypass intended shared-hosting sandbox permissions via unspecified vectors (no CVSS) - [CVE-2012-5676](https://cve.now/CVE-2012-5676.md): Buffer overflow in Adobe Flash Player before 10.3.183.48 and 11.x before 11.5.502.135 on Windows, before 10.3.183.48 and 11.x before 11.5.50 (no CVSS) - [CVE-2012-5677](https://cve.now/CVE-2012-5677.md): Integer overflow in Adobe Flash Player before 10.3.183.48 and 11.x before 11.5.502.135 on Windows, before 10.3.183.48 and 11.x before 11.5.5 (no CVSS) - [CVE-2012-5678](https://cve.now/CVE-2012-5678.md): Adobe Flash Player before 10.3.183.48 and 11.x before 11.5.502.135 on Windows, before 10.3.183.48 and 11.x before 11.5.502.136 on Mac OS X, (no CVSS) - [CVE-2012-1537](https://cve.now/CVE-2012-1537.md): Heap-based buffer overflow in DirectPlay in DirectX 9.0 through 11.1 in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows V (no CVSS) - [CVE-2012-2539](https://cve.now/CVE-2012-2539.md): Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; and Office Web Apps 2010 SP1 al (CVSS 7.8, KEV) - [CVE-2012-2549](https://cve.now/CVE-2012-2549.md): The IP-HTTPS server in Windows Server 2008 R2 and R2 SP1 and Server 2012 does not properly validate certificates, which allows remote attack (no CVSS) - [CVE-2012-2556](https://cve.now/CVE-2012-2556.md): The OpenType Font (OTF) driver in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, W (no CVSS) - [CVE-2012-4774](https://cve.now/CVE-2012-4774.md): Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold an (no CVSS) - [CVE-2012-4781](https://cve.now/CVE-2012-4781.md): Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web (no CVSS) - [CVE-2012-4782](https://cve.now/CVE-2012-4782.md): Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via a crafted web sit (no CVSS) - [CVE-2012-4786](https://cve.now/CVE-2012-4786.md): The kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 (no CVSS) - [CVE-2012-4787](https://cve.now/CVE-2012-4787.md): Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via a crafted web sit (CVSS 9.0) - [CVE-2012-4791](https://cve.now/CVE-2012-4791.md): Microsoft Exchange Server 2007 SP3 and 2010 SP1 and SP2 allows remote authenticated users to cause a denial of service (Information Store se (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2012-12-12 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.