# CVEs published 2012-12-19

18 CVEs were published on December 19, 2012: 0 critical, 0 high. Days are UTC.

- [CVE-2012-3329](https://cve.now/CVE-2012-3329.md): IBM Advanced Settings Utility (ASU) through 3.62 and 3.70 through 9.21 and Bootable Media Creator (BoMC) through 2.30 and 3.00 through 9.21 (no CVSS)
- [CVE-2012-3546](https://cve.now/CVE-2012-3546.md): org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.30, when FORM authentication is used, allows (no CVSS, org.apache.tomcat:tomcat)
- [CVE-2012-4431](https://cve.now/CVE-2012-4431.md): org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to by (no CVSS, org.apache.tomcat:tomcat)
- [CVE-2012-4534](https://cve.now/CVE-2012-4534.md): org/apache/tomcat/util/net/NioEndpoint.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28, when the NIO connector is used in conj (no CVSS)
- [CVE-2012-4846](https://cve.now/CVE-2012-4846.md): IBM Lotus Notes 8.5.x before 8.5.3 FP3 does not include the HTTPOnly flag in a Set-Cookie header for a web-application cookie, which makes i (no CVSS)
- [CVE-2012-4848](https://cve.now/CVE-2012-4848.md): Multiple cross-site scripting (XSS) vulnerabilities in IBM Lotus Foundations Start before 1.2.2c allow remote authenticated users to inject (no CVSS)
- [CVE-2012-5177](https://cve.now/CVE-2012-5177.md): Cross-site scripting (XSS) vulnerability in the Welcart plugin before 1.2.2 for WordPress allows remote attackers to inject arbitrary web sc (no CVSS)
- [CVE-2012-5178](https://cve.now/CVE-2012-5178.md): Cross-site request forgery (CSRF) vulnerability in the Welcart plugin before 1.2.2 for WordPress allows remote attackers to hijack the authe (no CVSS)
- [CVE-2012-5690](https://cve.now/CVE-2012-5690.md): RealNetworks RealPlayer before 16.0.0.282 and RealPlayer SP 1.0 through 1.1.5 allow remote attackers to execute arbitrary code via a RealAud (no CVSS)
- [CVE-2012-5691](https://cve.now/CVE-2012-5691.md): Buffer overflow in RealNetworks RealPlayer before 16.0.0.282 and RealPlayer SP 1.0 through 1.1.5 allows remote attackers to execute arbitrar (no CVSS)
- [CVE-2012-5967](https://cve.now/CVE-2012-5967.md): SQL injection vulnerability in menuXML.php in Centreon 2.3.3 through 2.3.9-4 (fixed in Centreon web 2.6.0) allows remote authenticated users (no CVSS, Centreon)
- [CVE-2012-5968](https://cve.now/CVE-2012-5968.md): The Huawei E585 device does not validate the status of admin sessions, which allows remote attackers to obtain sensitive user information an (no CVSS)
- [CVE-2012-5969](https://cve.now/CVE-2012-5969.md): Multiple directory traversal vulnerabilities on the Huawei E585 device allow remote attackers to (1) read arbitrary files via a .. (no CVSS)
- [CVE-2012-5970](https://cve.now/CVE-2012-5970.md): The Huawei E585 device allows remote attackers to cause a denial of service (NULL pointer dereference and device outage) via crafted HTTP re (no CVSS)
- [CVE-2012-5978](https://cve.now/CVE-2012-5978.md): Multiple directory traversal vulnerabilities in the (1) View Connection Server and (2) View Security Server in VMware View 4.x before 4.6.2 (no CVSS)
- [CVE-2012-5991](https://cve.now/CVE-2012-5991.md): screens/base/web\_auth\_custom.html on Cisco Wireless LAN Controller (WLC) devices with software 7.2.110.0 allows remote authenticated users t (no CVSS)
- [CVE-2012-5992](https://cve.now/CVE-2012-5992.md): Multiple cross-site request forgery (CSRF) vulnerabilities on Cisco Wireless LAN Controller (WLC) devices with software 7.2.110.0 allow remo (no CVSS)
- [CVE-2012-6007](https://cve.now/CVE-2012-6007.md): Cross-site scripting (XSS) vulnerability in screens/base/web\_auth\_custom.html on Cisco Wireless LAN Controller (WLC) devices with software 7 (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2012-12-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.