# CVEs published 2012-12-20 10 CVEs were published on December 20, 2012: 0 critical, 0 high. Days are UTC. - [CVE-2012-3428](https://cve.now/CVE-2012-3428.md): The IronJacamar container before 1.0.12.Final for JBoss Application Server, when allow-multiple-users is enabled in conjunction with a secur (no CVSS, org.jboss.ironjacamar:ironjacamar-jdbc) - [CVE-2012-4839](https://cve.now/CVE-2012-4839.md): The OSLC interface in the Web Client (aka CQ Web) in IBM Rational ClearQuest 7.1.2.x before 7.1.2.9 and 8.0.0.x before 8.0.0.5 allows remote (no CVSS) - [CVE-2012-4856](https://cve.now/CVE-2012-4856.md): The Service Processor in the IBM Power 5 91##-### and 940#-### before SF240\_418\_382 does not ensure that firewall code is executed, which al (no CVSS) - [CVE-2012-5469](https://cve.now/CVE-2012-5469.md): The Portable phpMyAdmin plugin before 1.3.1 for WordPress allows remote attackers to bypass authentication and obtain phpMyAdmin console acc (no CVSS) - [CVE-2012-5638](https://cve.now/CVE-2012-5638.md): The setup\_logging function in log.h in SANLock uses world-writable permissions for /var/log/sanlock.log, which allows local users to overwri (no CVSS) - [CVE-2012-5643](https://cve.now/CVE-2012-5643.md): Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 (no CVSS) - [CVE-2012-5765](https://cve.now/CVE-2012-5765.md): The Web Client (aka CQ Web) in IBM Rational ClearQuest 7.1.2.x before 7.1.2.9 and 8.0.0.x before 8.0.0.5 allows remote attackers to obtain s (no CVSS) - [CVE-2012-5955](https://cve.now/CVE-2012-5955.md): Unspecified vulnerability in the IBM HTTP Server component 5.3 in IBM WebSphere Application Server (WAS) for z/OS allows remote attackers to (no CVSS) - [CVE-2012-6270](https://cve.now/CVE-2012-6270.md): Adobe Shockwave Player through 11.6.8.638 allows remote attackers to trigger installation of a Shockwave Player 10.4.0.025 compatibility fea (no CVSS) - [CVE-2012-6271](https://cve.now/CVE-2012-6271.md): Adobe Shockwave Player through 11.6.8.638 allows remote attackers to trigger installation of arbitrary signed Xtras via a Shockwave movie th (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2012-12-20 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.