# CVEs published 2012-12-26 24 CVEs were published on December 26, 2012: 0 critical, 0 high. Days are UTC. - [CVE-2012-0958](https://cve.now/CVE-2012-0958.md): content/unity-api.js in the unity-firefox-extension extension 2.4.1 for Firefox exposes the toDataURL function in an API call, which allows (no CVSS) - [CVE-2012-0961](https://cve.now/CVE-2012-0961.md): Apt 0.8.16~exp5ubuntu13.x before 0.8.16~exp5ubuntu13.6, 0.8.16~exp12ubuntu10.x before 0.8.16~exp12ubuntu10.7, and 0.9.7.5ubuntu5.x before 0. (no CVSS) - [CVE-2012-0962](https://cve.now/CVE-2012-0962.md): Aptdaemon 0.43 in Ubuntu 11.10 and 12.04 LTS uses short IDs when importing PPA GPG keys from a keyserver, which allows remote attackers to i (no CVSS) - [CVE-2012-5161](https://cve.now/CVE-2012-5161.md): The XML Service interface in Citrix XenApp 6.5 and 6.5 Feature Pack 1 allows remote attackers to execute arbitrary code via unspecified vect (no CVSS) - [CVE-2012-5483](https://cve.now/CVE-2012-5483.md): tools/sample\_data.sh in OpenStack Keystone 2012.1.3, when access to Amazon Elastic Compute Cloud (Amazon EC2) is configured, uses world-read (no CVSS) - [CVE-2012-5625](https://cve.now/CVE-2012-5625.md): Openstack nova: information leak in libvirt lvm-backed instances (CVSS 6.5, Red Hat OpenStack Folsom for RHEL · Red Hat OpenStack Pl… +1) - [CVE-2012-6314](https://cve.now/CVE-2012-6314.md): Citrix XenDesktop Virtual Desktop Agent (VDA) 5.6.x before 5.6.200, when making changes to the server-side policy that control USB redirecti (no CVSS) - [CVE-2012-4616](https://cve.now/CVE-2012-4616.md): Directory traversal vulnerability in the Web UI in EMC Data Protection Advisor (DPA) 5.6 through SP1, 5.7 through SP1, and 5.8 through SP4 a (no CVSS) - [CVE-2012-6298](https://cve.now/CVE-2012-6298.md): Unspecified vulnerability in CA IdentityMinder r12.0 through CR16, r12.5 before SP15, and r12.6 GA allows remote attackers to execute arbitr (no CVSS) - [CVE-2012-6299](https://cve.now/CVE-2012-6299.md): Unspecified vulnerability in CA IdentityMinder r12.0 through CR16, r12.5 before SP15, and r12.6 GA allows remote attackers to bypass intende (no CVSS) - [CVE-2012-4816](https://cve.now/CVE-2012-4816.md): IBM Rational Automation Framework (RAF) 3.x through 3.0.0.5 allows remote attackers to bypass intended Env Gen Wizard (aka Environment Gener (no CVSS) - [CVE-2012-5951](https://cve.now/CVE-2012-5951.md): Unspecified vulnerability in IBM Tivoli NetView 1.4, 5.1 through 5.4, and 6.1 on z/OS allows local users to gain privileges by leveraging ac (no CVSS) - [CVE-2012-5179](https://cve.now/CVE-2012-5179.md): The Boat Browser application before 4.2 and Boat Browser Mini application before 3.9 for Android do not properly implement the WebView class (no CVSS) - [CVE-2012-5180](https://cve.now/CVE-2012-5180.md): The Opera Mobile application before 12.1 and Opera Mini application before 7.5 for Android do not properly implement the WebView class, whic (no CVSS) - [CVE-2012-5182](https://cve.now/CVE-2012-5182.md): The Loctouch application 3.4.6 and earlier for Android does not properly handle implicit intents, which allows attackers to obtain sensitive (no CVSS) - [CVE-2012-5183](https://cve.now/CVE-2012-5183.md): The Loctouch application 3.4.6 and earlier for Android allows attackers to obtain sensitive information about logged locations via a crafted (no CVSS) - [CVE-2012-5584](https://cve.now/CVE-2012-5584.md): The Table of Contents module 6.x-3.x before 6.x-3.8 for Drupal does not properly check node permissions, which allows remote attackers to re (no CVSS) - [CVE-2012-5585](https://cve.now/CVE-2012-5585.md): Cross-site scripting (XSS) vulnerability in the Mixpanel module 6.x-1.x before 6.x-1.1 in Drupal allows remote authenticated users with the (no CVSS) - [CVE-2012-5586](https://cve.now/CVE-2012-5586.md): The Services module 6.x-3.x before 6.x-3.3 and 7.x-3.x before 7.x-3.3 for Drupal allows remote authenticated users with the "access user pro (no CVSS) - [CVE-2012-5587](https://cve.now/CVE-2012-5587.md): Cross-site scripting (XSS) vulnerability in the Email Field module 6.x-1.x before 6.x-1.3 for Drupal allows remote attackers to inject arbit (no CVSS) - [CVE-2012-5588](https://cve.now/CVE-2012-5588.md): The Email Field module 6.x-1.x before 6.x-1.3 for Drupal, when using a field permission module and the field contact field formatter is set (no CVSS) - [CVE-2012-5589](https://cve.now/CVE-2012-5589.md): The MultiLink module 6.x-2.x before 6.x-2.7 and 7.x-2.x before 7.x-2.7 for Drupal does not properly check node permissions when generating a (no CVSS) - [CVE-2012-5590](https://cve.now/CVE-2012-5590.md): SQL injection vulnerability in the Webmail Plus module for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified (no CVSS) - [CVE-2012-5591](https://cve.now/CVE-2012-5591.md): Cross-site scripting (XSS) vulnerability in the Zero Point module 6.x-1.x before 6.x-1.18 and 7.x-1.x before 7.x-1.4 for Drupal allows remot (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2012-12-26 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.