# CVEs published 2013-01-03

16 CVEs were published on January 3, 2013: 0 critical, 0 high. Days are UTC.

- [CVE-2012-5667](https://cve.now/CVE-2012-5667.md): Multiple integer overflows in GNU Grep before 2.11 might allow context-dependent attackers to execute arbitrary code via vectors involving a (no CVSS)
- [CVE-2012-6433](https://cve.now/CVE-2012-6433.md): Cross-site request forgery (CSRF) vulnerability in e107\_admin/newspost.php in e107 1.0.1 allows remote attackers to hijack the authenticatio (no CVSS)
- [CVE-2012-6434](https://cve.now/CVE-2012-6434.md): Multiple cross-site request forgery (CSRF) vulnerabilities in e107\_admin/download.php in e107 1.0.2 allow remote attackers to hijack the aut (no CVSS)
- [CVE-2012-2379](https://cve.now/CVE-2012-2379.md): Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 o (no CVSS, org.apache.cxf:cxf)
- [CVE-2012-4545](https://cve.now/CVE-2012-4545.md): The http\_negotiate\_create\_context function in protocol/http/http\_negotiate.c in ELinks 0.12 before 0.12pre6, when using HTTP Negotiate or GS (no CVSS)
- [CVE-2012-5651](https://cve.now/CVE-2012-5651.md): Drupal 6.x before 6.27 and 7.x before 7.18 displays information for blocked users, which might allow remote attackers to obtain sensitive in (no CVSS)
- [CVE-2012-5652](https://cve.now/CVE-2012-5652.md): Drupal 6.x before 6.27 allows remote attackers to obtain sensitive information about uploaded files via a (1) RSS feed or (2) search result. (no CVSS)
- [CVE-2012-5653](https://cve.now/CVE-2012-5653.md): The file upload feature in Drupal 6.x before 6.27 and 7.x before 7.18 allows remote authenticated users to bypass the protection mechanism a (no CVSS)
- [CVE-2012-5654](https://cve.now/CVE-2012-5654.md): The Nodewords: D6 Meta Tags module before 6.x-1.14 for Drupal, when configured to automatically generate description meta tags from node tex (no CVSS)
- [CVE-2012-5655](https://cve.now/CVE-2012-5655.md): The Context module 6.x-3.x before 6.x-3.1 and 7.x-3.x before 7.x-3.0-beta6 for Drupal does not properly restrict access to block content, wh (no CVSS)
- [CVE-2012-5665](https://cve.now/CVE-2012-5665.md): ownCloud 4.0.x before 4.0.10 and 4.5.x before 4.5.5 does not properly restrict access to settings.php, which allows remote attackers to edit (no CVSS)
- [CVE-2012-5666](https://cve.now/CVE-2012-5666.md): Cross-site scripting (XSS) vulnerability in bookmarks/js/bookmarks.js in ownCloud 4.0.x before 4.0.10 and 4.5.x before 4.5.5 allows remote a (no CVSS)
- [CVE-2012-6080](https://cve.now/CVE-2012-6080.md): Directory traversal vulnerability in the \_do\_attachment\_move function in the AttachFile action (action/AttachFile.py) in MoinMoin 1.9.3 thro (no CVSS, moin)
- [CVE-2012-6081](https://cve.now/CVE-2012-6081.md): Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) act (no CVSS, moin)
- [CVE-2012-6082](https://cve.now/CVE-2012-6082.md): Cross-site scripting (XSS) vulnerability in the rsslink function in theme/\_\_init\_\_.py in MoinMoin 1.9.5 allows remote attackers to inject ar (no CVSS, moin)
- [CVE-2012-6495](https://cve.now/CVE-2012-6495.md): Multiple directory traversal vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions (no CVSS, moin)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2013-01-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.