# CVEs published 2013-01-04

22 CVEs were published on January 4, 2013: 0 critical, 0 high. Days are UTC.

- [CVE-2011-4316](https://cve.now/CVE-2011-4316.md): Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, in certain unspecified conditions, does not lock the desktop screen between S (no CVSS)
- [CVE-2012-0860](https://cve.now/CVE-2012-0860.md): Multiple untrusted search path vulnerabilities in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when adding a host, allow l (no CVSS)
- [CVE-2012-0861](https://cve.now/CVE-2012-0861.md): The vds\_installer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when adding a host, uses the -k curl parameter when down (no CVSS)
- [CVE-2012-2696](https://cve.now/CVE-2012-2696.md): The backend in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1 does not properly check privileges, which allows remote authent (no CVSS)
- [CVE-2012-3538](https://cve.now/CVE-2012-3538.md): Pulp in Red Hat CloudForms before 1.1 logs administrative passwords in a world-readable file, which allows local users to read pulp administ (no CVSS)
- [CVE-2012-4543](https://cve.now/CVE-2012-4543.md): Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Certificate System (RHCS) before 8.1.3 allow remote attackers to inject arbit (no CVSS)
- [CVE-2012-4555](https://cve.now/CVE-2012-4555.md): The token processing system (pki-tps) in Red Hat Certificate System (RHCS) before 8.1.3 does not properly handle interruptions of token form (no CVSS)
- [CVE-2012-4556](https://cve.now/CVE-2012-4556.md): The token processing system (pki-tps) in Red Hat Certificate System (RHCS) before 8.1.3 allows remote attackers to cause a denial of service (no CVSS)
- [CVE-2012-4574](https://cve.now/CVE-2012-4574.md): Pulp: red hat cloudforms: pulp in red hat cloudforms: information disclosure via world-readable configuration file (CVSS 5.5, Red Hat CloudForms for RHEL · Red Hat CloudForms Tools f… +1)
- [CVE-2012-5516](https://cve.now/CVE-2012-5516.md): Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when moving disks between storage domains, does not properly wipe-after-delet (no CVSS)
- [CVE-2012-5581](https://cve.now/CVE-2012-5581.md): Stack-based buffer overflow in tif\_dir.c in LibTIFF before 4.0.2 allows remote attackers to cause a denial of service (crash) and possibly e (no CVSS)
- [CVE-2012-5603](https://cve.now/CVE-2012-5603.md): proxies\_controller.rb in Katello in Red Hat CloudForms before 1.1 does not properly check permissions, which allows remote authenticated use (no CVSS)
- [CVE-2012-5605](https://cve.now/CVE-2012-5605.md): Grinder: red hat cloudforms: grinder in red hat cloudforms: local users can modify cache files via world-writable permissions (CVSS 3.3, Red Hat CloudForms for RHEL · Red Hat CloudForms Tools for…)
- [CVE-2012-6329](https://cve.now/CVE-2012-6329.md): The \_compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly handle backslashes and f (no CVSS)
- [CVE-2012-6330](https://cve.now/CVE-2012-6330.md): The localization functionality in TWiki before 5.1.3, and Foswiki 1.0.x through 1.0.10 and 1.1.x through 1.1.6, allows remote attackers to c (no CVSS)
- [CVE-2012-6348](https://cve.now/CVE-2012-6348.md): Centrify Deployment Manager 2.1.0.283, as distributed in Centrify Suite before 2012.5, allows local users to (1) overwrite arbitrary files v (no CVSS)
- [CVE-2012-5977](https://cve.now/CVE-2012-5977.md): Asterisk Open Source 1.8.x before 1.8.19.1, 10.x before 10.11.1, and 11.x before 11.1.2; Certified Asterisk 1.8.11 before 1.8.11-cert10; and (no CVSS)
- [CVE-2012-5976](https://cve.now/CVE-2012-5976.md): Multiple stack consumption vulnerabilities in Asterisk Open Source 1.8.x before 1.8.19.1, 10.x before 10.11.1, and 11.x before 11.1.2; Certi (no CVSS)
- [CVE-2012-6089](https://cve.now/CVE-2012-6089.md): Multiple stack-based buffer overflows in the canoniseFileName function in os/pl-os.c in SWI-Prolog before 6.2.5 and 6.3.x before 6.3.7 allow (no CVSS)
- [CVE-2012-6090](https://cve.now/CVE-2012-6090.md): Multiple stack-based buffer overflows in the expand function in os/pl-glob.c in SWI-Prolog before 6.2.5 and 6.3.x before 6.3.7 allow remote (no CVSS)
- [CVE-2012-6496](https://cve.now/CVE-2012-6496.md): SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allow (no CVSS, activerecord)
- [CVE-2012-6497](https://cve.now/CVE-2012-6497.md): The Authlogic gem for Ruby on Rails, when used with certain versions before 3.2.10, makes potentially unsafe find\_by\_id method calls, which (no CVSS, authlogic)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2013-01-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.