# CVEs published 2013-01-24

44 CVEs were published on January 24, 2013: 1 critical, 4 high. Days are UTC.

- [CVE-2012-5668](https://cve.now/CVE-2012-5668.md): FreeType before 2.4.11 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors rela (no CVSS)
- [CVE-2012-5669](https://cve.now/CVE-2012-5669.md): The \_bdf\_parse\_glyphs function in FreeType before 2.4.11 allows context-dependent attackers to cause a denial of service (crash) and possibl (no CVSS)
- [CVE-2012-5670](https://cve.now/CVE-2012-5670.md): The \_bdf\_parse\_glyphs function in FreeType before 2.4.11 allows context-dependent attackers to cause a denial of service (out-of-bounds writ (no CVSS)
- [CVE-2012-6095](https://cve.now/CVE-2012-6095.md): ProFTPD before 1.3.5rc1, when using the UserOwner directive, allows local users to modify the ownership of arbitrary files via a race condit (no CVSS)
- [CVE-2012-6435](https://cve.now/CVE-2012-6435.md): Rockwell Automation ControlLogix PLC Improper Access Control (CVSS 7.5, Rockwell Automation 1756-ENBT, 1756-EWEB, 1768-ENBT, 176… +6)
- [CVE-2012-6436](https://cve.now/CVE-2012-6436.md): Rockwell Automation ControlLogix PLC Improper Input Validation (CVSS 7.5, Rockwell Automation 1756-ENBT, 1756-EWEB, 1768-ENBT, 176… +6)
- [CVE-2012-6437](https://cve.now/CVE-2012-6437.md): Rockwell Automation ControlLogix PLC Improper Authentication (CVSS 9.8, Rockwell Automation 1756-ENBT, 1756-EWEB, 1768-ENBT, 176… +6)
- [CVE-2012-6438](https://cve.now/CVE-2012-6438.md): Rockwell Automation ControlLogix PLC Improper Input Validation (CVSS 7.5, Rockwell Automation 1756-ENBT, 1756-EWEB, 1768-ENBT, 176… +6)
- [CVE-2012-6439](https://cve.now/CVE-2012-6439.md): Rockwell Automation ControlLogix PLC Improper Access Control (no CVSS, Rockwell Automation 1756-ENBT, 1756-EWEB, 1768-ENBT, 176… +6)
- [CVE-2012-6440](https://cve.now/CVE-2012-6440.md): Rockwell Automation ControlLogix PLC Improper Input Validation (CVSS 4.8, Rockwell Automation 1756-ENBT, 1756-EWEB, 1768-ENBT, 176… +6)
- [CVE-2012-6441](https://cve.now/CVE-2012-6441.md): Rockwell Automation ControlLogix PLC Information Exposure (no CVSS, Rockwell Automation 1756-ENBT, 1756-EWEB, 1768-ENBT, 176… +6)
- [CVE-2012-6442](https://cve.now/CVE-2012-6442.md): Rockwell Automation ControlLogix PLC Improper Access Control (CVSS 7.5, Rockwell Automation 1756-ENBT, 1756-EWEB, 1768-ENBT, 176… +6)
- [CVE-2013-0839](https://cve.now/CVE-2013-0839.md): Use-after-free vulnerability in Google Chrome before 24.0.1312.56 allows remote attackers to cause a denial of service or possibly have unsp (no CVSS)
- [CVE-2013-0840](https://cve.now/CVE-2013-0840.md): Google Chrome before 24.0.1312.56 does not validate URLs during the opening of new windows, which has unspecified impact and remote attack v (no CVSS)
- [CVE-2013-0841](https://cve.now/CVE-2013-0841.md): Array index error in the content-blocking functionality in Google Chrome before 24.0.1312.56 allows remote attackers to cause a denial of se (no CVSS)
- [CVE-2013-0842](https://cve.now/CVE-2013-0842.md): Google Chrome before 24.0.1312.56 does not properly handle %00 characters in pathnames, which has unspecified impact and attack vectors. (no CVSS)
- [CVE-2013-0843](https://cve.now/CVE-2013-0843.md): content/renderer/media/webrtc\_audio\_renderer.cc in Google Chrome before 24.0.1312.56 on Mac OS X does not use an appropriate buffer size for (no CVSS)
- [CVE-2013-1102](https://cve.now/CVE-2013-1102.md): The Wireless Intrusion Prevention System (wIPS) component on Cisco Wireless LAN Controller (WLC) devices with software 7.0 before 7.0.235.0, (no CVSS)
- [CVE-2013-1103](https://cve.now/CVE-2013-1103.md): Cisco Wireless LAN Controller (WLC) devices with software 7.0 before 7.0.220.0, 7.1 before 7.1.91.0, and 7.2 before 7.2.103.0 allow remote a (no CVSS)
- [CVE-2013-1104](https://cve.now/CVE-2013-1104.md): The HTTP Profiling functionality on Cisco Wireless LAN Controller (WLC) devices with software 7.3.101.0 allows remote authenticated users to (no CVSS)
- [CVE-2013-1105](https://cve.now/CVE-2013-1105.md): Cisco Wireless LAN Controller (WLC) devices with software 7.0 before 7.0.235.3, 7.1 and 7.2 before 7.2.111.3, and 7.3 before 7.3.101.0 allow (no CVSS)
- [CVE-2011-4618](https://cve.now/CVE-2011-4618.md): Cross-site scripting (XSS) vulnerability in advancedtext.php in Advanced Text Widget plugin before 2.0.2 for WordPress allows remote attacke (no CVSS)
- [CVE-2012-1922](https://cve.now/CVE-2012-1922.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Sitecom WLM-2501 allow remote attackers to hijack the authentication of admini (no CVSS)
- [CVE-2012-2099](https://cve.now/CVE-2012-2099.md): Multiple cross-site scripting (XSS) vulnerabilities in Wikidforum 2.10 allow remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2012-6085](https://cve.now/CVE-2012-6085.md): The read\_block function in g10/import.c in GnuPG 1.4.x before 1.4.13 and 2.0.x through 2.0.19, when importing a key, allows remote attackers (no CVSS)
- [CVE-2012-6503](https://cve.now/CVE-2012-6503.md): Unspecified vulnerability in the NinjaXplorer component before 1.0.7 for Joomla! has unknown impact and attack vectors. (no CVSS)
- [CVE-2012-6504](https://cve.now/CVE-2012-6504.md): SQL injection vulnerability in mods/hours/data/get\_hours.php in PHP Volunteer Management 1.0.2 allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2012-6505](https://cve.now/CVE-2012-6505.md): Cross-site scripting (XSS) vulnerability in mods/hours/data/get\_hours.php in PHP Volunteer Management 1.0.2 allows remote attackers to injec (no CVSS)
- [CVE-2012-6506](https://cve.now/CVE-2012-6506.md): Multiple cross-site scripting (XSS) vulnerabilities in the Zingiri Web Shop plugin 2.4.0 for WordPress allow remote attackers to inject arbi (no CVSS)
- [CVE-2012-6507](https://cve.now/CVE-2012-6507.md): Multiple SQL injection vulnerabilities in admin.php in ChurchCMS 0.0.1 allow remote attackers to execute arbitrary SQL commands via the (1) (no CVSS)
- [CVE-2012-6508](https://cve.now/CVE-2012-6508.md): Multiple cross-site request forgery (CSRF) vulnerabilities in NetArt Media Car Portal 3.0 allow remote attackers to hijack the authenticatio (no CVSS)
- [CVE-2012-6509](https://cve.now/CVE-2012-6509.md): Unrestricted file upload vulnerability in NetArt Media Car Portal 3.0 allows remote attackers to execute arbitrary PHP code by uploading a f (no CVSS)
- [CVE-2012-6510](https://cve.now/CVE-2012-6510.md): Multiple cross-site scripting (XSS) vulnerabilities in NetArt Media Car Portal 3.0 allow remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2012-6511](https://cve.now/CVE-2012-6511.md): Multiple cross-site scripting (XSS) vulnerabilities in organizer/page/users.php in the Organizer plugin 1.2.1 for WordPress allow remote att (no CVSS)
- [CVE-2012-6512](https://cve.now/CVE-2012-6512.md): The Organizer plugin 1.2.1 for WordPress allows remote attackers to obtain the installation path via unspecified vectors to (1) plugin\_hook. (no CVSS)
- [CVE-2012-6513](https://cve.now/CVE-2012-6513.md): Cross-site scripting (XSS) vulnerability in index.php/Admin\_Preferences in gpEasy CMS 2.3.3 allows remote attackers to inject arbitrary web (no CVSS)
- [CVE-2012-6514](https://cve.now/CVE-2012-6514.md): Cross-site scripting (XSS) vulnerability in the nBill (com\_nbill) component 2.3.2 for Joomla! allows remote attackers to inject arbitrary we (no CVSS)
- [CVE-2012-6515](https://cve.now/CVE-2012-6515.md): eFront 3.6.10, 3.6.11 build 15059, and earlier allows remote attackers to obtain sensitive information via invalid courses\_ID parameter in t (no CVSS)
- [CVE-2012-6516](https://cve.now/CVE-2012-6516.md): SQL injection vulnerability in PHP Ticket System Beta 1 allows remote attackers to execute arbitrary SQL commands via the q parameter to ind (no CVSS)
- [CVE-2012-6517](https://cve.now/CVE-2012-6517.md): Multiple cross-site scripting (XSS) vulnerabilities in DiY-CMS 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) (no CVSS)
- [CVE-2012-6518](https://cve.now/CVE-2012-6518.md): Cross-site request forgery (CSRF) vulnerability in mod.php in DiY-CMS 1.0 allows remote attackers to hijack the authentication of administra (no CVSS)
- [CVE-2012-6519](https://cve.now/CVE-2012-6519.md): SQL injection vulnerability in modules/poll/index.php in DIY-CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the start (no CVSS)
- [CVE-2012-6520](https://cve.now/CVE-2012-6520.md): Multiple SQL injection vulnerabilities in the advanced search in Wikidforum 2.10 allow remote attackers to execute arbitrary SQL commands vi (no CVSS)
- [CVE-2012-6521](https://cve.now/CVE-2012-6521.md): Cross-site scripting (XSS) vulnerability in apps/admin/handlers/versions.php in Elefant CMS 1.2.0 allows remote attackers to inject arbitrar (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2013-01-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.