# CVEs published 2013-03-12

32 CVEs were published on March 12, 2013: 0 critical, 0 high. Days are UTC.

- [CVE-2011-1164](https://cve.now/CVE-2011-1164.md): Vino before 2.99.4 can connect external networks contrary to the statement in the vino-preferences dialog box, which might make it easier fo (no CVSS)
- [CVE-2011-1165](https://cve.now/CVE-2011-1165.md): Vino, possibly before 3.2, does not properly document that it opens ports in UPnP routers when the "Configure network to automatically accep (no CVSS)
- [CVE-2011-4966](https://cve.now/CVE-2011-4966.md): modules/rlm\_unix/rlm\_unix.c in FreeRADIUS before 2.2.0, when unix mode is enabled for user authentication, does not properly check the passw (no CVSS)
- [CVE-2012-5629](https://cve.now/CVE-2012-5629.md): The default configuration of the (1) LdapLoginModule and (2) LdapExtLoginModule modules in JBoss Enterprise Application Platform (EAP) 4.3.0 (no CVSS)
- [CVE-2012-5633](https://cve.now/CVE-2012-5633.md): The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasse (no CVSS, org.apache.cxf:cxf)
- [CVE-2012-5659](https://cve.now/CVE-2012-5659.md): Untrusted search path vulnerability in plugins/abrt-action-install-debuginfo-to-abrt-cache.c in Automatic Bug Reporting Tool (ABRT) 2.0.9 an (no CVSS)
- [CVE-2012-5660](https://cve.now/CVE-2012-5660.md): abrt-action-install-debuginfo in Automatic Bug Reporting Tool (ABRT) 2.0.9 and earlier allows local users to set world-writable permissions (no CVSS)
- [CVE-2012-6115](https://cve.now/CVE-2012-6115.md): The domain management tool (rhevm-manage-domains) in Red Hat Enterprise Virtualization Manager (RHEV-M) 3.1 and earlier, when the validate a (no CVSS)
- [CVE-2013-0168](https://cve.now/CVE-2013-0168.md): The MoveDisk command in Red Hat Enterprise Virtualization Manager (RHEV-M) 3.1 and earlier does not properly check permissions on storage do (no CVSS)
- [CVE-2013-0239](https://cve.now/CVE-2013-0239.md): Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows r (no CVSS, org.apache.cxf:cxf-rt-frontend-jaxrs)
- [CVE-2012-5509](https://cve.now/CVE-2012-5509.md): aeolus-configserver-setup in the Aeolas Configuration Server, as used in Red Hat CloudForms Cloud Engine before 1.1.2, uses world-readable p (no CVSS)
- [CVE-2012-6076](https://cve.now/CVE-2012-6076.md): Inkscape before 0.48.4 reads .eps files from /tmp instead of the current directory, which might cause Inkspace to process unintended files, (no CVSS)
- [CVE-2012-6117](https://cve.now/CVE-2012-6117.md): Aeolus Configuration Server, as used in Red Hat CloudForms Cloud Engine before 1.1.2, uses world-readable permissions for /var/log/aeolus-co (no CVSS)
- [CVE-2012-6118](https://cve.now/CVE-2012-6118.md): The Administer tab in Aeolus Conductor allows remote authenticated users to bypass intended quota restrictions by updating the Maximum Runni (no CVSS)
- [CVE-2013-0252](https://cve.now/CVE-2013-0252.md): boost::locale::utf::utf\_traits in the Boost.Locale library in Boost 1.48 through 1.52 does not properly detect certain invalid UTF-8 sequenc (no CVSS)
- [CVE-2013-0275](https://cve.now/CVE-2013-0275.md): Multiple cross-site scripting (XSS) vulnerabilities in Ganglia Web before 3.5.6 allow remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2013-1049](https://cve.now/CVE-2013-1049.md): Buffer overflow in the RFC1413 (ident) client in cfingerd 1.4.3-3 allows remote IDENT servers to cause a denial of service (crash) and possi (no CVSS)
- [CVE-2013-1423](https://cve.now/CVE-2013-1423.md): (1) contrib/gforge-3.0-cronjobs.patch, (2) cronjobs/homedirs.php, (3) deb-specific/fileforge.pl, (4) deb-specific/group\_dump\_update.pl, (5) (no CVSS)
- [CVE-2013-1468](https://cve.now/CVE-2013-1468.md): Cross-site request forgery (CSRF) vulnerability in the LocalFiles Editor plugin in Piwigo before 2.4.7 allows remote attackers to hijack the (no CVSS)
- [CVE-2013-1667](https://cve.now/CVE-2013-1667.md): The rehash mechanism in Perl 5.8.2 through 5.16.x allows context-dependent attackers to cause a denial of service (memory consumption and cr (no CVSS)
- [CVE-2013-1794](https://cve.now/CVE-2013-1794.md): Buffer overflow in certain client utilities in OpenAFS before 1.6.2 allows remote authenticated users to cause a denial of service (crash) a (no CVSS)
- [CVE-2013-1795](https://cve.now/CVE-2013-1795.md): Integer overflow in ptserver in OpenAFS before 1.6.2 allows remote attackers to cause a denial of service (crash) via a large list from the (no CVSS)
- [CVE-2012-4446](https://cve.now/CVE-2012-4446.md): The default configuration for Apache Qpid 0.20 and earlier, when the federation\_tag attribute is enabled, accepts AMQP connections without c (no CVSS, org.apache.qpid:qpid-client)
- [CVE-2012-4458](https://cve.now/CVE-2012-4458.md): The AMQP type decoder in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service (memory consumption and server cr (no CVSS)
- [CVE-2012-4459](https://cve.now/CVE-2012-4459.md): Integer overflow in the qpid::framing::Buffer::checkAvailable function in Apache Qpid 0.20 and earlier allows remote attackers to cause a de (no CVSS)
- [CVE-2012-4460](https://cve.now/CVE-2012-4460.md): The serializing/deserializing functions in the qpid::framing::Buffer class in Apache Qpid 0.20 and earlier allow remote attackers to cause a (no CVSS)
- [CVE-2012-4462](https://cve.now/CVE-2012-4462.md): aviary/jobcontrol.py in Condor, as used in Red Hat Enterprise MRG 2.3, when removing a job, allows remote attackers to cause a denial of ser (no CVSS)
- [CVE-2012-4684](https://cve.now/CVE-2012-4684.md): The alert functionality in bitcoind and Bitcoin-Qt before 0.7.0 supports different character representations of the same signature data, but (no CVSS)
- [CVE-2013-2272](https://cve.now/CVE-2013-2272.md): The penny-flooding protection mechanism in the CTxMemPool::accept method in bitcoind and Bitcoin-Qt before 0.4.9rc1, 0.5.x before 0.5.8rc1, (no CVSS)
- [CVE-2013-2273](https://cve.now/CVE-2013-2273.md): bitcoind and Bitcoin-Qt before 0.4.9rc1, 0.5.x before 0.5.8rc1, 0.6.0 before 0.6.0.11rc1, 0.6.1 through 0.6.5 before 0.6.5rc1, and 0.7.x bef (no CVSS)
- [CVE-2013-2292](https://cve.now/CVE-2013-2292.md): bitcoind and Bitcoin-Qt 0.8.0 and earlier allow remote attackers to cause a denial of service (electricity consumption) by mining a block to (no CVSS)
- [CVE-2013-2293](https://cve.now/CVE-2013-2293.md): The CTransaction::FetchInputs method in bitcoind and Bitcoin-Qt before 0.8.0rc1 copies transactions from disk to memory without incrementall (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2013-03-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.