CVE-2012-1827

MediumCVSS 6.5/10Last modified Jun 16, 2026

Description

The web service in AutoFORM PDM Archive before 7.1 does not have authorization requirements, which allows remote authenticated users to perform database operations via a SOAP request, as demonstrated by the initializeQueryDatabase2 request.

Metrics

CVSS 2.0 6.5/10AV:N/AC:L/Au:S/C:P/I:P/A:P

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/49335
http://www.kb.cert.org/vuls/id/773035US Government Resource
http://www.kb.cert.org/vuls/id/MAPG-8RQL83US Government Resource
http://www.securityfocus.com/bid/53716
http://secunia.com/advisories/49335
http://www.kb.cert.org/vuls/id/773035US Government Resource
http://www.kb.cert.org/vuls/id/MAPG-8RQL83US Government Resource
http://www.securityfocus.com/bid/53716

Timeline

Published: Jun 13, 2012
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-18286.5The administrative functions in AutoFORM PDM Archive before 7.1 do not have authorization requirements, which allows remote authenticated us CVE-2012-18293.5Multiple cross-site scripting (XSS) vulnerabilities in AutoFORM PDM Archive before 6.920 allow remote authenticated users to inject arbitrar CVE-2012-183010.0Stack-based buffer overflow in WellinTech KingView 6.53 allows remote attackers to execute arbitrary code via a crafted packet to TCP port 5 CVE-2012-183110.0Heap-based buffer overflow in WellinTech KingView 6.53 allows remote attackers to execute arbitrary code via a crafted packet to TCP port 55 CVE-2012-183210.0WellinTech KingView 6.53 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via a crafted p CVE-2012-18335.0VMware SpringSource Grails before 1.3.8, and 2.x before 2.0.2, does not properly restrict data binding, which might allow remote attackers t CVE-2012-18344.3Cross-site scripting (XSS) vulnerability in the cms_tpv_admin_head function in functions.php in the CMS Tree Page View plugin before 0.8.9 f CVE-2012-18354.3Multiple cross-site scripting (XSS) vulnerabilities in the All-in-One Event Calendar plugin 1.4 and 1.5 for WordPress allow remote attackers CVE-2012-18367.5Heap-based buffer overflow in dns.cpp in InspIRCd 2.0.5 might allow remote attackers to execute arbitrary code via a crafted DNS query that CVE-2012-18375.0The (1) webreports, (2) post/create-role, and (3) post/update-role programs in IBM Tivoli Endpoint Manager (TEM) before 8.2 do not include t CVE-2012-18385.0The web management interface on the LG-Nortel ELO GS24M switch allows remote attackers to bypass authentication, and consequently obtain cle CVE-2012-18397.5Multiple directory traversal vulnerabilities in the Get Template feature in plugins/gui.ajax/class.AJXP_ClientDriver.php in AjaXplorer 3.2.x