CVE-2012-2420

LowCVSS 1.8/10Last modified Jun 16, 2026

Description

The intu-help-qb (aka Intuit Help System Async Pluggable Protocol) handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012, when Internet Explorer is used, might allow remote attackers to obtain sensitive information via a URI with a % (percent) character as its (1) last or (2) second-to-last character, in situations where a certain "post-URL data" buffer contains a 0x0000 character but a buffer overflow does not occur.

Metrics

CVSS 2.0 1.8/10AV:A/AC:H/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://osvdb.org/80820
http://www.kb.cert.org/vuls/id/232979US Government Resource
http://www.securityfocus.com/archive/1/522138Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/74548
http://osvdb.org/80820
http://www.kb.cert.org/vuls/id/232979US Government Resource
http://www.securityfocus.com/archive/1/522138Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/74548

Timeline

Published: Apr 25, 2012
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-24211.8Absolute path traversal vulnerability in the intu-help-qb (aka Intuit Help System Async Pluggable Protocol) handlers in HelpAsyncPluggablePr CVE-2012-24222.9Intuit QuickBooks 2009 through 2012 might allow remote attackers to obtain pathname information via the qbwc://docontrol/GetCompanyFile func CVE-2012-24231.8The intu-help-qb (aka Intuit Help System Async Pluggable Protocol) handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 thro CVE-2012-24241.8The intu-help-qb (aka Intuit Help System Async Pluggable Protocol) handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 thro CVE-2012-24251.8The intu-help-qb (aka Intuit Help System Async Pluggable Protocol) handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 thro CVE-2012-24267.8The server in xArrow before 3.4.1 does not properly allocate memory, which allows remote attackers to cause a denial of service (NULL pointe CVE-2012-242710.0Heap-based buffer overflow in the server in xArrow before 3.4.1 allows remote attackers to execute arbitrary code via packets that trigger a CVE-2012-242810.0Integer overflow in the server in xArrow before 3.4.1 allows remote attackers to execute arbitrary code via a crafted packet that triggers a CVE-2012-242910.0The server in xArrow before 3.4.1 performs an invalid read operation, which allows remote attackers to execute arbitrary code via unspecifie CVE-2012-24356.5Directory traversal vulnerability in the captcha module in Pligg CMS before 1.2.2 allows remote authenticated users to include and execute a CVE-2012-24364.3Multiple cross-site scripting (XSS) vulnerabilities in Pligg CMS before 1.2.2 allow remote attackers to inject arbitrary web script or HTML CVE-2012-24375.0cookie_gen.php in ar web content manager (AWCM) 2.2 does not require authentication, which allows remote attackers to generate arbitrary coo