CVE-2012-5527

MediumCVSS 5.5/10Last modified Jun 16, 2026

Description

Claws Mail vCalendar plugin: credentials exposed on interface

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-522

Affected software

Vendor	Product	Versions
Claws Mail	Claws Mail vCalendar plugin	vCalendar plugin Version: 2.0.13; Claws Mail through 3.8.1

References

http://www.openwall.com/lists/oss-security/2012/11/28/10Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/11/28/8Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/11/28/9Mailing List, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-5527Issue Tracking, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2012-5527Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/11/28/10Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/11/28/8Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/11/28/9Mailing List, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-5527Issue Tracking, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2012-5527Third Party Advisory

Timeline

Published: Nov 25, 2019
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-55293.5TraceManager in Firebird 2.5.0 and 2.5.1, when trace is enabled, allows remote authenticated users to cause a denial of service (NULL pointe CVE-2012-55302.1The (1) pcmd and (2) pmlogger init scripts in Performance Co-Pilot (PCP) before 3.6.10 allow local users to overwrite arbitrary files via a CVE-2012-55314.3Multiple cross-site scripting (XSS) vulnerabilities in the GateIn Portal in JBoss Enterprise Portal Platform 5.2.2 allow remote attackers to CVE-2012-55324.9The main function in tools/hv/hv_kvp_daemon.c in hypervkvpd, as distributed in the Linux kernel before 3.8-rc1, allows local users to cause CVE-2012-55335.0The http_request_split_value function in request.c in lighttpd before 1.4.32 allows remote attackers to cause a denial of service (infinite CVE-2012-55347.5The hook_process function in the plugin API for WeeChat 0.3.0 through 0.3.9.1 allows remote attackers to execute arbitrary commands via shel CVE-2012-55357.5gnome-system-log polkit policy allows arbitrary files on the system to be read CVE-2012-55366.2A certain Red Hat build of the pam_ssh_agent_auth module on Red Hat Enterprise Linux (RHEL) 6 and Fedora Rawhide calls the glibc error funct CVE-2012-55376.0The Simplenews Scheduler module 6.x-2.x before 6.x-2.4 for Drupal allows remote authenticated users with the "send scheduled newsletters" pe CVE-2012-55382.1Cross-site scripting (XSS) vulnerability in the FileField Sources module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.6 for Drupal, when CVE-2012-55393.5The Organic Groups (OG) module 7.x-1.x before 7.x-1.5 for Drupal does not properly maintain pending group memberships, which allows remote a CVE-2012-55404.3Multiple cross-site scripting (XSS) vulnerabilities in the Hostip module 6.x-2.x before 6.x-2.2 and 7.x-2.x before 7.x-2.2 for Drupal allow