GCVE - cpe:2.3:a:intuit:quickbooks:2011:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:intuit:quickbooks:2011:*:*:*:*:*:*:*

part: a version: 2011 update: *

Vendor	Intuit (`6d5ef895-61c8-53c2-a937-b9530a18eef4`)
Product	Quickbooks (`c3afb16b-5c0b-5048-8a4e-81d9d5d15977`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2012-2425`	vulnerable	2026-06-08 05:02:04.501356	Details available The intu-help-qb (aka Intuit Help System Async Pluggable Protocol) handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012, when Internet Explorer is used, allow remote attackers to cause a denial of service (application crash) via a long URI. Published: 2012-04-25T20:00:00.000Z Updated: 2024-08-06T19:34:25.572Z Open on db.gcve.eu Reference links http://www.securityfocus.com/archive/1/522139 http://www.securityfocus.com/archive/1/522138 http://packetstormsecurity.org/files/111403/Intuit-Help-System-Protocol-File-Retrieval.html http://www.kb.cert.org/vuls/id/232979 https://exchange.xforce.ibmcloud.com/vulnerabilities/75176	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-2424`	vulnerable	2026-06-08 05:02:04.500960	Details available The intu-help-qb (aka Intuit Help System Async Pluggable Protocol) handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012, when Internet Explorer is used, allow remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a URI that lacks a required delimiter. Published: 2012-04-25T20:00:00.000Z Updated: 2024-08-06T19:34:25.367Z Open on db.gcve.eu Reference links http://www.securityfocus.com/archive/1/522139 http://www.securityfocus.com/archive/1/522138 https://exchange.xforce.ibmcloud.com/vulnerabilities/75175 http://www.kb.cert.org/vuls/id/232979	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-2423`	vulnerable	2026-06-08 05:02:04.500566	Details available The intu-help-qb (aka Intuit Help System Async Pluggable Protocol) handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012, when Internet Explorer is used, provide different responses to remote requests depending on whether a ZIP pathname is valid, which allows remote attackers to obtain potentially sensitive information about the installation path and product version via a series of requests involving the Msxml2.XMLHTTP object. Published: 2012-04-25T20:00:00.000Z Updated: 2024-08-06T19:34:25.501Z Open on db.gcve.eu Reference links https://exchange.xforce.ibmcloud.com/vulnerabilities/75174 http://www.securityfocus.com/archive/1/522139 http://www.kb.cert.org/vuls/id/232979	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-2422`	vulnerable	2026-06-08 05:02:04.500205	Details available Intuit QuickBooks 2009 through 2012 might allow remote attackers to obtain pathname information via the qbwc://docontrol/GetCompanyFile functionality. Published: 2012-04-25T20:00:00.000Z Updated: 2024-08-06T19:34:25.428Z Open on db.gcve.eu Reference links http://www.securityfocus.com/archive/1/522139 http://www.kb.cert.org/vuls/id/232979 https://exchange.xforce.ibmcloud.com/vulnerabilities/75173	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-2421`	vulnerable	2026-06-08 05:02:04.499835	Details available Absolute path traversal vulnerability in the intu-help-qb (aka Intuit Help System Async Pluggable Protocol) handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012, when Internet Explorer is used, might allow remote attackers to read arbitrary files in ZIP archives via a full pathname in the URI. Published: 2012-04-25T20:00:00.000Z Updated: 2024-08-06T19:34:25.477Z Open on db.gcve.eu Reference links https://exchange.xforce.ibmcloud.com/vulnerabilities/75172 http://www.securityfocus.com/archive/1/522139 http://www.kb.cert.org/vuls/id/232979	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-2420`	vulnerable	2026-06-08 05:02:04.499455	Details available The intu-help-qb (aka Intuit Help System Async Pluggable Protocol) handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012, when Internet Explorer is used, might allow remote attackers to obtain sensitive information via a URI with a % (percent) character as its (1) last or (2) second-to-last character, in situations where a certain "post-URL data" buffer contains a 0x0000 character but a buffer overflow does not occur. Published: 2012-04-25T20:00:00.000Z Updated: 2024-08-06T19:34:25.214Z Open on db.gcve.eu Reference links http://osvdb.org/80820 http://www.securityfocus.com/archive/1/522138 http://www.kb.cert.org/vuls/id/232979 https://exchange.xforce.ibmcloud.com/vulnerabilities/74548	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-2419`	vulnerable	2026-06-08 05:02:04.499030	Details available Memory leak in the intu-help-qb (aka Intuit Help System Async Pluggable Protocol) handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012, when Internet Explorer is used, allows remote attackers to cause a denial of service (memory consumption) via a URI with multiple references to the same name-value pair. Published: 2012-04-25T20:00:00.000Z Updated: 2024-08-06T19:34:25.538Z Open on db.gcve.eu Reference links https://exchange.xforce.ibmcloud.com/vulnerabilities/75171 http://www.securityfocus.com/archive/1/522138 http://www.kb.cert.org/vuls/id/232979	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-2418`	vulnerable	2026-06-08 05:02:04.497268	Details available Heap-based buffer overflow in the intu-help-qb (aka Intuit Help System Async Pluggable Protocol) handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012, when Internet Explorer is used, allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a URI with a % (percent) character as its (1) last or (2) second-to-last character. Published: 2012-04-25T20:00:00.000Z Updated: 2024-08-06T19:34:25.311Z Open on db.gcve.eu Reference links https://exchange.xforce.ibmcloud.com/vulnerabilities/75170 http://osvdb.org/80820 http://www.securityfocus.com/archive/1/522138 http://www.kb.cert.org/vuls/id/232979	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.