CVE-2012-2420: Exposure of Sensitive Information to an Unauthorized Actor

The intu-help-qb aka Intuit Help System Async Pluggable Protocol handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012, when Internet Explorer is used, might allow remote attackers to obtain sensitive information via a URI with a % percent character as its 1 last or 2...

CVE-2012-2421: Improper Limitation of a Pathname to a Restricted Directory

Absolute path traversal vulnerability in the intu-help-qb aka Intuit Help System Async Pluggable Protocol handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012, when Internet Explorer is used, might allow remote attackers to read arbitrary files in ZIP archives via a...

CVE-2012-2422: Exposure of Sensitive Information to an Unauthorized Actor

Intuit QuickBooks 2009 through 2012 might allow remote attackers to obtain pathname information via the qbwc://docontrol/GetCompanyFile functionality...