Archive

December 2011

Vulnerabilities first published in this month (UTC), newest first.

← November 2011 2011 / December January 2012 →

All Critical High Medium Low Exploited only Public exploit

340 results · Feed

Unscored —

CVE-2011-1710

Multiple integer overflows in the HTTP server in the Novell XTier framework 3.1.8 allow remote attackers to cause a den…

Dec 31, 2011
Medium 6.2

CVE-2011-4617

Virtualenv Allows Symlink Attack on /tmp/

virtualenv.py in virtualenv before 1.5 allows local users to overwrite arbitrary files via a symlink attack on a certain file in /tmp/.

virtualenv python-virtualenv Debian PyPI

Dec 31, 2011
Unscored —

CVE-2011-4620 Public exploit EPSS 13%

Buffer overflow in the ulSetError function in util/ulError.cxx in PLIB 1.8.5, as used in TORCS 1.3.1 and other products…

plib Debian

Dec 31, 2011
Unscored —

CVE-2011-5043 Public exploit

TomatoSoft Free Mp3 Player 1.0 allows remote attackers to cause a denial of service (application crash) via a long stri…

Dec 30, 2011
Unscored —

CVE-2011-5038

SQL injection vulnerability in hitCode hitAppoint 4.5.17 and possibly earlier allows remote attackers to execute arbitr…

Dec 30, 2011
Unscored —

CVE-2011-5045 Public exploit

Cross-site scripting (XSS) vulnerability in details_view.php in PHP Booking Calendar 10e allows remote attackers to inj…

Dec 30, 2011
Unscored —

CVE-2011-5040 Public exploit

Multiple cross-site scripting (XSS) vulnerabilities in Infoproject Biznis Heroj allow remote attackers to inject arbitr…

Dec 30, 2011
Unscored —

CVE-2011-5044 Public exploit

SopCast 3.4.7.45585 uses weak permissions (Everyone:Full Control) for Diagnose.exe, which allows local users to execute…

Dec 30, 2011
Unscored —

CVE-2011-5042

Cross-site scripting (XSS) vulnerability in inc/lib/lib.base.php in SASHA 0.2.0 allows remote attackers to inject arbit…

Dec 30, 2011
Unscored —

CVE-2011-5039 Public exploit

Multiple SQL injection vulnerabilities in Infoproject Biznis Heroj allow remote attackers to execute arbitrary SQL comm…

Dec 30, 2011
Unscored —

CVE-2011-5041 Public exploit

Multiple cross-site scripting (XSS) vulnerabilities in Pulse Pro CMS 1.7.2 allow remote attackers to inject arbitrary w…

Dec 30, 2011
Unscored —

CVE-2011-5046 Public exploit EPSS 45%

The Graphics Device Interface (GDI) in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windo…

Dec 30, 2011
Medium 5.3

CVE-2011-4461

Improper Input Validation in Jetty

Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

org.eclipse.jetty:jetty-server Maven

Dec 30, 2011
High 7.5

CVE-2011-4462

Plone Denial of Service vulnerability

Plone 4.1.3 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

plone PyPI

Dec 30, 2011
Unscored —

CVE-2011-4815

Ruby (aka CRuby) before 1.8.7-p357 computes hash values without restricting the ability to trigger hash collisions pred…

Dec 30, 2011
Unscored —

CVE-2011-4885 Public exploit EPSS 83%

PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions pr…

Dec 30, 2011
Unscored —

CVE-2011-4838

JRuby before 1.6.5.1 computes hash values without restricting the ability to trigger hash collisions predictably, which…

jruby Debian

Dec 30, 2011
Unscored —

CVE-2011-3416 EPSS 44%

The Forms Authentication feature in the ASP.NET subsystem in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5 SP1, 3.5.1,…

Dec 30, 2011
Unscored —

CVE-2011-3414 EPSS 58%

The CaseInsensitiveHashProvider.getHashCode function in the HashTable implementation in the ASP.NET subsystem in Micros…

Dec 30, 2011
Unscored —

CVE-2011-3417 EPSS 34%

The Forms Authentication feature in the ASP.NET subsystem in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5 SP1, 3.5.1,…

Dec 30, 2011
Unscored —

CVE-2011-3415 EPSS 23%

Open redirect vulnerability in the Forms Authentication feature in the ASP.NET subsystem in Microsoft .NET Framework 2.…

Dec 30, 2011
Unscored —

CVE-2011-5037

Google V8 computes hash values for form parameters without restricting the ability to trigger hash collisions predictab…

Dec 30, 2011
Medium —

CVE-2011-5036

Rack Gem Subject to Denial of Service via Hash Collisions

Rack before 1.1.3, 1.2.x before 1.2.5, and 1.3.x before 1.3.6 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by send…

rack ruby-rack org.jruby:jruby-parent Debian Maven RubyGems

Dec 30, 2011
High —

CVE-2011-5034 Public exploit EPSS 81%

Apache Geronimo Hash Collisions Cause DoS

Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.…

org.apache.geronimo:geronimo Maven

Dec 30, 2011
Unscored —

CVE-2011-5035 Public exploit EPSS 68%

Oracle Glassfish 2.1.1, 3.0.1, and 3.1.1, as used in Communications Server 2.0, Sun Java System Application Server 8.1 …

Dec 30, 2011
Unscored —

CVE-2011-4615

Multiple cross-site scripting (XSS) vulnerabilities in Zabbix before 1.8.10 allow remote attackers to inject arbitrary …

zabbix Debian

Dec 29, 2011
Unscored —

CVE-2011-5033 Public exploit

Stack-based buffer overflow in CFS.c in ConfigServer Security & Firewall (CSF) before 5.43, when running on a DirectAdm…

Dec 29, 2011
Unscored —

CVE-2011-5032

WMDrive.sys 3.4.181.224 in WinMount 3.5.1018 allows local users to cause a denial of service (NULL pointer dereference …

Dec 29, 2011
Unscored —

CVE-2011-5027

Cross-site scripting (XSS) vulnerability in ZABBIX before 1.8.10 allows remote attackers to inject arbitrary web script…

zabbix Debian

Dec 29, 2011
Unscored —

CVE-2011-5030

Cross-site scripting (XSS) vulnerability in the Meta tags quick module 7.x-2.x before 7.x-2.3 for Drupal allows remote …

Dec 29, 2011
Unscored —

CVE-2011-5029

Multiple cross-site scripting (XSS) vulnerabilities in Simple PHP Blog 0.7.0 and possibly earlier allow remote attacker…

Dec 29, 2011
Unscored —

CVE-2011-5031 Public exploit

Multiple SQL injection vulnerabilities in servlet/capexweb.parentvalidatepassword in cApexWEB 1.1 allow remote attacker…

Dec 29, 2011
Unscored —

CVE-2011-5028 Public exploit

Directory traversal vulnerability in novelllogmanager/FileDownload in Novell Sentinel Log Manager 1.2.0.1_938 and earli…

Dec 29, 2011
Unscored —

CVE-2011-4163

Unspecified vulnerability in HP Database Archiving Software 6.31 allows remote attackers to execute arbitrary code via …

Dec 29, 2011
Unscored —

CVE-2011-4165

Unspecified vulnerability in HP Database Archiving Software 6.31 allows remote attackers to execute arbitrary code via …

Dec 29, 2011
Unscored —

CVE-2011-4164

Unspecified vulnerability in HP Database Archiving Software 6.31 allows remote attackers to execute arbitrary code via …

Dec 29, 2011
Unscored —

CVE-2011-5024

Cross-site scripting (XSS) vulnerability in mmsearch/design in the Mailman/htdig integration patch for Mailman allows r…

Dec 29, 2011
Unscored —

CVE-2011-5023 Public exploit

Cross-site scripting (XSS) vulnerability in Pligg CMS 1.1.4 allows remote attackers to inject arbitrary web script or H…

Dec 29, 2011
Unscored —

CVE-2011-5022 Public exploit

SQL injection vulnerability in search.php in Pligg CMS 1.1.2 allows remote attackers to execute arbitrary SQL commands …

Dec 29, 2011
Unscored —

CVE-2011-5025 Public exploit

Multiple cross-site scripting (XSS) vulnerabilities in the wiki application in Yaws 1.88 allow remote attackers to inje…

yaws Debian

Dec 29, 2011