Skip to content
OpenAdvisories

Archive

8 January 2012

Vulnerabilities first published on this day (UTC), newest first.

← December 2011 2012 / January /8 February 2012 →
  1. 1 
  2. 24
  3. 37
  4. 410
  5. 53
  6. 611
  7. 73
  8. 818
  9. 9 
  10. 1014
  11. 11 
  12. 123
  13. 1314
  14. 147
  15. 157
  16. 16 
  17. 172
  18. 1880
  19. 1916
  20. 2014
  21. 21 
  22. 22 
  23. 231
  24. 2423
  25. 2523
  26. 264
  27. 2720
  28. 285
  29. 2920
  30. 305
  31. 31 
All Critical High Medium Low Exploited only Public exploit

18 results · Feed

  • Unscored —
    CVE-2011-4531 Public exploit

    Siemens Automation License Manager (ALM) 4.0 through 5.1+SP1+Upd1 allows remote attackers to cause a denial of service …

  • Unscored —
    CVE-2011-4529 Public exploit

    Multiple buffer overflows in Siemens Automation License Manager (ALM) 4.0 through 5.1+SP1+Upd1 allow remote attackers t…

  • Unscored —
    CVE-2011-4530 Public exploit

    Siemens Automation License Manager (ALM) 4.0 through 5.1+SP1+Upd1 does not properly copy fields obtained from clients, …

  • Unscored —
    CVE-2011-4532 Public exploit

    Absolute path traversal vulnerability in the ALMListView.ALMListCtrl ActiveX control in almaxcx.dll in the graphical us…

  • Unscored —
    CVE-2011-5057 Public exploit EPSS 27%

    Apache Struts 2.3.1.2 and earlier, 2.3.19-2.3.23, provides interfaces that do not properly restrict access to collectio…

  • Medium —
    CVE-2012-0394 Public exploit EPSS 73%

    Apache Struts's DebuggingInterceptor component allows remote code execution in developer mode

    The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itsel…

    org.apache.struts.xwork:xwork-core Maven
  • Medium —
    CVE-2012-0392 Public exploit EPSS 98%

    Apache Struts's CookieInterceptor component does not use the parameter-name whitelist

    The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.

    org.apache.struts:struts2-core org.apache.struts.xwork:xwork-core Maven
  • Critical 9.8
    CVE-2012-0391 Exploited Public exploit EPSS 76%

    Apache Struts Remote Java Code Execution

    The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a craf…

    org.apache.struts:struts2-core org.apache.struts.xwork:xwork-core Maven
    KEV Jan 21, 2022
  • Medium —
    CVE-2012-0393 Public exploit EPSS 36%

    Apache Struts's ParameterInterceptor component does not prevent access to public constructors

    The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary files via a crafted parameter that triggers the creation of a Java object.

    org.apache.struts:struts2-core org.apache.struts.xwork:xwork-core Maven
  • Unscored —
    CVE-2011-4360

    MediaWiki before 1.17.1 allows remote attackers to obtain the page titles of all restricted pages via a series of reque…

    mediawiki Debian
  • Unscored —
    CVE-2011-4361

    MediaWiki before 1.17.1 does not check for read permission before handling action=ajax requests, which allows remote at…

    mediawiki Debian
  • Unscored —
    CVE-2011-4056

    An unspecified ActiveX control in ActBar.ocx in Siemens Tecnomatix FactoryLink 6.6.1 (aka 6.6 SP1), 7.5.217 (aka 7.5 SP…

  • Unscored —
    CVE-2011-4055

    Buffer overflow in the WebClient ActiveX control in Siemens Tecnomatix FactoryLink 6.6.1 (aka 6.6 SP1), 7.5.217 (aka 7.…

  • Unscored —
    CVE-2011-4870

    Multiple buffer overflows in the (1) GUIControls, (2) BatchObjSrv, and (3) BatchSecCtrl ActiveX controls in Invensys Wo…

  • Unscored —
    CVE-2011-3206

    Multiple cross-site scripting (XSS) vulnerabilities in the administration interface in RHQ 4.2.0, as used in JBoss Oper…

  • Unscored —
    CVE-2011-5055

    MaraDNS 1.3.07.12 and 1.4.08 computes hash values for DNS data without properly restricting the ability to trigger hash…

    maradns Debian
  • Unscored —
    CVE-2011-5056

    The authoritative server in MaraDNS through 2.0.04 computes hash values for DNS data without restricting the ability to…

  • Unscored —
    CVE-2012-0024

    MaraDNS before 1.3.07.12 and 1.4.x before 1.4.08 computes hash values for DNS data without restricting the ability to t…

    maradns Debian