Skip to content
OpenAdvisories

Archive

January 2012

Vulnerabilities first published in this month (UTC), newest first.

← December 2011 2012 / January February 2012 →
  1. 1 
  2. 24
  3. 37
  4. 410
  5. 53
  6. 611
  7. 73
  8. 818
  9. 9 
  10. 1014
  11. 11 
  12. 123
  13. 1314
  14. 147
  15. 157
  16. 16 
  17. 172
  18. 1880
  19. 1916
  20. 2014
  21. 21 
  22. 22 
  23. 231
  24. 2423
  25. 2523
  26. 264
  27. 2720
  28. 285
  29. 2920
  30. 305
  31. 31 
All Critical High Medium Low Exploited only Public exploit

63 results · Clear filters · Feed

  • Unscored —
    CVE-2011-4789 Public exploit EPSS 64%

    Stack-based buffer overflow in magentservice.exe in the server in HP LoadRunner 11.00 before patch 4 allows remote atta…

  • Unscored —
    CVE-2011-4786 Public exploit EPSS 39%

    A certain ActiveX control in HPTicketMgr.dll in HP Easy Printer Care Software 2.5 and earlier allows remote attackers t…

  • Unscored —
    CVE-2012-0013 Public exploit EPSS 74%

    Incomplete blacklist vulnerability in the Windows Packager configuration in Microsoft Windows XP SP2 and SP3, Windows S…

  • High 8.1
    CVE-2012-0003 Public exploit EPSS 70%

    Unspecified vulnerability in winmm.dll in Windows Multimedia Library in Windows Media Player (WMP) in Microsoft Windows…

  • Unscored —
    CVE-2012-0007 Public exploit EPSS 19%

    The Microsoft Anti-Cross Site Scripting (AntiXSS) Library 3.x and 4.0 does not properly evaluate characters after the d…

  • Unscored —
    CVE-2011-4531 Public exploit

    Siemens Automation License Manager (ALM) 4.0 through 5.1+SP1+Upd1 allows remote attackers to cause a denial of service …

  • Unscored —
    CVE-2011-4529 Public exploit

    Multiple buffer overflows in Siemens Automation License Manager (ALM) 4.0 through 5.1+SP1+Upd1 allow remote attackers t…

  • Unscored —
    CVE-2011-4530 Public exploit

    Siemens Automation License Manager (ALM) 4.0 through 5.1+SP1+Upd1 does not properly copy fields obtained from clients, …

  • Unscored —
    CVE-2011-4532 Public exploit

    Absolute path traversal vulnerability in the ALMListView.ALMListCtrl ActiveX control in almaxcx.dll in the graphical us…

  • Unscored —
    CVE-2011-5057 Public exploit EPSS 27%

    Apache Struts 2.3.1.2 and earlier, 2.3.19-2.3.23, provides interfaces that do not properly restrict access to collectio…

  • Medium —
    CVE-2012-0394 Public exploit EPSS 73%

    Apache Struts's DebuggingInterceptor component allows remote code execution in developer mode

    The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itsel…

    org.apache.struts.xwork:xwork-core Maven
  • Medium —
    CVE-2012-0392 Public exploit EPSS 98%

    Apache Struts's CookieInterceptor component does not use the parameter-name whitelist

    The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.

    org.apache.struts:struts2-core org.apache.struts.xwork:xwork-core Maven
  • Critical 9.8
    CVE-2012-0391 Exploited Public exploit EPSS 76%

    Apache Struts Remote Java Code Execution

    The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a craf…

    org.apache.struts:struts2-core org.apache.struts.xwork:xwork-core Maven
    KEV Jan 21, 2022
  • Medium —
    CVE-2012-0393 Public exploit EPSS 36%

    Apache Struts's ParameterInterceptor component does not prevent access to public constructors

    The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary files via a crafted parameter that triggers the creation of a Java object.

    org.apache.struts:struts2-core org.apache.struts.xwork:xwork-core Maven
  • Unscored —
    CVE-2011-5053 Public exploit

    The Wi-Fi Protected Setup (WPS) protocol, when the "external registrar" authentication method is used, does not properl…

  • Medium —
    CVE-2011-4858 Public exploit EPSS 80%

    Improper Input Validation in Apache Tomcat

    Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption)…

    org.apache.tomcat:tomcat Maven
  • Unscored —
    CVE-2011-5019 Public exploit

    Cross-site scripting (XSS) vulnerability in setup/index.php in Textpattern CMS 4.4.1, when the product is incompletely …

  • Unscored —
    CVE-2011-5049 Public exploit

    MySQL 5.5.8, when running on Windows, allows remote attackers to cause a denial of service (NULL pointer dereference) v…

  • Unscored —
    CVE-2011-5050 Public exploit

    SQL injection vulnerability in corporate/Controller in Elitecore Technologies Cyberoam UTM before 10.01.2 build 059 all…

  • Unscored —
    CVE-2011-5052 Public exploit EPSS 30%

    Stack-based buffer overflow in CoCSoft Stream Down 6.8.0 allows remote web servers to execute arbitrary code via a long…

  • Unscored —
    CVE-2011-4643 Public exploit

    Multiple directory traversal vulnerabilities in Splunk 4.x before 4.2.5 allow remote authenticated users to read arbitr…

  • Unscored —
    CVE-2011-4642 Public exploit EPSS 29%

    mappy.py in Splunk Web in Splunk 4.2.x before 4.2.5 does not properly restrict use of the mappy command to access Pytho…

  • Unscored —
    CVE-2011-4644 Public exploit

    Splunk 4.2.5 and earlier, when a Free license is selected, enables potentially undesirable functionality within an envi…