Skip to content
OpenAdvisories

Archive

January 2012

Vulnerabilities first published in this month (UTC), newest first.

← December 2011 2012 / January February 2012 →
  1. 1 
  2. 24
  3. 37
  4. 410
  5. 53
  6. 611
  7. 73
  8. 818
  9. 9 
  10. 1014
  11. 11 
  12. 123
  13. 1314
  14. 147
  15. 157
  16. 16 
  17. 172
  18. 1880
  19. 1916
  20. 2014
  21. 21 
  22. 22 
  23. 231
  24. 2423
  25. 2523
  26. 264
  27. 2720
  28. 285
  29. 2920
  30. 305
  31. 31 
All Critical High Medium Low Exploited only Public exploit

14 results · Clear filters · Feed

  • Medium 6.5
    CVE-2012-0814

    The auth_parse_options function in auth-options.c in sshd in OpenSSH before 5.7 provides debug messages containing auth…

    openssh Debian
  • Medium —
    CVE-2011-4314

    OpenID4Java does not verify that Attribute Exchange (AX) information is signed

    message/ax/AxMessage.java in OpenID4Java before 0.9.6 final, as used in JBoss Enterprise Application Platform 5.1 before 5.1.2, Step2, Kay Framework before 1.0.2, and possibly other products does not verify that Attribute Exchange (AX) information is signed, …

    org.openid4java:openid4java openid4java Debian Maven
  • Medium —
    CVE-2011-1941

    phpMyAdmin Open Redirect in redirector

    Open redirect vulnerability in the redirector feature in phpMyAdmin 3.4.x before 3.4.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

    phpmyadmin phpmyadmin/phpmyadmin Debian Packagist
  • Medium —
    CVE-2011-3375

    Apache Tomcat Exposes IP Addresses and HTTP Headers of Requests

    Apache Tomcat 6.0.30 through 6.0.33 and 7.x before 7.0.22 does not properly perform certain caching and recycling operations involving request objects, which allows remote attackers to obtain unintended read access to IP address and HTTP header information in…

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2012-0022 EPSS 10%

    Denial of Service in Apache Tomcat

    Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach for handling parameters, which allows remote attackers to cause a denial of service (CPU consumption) via a request that contains many parameters and para…

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2011-1184

    Authentication Bypass in Apache Tomcat

    The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not have the expected countermeasures against replay attacks, which makes it easier for remote attackers to bypass intende…

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2011-5064

    Use of Hard-coded Cryptographic Key in Apache Tomcat

    DigestAuthenticator.java in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 uses Catalina as the hard-coded server secret (aka private key), which makes it easier for remote a…

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2011-5063

    Improper Authentication in Apache Tomcat

    The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check realm values, which might allow remote attackers to bypass intended access restrictions by leveraging the availa…

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2011-5062

    Improper Authentication in Apache Tomcat

    The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check qop values, which might allow remote attackers to bypass intended integrity-protection requirements via a qop=au…

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2012-0394 Public exploit EPSS 73%

    Apache Struts's DebuggingInterceptor component allows remote code execution in developer mode

    The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itsel…

    org.apache.struts.xwork:xwork-core Maven
  • Medium —
    CVE-2012-0392 Public exploit EPSS 98%

    Apache Struts's CookieInterceptor component does not use the parameter-name whitelist

    The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.

    org.apache.struts:struts2-core org.apache.struts.xwork:xwork-core Maven
  • Medium —
    CVE-2012-0393 Public exploit EPSS 36%

    Apache Struts's ParameterInterceptor component does not prevent access to public constructors

    The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary files via a crafted parameter that triggers the creation of a Java object.

    org.apache.struts:struts2-core org.apache.struts.xwork:xwork-core Maven
  • Medium —
    CVE-2011-4858 Public exploit EPSS 80%

    Improper Input Validation in Apache Tomcat

    Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption)…

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2011-4905

    Denial of Service in Apache ActiveMQ

    Apache ActiveMQ before 5.6.0 allows remote attackers to cause a denial of service (file-descriptor exhaustion and broker crash or hang) by sending many openwire failover:tcp:// connection requests.

    activemq org.apache.activemq:activemq-core Debian Maven