CVEs published in December 2011

352 vulnerabilities, 77 critical, 2 exploited.

• steve j baker plib Buffer overflow in the ulSetError function in util/ulError.cxx in PLIB 1.8.5, as used in TORCS 1... CVE-2011-4620 Public exploitFix available EPSS 12.6% 9.3 HighDecember 31, 2011
• python virtualenv Virtualenv Allows Symlink Attack on /tmp/ CVE-2011-4617 Fix available 1.2 LowDecember 31, 2011
• novell xtier framework Multiple integer overflows in the HTTP server in the Novell XTier framework 3.1.8 allow remote... CVE-2011-1710 7.5 HighDecember 31, 2011
• redhat libvirt, canonical ubuntu linux +1 more The networkReloadIptablesRules function in network/bridge_driver.c in libvirt before 0.9.9 does... CVE-2011-4600 Fix available 5.9 MediumDecember 31, 2011
• microsoft windows 7, windows server 2003, windows server 2008 +2 more +4 more The Graphics Device Interface (GDI) in win32k.sys in the kernel-mode drivers in Microsoft Windows... CVE-2011-5046 Public exploit EPSS 45.3% 9.3 HighDecember 30, 2011
• jjwdesign php booking calendar Cross-site scripting (XSS) vulnerability in details_view.php in PHP Booking Calendar 10e allows... CVE-2011-5045 Public exploit 4.3 MediumDecember 30, 2011
• sopcast SopCast 3.4.7.45585 uses weak permissions (Everyone:Full Control) for Diagnose.exe, which allows... CVE-2011-5044 Public exploit 7.2 HighDecember 30, 2011
• tomatosoft free mp3 player TomatoSoft Free Mp3 Player 1.0 allows remote attackers to cause a denial of service (application... CVE-2011-5043 Public exploit 4.3 MediumDecember 30, 2011
• gphemsley sasha Cross-site scripting (XSS) vulnerability in inc/lib/lib.base.php in SASHA 0.2.0 allows remote... CVE-2011-5042 4.3 MediumDecember 30, 2011
• pulsecms pulse cms Multiple cross-site scripting (XSS) vulnerabilities in Pulse Pro CMS 1.7.2 allow remote attackers... CVE-2011-5041 Public exploit 4.3 MediumDecember 30, 2011
• infoproject biznis heroj Multiple cross-site scripting (XSS) vulnerabilities in Infoproject Biznis Heroj allow remote... CVE-2011-5040 Public exploit 4.3 MediumDecember 30, 2011
• infoproject biznis heroj Multiple SQL injection vulnerabilities in Infoproject Biznis Heroj allow remote attackers to... CVE-2011-5039 Public exploit 7.5 HighDecember 30, 2011
• hitcode hitappoint SQL injection vulnerability in hitCode hitAppoint 4.5.17 and possibly earlier allows remote... CVE-2011-5038 7.5 HighDecember 30, 2011
• google v8 Google V8 computes hash values for form parameters without restricting the ability to trigger... CVE-2011-5037 5.0 MediumDecember 30, 2011
• rack project rack Rack Gem Subject to Denial of Service via Hash Collisions CVE-2011-5036 Fix available 5.0 MediumDecember 30, 2011
• oracle glassfish server Oracle Glassfish 2.1.1, 3.0.1, and 3.1.1, as used in Communications Server 2.0, Sun Java System... CVE-2011-5035 Public exploitFix available EPSS 68.2% 5.0 MediumDecember 30, 2011
• apache geronimo Apache Geronimo Hash Collisions Cause DoS CVE-2011-5034 Public exploitFix available EPSS 80.6% 7.8 HighDecember 30, 2011
• php PHP before 5.3.9 computes hash values for form parameters without restricting the ability to... CVE-2011-4885 Public exploitFix available EPSS 83.4% 5.0 MediumDecember 30, 2011
• jruby JRuby before 1.6.5.1 computes hash values without restricting the ability to trigger hash... CVE-2011-4838 Fix available 5.0 MediumDecember 30, 2011
• ruby-lang ruby Ruby (aka CRuby) before 1.8.7-p357 computes hash values without restricting the ability to... CVE-2011-4815 Fix available 7.8 HighDecember 30, 2011
• plone Plone Denial of Service vulnerability CVE-2011-4462 Fix available 5.0 MediumDecember 30, 2011
• microsoft windows 7, windows server 2003, windows server 2008 +2 more +4 more The Forms Authentication feature in the ASP.NET subsystem in Microsoft .NET Framework 1.1 SP1, 2... CVE-2011-3417 EPSS 34.3% 9.3 HighDecember 30, 2011
• microsoft windows 7, windows server 2003, windows server 2008 +2 more +4 more The Forms Authentication feature in the ASP.NET subsystem in Microsoft .NET Framework 1.1 SP1, 2... CVE-2011-3416 EPSS 43.7% 8.5 HighDecember 30, 2011
• microsoft windows 7, windows server 2003, windows server 2008 +2 more +4 more Open redirect vulnerability in the Forms Authentication feature in the ASP.NET subsystem in... CVE-2011-3415 EPSS 23.0% 6.8 MediumDecember 30, 2011
• microsoft windows 7, windows server 2003, windows server 2008 +2 more +4 more The CaseInsensitiveHashProvider.getHashCode function in the HashTable implementation in the ASP... CVE-2011-3414 EPSS 57.7% 7.8 HighDecember 30, 2011
• movabletype-opensource Debian movabletype-opensource - several DSA-2263-2 Fix available No scoreDecember 30, 2011
• configserver security firewall Stack-based buffer overflow in CFS.c in ConfigServer Security & Firewall (CSF) before 5.43, when... CVE-2011-5033 Public exploit 4.4 MediumDecember 29, 2011
• winmount WMDrive.sys 3.4.181.224 in WinMount 3.5.1018 allows local users to cause a denial of service ... CVE-2011-5032 4.9 MediumDecember 29, 2011
• shilpisoft capexweb Multiple SQL injection vulnerabilities in servlet/capexweb.parentvalidatepassword in cApexWEB 1.1... CVE-2011-5031 Public exploit 7.5 HighDecember 29, 2011
• valthbald meta tags quick Cross-site scripting (XSS) vulnerability in the Meta tags quick module 7.x-2.x before 7.x-2.3 for... CVE-2011-5030 3.5 LowDecember 29, 2011
• alexander palmo simple php blog Multiple cross-site scripting (XSS) vulnerabilities in Simple PHP Blog 0.7.0 and possibly earlier... CVE-2011-5029 4.3 MediumDecember 29, 2011
• novell sentinel log manager Directory traversal vulnerability in novelllogmanager/FileDownload in Novell Sentinel Log Manager... CVE-2011-5028 Public exploit 4.0 MediumDecember 29, 2011
• zabbix Cross-site scripting (XSS) vulnerability in ZABBIX before 1.8.10 allows remote attackers to... CVE-2011-5027 Fix available 4.3 MediumDecember 29, 2011
• zabbix Multiple cross-site scripting (XSS) vulnerabilities in Zabbix before 1.8.10 allow remote... CVE-2011-4615 Fix available 4.3 MediumDecember 29, 2011
• hp database archiving software Unspecified vulnerability in HP Database Archiving Software 6.31 allows remote attackers to... CVE-2011-4165 10.0 HighDecember 29, 2011
• hp database archiving software Unspecified vulnerability in HP Database Archiving Software 6.31 allows remote attackers to... CVE-2011-4164 10.0 HighDecember 29, 2011
• hp database archiving software Unspecified vulnerability in HP Database Archiving Software 6.31 allows remote attackers to... CVE-2011-4163 10.0 HighDecember 29, 2011
• yaws Multiple cross-site scripting (XSS) vulnerabilities in the wiki application in Yaws 1.88 allow... CVE-2011-5025 Public exploitFix available 4.3 MediumDecember 29, 2011
• gnu mailman Cross-site scripting (XSS) vulnerability in mmsearch/design in the Mailman/htdig integration... CVE-2011-5024 4.3 MediumDecember 29, 2011
• pligg cms Cross-site scripting (XSS) vulnerability in Pligg CMS 1.1.4 allows remote attackers to inject... CVE-2011-5023 Public exploit 4.3 MediumDecember 29, 2011
• pligg cms SQL injection vulnerability in search.php in Pligg CMS 1.1.2 allows remote attackers to execute... CVE-2011-5022 Public exploit 7.5 HighDecember 29, 2011
• winn guestbook Cross-site scripting (XSS) vulnerability in the addPost function in data/functions.php in Winn... CVE-2011-5026 Public exploit 4.3 MediumDecember 29, 2011
• phpids PHPIDS before 0.7 does not properly implement Regular Expression Denial of Service (ReDoS)... CVE-2011-5021 7.5 HighDecember 29, 2011
• mortbay jetty, oracle sun storage common array manager +1 more Improper Input Validation in Jetty CVE-2011-4461 Fix available 5.3 MediumDecember 29, 2011
• goahead webserver GoAhead WebServer allows remote attackers to cause a denial of service (daemon outage) via... CVE-2009-5111 5.0 MediumDecember 27, 2011
• dhttpd dhttpd allows remote attackers to cause a denial of service (daemon outage) via partial HTTP... CVE-2009-5110 5.0 MediumDecember 27, 2011
• apache http server The Apache HTTP Server 1.x and 2.x allows remote attackers to cause a denial of service (daemon... CVE-2007-6750 Public exploitFix available EPSS 70.5% 5.0 MediumDecember 27, 2011
• google idapython The IDAPython plugin before 1.5.2.3 in IDA Pro allows user-assisted remote attackers to execute... CVE-2011-4783 9.3 HighDecember 27, 2011
• wpsymposiumpro wp symposium Cross-site scripting (XSS) vulnerability in uploadify/get_profile_avatar.php in the WP Symposium... CVE-2011-3841 4.3 MediumDecember 27, 2011
• ibm lotus domino Unspecified vulnerability in the authentication functionality in the server in IBM Lotus Domino 8... CVE-2011-1393 7.8 HighDecember 27, 2011
• Show olderLoading…