# CVEs published 2011-10-12 50 CVEs were published on October 12, 2011: 0 critical, 2 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2011-0259](https://cve.now/CVE-2011-0259.md): CoreFoundation, as used in Apple iTunes before 10.5, does not properly perform string tokenization, which allows man-in-the-middle attackers (no CVSS) - [CVE-2011-2338](https://cve.now/CVE-2011-2338.md): WebKit, as used in Apple iTunes before 10.5, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memo (no CVSS) - [CVE-2011-2339](https://cve.now/CVE-2011-2339.md): WebKit, as used in Apple iTunes before 10.5, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memo (no CVSS) - [CVE-2011-2341](https://cve.now/CVE-2011-2341.md): WebKit, as used in Apple iTunes before 10.5, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memo (no CVSS) - [CVE-2011-2352](https://cve.now/CVE-2011-2352.md): WebKit, as used in Apple iTunes before 10.5, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memo (no CVSS) - [CVE-2011-2354](https://cve.now/CVE-2011-2354.md): WebKit, as used in Apple iTunes before 10.5, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memo (no CVSS) - [CVE-2011-2356](https://cve.now/CVE-2011-2356.md): WebKit, as used in Apple iTunes before 10.5, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memo (no CVSS) - [CVE-2011-2809](https://cve.now/CVE-2011-2809.md): WebKit, as used in Apple iTunes before 10.5, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memo (no CVSS) - [CVE-2011-2811](https://cve.now/CVE-2011-2811.md): WebKit, as used in Apple iTunes before 10.5, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memo (no CVSS) - [CVE-2011-2813](https://cve.now/CVE-2011-2813.md): WebKit, as used in Apple iTunes before 10.5, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memo (no CVSS) - [CVE-2011-2814](https://cve.now/CVE-2011-2814.md): WebKit, as used in Apple iTunes before 10.5, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memo (no CVSS) - [CVE-2011-2815](https://cve.now/CVE-2011-2815.md): WebKit, as used in Apple iTunes before 10.5, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memo (no CVSS) - [CVE-2011-2816](https://cve.now/CVE-2011-2816.md): WebKit, as used in Apple iTunes before 10.5, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memo (no CVSS) - [CVE-2011-2817](https://cve.now/CVE-2011-2817.md): WebKit, as used in Apple iTunes before 10.5, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memo (no CVSS) - [CVE-2011-2820](https://cve.now/CVE-2011-2820.md): WebKit, as used in Apple iTunes before 10.5, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memo (no CVSS) - [CVE-2011-2831](https://cve.now/CVE-2011-2831.md): WebKit, as used in Apple iTunes before 10.5, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memo (no CVSS) - [CVE-2011-3219](https://cve.now/CVE-2011-3219.md): Buffer overflow in CoreMedia, as used in Apple iTunes before 10.5, allows remote attackers to execute arbitrary code or cause a denial of se (no CVSS) - [CVE-2011-3233](https://cve.now/CVE-2011-3233.md): WebKit, as used in Apple iTunes before 10.5, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memo (no CVSS) - [CVE-2011-3235](https://cve.now/CVE-2011-3235.md): WebKit, as used in Apple iTunes before 10.5, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memo (no CVSS) - [CVE-2011-3236](https://cve.now/CVE-2011-3236.md): WebKit, as used in Apple iTunes before 10.5, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memo (no CVSS) - [CVE-2011-3237](https://cve.now/CVE-2011-3237.md): WebKit, as used in Apple iTunes before 10.5, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memo (no CVSS) - [CVE-2011-3238](https://cve.now/CVE-2011-3238.md): WebKit, as used in Apple iTunes before 10.5, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memo (no CVSS) - [CVE-2011-3239](https://cve.now/CVE-2011-3239.md): WebKit, as used in Apple iTunes before 10.5, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memo (no CVSS) - [CVE-2011-3241](https://cve.now/CVE-2011-3241.md): WebKit, as used in Apple iTunes before 10.5, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memo (no CVSS) - [CVE-2011-3244](https://cve.now/CVE-2011-3244.md): WebKit, as used in Apple iTunes before 10.5, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memo (no CVSS) - [CVE-2011-3252](https://cve.now/CVE-2011-3252.md): Buffer overflow in CoreAudio, as used in Apple iTunes before 10.5, allows remote attackers to execute arbitrary code or cause a denial of se (no CVSS) - [CVE-2011-1247](https://cve.now/CVE-2011-1247.md): Untrusted search path vulnerability in the Microsoft Active Accessibility component in Microsoft Windows XP SP2 and SP3, Windows Server 2003 (no CVSS) - [CVE-2011-1253](https://cve.now/CVE-2011-1253.md): Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5.1, and 4, and Silverlight 4 before 4.0.60831, does not properly restrict inheritance (no CVSS) - [CVE-2011-1895](https://cve.now/CVE-2011-1895.md): CRLF injection vulnerability in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, Update 1, Update 2, and SP1 allows remote attack (no CVSS) - [CVE-2011-1896](https://cve.now/CVE-2011-1896.md): Cross-site scripting (XSS) vulnerability in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, Update 1, Update 2, and SP1 allows r (no CVSS) - [CVE-2011-1897](https://cve.now/CVE-2011-1897.md): Cross-site scripting (XSS) vulnerability in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, Update 1, Update 2, and SP1 allows r (no CVSS) - [CVE-2011-1969](https://cve.now/CVE-2011-1969.md): Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, Update 1, Update 2, and SP1 provides the MicrosoftClient.jar file containing a s (no CVSS) - [CVE-2011-1985](https://cve.now/CVE-2011-1985.md): win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 S (CVSS 7.1) - [CVE-2011-1993](https://cve.now/CVE-2011-1993.md): Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code (no CVSS) - [CVE-2011-1995](https://cve.now/CVE-2011-1995.md): Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code (no CVSS) - [CVE-2011-1996](https://cve.now/CVE-2011-1996.md): Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code (no CVSS) - [CVE-2011-1997](https://cve.now/CVE-2011-1997.md): Microsoft Internet Explorer 6 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessi (no CVSS) - [CVE-2011-1998](https://cve.now/CVE-2011-1998.md): Microsoft Internet Explorer 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessi (no CVSS) - [CVE-2011-1999](https://cve.now/CVE-2011-1999.md): Microsoft Internet Explorer 8 does not properly allocate and access memory, which allows remote attackers to execute arbitrary code via vect (no CVSS) - [CVE-2011-2000](https://cve.now/CVE-2011-2000.md): Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code (no CVSS) - [CVE-2011-2001](https://cve.now/CVE-2011-2001.md): Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code (no CVSS) - [CVE-2011-2002](https://cve.now/CVE-2011-2002.md): win32k.sys in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 do (no CVSS) - [CVE-2011-2003](https://cve.now/CVE-2011-2003.md): Buffer overflow in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Wi (no CVSS) - [CVE-2011-2005](https://cve.now/CVE-2011-2005.md): afd.sys in the Ancillary Function Driver in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly validate user-mode input (CVSS 7.8, KEV) - [CVE-2011-2007](https://cve.now/CVE-2011-2007.md): Microsoft Host Integration Server (HIS) 2004 SP1, 2006 SP1, 2009, and 2010 allows remote attackers to cause a denial of service (SNA Server (no CVSS) - [CVE-2011-2008](https://cve.now/CVE-2011-2008.md): Microsoft Host Integration Server (HIS) 2004 SP1, 2006 SP1, 2009, and 2010 allows remote attackers to cause a denial of service (SNA Server (no CVSS) - [CVE-2011-2009](https://cve.now/CVE-2011-2009.md): Untrusted search path vulnerability in Windows Media Center in Microsoft Windows Vista SP2 and Windows 7 Gold and SP1, and Windows Media Cen (no CVSS) - [CVE-2011-2011](https://cve.now/CVE-2011-2011.md): Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows (no CVSS) - [CVE-2011-2012](https://cve.now/CVE-2011-2012.md): Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, Update 1, Update 2, and SP1 does not properly validate session cookies, which al (no CVSS) - [CVE-2011-3155](https://cve.now/CVE-2011-3155.md): Unspecified vulnerability in HP Onboard Administrator (OA) 3.21 through 3.31 allows remote attackers to bypass intended access restrictions (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2011-10-12 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.