# CVEs published 2011-12-08

22 CVEs were published on December 8, 2011: 0 critical, 0 high. Days are UTC.

- [CVE-2011-0291](https://cve.now/CVE-2011-0291.md): The BlackBerry PlayBook service on the Research In Motion (RIM) BlackBerry PlayBook tablet with software before 1.0.8.6067 allows local user (no CVSS)
- [CVE-2011-1530](https://cve.now/CVE-2011-1530.md): The process\_tgs\_req function in do\_tgs\_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.9 through 1.9.2 allows remo (no CVSS)
- [CVE-2011-4128](https://cve.now/CVE-2011-4128.md): Buffer overflow in the gnutls\_session\_get\_data function in lib/gnutls\_session.c in GnuTLS 2.12.x before 2.12.14 and 3.x before 3.0.7, when u (no CVSS)
- [CVE-2011-4315](https://cve.now/CVE-2011-4315.md): Heap-based buffer overflow in compression-pointer processing in core/ngx\_resolver.c in nginx before 1.0.10 allows remote resolvers to cause (no CVSS)
- [CVE-2011-2917](https://cve.now/CVE-2011-2917.md): SQL injection vulnerability in administrator/index2.php in Mambo CMS 4.6.5 and earlier allows remote attackers to execute arbitrary SQL comm (no CVSS)
- [CVE-2011-4707](https://cve.now/CVE-2011-4707.md): Multiple cross-site scripting (XSS) vulnerabilities in the Virus Scan Interface in SAP Netweaver allow remote attackers to inject arbitrary (no CVSS)
- [CVE-2011-4708](https://cve.now/CVE-2011-4708.md): Cross-site scripting (XSS) vulnerability in IBM Rational Asset Manager before 7.5.1 allows remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2011-4709](https://cve.now/CVE-2011-4709.md): Multiple cross-site scripting (XSS) vulnerabilities in Hotaru.php in the Search plugin 1.3 for Hotaru CMS allow remote attackers to inject a (no CVSS)
- [CVE-2011-4710](https://cve.now/CVE-2011-4710.md): Multiple SQL injection vulnerabilities in Pixie CMS 1.01 through 1.04 allow remote attackers to execute arbitrary SQL commands via the (1) p (no CVSS)
- [CVE-2011-4711](https://cve.now/CVE-2011-4711.md): Multiple directory traversal vulnerabilities in namazu.cgi in Namazu before 2.0.16 allow remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2011-4712](https://cve.now/CVE-2011-4712.md): Directory traversal vulnerability in Oxide WebServer allows remote attackers to read arbitrary files via a ..\\ (dot dot backslash) in an HTT (no CVSS)
- [CVE-2011-4713](https://cve.now/CVE-2011-4713.md): Directory traversal vulnerability in catalog/content.php in osCSS2 2.1.0 and earlier allows remote attackers to read arbitrary files via a . (no CVSS)
- [CVE-2011-4714](https://cve.now/CVE-2011-4714.md): Directory traversal vulnerability in Virtual Vertex Muster before 6.20 allows remote attackers to read arbitrary files via a \\.. (no CVSS)
- [CVE-2011-4715](https://cve.now/CVE-2011-4715.md): Directory traversal vulnerability in cgi-bin/koha/mainpage.pl in Koha 3.4 before 3.4.7 and 3.6 before 3.6.1, and LibLime Koha 4.2 and earlie (no CVSS)
- [CVE-2011-4716](https://cve.now/CVE-2011-4716.md): Directory traversal vulnerability in file in DreamBox DM800 1.6rc3, 1.5rc1, and earlier allows remote attackers to read arbitrary files via (no CVSS)
- [CVE-2011-2653](https://cve.now/CVE-2011-2653.md): Directory traversal vulnerability in the rtrlet component in Novell ZENworks Asset Management (ZAM) 7.5 allows remote attackers to execute a (no CVSS)
- [CVE-2011-3179](https://cve.now/CVE-2011-3179.md): The server process in Novell Messenger 2.1 and 2.2.x before 2.2.1, and Novell GroupWise Messenger 2.04 and earlier, allows remote attackers (no CVSS)
- [CVE-2011-3636](https://cve.now/CVE-2011-3636.md): Cross-site request forgery (CSRF) vulnerability in the management interface in FreeIPA before 2.1.4 allows remote attackers to hijack the au (no CVSS)
- [CVE-2011-4054](https://cve.now/CVE-2011-4054.md): Cross-site scripting (XSS) vulnerability in login.fcc in CA SiteMinder R6 SP6 before CR7 and R12 SP3 before CR8 allows remote attackers to i (no CVSS)
- [CVE-2011-4264](https://cve.now/CVE-2011-4264.md): Cross-site scripting (XSS) vulnerability in Etomite before 1.1 allows remote attackers to inject arbitrary web script or HTML via unspecifie (no CVSS)
- [CVE-2011-4265](https://cve.now/CVE-2011-4265.md): Cross-site scripting (XSS) vulnerability in phpWebSite before 1.0.0 allows remote attackers to inject arbitrary web script or HTML via unspe (no CVSS)
- [CVE-2011-4539](https://cve.now/CVE-2011-4539.md): dhcpd in ISC DHCP 4.x before 4.2.3-P1 and 4.1-ESV before 4.1-ESV-R4 does not properly handle regular expressions in dhcpd.conf, which allows (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2011-12-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.