# CVEs published 2011-12-14

37 CVEs were published on December 14, 2011: 0 critical, 1 high. Days are UTC.

- [CVE-2011-2463](https://cve.now/CVE-2011-2463.md): Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 8.0 through 9.0.1 allows remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2011-2741](https://cve.now/CVE-2011-2741.md): EMC RSA Adaptive Authentication On-Premise (AAOP) 6.0.2.1 SP1 Patch 2, SP1 Patch 3, SP2, SP2 Patch 1, and SP3 does not properly implement De (no CVSS)
- [CVE-2011-2742](https://cve.now/CVE-2011-2742.md): EMC RSA Adaptive Authentication On-Premise (AAOP) 6.0.2.1 SP1 Patch 2, SP1 Patch 3, SP2, SP2 Patch 1, and SP3 does not properly perform fore (no CVSS)
- [CVE-2011-4368](https://cve.now/CVE-2011-4368.md): Cross-site scripting (XSS) vulnerability in Remote Development Services (RDS) in Adobe ColdFusion 8.0 through 9.0.1 allows remote attackers (no CVSS)
- [CVE-2011-1508](https://cve.now/CVE-2011-1508.md): Microsoft Publisher 2003 SP3, and 2007 SP2 and SP3, does not properly manage memory allocations for function pointers, which allows user-ass (no CVSS)
- [CVE-2011-1983](https://cve.now/CVE-2011-1983.md): Use-after-free vulnerability in Microsoft Office 2007 SP2 and SP3, Office 2010 Gold and SP1, and Office for Mac 2011 allows remote attackers (no CVSS)
- [CVE-2011-1992](https://cve.now/CVE-2011-1992.md): The XSS Filter in Microsoft Internet Explorer 8 allows remote attackers to read content from a different (1) domain or (2) zone via a "trial (no CVSS)
- [CVE-2011-2010](https://cve.now/CVE-2011-2010.md): The Microsoft Office Input Method Editor (IME) for Simplified Chinese in Microsoft Pinyin IME 2010, Office Pinyin SimpleFast Style 2010, and (no CVSS)
- [CVE-2011-2018](https://cve.now/CVE-2011-2018.md): The kernel in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, and Windows 7 Gold and (no CVSS)
- [CVE-2011-2019](https://cve.now/CVE-2011-2019.md): Untrusted search path vulnerability in Microsoft Internet Explorer 9 on Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1 allows (no CVSS)
- [CVE-2011-3396](https://cve.now/CVE-2011-3396.md): Untrusted search path vulnerability in Microsoft PowerPoint 2007 SP2 and 2010 allows local users to gain privileges via a Trojan horse DLL i (no CVSS)
- [CVE-2011-3397](https://cve.now/CVE-2011-3397.md): The Microsoft Time component in DATIME.DLL in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows remote attackers to execute arbitr (no CVSS)
- [CVE-2011-3400](https://cve.now/CVE-2011-3400.md): Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 do not properly handle OLE objects in memory, which allows remote attackers to execute (no CVSS)
- [CVE-2011-3401](https://cve.now/CVE-2011-3401.md): ENCDEC.DLL in Windows Media Player and Media Center in Microsoft Windows XP SP2 and SP3, Windows Vista SP2, and Windows 7 Gold and SP1 allow (no CVSS)
- [CVE-2011-3403](https://cve.now/CVE-2011-3403.md): Microsoft Excel 2003 SP3 and Office 2004 for Mac do not properly handle objects in memory, which allows remote attackers to execute arbitrar (no CVSS)
- [CVE-2011-3404](https://cve.now/CVE-2011-3404.md): Microsoft Internet Explorer 6 through 9 does not properly use the Content-Disposition HTTP header to control rendering of the HTTP response (no CVSS)
- [CVE-2011-3406](https://cve.now/CVE-2011-3406.md): Buffer overflow in Active Directory, Active Directory Application Mode (ADAM), and Active Directory Lightweight Directory Service (AD LDS) i (CVSS 8.8)
- [CVE-2011-3408](https://cve.now/CVE-2011-3408.md): Csrsrv.dll in the Client/Server Run-time Subsystem (aka CSRSS) in the Win32 subsystem in Microsoft Windows XP SP2 and SP3, Windows Server 20 (no CVSS)
- [CVE-2011-3410](https://cve.now/CVE-2011-3410.md): Array index error in Microsoft Publisher 2003 SP3, and 2007 SP2 and SP3, allows remote attackers to execute arbitrary code via a crafted Pub (no CVSS)
- [CVE-2011-3411](https://cve.now/CVE-2011-3411.md): Microsoft Publisher 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Publisher file that leverages incorrect handlin (no CVSS)
- [CVE-2011-3412](https://cve.now/CVE-2011-3412.md): Microsoft Publisher 2003 SP3, and 2007 SP2 and SP3, allows remote attackers to execute arbitrary code via a crafted Publisher file that leve (no CVSS)
- [CVE-2011-3413](https://cve.now/CVE-2011-3413.md): Microsoft PowerPoint 2007 SP2; Office 2008 for Mac; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2; and Pow (no CVSS)
- [CVE-2011-4800](https://cve.now/CVE-2011-4800.md): Directory traversal vulnerability in Serv-U FTP Server before 11.1.0.5 allows remote authenticated users to read and write arbitrary files, (no CVSS)
- [CVE-2011-4801](https://cve.now/CVE-2011-4801.md): SQL injection vulnerability in akeyActivationLogin.do in Authenex Web Management Control in Authenex Strong Authentication System (ASAS) Ser (no CVSS)
- [CVE-2011-4802](https://cve.now/CVE-2011-4802.md): Multiple SQL injection vulnerabilities in Dolibarr 3.1.0 RC and probably earlier allow remote authenticated users to execute arbitrary SQL c (no CVSS)
- [CVE-2011-4803](https://cve.now/CVE-2011-4803.md): SQL injection vulnerability in wptouch/ajax.php in the WPTouch plugin for WordPress allows remote attackers to execute arbitrary SQL command (no CVSS)
- [CVE-2011-4804](https://cve.now/CVE-2011-4804.md): Directory traversal vulnerability in the obSuggest (com\_obsuggest) component before 1.8 for Joomla! allows remote attackers to read arbitrar (no CVSS)
- [CVE-2011-4805](https://cve.now/CVE-2011-4805.md): Cross-site scripting (XSS) vulnerability in pubDBLogon.jsp in SAP Crystal Report Server 2008 allows remote attackers to inject arbitrary web (no CVSS)
- [CVE-2011-4806](https://cve.now/CVE-2011-4806.md): Multiple cross-site scripting (XSS) vulnerabilities in main.php in phpAlbum 0.4.1.16 and earlier allow remote attackers to inject arbitrary (no CVSS)
- [CVE-2011-4807](https://cve.now/CVE-2011-4807.md): Directory traversal vulnerability in main.php in phpAlbum 0.4.1.16 and earlier allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2011-4808](https://cve.now/CVE-2011-4808.md): SQL injection vulnerability in the HM Community (com\_hmcommunity) component before 1.01 for Joomla! allows remote attackers to execute arbit (no CVSS)
- [CVE-2011-4809](https://cve.now/CVE-2011-4809.md): Multiple cross-site scripting (XSS) vulnerabilities in the HM Community (com\_hmcommunity) component before 1.01 for Joomla! allow remote att (no CVSS)
- [CVE-2011-4810](https://cve.now/CVE-2011-4810.md): Multiple directory traversal vulnerabilities in WHMCompleteSolution (WHMCS) 3.x and 4.x allow remote attackers to read arbitrary files via t (no CVSS)
- [CVE-2011-4811](https://cve.now/CVE-2011-4811.md): SQL injection vulnerability in pokaz\_podkat.php in BestShopPro allows remote attackers to execute arbitrary SQL commands via the str paramet (no CVSS)
- [CVE-2011-4812](https://cve.now/CVE-2011-4812.md): Cross-site scripting (XSS) vulnerability in nowosci.php in BestShopPro allows remote attackers to inject arbitrary web script or HTML via th (no CVSS)
- [CVE-2011-4813](https://cve.now/CVE-2011-4813.md): Directory traversal vulnerability in clientarea.php in WHMCompleteSolution (WHMCS) 3.x.x allows remote attackers to read arbitrary files via (no CVSS)
- [CVE-2011-4814](https://cve.now/CVE-2011-4814.md): Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 3.1.0 RC and probably earlier allow remote attackers to inject arbitrary web (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2011-12-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.