# CVEs published 2011-12-15

22 CVEs were published on December 15, 2011: 0 critical, 0 high. Days are UTC.

- [CVE-2011-4339](https://cve.now/CVE-2011-4339.md): ipmievd (aka the IPMI event daemon) in OpenIPMI, as used in the ipmitool package 1.8.11 in Red Hat Enterprise Linux (RHEL) 6, Debian GNU/Lin (no CVSS)
- [CVE-2011-4516](https://cve.now/CVE-2011-4516.md): Heap-based buffer overflow in the jpc\_cox\_getcompparms function in libjasper/jpc/jpc\_cs.c in JasPer 1.900.1 allows remote attackers to execu (no CVSS)
- [CVE-2011-4517](https://cve.now/CVE-2011-4517.md): The jpc\_crg\_getparms function in libjasper/jpc/jpc\_cs.c in JasPer 1.900.1 uses an incorrect data type during a certain size calculation, whi (no CVSS)
- [CVE-2011-4597](https://cve.now/CVE-2011-4597.md): The SIP over UDP implementation in Asterisk Open Source 1.4.x before 1.4.43, 1.6.x before 1.6.2.21, and 1.8.x before 1.8.7.2 uses different (no CVSS)
- [CVE-2011-4598](https://cve.now/CVE-2011-4598.md): The handle\_request\_info function in channels/chan\_sip.c in Asterisk Open Source 1.6.2.x before 1.6.2.21 and 1.8.x before 1.8.7.2, when autom (no CVSS)
- [CVE-2011-4606](https://cve.now/CVE-2011-4606.md): Artsoft Entertainment Rocks'n'Diamonds (aka rocksndiamonds) 3.3.0.1 allows local users to overwrite arbitrary files via a symlink attack on (no CVSS)
- [CVE-2011-4822](https://cve.now/CVE-2011-4822.md): Multiple cross-site scripting (XSS) vulnerabilities in the user profile feature in Atlassian FishEye before 2.5.5 allow remote attackers to (no CVSS)
- [CVE-2011-4823](https://cve.now/CVE-2011-4823.md): Multiple SQL injection vulnerabilities in Vik Real Estate (com\_vikrealestate) component 1.0 for Joomla! allow remote attackers to execute ar (no CVSS)
- [CVE-2011-4824](https://cve.now/CVE-2011-4824.md): SQL injection vulnerability in auth\_login.php in Cacti before 0.8.7h allows remote attackers to execute arbitrary SQL commands via the login (no CVSS)
- [CVE-2011-4825](https://cve.now/CVE-2011-4825.md): Static code injection vulnerability in inc/function.base.php in Ajax File and Image Manager before 1.1, as used in tinymce before 1.4.2, php (no CVSS)
- [CVE-2011-4826](https://cve.now/CVE-2011-4826.md): SQL injection vulnerability in session.php in AutoSec Tools V-CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the user (no CVSS)
- [CVE-2011-4827](https://cve.now/CVE-2011-4827.md): Multiple cross-site scripting (XSS) vulnerabilities in AutoSec Tools V-CMS 1.0 allow remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2011-4828](https://cve.now/CVE-2011-4828.md): Unrestricted file upload vulnerability in includes/inline\_image\_upload.php in AutoSec Tools V-CMS 1.0 allows remote attackers to execute arb (no CVSS)
- [CVE-2011-4829](https://cve.now/CVE-2011-4829.md): SQL injection vulnerability in the com\_listing component in Barter Sites component 1.3 for Joomla! allows remote attackers to execute arbitr (no CVSS)
- [CVE-2011-4830](https://cve.now/CVE-2011-4830.md): Multiple cross-site scripting (XSS) vulnerabilities in the com\_listing component in Barter Sites component 1.3 for Joomla! allow remote auth (no CVSS)
- [CVE-2011-4831](https://cve.now/CVE-2011-4831.md): Directory traversal vulnerability in webFileBrowser.php in Web File Browser 0.4b14 allows remote authenticated users to read arbitrary files (no CVSS)
- [CVE-2011-4832](https://cve.now/CVE-2011-4832.md): Directory traversal vulnerability in CaupoShop Pro 2.x, CaupoShop Classic 3.01, and CaupoShop Pro 3.70 and earlier allows remote attackers t (no CVSS)
- [CVE-2011-4833](https://cve.now/CVE-2011-4833.md): Multiple SQL injection vulnerabilities in the Leads module in SugarCRM 6.1 before 6.1.7, 6.2 before 6.2.4, 6.3 before 6.3.0RC3, and 6.4 befo (no CVSS)
- [CVE-2011-4834](https://cve.now/CVE-2011-4834.md): The GetInstalledPackages function in the configuration tool in HP Application Lifestyle Management (ALM) 11 on AIX, HP-UX, and Solaris allow (no CVSS)
- [CVE-2011-4835](https://cve.now/CVE-2011-4835.md): Directory traversal vulnerability in the web interface in HomeSeer HS2 2.5.0.20 allows remote attackers to access arbitrary files via unspec (no CVSS)
- [CVE-2011-4836](https://cve.now/CVE-2011-4836.md): Cross-site scripting (XSS) vulnerability in the web interface in HomeSeer HS2 2.5.0.20 allows remote attackers to inject arbitrary web scrip (no CVSS)
- [CVE-2011-4837](https://cve.now/CVE-2011-4837.md): Cross-site request forgery (CSRF) vulnerability in /ctrl in the web interface in HomeSeer HS2 2.5.0.20 allows remote attackers to hijack the (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2011-12-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.