# CVEs published 2011-12-24

8 CVEs were published on December 24, 2011: 0 critical, 0 high. Days are UTC.

- [CVE-2011-3372](https://cve.now/CVE-2011-3372.md): imap/nntpd.c in the NNTP server (nntpd) for Cyrus IMAPd 2.4.x before 2.4.12 allows remote attackers to bypass authentication by sending an A (no CVSS)
- [CVE-2011-3378](https://cve.now/CVE-2011-3378.md): RPM 4.4.x through 4.9.x, probably before 4.9.1.2, allows remote attackers to cause a denial of service (memory corruption) and possibly exec (no CVSS)
- [CVE-2011-3835](https://cve.now/CVE-2011-3835.md): Multiple cross-site scripting (XSS) vulnerabilities in Wuzly 2.0 allow remote attackers to inject arbitrary web script or HTML via the Refer (no CVSS)
- [CVE-2011-3836](https://cve.now/CVE-2011-3836.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Wuzly 2.0 allow remote attackers to hijack the authentication of administrator (no CVSS)
- [CVE-2011-3837](https://cve.now/CVE-2011-3837.md): Directory traversal vulnerability in blog\_system/data\_functions.php in Wuzly 2.0 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2011-3838](https://cve.now/CVE-2011-3838.md): Multiple SQL injection vulnerabilities in Wuzly 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) u parameter to fp.p (no CVSS)
- [CVE-2011-3839](https://cve.now/CVE-2011-3839.md): The administration functionality in Wuzly 2.0 allows remote attackers to bypass authentication by setting the dXNlcm5hbWU cookie. (no CVSS)
- [CVE-2011-4362](https://cve.now/CVE-2011-4362.md): Integer signedness error in the base64\_decode function in the HTTP authentication functionality (http\_auth.c) in lighttpd 1.4 before 1.4.30 (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2011-12-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.