# CVEs published 2011-12-30

22 CVEs were published on December 30, 2011: 0 critical, 0 high. Days are UTC.

- [CVE-2011-5038](https://cve.now/CVE-2011-5038.md): SQL injection vulnerability in hitCode hitAppoint 4.5.17 and possibly earlier allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2011-5039](https://cve.now/CVE-2011-5039.md): Multiple SQL injection vulnerabilities in Infoproject Biznis Heroj allow remote attackers to execute arbitrary SQL commands via the (1) user (no CVSS)
- [CVE-2011-5040](https://cve.now/CVE-2011-5040.md): Multiple cross-site scripting (XSS) vulnerabilities in Infoproject Biznis Heroj allow remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2011-5041](https://cve.now/CVE-2011-5041.md): Multiple cross-site scripting (XSS) vulnerabilities in Pulse Pro CMS 1.7.2 allow remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2011-5042](https://cve.now/CVE-2011-5042.md): Cross-site scripting (XSS) vulnerability in inc/lib/lib.base.php in SASHA 0.2.0 allows remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2011-5043](https://cve.now/CVE-2011-5043.md): TomatoSoft Free Mp3 Player 1.0 allows remote attackers to cause a denial of service (application crash) via a long string in an MP3 file, po (no CVSS)
- [CVE-2011-5044](https://cve.now/CVE-2011-5044.md): SopCast 3.4.7.45585 uses weak permissions (Everyone:Full Control) for Diagnose.exe, which allows local users to execute arbitrary code by re (no CVSS)
- [CVE-2011-5045](https://cve.now/CVE-2011-5045.md): Cross-site scripting (XSS) vulnerability in details\_view.php in PHP Booking Calendar 10e allows remote attackers to inject arbitrary web scr (no CVSS)
- [CVE-2011-5046](https://cve.now/CVE-2011-5046.md): The Graphics Device Interface (GDI) in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, W (no CVSS)
- [CVE-2011-3414](https://cve.now/CVE-2011-3414.md): The CaseInsensitiveHashProvider.getHashCode function in the HashTable implementation in the ASP.NET subsystem in Microsoft .NET Framework 1. (no CVSS)
- [CVE-2011-3415](https://cve.now/CVE-2011-3415.md): Open redirect vulnerability in the Forms Authentication feature in the ASP.NET subsystem in Microsoft .NET Framework 2.0 SP2, 3.5 SP1, 3.5.1 (no CVSS)
- [CVE-2011-3416](https://cve.now/CVE-2011-3416.md): The Forms Authentication feature in the ASP.NET subsystem in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0 allows remot (no CVSS)
- [CVE-2011-3417](https://cve.now/CVE-2011-3417.md): The Forms Authentication feature in the ASP.NET subsystem in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0, when slidin (no CVSS)
- [CVE-2011-4461](https://cve.now/CVE-2011-4461.md): Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, (no CVSS, org.eclipse.jetty:jetty-server)
- [CVE-2011-4462](https://cve.now/CVE-2011-4462.md): Plone 4.1.3 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, whi (no CVSS, plone)
- [CVE-2011-4815](https://cve.now/CVE-2011-4815.md): Ruby (aka CRuby) before 1.8.7-p357 computes hash values without restricting the ability to trigger hash collisions predictably, which allows (no CVSS)
- [CVE-2011-4838](https://cve.now/CVE-2011-4838.md): JRuby before 1.6.5.1 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-depen (no CVSS)
- [CVE-2011-4885](https://cve.now/CVE-2011-4885.md): PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allo (no CVSS)
- [CVE-2011-5034](https://cve.now/CVE-2011-5034.md): Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predic (no CVSS, org.apache.geronimo:geronimo)
- [CVE-2011-5035](https://cve.now/CVE-2011-5035.md): Oracle Glassfish 2.1.1, 3.0.1, and 3.1.1, as used in Communications Server 2.0, Sun Java System Application Server 8.1 and 8.2, and possibly (no CVSS)
- [CVE-2011-5036](https://cve.now/CVE-2011-5036.md): Rack before 1.1.3, 1.2.x before 1.2.5, and 1.3.x before 1.3.6 computes hash values for form parameters without restricting the ability to tr (no CVSS, rack · org.jruby:jruby-parent)
- [CVE-2011-5037](https://cve.now/CVE-2011-5037.md): Google V8 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remo (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2011-12-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.