CVEs published January 8, 2012
18 CVEs were published on January 8, 2012: 1 critical, 0 high. 1 is now in CISA KEV.
- Published
- 18
- Critical
- 1
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 17
- Now in CISA KEV
- 1
- Fix available
- 4
Most affected products
- org.apache.struts:struts2-core · org.apache.struts.xwork:xw…
- 3
- org.apache.struts.xwork:xwork-core
- 1
Critical 1
Medium, low and unrated 17
- CVE-2011-4529Multiple buffer overflows in Siemens Automation License Manager (ALM) 4.0 through 5.1+SP1+Upd1 allow remote attackers to execute arbitrary c
- CVE-2011-4530Siemens Automation License Manager (ALM) 4.0 through 5.1+SP1+Upd1 does not properly copy fields obtained from clients, which allows remote a
- CVE-2011-4531Siemens Automation License Manager (ALM) 4.0 through 5.1+SP1+Upd1 allows remote attackers to cause a denial of service (NULL pointer derefer
- CVE-2011-4532Absolute path traversal vulnerability in the ALMListView.ALMListCtrl ActiveX control in almaxcx.dll in the graphical user interface in Sieme
- CVE-2011-5057Apache Struts 2.3.1.2 and earlier, 2.3.19-2.3.23, provides interfaces that do not properly restrict access to collections such as the sessio
- CVE-2012-0392The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to org.apache.struts:struts2-core · org.apache.struts.xwork:xw…
- CVE-2012-0393The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attacorg.apache.struts:struts2-core · org.apache.struts.xwork:xw…
- CVE-2012-0394The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrarorg.apache.struts.xwork:xwork-core
- CVE-2011-4360MediaWiki before 1.17.1 allows remote attackers to obtain the page titles of all restricted pages via a series of requests involving the (1)
- CVE-2011-4361MediaWiki before 1.17.1 does not check for read permission before handling action=ajax requests, which allows remote attackers to obtain sen
- CVE-2011-3206Multiple cross-site scripting (XSS) vulnerabilities in the administration interface in RHQ 4.2.0, as used in JBoss Operations Network (aka J
- CVE-2011-4055Buffer overflow in the WebClient ActiveX control in Siemens Tecnomatix FactoryLink 6.6.1 (aka 6.6 SP1), 7.5.217 (aka 7.5 SP2), and 8.0.2.54
- CVE-2011-4056An unspecified ActiveX control in ActBar.ocx in Siemens Tecnomatix FactoryLink 6.6.1 (aka 6.6 SP1), 7.5.217 (aka 7.5 SP2), and 8.0.2.54 allo
- CVE-2011-4870Multiple buffer overflows in the (1) GUIControls, (2) BatchObjSrv, and (3) BatchSecCtrl ActiveX controls in Invensys Wonderware InBatch 9.0
- CVE-2011-5055MaraDNS 1.3.07.12 and 1.4.08 computes hash values for DNS data without properly restricting the ability to trigger hash collisions predictab
- CVE-2011-5056The authoritative server in MaraDNS through 2.0.04 computes hash values for DNS data without restricting the ability to trigger hash collisi
- CVE-2012-0024MaraDNS before 1.3.07.12 and 1.4.x before 1.4.08 computes hash values for DNS data without restricting the ability to trigger hash collision