# CVEs published 2012-01-08 18 CVEs were published on January 8, 2012: 1 critical, 0 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2011-4529](https://cve.now/CVE-2011-4529.md): Multiple buffer overflows in Siemens Automation License Manager (ALM) 4.0 through 5.1+SP1+Upd1 allow remote attackers to execute arbitrary c (no CVSS) - [CVE-2011-4530](https://cve.now/CVE-2011-4530.md): Siemens Automation License Manager (ALM) 4.0 through 5.1+SP1+Upd1 does not properly copy fields obtained from clients, which allows remote a (no CVSS) - [CVE-2011-4531](https://cve.now/CVE-2011-4531.md): Siemens Automation License Manager (ALM) 4.0 through 5.1+SP1+Upd1 allows remote attackers to cause a denial of service (NULL pointer derefer (no CVSS) - [CVE-2011-4532](https://cve.now/CVE-2011-4532.md): Absolute path traversal vulnerability in the ALMListView.ALMListCtrl ActiveX control in almaxcx.dll in the graphical user interface in Sieme (no CVSS) - [CVE-2011-5057](https://cve.now/CVE-2011-5057.md): Apache Struts 2.3.1.2 and earlier, 2.3.19-2.3.23, provides interfaces that do not properly restrict access to collections such as the sessio (no CVSS) - [CVE-2012-0391](https://cve.now/CVE-2012-0391.md): The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception ha (CVSS 9.8, KEV, org.apache.struts:struts2-core · org.apache.struts.xwork:xw…) - [CVE-2012-0392](https://cve.now/CVE-2012-0392.md): The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to (no CVSS, org.apache.struts:struts2-core · org.apache.struts.xwork:xw…) - [CVE-2012-0393](https://cve.now/CVE-2012-0393.md): The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attac (no CVSS, org.apache.struts:struts2-core · org.apache.struts.xwork:xw…) - [CVE-2012-0394](https://cve.now/CVE-2012-0394.md): The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrar (no CVSS, org.apache.struts.xwork:xwork-core) - [CVE-2011-4360](https://cve.now/CVE-2011-4360.md): MediaWiki before 1.17.1 allows remote attackers to obtain the page titles of all restricted pages via a series of requests involving the (1) (no CVSS) - [CVE-2011-4361](https://cve.now/CVE-2011-4361.md): MediaWiki before 1.17.1 does not check for read permission before handling action=ajax requests, which allows remote attackers to obtain sen (no CVSS) - [CVE-2011-3206](https://cve.now/CVE-2011-3206.md): Multiple cross-site scripting (XSS) vulnerabilities in the administration interface in RHQ 4.2.0, as used in JBoss Operations Network (aka J (no CVSS) - [CVE-2011-4055](https://cve.now/CVE-2011-4055.md): Buffer overflow in the WebClient ActiveX control in Siemens Tecnomatix FactoryLink 6.6.1 (aka 6.6 SP1), 7.5.217 (aka 7.5 SP2), and 8.0.2.54 (no CVSS) - [CVE-2011-4056](https://cve.now/CVE-2011-4056.md): An unspecified ActiveX control in ActBar.ocx in Siemens Tecnomatix FactoryLink 6.6.1 (aka 6.6 SP1), 7.5.217 (aka 7.5 SP2), and 8.0.2.54 allo (no CVSS) - [CVE-2011-4870](https://cve.now/CVE-2011-4870.md): Multiple buffer overflows in the (1) GUIControls, (2) BatchObjSrv, and (3) BatchSecCtrl ActiveX controls in Invensys Wonderware InBatch 9.0 (no CVSS) - [CVE-2011-5055](https://cve.now/CVE-2011-5055.md): MaraDNS 1.3.07.12 and 1.4.08 computes hash values for DNS data without properly restricting the ability to trigger hash collisions predictab (no CVSS) - [CVE-2011-5056](https://cve.now/CVE-2011-5056.md): The authoritative server in MaraDNS through 2.0.04 computes hash values for DNS data without restricting the ability to trigger hash collisi (no CVSS) - [CVE-2012-0024](https://cve.now/CVE-2012-0024.md): MaraDNS before 1.3.07.12 and 1.4.x before 1.4.08 computes hash values for DNS data without restricting the ability to trigger hash collision (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2012-01-08 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.