Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: November 2011

20 records · 1 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2010-4977
    35Monitor

    SQL injection vulnerability in menu.php in the Canteen (com_canteen) component 1.0 for Joomla! allows remote attackers to execute arbitrary

    HighCVSS 7.5Proof of conceptEPSS 15%

    joomla · joomla\!Nov 1, 2011

  • CVE-2011-3165
    44Plan

    Unspecified vulnerability in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via u

    CriticalCVSS 10.0No exploitEPSS 12%

    hp · openview network node managerNov 2, 2011

  • CVE-2011-3166
    44Plan

    Unspecified vulnerability in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via u

    CriticalCVSS 10.0No exploitEPSS 12%

    hp · openview network node managerNov 2, 2011

  • CVE-2011-3167
    59Plan

    Unspecified vulnerability in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via u

    CriticalCVSS 10.0WeaponizedEPSS 64%

    hp · openview network node managerNov 2, 2011

  • CVE-2011-4075
    46Plan

    The masort function in lib/functions.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to execute arbitrary PHP code via the or

    HighCVSS 7.5WeaponizedEPSS 51%

    phpldapadmin project · phpldapadminNov 2, 2011

  • CVE-2011-3402
    88Now

    Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3,

    HighCVSS 8.8KEVWeaponizedEPSS 78%

    microsoft · windows 7Nov 4, 2011

  • CVE-2011-2004
    35Monitor

    Array index error in win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1 allows

    HighCVSS 7.1No exploitEPSS 24%

    microsoft · windows 7Nov 8, 2011

  • CVE-2011-2013
    49Plan

    Integer overflow in the TCP/IP implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold an

    CriticalCVSS 9.8Proof of conceptEPSS 32%

    microsoft · windows 7Nov 8, 2011

  • CVE-2011-2014
    39Monitor

    The LDAP over SSL (aka LDAPS) implementation in Active Directory, Active Directory Application Mode (ADAM), and Active Directory Lightweight

    CriticalCVSS 9.0No exploitEPSS 10%

    microsoft · windows 7Nov 8, 2011

  • CVE-2011-4157
    44Plan

    Stack-based buffer overflow in hydra.exe in HP SAN/iQ before 9.5 on the HP StorageWorks P4000 Virtual SAN Appliance allows remote attackers

    CriticalCVSS 10.0No exploitEPSS 13%

    hp · centralized management console softwareNov 16, 2011

  • CVE-2011-4096
    31Monitor

    The idnsGrokReply function in Squid before 3.1.16 does not properly free memory, which allows remote attackers to cause a denial of service

    MediumCVSS 5.0No exploitEPSS 37%

    squid-cache · squidNov 17, 2011

  • CVE-2011-4107
    30Monitor

    The simplexml_load_string function in the XML import plug-in (libraries/import/xml.php) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before

    MediumCVSS 6.5Proof of conceptEPSS 12%

    phpmyadmin · phpmyadminNov 17, 2011

  • CVE-2011-4404
    40Plan

    The default configuration of the HTTP server in Jetty in vSphere Update Manager in VMware vCenter Update Manager 4.0 before Update 4 and 4.1

    MediumCVSS 5.0WeaponizedEPSS 58%

    vmware · vcenter update managerNov 18, 2011

  • CVE-2011-4040
    60This week

    Buffer overflow in MiniSmtp 3.0.11818 in NJStar Communicator allows remote attackers to execute arbitrary code via a crafted packet.

    CriticalCVSS 10.0WeaponizedEPSS 65%

    njstar · njstar communicatorNov 21, 2011

  • CVE-2011-4496
    40Plan

    Buffer overflow in Aviosoft DTV Player 1.0.1.2 allows remote attackers to execute arbitrary code via a crafted .plf (aka playlist) file.

    CriticalCVSS 9.3WeaponizedEPSS 11%

    aviosoft · dtv playerNov 21, 2011

  • CVE-2011-4313
    25Monitor

    query.c in ISC BIND 9.0.x through 9.6.x, 9.4-ESV through 9.4-ESV-R5, 9.6-ESV through 9.6-ESV-R5, 9.7.0 through 9.7.4, 9.8.0 through 9.8.1, a

    MediumCVSS 5.0No exploitEPSS 16%

    isc · bindNov 29, 2011

  • CVE-2011-3639
    32Monitor

    The mod_proxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the Revision 1179239 patch is in place, do

    MediumCVSS 4.3Proof of conceptEPSS 50%

    apache · http serverNov 30, 2011

  • CVE-2011-4191
    33Monitor

    Stack-based buffer overflow in the xdrDecodeString function in XNFS.NLM in Novell NetWare 6.5 SP8 allows remote attackers to execute arbitra

    HighCVSS 7.5Proof of conceptEPSS 10%

    novell · netwareNov 30, 2011

  • CVE-2011-4317
    35Monitor

    The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21, when the Revision 11792

    MediumCVSS 4.3Proof of conceptEPSS 59%

    apache · http serverNov 30, 2011

  • CVE-2011-4542
    40Plan

    Hastymail2 2.1.1 before RC2 allows remote attackers to execute arbitrary commands via the (1) rs or (2) rsargs[] parameter in a mailbox Draf

    HighCVSS 7.5WeaponizedEPSS 24%

    hastymail · hastymail2Nov 30, 2011