CVE-2011-5331

Distributed Ruby (aka DRuby) 1.8 mishandles instance_eval.

• https://github.com/tomquinn8/CVE-2011-5331

CVE-2011-4919

mpack 1.6 has information disclosure via eavesdropping on mails sent by other users

• https://github.com/hartwork/mpacktrafficripper

CVE-2011-4862

Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long encryption key, as exploited in the wild in December 2011.

• https://github.com/hdbreaker/GO-CVE-2011-4862

• https://github.com/kpawar2410/CVE-2011-4862

• https://github.com/lol-fi/cve-2011-4862

CVE-2011-4107

The simplexml_load_string function in the XML import plug-in (libraries/import/xml.php) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before 3.3.10.5 allows remote authenticated users to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.

• https://github.com/SECFORCE/CVE-2011-4107

CVE-2011-3872

Puppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6, and Puppet Enterprise (PE) Users 1.0, 1.1, and 1.2 before 1.2.4, when signing an agent certificate, adds the Puppet master's certdnsnames values to the X.509 Subject Alternative Name field of the certificate, which allows remote attackers to spoof a Puppet master via a man-in-the-middle (MITM) attack against an agent that uses an alternate DNS name for the master, aka "AltNames Vulnerability."

• https://github.com/puppetlabs-toy-chest/puppetlabs-cve20113872

CVE-2011-3556

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier, 1.4.2_33 and earlier, and JRockit R28.1.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to RMI, a different vulnerability than CVE-2011-3557.

• https://github.com/sk4la/cve_2011_3556

CVE-2011-3389

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.

• https://github.com/mpgn/BEAST-PoC

CVE-2011-3368

The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.

• https://github.com/SECFORCE/CVE-2011-3368

• https://github.com/colorblindpentester/CVE-2011-3368

CVE-2011-3192

The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086.

• https://github.com/tkisason/KillApachePy

• https://github.com/limkokholefork/CVE-2011-3192

• https://github.com/stcmjp/cve-2011-3192

• https://github.com/futurezayka/CVE-2011-3192

• https://github.com/warmilk/http-Dos-Attack-Detection

CVE-2011-3026

Integer overflow in libpng, as used in Google Chrome before 17.0.963.56, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger an integer truncation.

• https://github.com/argp/cve-2011-3026-firefox

CVE-2011-2894

Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from untrusted sources, which allows remote attackers to bypass intended security restrictions and execute untrusted code by (1) serializing a java.lang.Proxy instance and using InvocationHandler, or (2) accessing internal AOP interfaces, as demonstrated using deserialization of a DefaultListableBeanFactory instance to execute arbitrary commands via the java.lang.Runtime class.

• https://github.com/pwntester/SpringBreaker

CVE-2011-2523

vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.

• https://github.com/padsalatushal/CVE-2011-2523

• https://github.com/4m3rr0r/CVE-2011-2523-poc

• https://github.com/Lynk4/CVE-2011-2523

• https://github.com/cowsecurity/CVE-2011-2523

• https://github.com/nobodyatall648/CVE-2011-2523

• https://github.com/MFernstrom/OffensivePascal-CVE-2011-2523

• https://github.com/everythingBlackkk/vsFTPd-Backdoor-Exploit-CVE-2011-2523-

• https://github.com/Gill-Singh-A/vsFTP-2.3.4-Remote-Root-Shell-Exploit

• https://github.com/0xB0y426/CVE-2011-2523-PoC

• https://github.com/0xSojalSec/-CVE-2011-2523

• https://github.com/0xSojalSec/CVE-2011-2523

• https://github.com/Gr4ykt/CVE-2011-2523

• https://github.com/sug4r-wr41th/CVE-2011-2523

• https://github.com/vaishnavucv/CVE-2011-2523

• https://github.com/XiangSi-Howard/CTF---CVE-2011-2523

• https://github.com/Shubham-2k1/Exploit-CVE-2011-2523

• https://github.com/Tenor-Z/SmileySploit

• https://github.com/chleba124/vsftpd-exploit

• https://github.com/AnugiArrawwala/CVE-Research

• https://github.com/davidlares/vsftpd-exploitation

• https://github.com/HerculesRD/vsftpd2.3.4PyExploit

CVE-2011-2461

Cross-site scripting (XSS) vulnerability in the Adobe Flex SDK 3.x and 4.x before 4.6 allows remote attackers to inject arbitrary web script or HTML via vectors related to the loading of modules from different domains.

• https://github.com/ikkisoft/ParrotNG

• https://github.com/edmondscommerce/CVE-2011-2461_Magento_Patch

• https://github.com/u-maxx/magento-swf-patched-CVE-2011-2461

CVE-2011-1974

NDISTAPI.sys in the NDISTAPI driver in Remote Access Service (RAS) in Microsoft Windows XP SP2 and SP3 and Windows Server 2003 SP2 does not properly validate user-mode input, which allows local users to gain privileges via a crafted application, aka "NDISTAPI Elevation of Privilege Vulnerability."

• https://github.com/hittlle/CVE-2011-1974-PoC

CVE-2011-1720

The SMTP server in Postfix before 2.5.13, 2.6.x before 2.6.10, 2.7.x before 2.7.4, and 2.8.x before 2.8.3, when certain Cyrus SASL authentication methods are enabled, does not create a new server handle after client authentication fails, which allows remote attackers to cause a denial of service (heap memory corruption and daemon crash) or possibly execute arbitrary code via an invalid AUTH command with one method followed by an AUTH command with a different method.

• https://github.com/nbeguier/postfix_exploit

CVE-2011-1575

The STARTTLS implementation in ftp_parser.c in Pure-FTPd before 1.0.30 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted FTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.

• https://github.com/masamoon/cve-2011-1575-poc

CVE-2011-1571

Unspecified vulnerability in the XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote attackers to execute arbitrary commands via unknown vectors.

• https://github.com/noobpk/CVE-2011-1571

CVE-2011-1485

Race condition in the pkexec utility and polkitd daemon in PolicyKit (aka polkit) 0.96 allows local users to gain privileges by executing a setuid program from pkexec, related to the use of the effective user ID instead of the real user ID.

• https://github.com/Pashkela/CVE-2011-1485

CVE-2011-1475

The HTTP BIO connector in Apache Tomcat 7.0.x before 7.0.12 does not properly handle HTTP pipelining, which allows remote attackers to read responses intended for other clients in opportunistic circumstances by examining the application data in HTTP packets, related to "a mix-up of responses for requests from different users."

• https://github.com/samaujs/CVE-2011-1475

CVE-2011-1473

** DISPUTED ** OpenSSL before 0.9.8l, and 0.9.8m through 1.x, does not properly restrict client-initiated renegotiation within the SSL and TLS protocols, which might make it easier for remote attackers to cause a denial of service (CPU consumption) by performing many renegotiations within a single connection, a different vulnerability than CVE-2011-5094. NOTE: it can also be argued that it is the responsibility of server deployments, not a security library, to prevent or limit renegotiation when it is inappropriate within a specific environment.

• https://github.com/XDLDCG/bash-tls-reneg-attack

• https://github.com/zjt674449039/cve-2011-1473

CVE-2011-1249

The Ancillary Function Driver (AFD) in afd.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly validate user-mode input, which allows local users to gain privileges via a crafted application, aka "Ancillary Function Driver Elevation of Privilege Vulnerability."

• https://github.com/n3rdh4x0r/CVE-2011-1249

• https://github.com/Madusanka99/OHTS

CVE-2011-1237

Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application that leverages incorrect driver object management, a different vulnerability than other "Vulnerability Type 1" CVEs listed in MS11-034, aka "Win32k Use After Free Vulnerability."

• https://github.com/BrunoPujos/CVE-2011-1237

CVE-2011-0228

The Data Security component in Apple iOS before 4.2.10 and 4.3.x before 4.3.5 does not check the basicConstraints parameter during validation of X.509 certificate chains, which allows man-in-the-middle attackers to spoof an SSL server by using a non-CA certificate to sign a certificate for an arbitrary domain.

• https://github.com/jan0/isslfix

• https://github.com/amil-ptl-test/ptl_cve_2011_0228

CVE-2011-0104

Microsoft Excel 2002 SP3 and 2003 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted HLink record in an Excel file, aka "Excel Buffer Overwrite Vulnerability."

• https://github.com/Sunqiz/CVE-2011-0104-reproduction