CVEs

346,462 total · page 5962 of 6,930

CVE	Vendor / Product	Risk	CVSS	EPSS	Published	Description
CVE-2011-3400	Microsoft Windows Xp	0.09	—	0.72	Dec 14, 2011	Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 do not properly handle OLE objects in memory, which allows remote attackers to execute arbitrary code via a crafted object in a file, aka "OLE Property Vulnerability."
CVE-2011-3397	Microsoft Windows Xp	0.02	—	0.20	Dec 14, 2011	The Microsoft Time component in DATIME.DLL in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows remote attackers to execute arbitrary code via a crafted web site that leverages an unspecified "binary behavior" in Internet Explorer, aka "Microsoft Time Remote Code…
CVE-2011-3396	Microsoft Powerpoint	0.02	—	0.22	Dec 14, 2011	Untrusted search path vulnerability in Microsoft PowerPoint 2007 SP2 and 2010 allows local users to gain privileges via a Trojan horse DLL in the current working directory, aka "PowerPoint Insecure Library Loading Vulnerability."
CVE-2011-2019	Microsoft Internet Explorer	0.01	—	0.13	Dec 14, 2011	Untrusted search path vulnerability in Microsoft Internet Explorer 9 on Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains an…
CVE-2011-2018	Microsoft Windows Xp	0.00	—	0.02	Dec 14, 2011	The kernel in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, and Windows 7 Gold and SP1 does not properly initialize objects, which allows local users to gain privileges via a crafted application, aka "Windows Kernel…
CVE-2011-2010	Microsoft Pinyin Ime	0.00	—	0.02	Dec 14, 2011	The Microsoft Office Input Method Editor (IME) for Simplified Chinese in Microsoft Pinyin IME 2010, Office Pinyin SimpleFast Style 2010, and Office Pinyin New Experience Style 2010 does not properly restrict access to configuration options, which allows local users to gain…
CVE-2011-1992	Microsoft Internet Explorer	0.02	—	0.20	Dec 14, 2011	The XSS Filter in Microsoft Internet Explorer 8 allows remote attackers to read content from a different (1) domain or (2) zone via a "trial and error" attack, aka "XSS Filter Information Disclosure Vulnerability."
CVE-2011-1983	Microsoft Office	0.02	—	0.23	Dec 14, 2011	Use-after-free vulnerability in Microsoft Office 2007 SP2 and SP3, Office 2010 Gold and SP1, and Office for Mac 2011 allows remote attackers to execute arbitrary code via a crafted Word document, aka "Word Use After Free Vulnerability."
CVE-2011-1508	Microsoft Publisher	0.01	—	0.14	Dec 14, 2011	Microsoft Publisher 2003 SP3, and 2007 SP2 and SP3, does not properly manage memory allocations for function pointers, which allows user-assisted remote attackers to execute arbitrary code via a crafted Publisher file, aka "Publisher Function Pointer Overwrite Vulnerability."
CVE-2011-3917	Google Chrome	0.00	—	0.01	Dec 13, 2011	Stack-based buffer overflow in FileWatcher in Google Chrome before 16.0.912.63 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVE-2011-3916	Google Chrome	0.00	—	0.01	Dec 13, 2011	Google Chrome before 16.0.912.63 does not properly handle PDF cross references, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVE-2011-3915	Google Chrome	0.00	—	0.01	Dec 13, 2011	Buffer overflow in Google Chrome before 16.0.912.63 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to PDF fonts.
CVE-2011-3914	Google Chrome	0.00	—	0.01	Dec 13, 2011	The internationalization (aka i18n) functionality in Google V8, as used in Google Chrome before 16.0.912.63, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger an out-of-bounds write.
CVE-2011-3913	Google Chrome	0.00	—	0.02	Dec 13, 2011	Use-after-free vulnerability in Google Chrome before 16.0.912.63 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to Range handling.
CVE-2011-3912	Google Chrome	0.00	—	0.01	Dec 13, 2011	Use-after-free vulnerability in Google Chrome before 16.0.912.63 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to SVG filters.
CVE-2011-3911	Google Chrome	0.00	—	0.01	Dec 13, 2011	Google Chrome before 16.0.912.63 does not properly handle PDF documents, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVE-2011-3910	Google Chrome	0.00	—	0.01	Dec 13, 2011	Google Chrome before 16.0.912.63 does not properly handle YUV video frames, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVE-2011-3909	Google Chrome	0.00	—	0.02	Dec 13, 2011	The Cascading Style Sheets (CSS) implementation in Google Chrome before 16.0.912.63 on 64-bit platforms does not properly manage property arrays, which allows remote attackers to cause a denial of service (memory corruption) via unspecified vectors.
CVE-2011-3908	Google Chrome	0.00	—	0.02	Dec 13, 2011	Google Chrome before 16.0.912.63 does not properly parse SVG documents, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVE-2011-3907	Google Chrome	0.00	—	0.01	Dec 13, 2011	The view-source feature in Google Chrome before 16.0.912.63 allows remote attackers to spoof the URL bar via unspecified vectors.
CVE-2011-3906	Google Chrome	0.00	—	0.01	Dec 13, 2011	The PDF parser in Google Chrome before 16.0.912.63 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVE-2011-3905	Google Chrome	0.00	—	0.02	Dec 13, 2011	libxml2, as used in Google Chrome before 16.0.912.63, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVE-2011-3904	Google Chrome	0.00	—	0.01	Dec 13, 2011	Use-after-free vulnerability in Google Chrome before 16.0.912.63 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to bidirectional text (aka bidi) handling.
CVE-2011-3903	Google Chrome	0.00	—	0.01	Dec 13, 2011	Google Chrome before 16.0.912.63 does not properly perform regex matching, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVE-2011-4266	Ffftp Ffftp	0.00	—	0.02	Dec 13, 2011	Untrusted search path vulnerability in FFFTP before 1.98d allows local users to gain privileges via a Trojan horse executable file in a directory that is accessed for reading an extensionless file, as demonstrated by executing the README.exe file when a user attempts to access…
CVE-2011-4202	Restorepoint Restorepoint	0.00	—	0.00	Dec 13, 2011	The Tadasoft Restorepoint 3.2 evaluation image uses weak permissions (www write access) for unspecified scripts, which allows local users to gain privileges by modifying a script file.
CVE-2011-4201	Restorepoint Restorepoint	0.00	—	0.02	Dec 13, 2011	remote_support.cgi in the Tadasoft Restorepoint 3.2 evaluation image allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) pid1 or (2) pid2 parameter in a stop_remote_support action.
CVE-2011-4357	Clearsilver Clearsilver	0.00	—	0.03	Dec 10, 2011	Format string vulnerability in the p_cgi_error function in python/neo_cgi.c in the Python CGI Kit (neo_cgi) module for Clearsilver 0.10.5 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers…
CVE-2011-4349	Colord colord	0.00	—	0.00	Dec 10, 2011	Multiple SQL injection vulnerabilities in (1) cd-mapping-db.c and (2) cd-device-db.c in colord before 0.1.15 allow local users to execute arbitrary SQL commands via vectors related to color devices and (a) device id, (b) property, or (c) profile id.
CVE-2011-4346	Red Hat Satellite	0.00	—	0.02	Dec 10, 2011	Cross-site scripting (XSS) vulnerability in the web interface in Red Hat Network (RHN) Satellite 5.4.1 allows remote authenticated users to inject arbitrary web script or HTML via the Description field of the asset tag in a Custom Info page.
CVE-2011-4719	Google Google Chrome	0.00	—	0.01	Dec 9, 2011	Multiple unspecified vulnerabilities in Google Chrome before 16.0.912.63 on the Acer AC700, Samsung Series 5, and Cr-48 Chromebook platforms have unknown impact and attack vectors.
CVE-2011-4315	Nginx Nginx	0.00	—	0.06	Dec 8, 2011	Heap-based buffer overflow in compression-pointer processing in core/ngx_resolver.c in nginx before 1.0.10 allows remote resolvers to cause a denial of service (daemon crash) or possibly have unspecified other impact via a long response.
CVE-2011-4128	GNU Gnutls	0.00	—	0.02	Dec 8, 2011	Buffer overflow in the gnutls_session_get_data function in lib/gnutls_session.c in GnuTLS 2.12.x before 2.12.14 and 3.x before 3.0.7, when used on a client that performs nonstandard session resumption, allows remote TLS servers to cause a denial of service (application crash)…
CVE-2011-1530	Mit Kerberos	0.00	—	0.02	Dec 8, 2011	The process_tgs_req function in do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.9 through 1.9.2 allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted TGS request that triggers an…
CVE-2011-0291	Blackberry PlayBook	0.00	—	0.00	Dec 8, 2011	The BlackBerry PlayBook service on the Research In Motion (RIM) BlackBerry PlayBook tablet with software before 1.0.8.6067 allows local users to gain privileges via a crafted configuration file in a backup archive.
CVE-2011-4716	Dreambox DM800	0.03	—	0.03	Dec 8, 2011	Directory traversal vulnerability in file in DreamBox DM800 1.6rc3, 1.5rc1, and earlier allows remote attackers to read arbitrary files via the file parameter.
CVE-2011-4715	Koha Liblime Koha	0.00	—	0.09	Dec 8, 2011	Directory traversal vulnerability in cgi-bin/koha/mainpage.pl in Koha 3.4 before 3.4.7 and 3.6 before 3.6.1, and LibLime Koha 4.2 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the KohaOpacLanguage cookie to cgi-bin/opac/opac-main.pl, related…
CVE-2011-4714	Virtual Vertex Muster	0.03	—	0.04	Dec 8, 2011	Directory traversal vulnerability in Virtual Vertex Muster before 6.20 allows remote attackers to read arbitrary files via a \.. (backslash dot dot) in the URL.
CVE-2011-4713	Oscss Oscss	0.03	—	0.03	Dec 8, 2011	Directory traversal vulnerability in catalog/content.php in osCSS2 2.1.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the _ID parameter to (1) catalog/shopping_cart.php or (2) catalog/content.php.
CVE-2011-4712	Monoxide0184 Oxide Webserver	0.03	—	0.03	Dec 8, 2011	Directory traversal vulnerability in Oxide WebServer allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in an HTTP request.
CVE-2011-4711	Namazu Namazu	0.00	—	0.02	Dec 8, 2011	Multiple directory traversal vulnerabilities in namazu.cgi in Namazu before 2.0.16 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) lang or (2) result parameter.
CVE-2011-4710	Getpixie Pixie CMS	0.03	—	0.02	Dec 8, 2011	Multiple SQL injection vulnerabilities in Pixie CMS 1.01 through 1.04 allow remote attackers to execute arbitrary SQL commands via the (1) pixie_user parameter and (2) Referer HTTP header in a request to the default URI.
CVE-2011-4709	Hotaru Search Plugin	0.03	—	0.02	Dec 8, 2011	Multiple cross-site scripting (XSS) vulnerabilities in Hotaru.php in the Search plugin 1.3 for Hotaru CMS allow remote attackers to inject arbitrary web script or HTML via the (1) SITE_NAME parameter to admin_index.php, or the (2) return and (3) search parameters to index.php. …
CVE-2011-4708	IBM Rational Asset Manager	0.00	—	0.01	Dec 8, 2011	Cross-site scripting (XSS) vulnerability in IBM Rational Asset Manager before 7.5.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2011-4707	SAP Netweaver	0.00	—	0.01	Dec 8, 2011	Multiple cross-site scripting (XSS) vulnerabilities in the Virus Scan Interface in SAP Netweaver allow remote attackers to inject arbitrary web script or HTML via the (1) instname parameter to the VsiTestScan servlet and (2) name parameter to the VsiTestServlet servlet.
CVE-2011-2917	Mambo (software) Mambo	0.03	—	0.01	Dec 8, 2011	SQL injection vulnerability in administrator/index2.php in Mambo CMS 4.6.5 and earlier allows remote attackers to execute arbitrary SQL commands via the zorder parameter.
CVE-2011-4539	Isc DHCP	0.01	—	0.15	Dec 8, 2011	dhcpd in ISC DHCP 4.x before 4.2.3-P1 and 4.1-ESV before 4.1-ESV-R4 does not properly handle regular expressions in dhcpd.conf, which allows remote attackers to cause a denial of service (daemon crash) via a crafted request packet.
CVE-2011-4265	Phpwebsite Phpwebsite	0.00	—	0.01	Dec 8, 2011	Cross-site scripting (XSS) vulnerability in phpWebSite before 1.0.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2011-4264	Etomite Etomite	0.00	—	0.01	Dec 8, 2011	Cross-site scripting (XSS) vulnerability in Etomite before 1.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2011-4054	Ca Siteminder	0.00	—	0.01	Dec 8, 2011	Cross-site scripting (XSS) vulnerability in login.fcc in CA SiteMinder R6 SP6 before CR7 and R12 SP3 before CR8 allows remote attackers to inject arbitrary web script or HTML via the postpreservationdata parameter.

CVE-2011-3400Dec 14, 2011
Microsoft
Windows Xp
risk 0.09cvss —epss 0.72
Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 do not properly handle OLE objects in memory, which allows remote attackers to execute arbitrary code via a crafted object in a file, aka "OLE Property Vulnerability."
CVE-2011-3397Dec 14, 2011
Microsoft
Windows Xp
risk 0.02cvss —epss 0.20
The Microsoft Time component in DATIME.DLL in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows remote attackers to execute arbitrary code via a crafted web site that leverages an unspecified "binary behavior" in Internet Explorer, aka "Microsoft Time Remote Code…
CVE-2011-3396Dec 14, 2011
Microsoft
Powerpoint
risk 0.02cvss —epss 0.22
Untrusted search path vulnerability in Microsoft PowerPoint 2007 SP2 and 2010 allows local users to gain privileges via a Trojan horse DLL in the current working directory, aka "PowerPoint Insecure Library Loading Vulnerability."
CVE-2011-2019Dec 14, 2011
Microsoft
Internet Explorer
risk 0.01cvss —epss 0.13
Untrusted search path vulnerability in Microsoft Internet Explorer 9 on Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains an…
CVE-2011-2018Dec 14, 2011
Microsoft
Windows Xp
risk 0.00cvss —epss 0.02
The kernel in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, and Windows 7 Gold and SP1 does not properly initialize objects, which allows local users to gain privileges via a crafted application, aka "Windows Kernel…
CVE-2011-2010Dec 14, 2011
Microsoft
Pinyin Ime
risk 0.00cvss —epss 0.02
The Microsoft Office Input Method Editor (IME) for Simplified Chinese in Microsoft Pinyin IME 2010, Office Pinyin SimpleFast Style 2010, and Office Pinyin New Experience Style 2010 does not properly restrict access to configuration options, which allows local users to gain…
CVE-2011-1992Dec 14, 2011
Microsoft
Internet Explorer
risk 0.02cvss —epss 0.20
The XSS Filter in Microsoft Internet Explorer 8 allows remote attackers to read content from a different (1) domain or (2) zone via a "trial and error" attack, aka "XSS Filter Information Disclosure Vulnerability."
CVE-2011-1983Dec 14, 2011
Microsoft
Office
risk 0.02cvss —epss 0.23
Use-after-free vulnerability in Microsoft Office 2007 SP2 and SP3, Office 2010 Gold and SP1, and Office for Mac 2011 allows remote attackers to execute arbitrary code via a crafted Word document, aka "Word Use After Free Vulnerability."
CVE-2011-1508Dec 14, 2011
Microsoft
Publisher
risk 0.01cvss —epss 0.14
Microsoft Publisher 2003 SP3, and 2007 SP2 and SP3, does not properly manage memory allocations for function pointers, which allows user-assisted remote attackers to execute arbitrary code via a crafted Publisher file, aka "Publisher Function Pointer Overwrite Vulnerability."
CVE-2011-3917Dec 13, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Stack-based buffer overflow in FileWatcher in Google Chrome before 16.0.912.63 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVE-2011-3916Dec 13, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Google Chrome before 16.0.912.63 does not properly handle PDF cross references, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVE-2011-3915Dec 13, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Buffer overflow in Google Chrome before 16.0.912.63 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to PDF fonts.
CVE-2011-3914Dec 13, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
The internationalization (aka i18n) functionality in Google V8, as used in Google Chrome before 16.0.912.63, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger an out-of-bounds write.
CVE-2011-3913Dec 13, 2011
Google
Chrome
risk 0.00cvss —epss 0.02
Use-after-free vulnerability in Google Chrome before 16.0.912.63 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to Range handling.
CVE-2011-3912Dec 13, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Use-after-free vulnerability in Google Chrome before 16.0.912.63 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to SVG filters.
CVE-2011-3911Dec 13, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Google Chrome before 16.0.912.63 does not properly handle PDF documents, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVE-2011-3910Dec 13, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Google Chrome before 16.0.912.63 does not properly handle YUV video frames, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVE-2011-3909Dec 13, 2011
Google
Chrome
risk 0.00cvss —epss 0.02
The Cascading Style Sheets (CSS) implementation in Google Chrome before 16.0.912.63 on 64-bit platforms does not properly manage property arrays, which allows remote attackers to cause a denial of service (memory corruption) via unspecified vectors.
CVE-2011-3908Dec 13, 2011
Google
Chrome
risk 0.00cvss —epss 0.02
Google Chrome before 16.0.912.63 does not properly parse SVG documents, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVE-2011-3907Dec 13, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
The view-source feature in Google Chrome before 16.0.912.63 allows remote attackers to spoof the URL bar via unspecified vectors.
CVE-2011-3906Dec 13, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
The PDF parser in Google Chrome before 16.0.912.63 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVE-2011-3905Dec 13, 2011
Google
Chrome
risk 0.00cvss —epss 0.02
libxml2, as used in Google Chrome before 16.0.912.63, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVE-2011-3904Dec 13, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Use-after-free vulnerability in Google Chrome before 16.0.912.63 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to bidirectional text (aka bidi) handling.
CVE-2011-3903Dec 13, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Google Chrome before 16.0.912.63 does not properly perform regex matching, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVE-2011-4266Dec 13, 2011
Ffftp
Ffftp
risk 0.00cvss —epss 0.02
Untrusted search path vulnerability in FFFTP before 1.98d allows local users to gain privileges via a Trojan horse executable file in a directory that is accessed for reading an extensionless file, as demonstrated by executing the README.exe file when a user attempts to access…
CVE-2011-4202Dec 13, 2011
Restorepoint
Restorepoint
risk 0.00cvss —epss 0.00
The Tadasoft Restorepoint 3.2 evaluation image uses weak permissions (www write access) for unspecified scripts, which allows local users to gain privileges by modifying a script file.
CVE-2011-4201Dec 13, 2011
Restorepoint
Restorepoint
risk 0.00cvss —epss 0.02
remote_support.cgi in the Tadasoft Restorepoint 3.2 evaluation image allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) pid1 or (2) pid2 parameter in a stop_remote_support action.
CVE-2011-4357Dec 10, 2011
Clearsilver
Clearsilver
risk 0.00cvss —epss 0.03
Format string vulnerability in the p_cgi_error function in python/neo_cgi.c in the Python CGI Kit (neo_cgi) module for Clearsilver 0.10.5 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers…
CVE-2011-4349Dec 10, 2011
Colord
colord
risk 0.00cvss —epss 0.00
Multiple SQL injection vulnerabilities in (1) cd-mapping-db.c and (2) cd-device-db.c in colord before 0.1.15 allow local users to execute arbitrary SQL commands via vectors related to color devices and (a) device id, (b) property, or (c) profile id.
CVE-2011-4346Dec 10, 2011
Red Hat
Satellite
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in the web interface in Red Hat Network (RHN) Satellite 5.4.1 allows remote authenticated users to inject arbitrary web script or HTML via the Description field of the asset tag in a Custom Info page.
CVE-2011-4719Dec 9, 2011
Google
Google Chrome
risk 0.00cvss —epss 0.01
Multiple unspecified vulnerabilities in Google Chrome before 16.0.912.63 on the Acer AC700, Samsung Series 5, and Cr-48 Chromebook platforms have unknown impact and attack vectors.
CVE-2011-4315Dec 8, 2011
Nginx
Nginx
risk 0.00cvss —epss 0.06
Heap-based buffer overflow in compression-pointer processing in core/ngx_resolver.c in nginx before 1.0.10 allows remote resolvers to cause a denial of service (daemon crash) or possibly have unspecified other impact via a long response.
CVE-2011-4128Dec 8, 2011
GNU
Gnutls
risk 0.00cvss —epss 0.02
Buffer overflow in the gnutls_session_get_data function in lib/gnutls_session.c in GnuTLS 2.12.x before 2.12.14 and 3.x before 3.0.7, when used on a client that performs nonstandard session resumption, allows remote TLS servers to cause a denial of service (application crash)…
CVE-2011-1530Dec 8, 2011
Mit
Kerberos
risk 0.00cvss —epss 0.02
The process_tgs_req function in do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.9 through 1.9.2 allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted TGS request that triggers an…
CVE-2011-0291Dec 8, 2011
Blackberry
PlayBook
risk 0.00cvss —epss 0.00
The BlackBerry PlayBook service on the Research In Motion (RIM) BlackBerry PlayBook tablet with software before 1.0.8.6067 allows local users to gain privileges via a crafted configuration file in a backup archive.
CVE-2011-4716Dec 8, 2011
Dreambox
DM800
risk 0.03cvss —epss 0.03
Directory traversal vulnerability in file in DreamBox DM800 1.6rc3, 1.5rc1, and earlier allows remote attackers to read arbitrary files via the file parameter.
CVE-2011-4715Dec 8, 2011
Koha
Liblime Koha
risk 0.00cvss —epss 0.09
Directory traversal vulnerability in cgi-bin/koha/mainpage.pl in Koha 3.4 before 3.4.7 and 3.6 before 3.6.1, and LibLime Koha 4.2 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the KohaOpacLanguage cookie to cgi-bin/opac/opac-main.pl, related…
CVE-2011-4714Dec 8, 2011
Virtual Vertex
Muster
risk 0.03cvss —epss 0.04
Directory traversal vulnerability in Virtual Vertex Muster before 6.20 allows remote attackers to read arbitrary files via a \.. (backslash dot dot) in the URL.
CVE-2011-4713Dec 8, 2011
Oscss
Oscss
risk 0.03cvss —epss 0.03
Directory traversal vulnerability in catalog/content.php in osCSS2 2.1.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the _ID parameter to (1) catalog/shopping_cart.php or (2) catalog/content.php.
CVE-2011-4712Dec 8, 2011
Monoxide0184
Oxide Webserver
risk 0.03cvss —epss 0.03
Directory traversal vulnerability in Oxide WebServer allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in an HTTP request.
CVE-2011-4711Dec 8, 2011
Namazu
Namazu
risk 0.00cvss —epss 0.02
Multiple directory traversal vulnerabilities in namazu.cgi in Namazu before 2.0.16 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) lang or (2) result parameter.
CVE-2011-4710Dec 8, 2011
Getpixie
Pixie CMS
risk 0.03cvss —epss 0.02
Multiple SQL injection vulnerabilities in Pixie CMS 1.01 through 1.04 allow remote attackers to execute arbitrary SQL commands via the (1) pixie_user parameter and (2) Referer HTTP header in a request to the default URI.
CVE-2011-4709Dec 8, 2011
Hotaru
Search Plugin
risk 0.03cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in Hotaru.php in the Search plugin 1.3 for Hotaru CMS allow remote attackers to inject arbitrary web script or HTML via the (1) SITE_NAME parameter to admin_index.php, or the (2) return and (3) search parameters to index.php. …
CVE-2011-4708Dec 8, 2011
IBM
Rational Asset Manager
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in IBM Rational Asset Manager before 7.5.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2011-4707Dec 8, 2011
SAP
Netweaver
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in the Virus Scan Interface in SAP Netweaver allow remote attackers to inject arbitrary web script or HTML via the (1) instname parameter to the VsiTestScan servlet and (2) name parameter to the VsiTestServlet servlet.
CVE-2011-2917Dec 8, 2011
Mambo (software)
Mambo
risk 0.03cvss —epss 0.01
SQL injection vulnerability in administrator/index2.php in Mambo CMS 4.6.5 and earlier allows remote attackers to execute arbitrary SQL commands via the zorder parameter.
CVE-2011-4539Dec 8, 2011
Isc
DHCP
risk 0.01cvss —epss 0.15
dhcpd in ISC DHCP 4.x before 4.2.3-P1 and 4.1-ESV before 4.1-ESV-R4 does not properly handle regular expressions in dhcpd.conf, which allows remote attackers to cause a denial of service (daemon crash) via a crafted request packet.
CVE-2011-4265Dec 8, 2011
Phpwebsite
Phpwebsite
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in phpWebSite before 1.0.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2011-4264Dec 8, 2011
Etomite
Etomite
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Etomite before 1.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2011-4054Dec 8, 2011
Ca
Siteminder
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in login.fcc in CA SiteMinder R6 SP6 before CR7 and R12 SP3 before CR8 allows remote attackers to inject arbitrary web script or HTML via the postpreservationdata parameter.