CVEs

346,434 total · page 5970 of 6,929

CVE	Vendor / Product	Risk	CVSS	EPSS	Published	Description
CVE-2009-0905	IBM Websphere Mq	0.00	—	0.00	Oct 30, 2011	IBM WebSphere MQ 6.0 before 6.0.2.8 and 7.0 before 7.0.1.0 does not properly handle long group names, which might allow local users to gain privileges by leveraging combinations of group names with the same initial substring.
CVE-2009-0900	IBM Websphere Mq	0.00	—	0.00	Oct 30, 2011	Heap-based buffer overflow in the client in IBM WebSphere MQ 6.0 before 6.0.2.7 and 7.0 before 7.0.1.0 allows local users to gain privileges via crafted SSL information in a Client Channel Definition Table (CCDT) file.
CVE-2011-1367	IBM Rational Appscan	0.00	—	0.04	Oct 30, 2011	Unspecified vulnerability in the File Load feature in IBM Rational AppScan Standard and Express 7.8.x, 7.9.x, and 8.0.x before 8.0.0.3 allows remote attackers to execute arbitrary commands via a crafted .scan file.
CVE-2011-1366	IBM Rational Appscan	0.00	—	0.02	Oct 30, 2011	Unspecified vulnerability in the Import feature in IBM Rational AppScan Enterprise and AppScan Reporting Console 5.2 through 7.9.x and 8.x before 8.0.1.1 allows remote attackers to execute arbitrary commands on an agent server via a crafted ZIP archive.
CVE-2009-2748	IBM Websphere Application Server	0.00	—	0.02	Oct 30, 2011	Cross-site scripting (XSS) vulnerability in the Administration Console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.29 and 7.1 before 7.0.0.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2009-2747	IBM Websphere Application Server	0.00	—	0.02	Oct 30, 2011	The Java Naming and Directory Interface (JNDI) implementation in IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.39, 6.1 before 6.1.0.29, and 7.0 before 7.0.0.7 does not properly restrict access to UserRegistry object methods, which allows remote attackers to obtain…
CVE-2011-1370	IBM Sametime	0.00	—	0.01	Oct 29, 2011	The default configuration of the Sametime configuration servlet (SCS) in the server in IBM Lotus Sametime 7.0 through 8.5.2 does not enable an authentication requirement, which allows remote attackers to read the configuration settings by examining a response message.
CVE-2011-1368	IBM Websphere Application Server	0.00	—	0.02	Oct 29, 2011	The JavaServer Faces (JSF) application functionality in IBM WebSphere Application Server 8.x before 8.0.0.1 does not properly handle requests, which allows remote attackers to read unspecified files via unknown vectors.
CVE-2010-0780	IBM Websphere Mq	0.00	—	0.02	Oct 29, 2011	IBM WebSphere MQ 7.x before 7.0.1.4 allows remote attackers to cause a denial of service (disk consumption) via multiple connection attempts to a stopped queue manager.
CVE-2011-3640	Google Chrome	0.00	—	0.01	Oct 28, 2011	Untrusted search path vulnerability in Mozilla Network Security Services (NSS), as used in Google Chrome before 17 on Windows and Mac OS X, might allow local users to gain privileges via a Trojan horse pkcs11.txt file in a top-level directory. NOTE: the vendor's response was…
CVE-2011-3251	Apple Inc. Quicktime	0.00	—	0.04	Oct 28, 2011	Apple QuickTime before 7.7.1 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted TKHD atoms in a QuickTime movie file.
CVE-2011-3250	Apple Inc. Quicktime	0.00	—	0.05	Oct 28, 2011	Integer overflow in Apple QuickTime before 7.7.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with JPEG2000 encoding.
CVE-2011-3249	Apple Inc. Quicktime	0.00	—	0.05	Oct 28, 2011	Buffer overflow in Apple QuickTime before 7.7.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with FLC encoding.
CVE-2011-3248	Apple Inc. Quicktime	0.00	—	0.05	Oct 28, 2011	Integer signedness error in Apple QuickTime before 7.7.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted font table in a QuickTime movie file.
CVE-2011-3247	Apple Inc. Quicktime	0.00	—	0.04	Oct 28, 2011	Integer overflow in Apple QuickTime before 7.7.1 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PICT file.
CVE-2011-2830	Google Chrome	0.00	—	0.01	Oct 28, 2011	Google V8, as used in Google Chrome before 14.0.835.163, does not properly implement script object wrappers, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via unknown vectors.
CVE-2011-1371	IBM Websphere Ilog Rule Team Server	0.00	—	0.01	Oct 28, 2011	Cross-site scripting (XSS) vulnerability in content/error.jsp in IBM WebSphere ILOG Rule Team Server 7.1.1 allows remote attackers to inject arbitrary web script or HTML via vectors that trigger an Unknown Error document, a different vulnerability than CVE-2011-4171.
CVE-2011-1360	IBM HTTP Server	0.00	—	0.02	Oct 28, 2011	Multiple cross-site scripting (XSS) vulnerabilities in IBM HTTP Server 2.0.47 and earlier, as used in WebSphere Application Server and other products, allow remote attackers to inject arbitrary web script or HTML via vectors involving unspecified documentation files in (1)…
CVE-2011-4004	Cisco Systems, Inc. Webex Recording Format Player	0.00	—	0.04	Oct 27, 2011	Buffer overflow in the ATAS32 processing functionality in the Cisco WebEx Recording Format (WRF) player T26 before SP49 EP40 and T27 before SP28 allows remote attackers to execute arbitrary code via a crafted WRF file.
CVE-2011-3319	Cisco Systems, Inc. Webex Recording Format Player	0.00	—	0.03	Oct 27, 2011	Buffer overflow in the WRF parsing functionality in the Cisco WebEx Recording Format (WRF) player T26 before SP49 EP40 and T27 before SP28 allows remote attackers to execute arbitrary code via a crafted WRF file.
CVE-2011-3318	Cisco Systems, Inc. Video Surveillance 2421	0.00	—	0.01	Oct 27, 2011	Cisco Video Surveillance 2421 and 2500 series cameras with software 1.1.x and 2.x before 2.4.0 and Video Surveillance 2600 series cameras with software before 4.2.0-13 allow remote attackers to cause a denial of service (device reload) by sending crafted RTSP packets over TCP,…
CVE-2011-3315	Cisco Systems, Inc. Unified Communications Manager	0.05	—	0.26	Oct 27, 2011	Directory traversal vulnerability in Cisco Unified Communications Manager (CUCM) 5.x and 6.x before 6.1(5)SU2, 7.x before 7.1(5b)SU2, and 8.x before 8.0(3), and Cisco Unified Contact Center Express (aka Unified CCX or UCCX) and Cisco Unified IP Interactive Voice Response…
CVE-2011-2569	Cisco Systems, Inc. Unified Computing System	0.00	—	0.00	Oct 27, 2011	Cisco Nexus OS (aka NX-OS) 4.2 and 5.0 and Cisco Unified Computing System with software 1.4 and 2.0 do not properly restrict command-line options, which allows local users to gain privileges via unspecified vectors, aka Bug IDs CSCtf40008, CSCtg18363, CSCtr44645, CSCts10195, and…
CVE-2011-4079	OpenLDAP Openldap	0.00	—	0.04	Oct 27, 2011	Off-by-one error in the UTF8StringNormalize function in OpenLDAP 2.4.26 and earlier allows remote attackers to cause a denial of service (slapd crash) via a zero-length string that triggers a heap-based buffer overflow, as demonstrated using an empty postalAddressAttribute value…
CVE-2011-3872	Puppet (software) Puppet	0.00	—	0.02	Oct 27, 2011	Puppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6, and Puppet Enterprise (PE) Users 1.0, 1.1, and 1.2 before 1.2.4, when signing an agent certificate, adds the Puppet master's certdnsnames values to the X.509 Subject Alternative Name field of the certificate, which allows remote…
CVE-2011-3871	Puppet (software) Puppet	0.00	—	0.00	Oct 27, 2011	Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in --edit mode, uses a predictable file name, which allows local users to run arbitrary Puppet code or trick a user into editing arbitrary files.
CVE-2011-3870	Puppet (software) Puppet	0.00	—	0.00	Oct 27, 2011	Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to modify the permissions of arbitrary files via a symlink attack on the SSH authorized_keys file.
CVE-2011-3869	Puppet (software) Puppet	0.00	—	0.00	Oct 27, 2011	Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to overwrite arbitrary files via a symlink attack on the .k5login file.
CVE-2011-3848	Puppet (software) Puppet	0.00	—	0.01	Oct 27, 2011	Directory traversal vulnerability in Puppet 2.6.x before 2.6.10 and 2.7.x before 2.7.4 allows remote attackers to write X.509 Certificate Signing Request (CSR) to arbitrary locations via (1) a double-encoded key parameter in the URI in 2.7.x, (2) the CN in the Subject of a CSR…
CVE-2011-3891	Google Chrome	0.00	—	0.01	Oct 25, 2011	Google Chrome before 15.0.874.102 does not properly restrict access to internal Google V8 functions, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVE-2011-3890	Google Chrome	0.00	—	0.01	Oct 25, 2011	Use-after-free vulnerability in Google Chrome before 15.0.874.102 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to video source handling.
CVE-2011-3889	Google Chrome	0.00	—	0.01	Oct 25, 2011	Heap-based buffer overflow in the Web Audio implementation in Google Chrome before 15.0.874.102 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVE-2011-3888	Google Chrome	0.00	—	0.02	Oct 25, 2011	Use-after-free vulnerability in Google Chrome before 15.0.874.102 allows user-assisted remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to editing operations in conjunction with an unknown plug-in.
CVE-2011-3887	Google Chrome	0.00	—	0.01	Oct 25, 2011	Google Chrome before 15.0.874.102 does not properly handle javascript: URLs, which allows remote attackers to bypass intended access restrictions and read cookies via unspecified vectors.
CVE-2011-3886	Google V8	0.00	—	0.01	Oct 25, 2011	Google V8, as used in Google Chrome before 15.0.874.102, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers out-of-bounds write operations.
CVE-2011-3885	Google Chrome	0.00	—	0.02	Oct 25, 2011	Use-after-free vulnerability in Google Chrome before 15.0.874.102 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to stale Cascading Style Sheets (CSS) token-sequence data.
CVE-2011-3884	Google Chrome	0.00	—	0.01	Oct 25, 2011	Google Chrome before 15.0.874.102 does not properly address timing issues during DOM traversal, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document.
CVE-2011-3883	Google Chrome	0.00	—	0.01	Oct 25, 2011	Use-after-free vulnerability in Google Chrome before 15.0.874.102 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to counters.
CVE-2011-3882	Google Chrome	0.00	—	0.01	Oct 25, 2011	Use-after-free vulnerability in Google Chrome before 15.0.874.102 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to media buffers.
CVE-2011-3881	Google Chrome	0.00	—	0.02	Oct 25, 2011	WebKit, as used in Google Chrome before 15.0.874.102 and Android before 4.4, allows remote attackers to bypass the Same Origin Policy and conduct Universal XSS (UXSS) attacks via vectors related to (1) the DOMWindow::clear function and use of a selection object, (2) the…
CVE-2011-3880	Google Chrome	0.00	—	0.01	Oct 25, 2011	Google Chrome before 15.0.874.102 does not prevent use of an unspecified special character as a delimiter in HTTP headers, which has unknown impact and remote attack vectors.
CVE-2011-3879	Google Chrome	0.00	—	0.01	Oct 25, 2011	Google Chrome before 15.0.874.102 does not prevent redirects to chrome: URLs, which has unspecified impact and remote attack vectors.
CVE-2011-3878	Google Chrome	0.00	—	0.01	Oct 25, 2011	Race condition in Google Chrome before 15.0.874.102 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to worker process initialization.
CVE-2011-3877	Google Chrome	0.00	—	0.01	Oct 25, 2011	Cross-site scripting (XSS) vulnerability in the appcache internals page in Google Chrome before 15.0.874.102 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2011-3876	Google Chrome	0.00	—	0.01	Oct 25, 2011	Google Chrome before 15.0.874.102 does not properly handle downloading files that have whitespace characters at the end of a filename, which has unspecified impact and user-assisted remote attack vectors.
CVE-2011-3875	Google Chrome	0.00	—	0.01	Oct 25, 2011	Google Chrome before 15.0.874.102 does not properly handle drag and drop operations on URL strings, which allows user-assisted remote attackers to spoof the URL bar via unspecified vectors.
CVE-2011-2845	Google Chrome	0.00	—	0.01	Oct 25, 2011	Google Chrome before 15.0.874.102 does not properly handle history data, which allows user-assisted remote attackers to spoof the URL bar via unspecified vectors.
CVE-2011-4173	Simple Machines Smf	0.00	—	0.01	Oct 24, 2011	Cross-site request forgery (CSRF) vulnerability in Simple Machines Forum (SMF) 2.x before 2.0.1 allows remote attackers to hijack the authentication of administrators or moderators via vectors involving image files, a different vulnerability than CVE-2011-3615. NOTE: some of…
CVE-2011-4172	Kent Web Web Forum	0.00	—	0.01	Oct 24, 2011	Multiple cross-site scripting (XSS) vulnerabilities in KENT-WEB WEB FORUM before 5.1 allow remote attackers to inject arbitrary web script or HTML via (1) an e-mail address field or (2) a cookie, a related issue to CVE-2011-3383, CVE-2011-3983, and CVE-2011-3984.
CVE-2011-4171	IBM Websphere Ilog Rule Team Server	0.00	—	0.01	Oct 24, 2011	Cross-site scripting (XSS) vulnerability in content/error.jsp in IBM WebSphere ILOG Rule Team Server 7.1.1 allows remote attackers to inject arbitrary web script or HTML via the project parameter to teamserver/faces/home.jsp.

CVE-2009-0905Oct 30, 2011
IBM
Websphere Mq
risk 0.00cvss —epss 0.00
IBM WebSphere MQ 6.0 before 6.0.2.8 and 7.0 before 7.0.1.0 does not properly handle long group names, which might allow local users to gain privileges by leveraging combinations of group names with the same initial substring.
CVE-2009-0900Oct 30, 2011
IBM
Websphere Mq
risk 0.00cvss —epss 0.00
Heap-based buffer overflow in the client in IBM WebSphere MQ 6.0 before 6.0.2.7 and 7.0 before 7.0.1.0 allows local users to gain privileges via crafted SSL information in a Client Channel Definition Table (CCDT) file.
CVE-2011-1367Oct 30, 2011
IBM
Rational Appscan
risk 0.00cvss —epss 0.04
Unspecified vulnerability in the File Load feature in IBM Rational AppScan Standard and Express 7.8.x, 7.9.x, and 8.0.x before 8.0.0.3 allows remote attackers to execute arbitrary commands via a crafted .scan file.
CVE-2011-1366Oct 30, 2011
IBM
Rational Appscan
risk 0.00cvss —epss 0.02
Unspecified vulnerability in the Import feature in IBM Rational AppScan Enterprise and AppScan Reporting Console 5.2 through 7.9.x and 8.x before 8.0.1.1 allows remote attackers to execute arbitrary commands on an agent server via a crafted ZIP archive.
CVE-2009-2748Oct 30, 2011
IBM
Websphere Application Server
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in the Administration Console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.29 and 7.1 before 7.0.0.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2009-2747Oct 30, 2011
IBM
Websphere Application Server
risk 0.00cvss —epss 0.02
The Java Naming and Directory Interface (JNDI) implementation in IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.39, 6.1 before 6.1.0.29, and 7.0 before 7.0.0.7 does not properly restrict access to UserRegistry object methods, which allows remote attackers to obtain…
CVE-2011-1370Oct 29, 2011
IBM
Sametime
risk 0.00cvss —epss 0.01
The default configuration of the Sametime configuration servlet (SCS) in the server in IBM Lotus Sametime 7.0 through 8.5.2 does not enable an authentication requirement, which allows remote attackers to read the configuration settings by examining a response message.
CVE-2011-1368Oct 29, 2011
IBM
Websphere Application Server
risk 0.00cvss —epss 0.02
The JavaServer Faces (JSF) application functionality in IBM WebSphere Application Server 8.x before 8.0.0.1 does not properly handle requests, which allows remote attackers to read unspecified files via unknown vectors.
CVE-2010-0780Oct 29, 2011
IBM
Websphere Mq
risk 0.00cvss —epss 0.02
IBM WebSphere MQ 7.x before 7.0.1.4 allows remote attackers to cause a denial of service (disk consumption) via multiple connection attempts to a stopped queue manager.
CVE-2011-3640Oct 28, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Untrusted search path vulnerability in Mozilla Network Security Services (NSS), as used in Google Chrome before 17 on Windows and Mac OS X, might allow local users to gain privileges via a Trojan horse pkcs11.txt file in a top-level directory. NOTE: the vendor's response was…
CVE-2011-3251Oct 28, 2011
Apple Inc.
Quicktime
risk 0.00cvss —epss 0.04
Apple QuickTime before 7.7.1 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted TKHD atoms in a QuickTime movie file.
CVE-2011-3250Oct 28, 2011
Apple Inc.
Quicktime
risk 0.00cvss —epss 0.05
Integer overflow in Apple QuickTime before 7.7.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with JPEG2000 encoding.
CVE-2011-3249Oct 28, 2011
Apple Inc.
Quicktime
risk 0.00cvss —epss 0.05
Buffer overflow in Apple QuickTime before 7.7.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with FLC encoding.
CVE-2011-3248Oct 28, 2011
Apple Inc.
Quicktime
risk 0.00cvss —epss 0.05
Integer signedness error in Apple QuickTime before 7.7.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted font table in a QuickTime movie file.
CVE-2011-3247Oct 28, 2011
Apple Inc.
Quicktime
risk 0.00cvss —epss 0.04
Integer overflow in Apple QuickTime before 7.7.1 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PICT file.
CVE-2011-2830Oct 28, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Google V8, as used in Google Chrome before 14.0.835.163, does not properly implement script object wrappers, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via unknown vectors.
CVE-2011-1371Oct 28, 2011
IBM
Websphere Ilog Rule Team Server
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in content/error.jsp in IBM WebSphere ILOG Rule Team Server 7.1.1 allows remote attackers to inject arbitrary web script or HTML via vectors that trigger an Unknown Error document, a different vulnerability than CVE-2011-4171.
CVE-2011-1360Oct 28, 2011
IBM
HTTP Server
risk 0.00cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in IBM HTTP Server 2.0.47 and earlier, as used in WebSphere Application Server and other products, allow remote attackers to inject arbitrary web script or HTML via vectors involving unspecified documentation files in (1)…
CVE-2011-4004Oct 27, 2011
Cisco Systems, Inc.
Webex Recording Format Player
risk 0.00cvss —epss 0.04
Buffer overflow in the ATAS32 processing functionality in the Cisco WebEx Recording Format (WRF) player T26 before SP49 EP40 and T27 before SP28 allows remote attackers to execute arbitrary code via a crafted WRF file.
CVE-2011-3319Oct 27, 2011
Cisco Systems, Inc.
Webex Recording Format Player
risk 0.00cvss —epss 0.03
Buffer overflow in the WRF parsing functionality in the Cisco WebEx Recording Format (WRF) player T26 before SP49 EP40 and T27 before SP28 allows remote attackers to execute arbitrary code via a crafted WRF file.
CVE-2011-3318Oct 27, 2011
Cisco Systems, Inc.
Video Surveillance 2421
risk 0.00cvss —epss 0.01
Cisco Video Surveillance 2421 and 2500 series cameras with software 1.1.x and 2.x before 2.4.0 and Video Surveillance 2600 series cameras with software before 4.2.0-13 allow remote attackers to cause a denial of service (device reload) by sending crafted RTSP packets over TCP,…
CVE-2011-3315Oct 27, 2011
Cisco Systems, Inc.
Unified Communications Manager
risk 0.05cvss —epss 0.26
Directory traversal vulnerability in Cisco Unified Communications Manager (CUCM) 5.x and 6.x before 6.1(5)SU2, 7.x before 7.1(5b)SU2, and 8.x before 8.0(3), and Cisco Unified Contact Center Express (aka Unified CCX or UCCX) and Cisco Unified IP Interactive Voice Response…
CVE-2011-2569Oct 27, 2011
Cisco Systems, Inc.
Unified Computing System
risk 0.00cvss —epss 0.00
Cisco Nexus OS (aka NX-OS) 4.2 and 5.0 and Cisco Unified Computing System with software 1.4 and 2.0 do not properly restrict command-line options, which allows local users to gain privileges via unspecified vectors, aka Bug IDs CSCtf40008, CSCtg18363, CSCtr44645, CSCts10195, and…
CVE-2011-4079Oct 27, 2011
OpenLDAP
Openldap
risk 0.00cvss —epss 0.04
Off-by-one error in the UTF8StringNormalize function in OpenLDAP 2.4.26 and earlier allows remote attackers to cause a denial of service (slapd crash) via a zero-length string that triggers a heap-based buffer overflow, as demonstrated using an empty postalAddressAttribute value…
CVE-2011-3872Oct 27, 2011
Puppet (software)
Puppet
risk 0.00cvss —epss 0.02
Puppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6, and Puppet Enterprise (PE) Users 1.0, 1.1, and 1.2 before 1.2.4, when signing an agent certificate, adds the Puppet master's certdnsnames values to the X.509 Subject Alternative Name field of the certificate, which allows remote…
CVE-2011-3871Oct 27, 2011
Puppet (software)
Puppet
risk 0.00cvss —epss 0.00
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in --edit mode, uses a predictable file name, which allows local users to run arbitrary Puppet code or trick a user into editing arbitrary files.
CVE-2011-3870Oct 27, 2011
Puppet (software)
Puppet
risk 0.00cvss —epss 0.00
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to modify the permissions of arbitrary files via a symlink attack on the SSH authorized_keys file.
CVE-2011-3869Oct 27, 2011
Puppet (software)
Puppet
risk 0.00cvss —epss 0.00
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to overwrite arbitrary files via a symlink attack on the .k5login file.
CVE-2011-3848Oct 27, 2011
Puppet (software)
Puppet
risk 0.00cvss —epss 0.01
Directory traversal vulnerability in Puppet 2.6.x before 2.6.10 and 2.7.x before 2.7.4 allows remote attackers to write X.509 Certificate Signing Request (CSR) to arbitrary locations via (1) a double-encoded key parameter in the URI in 2.7.x, (2) the CN in the Subject of a CSR…
CVE-2011-3891Oct 25, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Google Chrome before 15.0.874.102 does not properly restrict access to internal Google V8 functions, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVE-2011-3890Oct 25, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Use-after-free vulnerability in Google Chrome before 15.0.874.102 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to video source handling.
CVE-2011-3889Oct 25, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Heap-based buffer overflow in the Web Audio implementation in Google Chrome before 15.0.874.102 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVE-2011-3888Oct 25, 2011
Google
Chrome
risk 0.00cvss —epss 0.02
Use-after-free vulnerability in Google Chrome before 15.0.874.102 allows user-assisted remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to editing operations in conjunction with an unknown plug-in.
CVE-2011-3887Oct 25, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Google Chrome before 15.0.874.102 does not properly handle javascript: URLs, which allows remote attackers to bypass intended access restrictions and read cookies via unspecified vectors.
CVE-2011-3886Oct 25, 2011
Google
V8
risk 0.00cvss —epss 0.01
Google V8, as used in Google Chrome before 15.0.874.102, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers out-of-bounds write operations.
CVE-2011-3885Oct 25, 2011
Google
Chrome
risk 0.00cvss —epss 0.02
Use-after-free vulnerability in Google Chrome before 15.0.874.102 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to stale Cascading Style Sheets (CSS) token-sequence data.
CVE-2011-3884Oct 25, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Google Chrome before 15.0.874.102 does not properly address timing issues during DOM traversal, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document.
CVE-2011-3883Oct 25, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Use-after-free vulnerability in Google Chrome before 15.0.874.102 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to counters.
CVE-2011-3882Oct 25, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Use-after-free vulnerability in Google Chrome before 15.0.874.102 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to media buffers.
CVE-2011-3881Oct 25, 2011
Google
Chrome
risk 0.00cvss —epss 0.02
WebKit, as used in Google Chrome before 15.0.874.102 and Android before 4.4, allows remote attackers to bypass the Same Origin Policy and conduct Universal XSS (UXSS) attacks via vectors related to (1) the DOMWindow::clear function and use of a selection object, (2) the…
CVE-2011-3880Oct 25, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Google Chrome before 15.0.874.102 does not prevent use of an unspecified special character as a delimiter in HTTP headers, which has unknown impact and remote attack vectors.
CVE-2011-3879Oct 25, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Google Chrome before 15.0.874.102 does not prevent redirects to chrome: URLs, which has unspecified impact and remote attack vectors.
CVE-2011-3878Oct 25, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Race condition in Google Chrome before 15.0.874.102 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to worker process initialization.
CVE-2011-3877Oct 25, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the appcache internals page in Google Chrome before 15.0.874.102 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2011-3876Oct 25, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Google Chrome before 15.0.874.102 does not properly handle downloading files that have whitespace characters at the end of a filename, which has unspecified impact and user-assisted remote attack vectors.
CVE-2011-3875Oct 25, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Google Chrome before 15.0.874.102 does not properly handle drag and drop operations on URL strings, which allows user-assisted remote attackers to spoof the URL bar via unspecified vectors.
CVE-2011-2845Oct 25, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Google Chrome before 15.0.874.102 does not properly handle history data, which allows user-assisted remote attackers to spoof the URL bar via unspecified vectors.
CVE-2011-4173Oct 24, 2011
Simple Machines
Smf
risk 0.00cvss —epss 0.01
Cross-site request forgery (CSRF) vulnerability in Simple Machines Forum (SMF) 2.x before 2.0.1 allows remote attackers to hijack the authentication of administrators or moderators via vectors involving image files, a different vulnerability than CVE-2011-3615. NOTE: some of…
CVE-2011-4172Oct 24, 2011
Kent Web
Web Forum
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in KENT-WEB WEB FORUM before 5.1 allow remote attackers to inject arbitrary web script or HTML via (1) an e-mail address field or (2) a cookie, a related issue to CVE-2011-3383, CVE-2011-3983, and CVE-2011-3984.
CVE-2011-4171Oct 24, 2011
IBM
Websphere Ilog Rule Team Server
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in content/error.jsp in IBM WebSphere ILOG Rule Team Server 7.1.1 allows remote attackers to inject arbitrary web script or HTML via the project parameter to teamserver/faces/home.jsp.