CVEs

346,414 total · page 5979 of 6,929

CVE	Vendor / Product	Risk	CVSS	EPSS	Published	Description
CVE-2011-3974	FFmpeg Ffmpeg	0.00	—	0.03	Oct 2, 2011	Integer signedness error in the decode_residual_inter function in cavsdec.c in libavcodec in FFmpeg before 0.7.4 and 0.8.x before 0.8.3 allows remote attackers to cause a denial of service (incorrect write operation and application crash) via an invalid bitstream in a Chinese…
CVE-2011-3973	FFmpeg Ffmpeg	0.00	—	0.03	Oct 2, 2011	cavsdec.c in libavcodec in FFmpeg before 0.7.4 and 0.8.x before 0.8.3 allows remote attackers to cause a denial of service (incorrect write operation and application crash) via an invalid bitstream in a Chinese AVS video (aka CAVS) file, related to the decode_residual_block,…
CVE-2011-3371	Punbb Punbb	0.00	—	0.02	Oct 2, 2011	Multiple cross-site scripting (XSS) vulnerabilities in include/functions.php in PunBB before 1.3.6 allow remote attackers to inject arbitrary web script or HTML via the (1) id, (2) form_sent, (3) csrf_token, (4) req_confirm, or (5) delete parameter to delete.php, the (6) id, (7)…
CVE-2011-3362	FFmpeg Ffmpeg	0.00	—	0.03	Oct 2, 2011	Integer signedness error in the decode_residual_block function in cavsdec.c in libavcodec in FFmpeg before 0.7.3 and 0.8.x before 0.8.2, and libav through 0.7.1, allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute…
CVE-2011-2411	Samba (software) Samba	0.00	—	0.06	Oct 2, 2011	Unspecified vulnerability on HP NonStop Servers with software H06.x through H06.23.00 and J06.x through J06.12.00, when Samba is used, allows remote authenticated users to execute arbitrary code via unknown vectors.
CVE-2011-2674	Basercms Basercms	0.00	—	0.01	Oct 2, 2011	BaserCMS before 1.6.12 does not properly restrict additions to the membership of the operators group, which allows remote authenticated users to gain privileges via unspecified vectors.
CVE-2011-2673	Basercms Basercms	0.00	—	0.02	Oct 2, 2011	Cross-site scripting (XSS) vulnerability in BaserCMS before 1.6.13.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2011-0554	Symantec Im Manager	0.00	—	0.04	Oct 2, 2011	The management console in Symantec IM Manager before 8.4.18 allows remote attackers to execute arbitrary code via unspecified vectors, related to a "code injection issue."
CVE-2011-0553	Symantec Im Manager	0.00	—	0.02	Oct 2, 2011	SQL injection vulnerability in the management console in Symantec IM Manager before 8.4.18 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2011-0552	Symantec Im Manager	0.00	—	0.03	Oct 2, 2011	Multiple cross-site scripting (XSS) vulnerabilities in the management console in Symantec IM Manager before 8.4.18 allow remote attackers to inject arbitrary web script or HTML via the (1) refreshRateSetting parameter to IMManager/Admin/IMAdminSystemDashboard.asp, the (2) nav or…
CVE-2011-3580	IceWarp Server	0.00	—	0.02	Sep 30, 2011	IceWarp WebMail in IceWarp Mail Server before 10.3.3 allows remote attackers to obtain configuration information via a direct request to the /server URI, which triggers a call to the phpinfo function.
CVE-2011-3579	IceWarp Server	0.03	—	0.05	Sep 30, 2011	server/webmail.php in IceWarp WebMail in IceWarp Mail Server before 10.3.3 allows remote attackers to read arbitrary files, and possibly send HTTP requests to intranet servers or cause a denial of service (CPU and memory consumption), via an XML external entity declaration in…
CVE-2011-3369	EtherApe EtherApe	0.00	—	0.02	Sep 30, 2011	The add_conversation function in conversations.c in EtherApe before 0.9.12 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an RPC packet, related to the get_rpc function in decode_proto.c.
CVE-2011-3010	TWiki Twiki	0.03	—	0.06	Sep 30, 2011	Multiple cross-site scripting (XSS) vulnerabilities in TWiki before 5.1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the newtopic parameter in a WebCreateNewTopic action, related to the TWiki.WebCreateNewTopicTemplate topic; or (2) the query string to…
CVE-2011-2998	Mozilla Corporation Firefox	0.00	—	0.05	Sep 30, 2011	Integer underflow in Mozilla Firefox 3.6.x before 3.6.23 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via JavaScript code containing a large RegExp expression.
CVE-2011-3866	Mozilla Corporation Firefox	0.00	—	0.01	Sep 29, 2011	Mozilla Firefox before 7.0 and SeaMonkey before 2.4 do not properly restrict availability of motion data events, which makes it easier for remote attackers to read keystrokes by leveraging JavaScript code running in a background tab.
CVE-2011-3504	FFmpeg Ffmpeg	0.00	—	0.06	Sep 29, 2011	The Matroska format decoder in FFmpeg before 0.8.3 does not properly allocate memory, which allows remote attackers to execute arbitrary code via a crafted file.
CVE-2011-3232	Mozilla Corporation Firefox	0.00	—	0.05	Sep 29, 2011	YARR, as used in Mozilla Firefox before 7.0, Thunderbird before 7.0, and SeaMonkey before 2.4, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted JavaScript.
CVE-2011-3005	Mozilla Corporation Firefox	0.00	—	0.04	Sep 29, 2011	Use-after-free vulnerability in Mozilla Firefox 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted OGG headers in a .ogg file.
CVE-2011-3004	Mozilla Corporation Firefox	0.00	—	0.01	Sep 29, 2011	The JSSubScriptLoader in Mozilla Firefox 4.x through 6 and SeaMonkey before 2.4 does not properly handle XPCNativeWrappers during calls to the loadSubScript method in an add-on, which makes it easier for remote attackers to gain privileges via a crafted web site that leverages…
CVE-2011-3003	Mozilla Corporation Firefox	0.00	—	0.04	Sep 29, 2011	Mozilla Firefox before 7.0 and SeaMonkey before 2.4 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unspecified WebGL test case that triggers a memory-allocation error and a resulting out-of-bounds write operation.
CVE-2011-3002	Mozilla Corporation Firefox	0.00	—	0.03	Sep 29, 2011	Almost Native Graphics Layer Engine (ANGLE), as used in Mozilla Firefox before 7.0 and SeaMonkey before 2.4, does not validate the return value of a GrowAtomTable function call, which allows remote attackers to cause a denial of service (application crash) or possibly execute…
CVE-2011-3001	Mozilla Corporation Firefox	0.00	—	0.01	Sep 29, 2011	Mozilla Firefox 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 do not prevent manual add-on installation in response to the holding of the Enter key, which allows user-assisted remote attackers to bypass intended access restrictions via a crafted web site that…
CVE-2011-3000	Mozilla Corporation Firefox	0.00	—	0.02	Sep 29, 2011	Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 do not properly handle HTTP responses that contain multiple Location, Content-Length, or Content-Disposition headers, which makes it easier for remote attackers to conduct HTTP…
CVE-2011-2999	Mozilla Corporation Firefox	0.00	—	0.01	Sep 29, 2011	Mozilla Firefox before 3.6.23 and 4.x through 5, Thunderbird before 6.0, and SeaMonkey before 2.3 do not properly handle "location" as the name of a frame, which allows remote attackers to bypass the Same Origin Policy via a crafted web site, a different vulnerability than…
CVE-2011-2997	Mozilla Corporation Firefox	0.00	—	0.05	Sep 29, 2011	Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 6, Thunderbird before 7.0, and SeaMonkey before 2.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVE-2011-2996	Mozilla Corporation Firefox	0.00	—	0.04	Sep 29, 2011	Unspecified vulnerability in the plugin API in Mozilla Firefox 3.6.x before 3.6.23 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVE-2011-2995	Mozilla Corporation Firefox	0.00	—	0.04	Sep 29, 2011	Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute…
CVE-2011-2372	Mozilla Corporation Firefox	0.00	—	0.01	Sep 29, 2011	Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 do not prevent the starting of a download in response to the holding of the Enter key, which allows user-assisted remote attackers to bypass intended access restrictions via a…
CVE-2011-3865	WordPress Black-LetterHead	0.03	—	0.03	Sep 28, 2011	Cross-site scripting (XSS) vulnerability in the Black-LetterHead theme before 1.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.
CVE-2011-3864	WordPress The Erudite	0.00	—	0.02	Sep 28, 2011	Cross-site scripting (XSS) vulnerability in the The Erudite theme before 2.7.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpage parameter.
CVE-2011-3863	WordPress RedLine	0.03	—	0.03	Sep 28, 2011	Cross-site scripting (XSS) vulnerability in the RedLine theme before 1.66 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVE-2011-3862	WordPress Morning Coffee	0.03	—	0.04	Sep 28, 2011	Cross-site scripting (XSS) vulnerability in the Morning Coffee theme before 3.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.
CVE-2011-3861	WordPress Web Minimalist 200901	0.03	—	0.03	Sep 28, 2011	Cross-site scripting (XSS) vulnerability in the Web Minimalist 200901 theme before 1.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.
CVE-2011-3860	WordPress Cover WP	0.03	—	0.03	Sep 28, 2011	Cross-site scripting (XSS) vulnerability in the Cover WP theme before 1.6.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVE-2011-3859	WordPress Trending	0.03	—	0.03	Sep 28, 2011	Cross-site scripting (XSS) vulnerability in the Trending theme before 0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpage parameter.
CVE-2011-3858	WordPress Pixiv Custom	0.03	—	0.04	Sep 28, 2011	Cross-site scripting (XSS) vulnerability in the Pixiv Custom theme before 2.1.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVE-2011-3857	WordPress Antisnews	0.00	—	0.02	Sep 28, 2011	Cross-site scripting (XSS) vulnerability in the Antisnews theme before 1.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVE-2011-3856	WordPress Elegant Grunge	0.03	—	0.03	Sep 28, 2011	Cross-site scripting (XSS) vulnerability in the Elegant Grunge theme before 1.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVE-2011-3855	WordPress F8 Lite	0.03	—	0.03	Sep 28, 2011	Cross-site scripting (XSS) vulnerability in the F8 Lite theme before 4.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVE-2011-3854	WordPress ZenLite	0.00	—	0.02	Sep 28, 2011	Cross-site scripting (XSS) vulnerability in the ZenLite theme before 4.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVE-2011-3853	WordPress Hybrid	0.00	—	0.02	Sep 28, 2011	Cross-site scripting (XSS) vulnerability in the Hybrid theme before 0.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpage parameter.
CVE-2011-3852	WordPress EvoLve	0.03	—	0.03	Sep 28, 2011	Cross-site scripting (XSS) vulnerability in the EvoLve theme before 1.2.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVE-2011-3851	WordPress News	0.00	—	0.02	Sep 28, 2011	Cross-site scripting (XSS) vulnerability in the News theme before 0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpage parameter.
CVE-2011-3850	WordPress Atahualpa	0.03	—	0.04	Sep 28, 2011	Cross-site scripting (XSS) vulnerability in the Atahualpa theme before 3.6.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVE-2011-3694	Netsaro Enterprise Messenger Server	0.00	—	0.01	Sep 27, 2011	The Server Administration Console in NetSaro Enterprise Messenger Server 2.0 allows remote attackers to read application source code by appending a %00 character to a URL.
CVE-2011-3693	Netsaro Enterprise Messenger Server	0.00	—	0.00	Sep 27, 2011	NetSaro Enterprise Messenger Server 2.0 allows local users to discover cleartext server credentials by reading the NetSaro.fdb file.
CVE-2011-3692	Netsaro Enterprise Messenger Server	0.00	—	0.00	Sep 27, 2011	NetSaro Enterprise Messenger Server 2.0 stores cleartext console credentials in configuration.xml, which allows local users to obtain sensitive information by reading this file and performing a base64 decoding step.
CVE-2011-3691	Foxitsoftware Reader	0.00	—	0.01	Sep 27, 2011	Untrusted search path vulnerability in Foxit Reader before 5.0.2.0718 allows local users to gain privileges via a Trojan horse dwmapi.dll, dwrite.dll, or msdrm.dll in the current working directory.
CVE-2011-3690	Plotsoft Pdfill PDF Editor	0.00	—	0.01	Sep 27, 2011	Untrusted search path vulnerability in PlotSoft PDFill PDF Editor 8.0 allows local users to gain privileges via a Trojan horse mfc70enu.dll or mfc80loc.dll in the current working directory.

CVE-2011-3974Oct 2, 2011
FFmpeg
Ffmpeg
risk 0.00cvss —epss 0.03
Integer signedness error in the decode_residual_inter function in cavsdec.c in libavcodec in FFmpeg before 0.7.4 and 0.8.x before 0.8.3 allows remote attackers to cause a denial of service (incorrect write operation and application crash) via an invalid bitstream in a Chinese…
CVE-2011-3973Oct 2, 2011
FFmpeg
Ffmpeg
risk 0.00cvss —epss 0.03
cavsdec.c in libavcodec in FFmpeg before 0.7.4 and 0.8.x before 0.8.3 allows remote attackers to cause a denial of service (incorrect write operation and application crash) via an invalid bitstream in a Chinese AVS video (aka CAVS) file, related to the decode_residual_block,…
CVE-2011-3371Oct 2, 2011
Punbb
Punbb
risk 0.00cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in include/functions.php in PunBB before 1.3.6 allow remote attackers to inject arbitrary web script or HTML via the (1) id, (2) form_sent, (3) csrf_token, (4) req_confirm, or (5) delete parameter to delete.php, the (6) id, (7)…
CVE-2011-3362Oct 2, 2011
FFmpeg
Ffmpeg
risk 0.00cvss —epss 0.03
Integer signedness error in the decode_residual_block function in cavsdec.c in libavcodec in FFmpeg before 0.7.3 and 0.8.x before 0.8.2, and libav through 0.7.1, allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute…
CVE-2011-2411Oct 2, 2011
Samba (software)
Samba
risk 0.00cvss —epss 0.06
Unspecified vulnerability on HP NonStop Servers with software H06.x through H06.23.00 and J06.x through J06.12.00, when Samba is used, allows remote authenticated users to execute arbitrary code via unknown vectors.
CVE-2011-2674Oct 2, 2011
Basercms
Basercms
risk 0.00cvss —epss 0.01
BaserCMS before 1.6.12 does not properly restrict additions to the membership of the operators group, which allows remote authenticated users to gain privileges via unspecified vectors.
CVE-2011-2673Oct 2, 2011
Basercms
Basercms
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in BaserCMS before 1.6.13.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2011-0554Oct 2, 2011
Symantec
Im Manager
risk 0.00cvss —epss 0.04
The management console in Symantec IM Manager before 8.4.18 allows remote attackers to execute arbitrary code via unspecified vectors, related to a "code injection issue."
CVE-2011-0553Oct 2, 2011
Symantec
Im Manager
risk 0.00cvss —epss 0.02
SQL injection vulnerability in the management console in Symantec IM Manager before 8.4.18 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2011-0552Oct 2, 2011
Symantec
Im Manager
risk 0.00cvss —epss 0.03
Multiple cross-site scripting (XSS) vulnerabilities in the management console in Symantec IM Manager before 8.4.18 allow remote attackers to inject arbitrary web script or HTML via the (1) refreshRateSetting parameter to IMManager/Admin/IMAdminSystemDashboard.asp, the (2) nav or…
CVE-2011-3580Sep 30, 2011
IceWarp
Server
risk 0.00cvss —epss 0.02
IceWarp WebMail in IceWarp Mail Server before 10.3.3 allows remote attackers to obtain configuration information via a direct request to the /server URI, which triggers a call to the phpinfo function.
CVE-2011-3579Sep 30, 2011
IceWarp
Server
risk 0.03cvss —epss 0.05
server/webmail.php in IceWarp WebMail in IceWarp Mail Server before 10.3.3 allows remote attackers to read arbitrary files, and possibly send HTTP requests to intranet servers or cause a denial of service (CPU and memory consumption), via an XML external entity declaration in…
CVE-2011-3369Sep 30, 2011
EtherApe
EtherApe
risk 0.00cvss —epss 0.02
The add_conversation function in conversations.c in EtherApe before 0.9.12 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an RPC packet, related to the get_rpc function in decode_proto.c.
CVE-2011-3010Sep 30, 2011
TWiki
Twiki
risk 0.03cvss —epss 0.06
Multiple cross-site scripting (XSS) vulnerabilities in TWiki before 5.1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the newtopic parameter in a WebCreateNewTopic action, related to the TWiki.WebCreateNewTopicTemplate topic; or (2) the query string to…
CVE-2011-2998Sep 30, 2011
Mozilla Corporation
Firefox
risk 0.00cvss —epss 0.05
Integer underflow in Mozilla Firefox 3.6.x before 3.6.23 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via JavaScript code containing a large RegExp expression.
CVE-2011-3866Sep 29, 2011
Mozilla Corporation
Firefox
risk 0.00cvss —epss 0.01
Mozilla Firefox before 7.0 and SeaMonkey before 2.4 do not properly restrict availability of motion data events, which makes it easier for remote attackers to read keystrokes by leveraging JavaScript code running in a background tab.
CVE-2011-3504Sep 29, 2011
FFmpeg
Ffmpeg
risk 0.00cvss —epss 0.06
The Matroska format decoder in FFmpeg before 0.8.3 does not properly allocate memory, which allows remote attackers to execute arbitrary code via a crafted file.
CVE-2011-3232Sep 29, 2011
Mozilla Corporation
Firefox
risk 0.00cvss —epss 0.05
YARR, as used in Mozilla Firefox before 7.0, Thunderbird before 7.0, and SeaMonkey before 2.4, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted JavaScript.
CVE-2011-3005Sep 29, 2011
Mozilla Corporation
Firefox
risk 0.00cvss —epss 0.04
Use-after-free vulnerability in Mozilla Firefox 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted OGG headers in a .ogg file.
CVE-2011-3004Sep 29, 2011
Mozilla Corporation
Firefox
risk 0.00cvss —epss 0.01
The JSSubScriptLoader in Mozilla Firefox 4.x through 6 and SeaMonkey before 2.4 does not properly handle XPCNativeWrappers during calls to the loadSubScript method in an add-on, which makes it easier for remote attackers to gain privileges via a crafted web site that leverages…
CVE-2011-3003Sep 29, 2011
Mozilla Corporation
Firefox
risk 0.00cvss —epss 0.04
Mozilla Firefox before 7.0 and SeaMonkey before 2.4 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unspecified WebGL test case that triggers a memory-allocation error and a resulting out-of-bounds write operation.
CVE-2011-3002Sep 29, 2011
Mozilla Corporation
Firefox
risk 0.00cvss —epss 0.03
Almost Native Graphics Layer Engine (ANGLE), as used in Mozilla Firefox before 7.0 and SeaMonkey before 2.4, does not validate the return value of a GrowAtomTable function call, which allows remote attackers to cause a denial of service (application crash) or possibly execute…
CVE-2011-3001Sep 29, 2011
Mozilla Corporation
Firefox
risk 0.00cvss —epss 0.01
Mozilla Firefox 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 do not prevent manual add-on installation in response to the holding of the Enter key, which allows user-assisted remote attackers to bypass intended access restrictions via a crafted web site that…
CVE-2011-3000Sep 29, 2011
Mozilla Corporation
Firefox
risk 0.00cvss —epss 0.02
Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 do not properly handle HTTP responses that contain multiple Location, Content-Length, or Content-Disposition headers, which makes it easier for remote attackers to conduct HTTP…
CVE-2011-2999Sep 29, 2011
Mozilla Corporation
Firefox
risk 0.00cvss —epss 0.01
Mozilla Firefox before 3.6.23 and 4.x through 5, Thunderbird before 6.0, and SeaMonkey before 2.3 do not properly handle "location" as the name of a frame, which allows remote attackers to bypass the Same Origin Policy via a crafted web site, a different vulnerability than…
CVE-2011-2997Sep 29, 2011
Mozilla Corporation
Firefox
risk 0.00cvss —epss 0.05
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 6, Thunderbird before 7.0, and SeaMonkey before 2.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVE-2011-2996Sep 29, 2011
Mozilla Corporation
Firefox
risk 0.00cvss —epss 0.04
Unspecified vulnerability in the plugin API in Mozilla Firefox 3.6.x before 3.6.23 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVE-2011-2995Sep 29, 2011
Mozilla Corporation
Firefox
risk 0.00cvss —epss 0.04
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute…
CVE-2011-2372Sep 29, 2011
Mozilla Corporation
Firefox
risk 0.00cvss —epss 0.01
Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 do not prevent the starting of a download in response to the holding of the Enter key, which allows user-assisted remote attackers to bypass intended access restrictions via a…
CVE-2011-3865Sep 28, 2011
WordPress
Black-LetterHead
risk 0.03cvss —epss 0.03
Cross-site scripting (XSS) vulnerability in the Black-LetterHead theme before 1.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.
CVE-2011-3864Sep 28, 2011
WordPress
The Erudite
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in the The Erudite theme before 2.7.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpage parameter.
CVE-2011-3863Sep 28, 2011
WordPress
RedLine
risk 0.03cvss —epss 0.03
Cross-site scripting (XSS) vulnerability in the RedLine theme before 1.66 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVE-2011-3862Sep 28, 2011
WordPress
Morning Coffee
risk 0.03cvss —epss 0.04
Cross-site scripting (XSS) vulnerability in the Morning Coffee theme before 3.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.
CVE-2011-3861Sep 28, 2011
WordPress
Web Minimalist 200901
risk 0.03cvss —epss 0.03
Cross-site scripting (XSS) vulnerability in the Web Minimalist 200901 theme before 1.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.
CVE-2011-3860Sep 28, 2011
WordPress
Cover WP
risk 0.03cvss —epss 0.03
Cross-site scripting (XSS) vulnerability in the Cover WP theme before 1.6.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVE-2011-3859Sep 28, 2011
WordPress
Trending
risk 0.03cvss —epss 0.03
Cross-site scripting (XSS) vulnerability in the Trending theme before 0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpage parameter.
CVE-2011-3858Sep 28, 2011
WordPress
Pixiv Custom
risk 0.03cvss —epss 0.04
Cross-site scripting (XSS) vulnerability in the Pixiv Custom theme before 2.1.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVE-2011-3857Sep 28, 2011
WordPress
Antisnews
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in the Antisnews theme before 1.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVE-2011-3856Sep 28, 2011
WordPress
Elegant Grunge
risk 0.03cvss —epss 0.03
Cross-site scripting (XSS) vulnerability in the Elegant Grunge theme before 1.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVE-2011-3855Sep 28, 2011
WordPress
F8 Lite
risk 0.03cvss —epss 0.03
Cross-site scripting (XSS) vulnerability in the F8 Lite theme before 4.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVE-2011-3854Sep 28, 2011
WordPress
ZenLite
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in the ZenLite theme before 4.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVE-2011-3853Sep 28, 2011
WordPress
Hybrid
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in the Hybrid theme before 0.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpage parameter.
CVE-2011-3852Sep 28, 2011
WordPress
EvoLve
risk 0.03cvss —epss 0.03
Cross-site scripting (XSS) vulnerability in the EvoLve theme before 1.2.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVE-2011-3851Sep 28, 2011
WordPress
News
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in the News theme before 0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpage parameter.
CVE-2011-3850Sep 28, 2011
WordPress
Atahualpa
risk 0.03cvss —epss 0.04
Cross-site scripting (XSS) vulnerability in the Atahualpa theme before 3.6.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
CVE-2011-3694Sep 27, 2011
Netsaro
Enterprise Messenger Server
risk 0.00cvss —epss 0.01
The Server Administration Console in NetSaro Enterprise Messenger Server 2.0 allows remote attackers to read application source code by appending a %00 character to a URL.
CVE-2011-3693Sep 27, 2011
Netsaro
Enterprise Messenger Server
risk 0.00cvss —epss 0.00
NetSaro Enterprise Messenger Server 2.0 allows local users to discover cleartext server credentials by reading the NetSaro.fdb file.
CVE-2011-3692Sep 27, 2011
Netsaro
Enterprise Messenger Server
risk 0.00cvss —epss 0.00
NetSaro Enterprise Messenger Server 2.0 stores cleartext console credentials in configuration.xml, which allows local users to obtain sensitive information by reading this file and performing a base64 decoding step.
CVE-2011-3691Sep 27, 2011
Foxitsoftware
Reader
risk 0.00cvss —epss 0.01
Untrusted search path vulnerability in Foxit Reader before 5.0.2.0718 allows local users to gain privileges via a Trojan horse dwmapi.dll, dwrite.dll, or msdrm.dll in the current working directory.
CVE-2011-3690Sep 27, 2011
Plotsoft
Pdfill PDF Editor
risk 0.00cvss —epss 0.01
Untrusted search path vulnerability in PlotSoft PDFill PDF Editor 8.0 allows local users to gain privileges via a Trojan horse mfc70enu.dll or mfc80loc.dll in the current working directory.