CVEs

346,414 total · page 5983 of 6,929

CVE	Vendor / Product	Risk	CVSS	EPSS	Published	Description
CVE-2011-3696	60cyclecms Project 60cyclecms	0.00	—	0.02	Sep 23, 2011	60cycleCMS 2.5.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by post.php and certain other files.
CVE-2011-3695	111webcalendar 111webcalendar	0.00	—	0.01	Sep 23, 2011	111WebCalendar 1.2.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by footer.php and certain other files.
CVE-2011-2766	Fast Cgi Project Fast Cgi	0.01	—	0.07	Sep 23, 2011	The FCGI (aka Fast CGI) module 0.70 through 0.73 for Perl, as used by CGI::Fast, uses environment variable values from one request during processing of a later request, which allows remote attackers to bypass authentication via crafted HTTP headers.
CVE-2011-2544	Cisco Systems, Inc. Telepresence System Software	0.03	—	0.05	Sep 23, 2011	Cross-site scripting (XSS) vulnerability in the web interface in Cisco TelePresence System MXP Series F9.1 and earlier allows remote authenticated users to inject arbitrary web script or HTML via a crafted Call ID, as demonstrated by resultant cross-site request forgery (CSRF)…
CVE-2011-2543	Cisco Systems, Inc. Telepresence System Integrator C Series	0.04	—	0.12	Sep 23, 2011	Buffer overflow in the cuil component in Cisco Telepresence System Integrator C Series 4.x before TC4.2.0 allows remote authenticated users to cause a denial of service (endpoint reboot or process crash) or possibly execute arbitrary code via a long location parameter to the…
CVE-2011-3210	OpenSSL Project OpenSSL	0.00	—	0.05	Sep 22, 2011	The ephemeral ECDH ciphersuite functionality in OpenSSL 0.9.8 through 0.9.8r and 1.0.x before 1.0.0e does not ensure thread safety during processing of handshake messages from clients, which allows remote attackers to cause a denial of service (daemon crash) via out-of-order…
CVE-2011-3207	OpenSSL Project OpenSSL	0.00	—	0.05	Sep 22, 2011	crypto/x509/x509_vfy.c in OpenSSL 1.0.x before 1.0.0e does not initialize certain structure members, which makes it easier for remote attackers to bypass CRL validation by using a nextUpdate value corresponding to a time in the past.
CVE-2011-1913	Mercator Sentinel	0.00	—	0.02	Sep 22, 2011	SQL injection vulnerability in the login form in the web interface in Mercator SENTINEL 2.0 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2011-2444	Adobe Inc. Flashplayer	0.00	—	0.03	Sep 22, 2011	Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.10 on Windows, Mac OS X, Linux, and Solaris, and before 10.3.186.7 on Android, allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to a "universal cross-site…
CVE-2011-2430	Adobe Inc. Flashplayer	0.01	—	0.06	Sep 22, 2011	Adobe Flash Player before 10.3.183.10 on Windows, Mac OS X, Linux, and Solaris, and before 10.3.186.7 on Android, allows remote attackers to execute arbitrary code via crafted streaming media, related to a "logic error vulnerability."
CVE-2011-2429	Adobe Inc. Flashplayer	0.00	—	0.04	Sep 22, 2011	Adobe Flash Player before 10.3.183.10 on Windows, Mac OS X, Linux, and Solaris, and before 10.3.186.7 on Android, allows attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors, related to a "security control bypass."
CVE-2011-2428	Adobe Inc. Flashplayer	0.00	—	0.05	Sep 22, 2011	Adobe Flash Player before 10.3.183.10 on Windows, Mac OS X, Linux, and Solaris, and before 10.3.186.7 on Android, allows attackers to execute arbitrary code or cause a denial of service (browser crash) via unspecified vectors, related to a "logic error issue."
CVE-2011-2427	Adobe Inc. Flashplayer	0.01	—	0.06	Sep 22, 2011	Stack-based buffer overflow in the ActionScript Virtual Machine (AVM) component in Adobe Flash Player before 10.3.183.10 on Windows, Mac OS X, Linux, and Solaris, and before 10.3.186.7 on Android, allows attackers to execute arbitrary code or cause a denial of service via…
CVE-2011-2426	Adobe Inc. Flashplayer	0.01	—	0.08	Sep 22, 2011	Stack-based buffer overflow in the ActionScript Virtual Machine (AVM) component in Adobe Flash Player before 10.3.183.10 on Windows, Mac OS X, Linux, and Solaris, and before 10.3.186.7 on Android, allows remote attackers to execute arbitrary code via unspecified vectors.
CVE-2011-3578	Mantisbt Mantisbt	0.00	—	0.02	Sep 21, 2011	Cross-site scripting (XSS) vulnerability in bug_actiongroup_ext_page.php in MantisBT before 1.2.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter, related to bug_actiongroup_page.php, a different vulnerability than CVE-2011-3357.
CVE-2011-3358	Mantisbt Mantisbt	0.00	—	0.02	Sep 21, 2011	Multiple cross-site scripting (XSS) vulnerabilities in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML via the (1) os, (2) os_build, or (3) platform parameter to (a) bug_report_page.php or (b) bug_update_advanced_page.php, related to use of…
CVE-2011-3357	Mantisbt Mantisbt	0.00	—	0.09	Sep 21, 2011	Directory traversal vulnerability in bug_actiongroup_ext_page.php in MantisBT before 1.2.8 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the action parameter, related to bug_actiongroup_page.php.
CVE-2011-3356	Mantisbt Mantisbt	0.00	—	0.02	Sep 21, 2011	Multiple cross-site scripting (XSS) vulnerabilities in config_defaults_inc.php in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO, as demonstrated by the PATH_INFO to (1) manage_config_email_page.php, (2)…
CVE-2011-3290	Cisco Systems, Inc. Identity Services Engine Software	0.00	—	0.02	Sep 21, 2011	Cisco Identity Services Engine (ISE) before 1.0.4.MR2 has default Oracle database credentials, which allows remote attackers to modify settings or perform unspecified other administrative actions via unknown vectors, aka Bug ID CSCts59135.
CVE-2011-2938	Mantisbt Mantisbt	0.00	—	0.05	Sep 21, 2011	Multiple cross-site scripting (XSS) vulnerabilities in filter_api.php in MantisBT before 1.2.7 allow remote attackers to inject arbitrary web script or HTML via a parameter, as demonstrated by the project_id parameter to search.php.
CVE-2011-2937	Roundcube Webmail	0.00	—	0.02	Sep 21, 2011	Cross-site scripting (XSS) vulnerability in the UI messages functionality in Roundcube Webmail before 0.5.4 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI.
CVE-2011-2412	Microfocus Business Service Automation (BSA) Essentials	0.01	—	0.08	Sep 21, 2011	Unspecified vulnerability in HP Business Service Automation (BSA) Essentials 2.01 allows remote attackers to execute arbitrary code via unknown vectors.
CVE-2011-3577	IBM Websphere Commerce	0.00	—	0.02	Sep 20, 2011	IBM WebSphere Commerce 6.x through 6.0.0.11 and 7.x through 7.0.0.3 does not properly implement Activity Token authentication for Web Services, which has unspecified impact and attack vectors.
CVE-2011-3484	Wireshark Wireshark	0.00	—	0.02	Sep 20, 2011	The unxorFrame function in epan/dissectors/packet-opensafety.c in the OpenSafety dissector in Wireshark 1.6.x before 1.6.2 does not properly validate a certain frame size, which allows remote attackers to cause a denial of service (loop and application crash) via a malformed…
CVE-2011-3483	Wireshark Wireshark	0.03	—	0.06	Sep 20, 2011	Wireshark 1.6.x before 1.6.2 allows remote attackers to cause a denial of service (application crash) via a malformed capture file that leads to an invalid root tvbuff, related to a "buffer exception handling vulnerability."
CVE-2011-3482	Wireshark Wireshark	0.00	—	0.02	Sep 20, 2011	The csnStreamDissector function in epan/dissectors/packet-csn1.c in the CSN.1 dissector in Wireshark 1.6.x before 1.6.2 does not initialize a certain structure member, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.
CVE-2011-3360	Wireshark Wireshark	0.06	—	0.36	Sep 20, 2011	Untrusted search path vulnerability in Wireshark 1.4.x before 1.4.9 and 1.6.x before 1.6.2 allows local users to gain privileges via a Trojan horse Lua script in an unspecified directory.
CVE-2011-2672	Semanticscuttle Semanticscuttle	0.00	—	0.01	Sep 20, 2011	Cross-site scripting (XSS) vulnerability in SemanticScuttle before 0.98 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2011-1911	Jaspersoft Jasperreports Server Community Project	0.00	—	0.01	Sep 20, 2011	JasperServer in JasperReports Server Community Project 3.7.0 and 3.7.1 uses a predictable _flowExecutionKey parameter, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via a brute-force approach.
CVE-2011-1510	Manageengine Servicedesk Plus	0.00	—	0.01	Sep 20, 2011	Cross-site scripting (XSS) vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus (SDP) before 8012 allows remote attackers to inject arbitrary web script or HTML via the searchText parameter.
CVE-2011-1509	Manageengine Servicedesk Plus	0.00	—	0.01	Sep 20, 2011	The encryptPassword function in Login.js in ManageEngine ServiceDesk Plus (SDP) 8012 and earlier uses a Caesar cipher for encryption of passwords in cookies, which makes it easier for remote attackers to obtain sensitive information by sniffing the network.
CVE-2011-3348	Apache HTTP Server	0.02	—	0.22	Sep 20, 2011	The mod_proxy_ajp module in the Apache HTTP Server before 2.2.21, when used with mod_proxy_balancer in certain configurations, allows remote attackers to cause a denial of service (temporary "error state" in the backend server) via a malformed HTTP request.
CVE-2011-2925	Red Hat Cumin	0.00	—	0.00	Sep 20, 2011	Cumin in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0 records broker authentication credentials in a log file, which allows local users to bypass authentication and perform unauthorized actions on jobs and message queues via a direct connection to the broker.
CVE-2011-3576	IBM Lotus Domino	0.00	—	0.01	Sep 19, 2011	Cross-site scripting (XSS) vulnerability in IBM Lotus Domino 8.5.2 allows remote attackers to inject arbitrary web script or HTML via the PanelIcon parameter in an fmpgPanelHeader ReadForm action to WebAdmin.nsf.
CVE-2011-3575	IBM Lotus Domino	0.04	—	0.11	Sep 19, 2011	Stack-based buffer overflow in the NSFComputeEvaluateExt function in Nnotes.dll in IBM Lotus Domino 8.5.2 allows remote authenticated users to execute arbitrary code via a long tHPRAgentName parameter in an fmHttpPostRequest OpenForm action to WebAdmin.nsf.
CVE-2011-3424	TIBCO Software Managed File Transfer Command Center	0.00	—	0.01	Sep 19, 2011	Session fixation vulnerability in the Managed File Transfer server in TIBCO Managed File Transfer Internet Server before 7.1.1 and Managed File Transfer Command Center before 7.1.1, and the server in TIBCO Slingshot before 1.8.1, allows remote attackers to hijack web sessions…
CVE-2011-3423	TIBCO Software Managed File Transfer Command Center	0.00	—	0.01	Sep 19, 2011	Cross-site scripting (XSS) vulnerability in the Managed File Transfer server in TIBCO Managed File Transfer Internet Server before 7.1.1 and Managed File Transfer Command Center before 7.1.1, and the server in TIBCO Slingshot before 1.8.1, allows remote attackers to inject…
CVE-2011-3345	Openfabrics Enterprise Distribution	0.00	—	0.00	Sep 19, 2011	ulp/sdp/sdp_proc.c in the ib_sdp module (aka ib_sdp.ko) in the ofa_kernel package in the InfiniBand driver implementation in OpenFabrics Enterprise Distribution (OFED) before 1.5.3 does not properly handle certain non-array variables, which allows local users to cause a denial…
CVE-2011-3234	Google Chrome	0.00	—	0.02	Sep 19, 2011	Google Chrome before 14.0.835.163 does not properly handle boxes, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVE-2011-2875	Google Chrome	0.00	—	0.01	Sep 19, 2011	Google V8, as used in Google Chrome before 14.0.835.163, does not properly perform object sealing, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage "type confusion."
CVE-2011-2874	Google Chrome	0.00	—	0.01	Sep 19, 2011	Google Chrome before 14.0.835.163 does not perform an expected pin operation for a self-signed certificate during a session, which has unspecified impact and remote attack vectors.
CVE-2011-2864	Google Chrome	0.00	—	0.01	Sep 19, 2011	Google Chrome before 14.0.835.163 does not properly handle Tibetan characters, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVE-2011-2862	Google Chrome	0.00	—	0.01	Sep 19, 2011	Google V8, as used in Google Chrome before 14.0.835.163, does not properly restrict access to built-in objects, which has unspecified impact and remote attack vectors.
CVE-2011-2861	Google Chrome	0.00	—	0.01	Sep 19, 2011	Google Chrome before 14.0.835.163 does not properly handle strings in PDF documents, which allows remote attackers to have an unspecified impact via a crafted document that triggers an incorrect read operation.
CVE-2011-2860	Google Chrome	0.00	—	0.02	Sep 19, 2011	Use-after-free vulnerability in Google Chrome before 14.0.835.163 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to table styles.
CVE-2011-2859	Google Chrome	0.00	—	0.01	Sep 19, 2011	Google Chrome before 14.0.835.163 uses incorrect permissions for non-gallery pages, which has unspecified impact and attack vectors.
CVE-2011-2858	Google Chrome	0.00	—	0.01	Sep 19, 2011	Google Chrome before 14.0.835.163 does not properly handle triangle arrays, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVE-2011-2857	Google Chrome	0.00	—	0.02	Sep 19, 2011	Use-after-free vulnerability in Google Chrome before 14.0.835.163 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the focus controller.
CVE-2011-2856	Google Chrome	0.00	—	0.01	Sep 19, 2011	Google V8, as used in Google Chrome before 14.0.835.163, allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
CVE-2011-2855	Google Chrome	0.00	—	0.02	Sep 19, 2011	Google Chrome before 14.0.835.163 does not properly handle Cascading Style Sheets (CSS) token sequences, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale node."

CVE-2011-3696Sep 23, 2011
60cyclecms Project
60cyclecms
risk 0.00cvss —epss 0.02
60cycleCMS 2.5.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by post.php and certain other files.
CVE-2011-3695Sep 23, 2011
111webcalendar
111webcalendar
risk 0.00cvss —epss 0.01
111WebCalendar 1.2.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by footer.php and certain other files.
CVE-2011-2766Sep 23, 2011
Fast Cgi Project
Fast Cgi
risk 0.01cvss —epss 0.07
The FCGI (aka Fast CGI) module 0.70 through 0.73 for Perl, as used by CGI::Fast, uses environment variable values from one request during processing of a later request, which allows remote attackers to bypass authentication via crafted HTTP headers.
CVE-2011-2544Sep 23, 2011
Cisco Systems, Inc.
Telepresence System Software
risk 0.03cvss —epss 0.05
Cross-site scripting (XSS) vulnerability in the web interface in Cisco TelePresence System MXP Series F9.1 and earlier allows remote authenticated users to inject arbitrary web script or HTML via a crafted Call ID, as demonstrated by resultant cross-site request forgery (CSRF)…
CVE-2011-2543Sep 23, 2011
Cisco Systems, Inc.
Telepresence System Integrator C Series
risk 0.04cvss —epss 0.12
Buffer overflow in the cuil component in Cisco Telepresence System Integrator C Series 4.x before TC4.2.0 allows remote authenticated users to cause a denial of service (endpoint reboot or process crash) or possibly execute arbitrary code via a long location parameter to the…
CVE-2011-3210Sep 22, 2011
OpenSSL Project
OpenSSL
risk 0.00cvss —epss 0.05
The ephemeral ECDH ciphersuite functionality in OpenSSL 0.9.8 through 0.9.8r and 1.0.x before 1.0.0e does not ensure thread safety during processing of handshake messages from clients, which allows remote attackers to cause a denial of service (daemon crash) via out-of-order…
CVE-2011-3207Sep 22, 2011
OpenSSL Project
OpenSSL
risk 0.00cvss —epss 0.05
crypto/x509/x509_vfy.c in OpenSSL 1.0.x before 1.0.0e does not initialize certain structure members, which makes it easier for remote attackers to bypass CRL validation by using a nextUpdate value corresponding to a time in the past.
CVE-2011-1913Sep 22, 2011
Mercator
Sentinel
risk 0.00cvss —epss 0.02
SQL injection vulnerability in the login form in the web interface in Mercator SENTINEL 2.0 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2011-2444Sep 22, 2011
Adobe Inc.
Flashplayer
risk 0.00cvss —epss 0.03
Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.10 on Windows, Mac OS X, Linux, and Solaris, and before 10.3.186.7 on Android, allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to a "universal cross-site…
CVE-2011-2430Sep 22, 2011
Adobe Inc.
Flashplayer
risk 0.01cvss —epss 0.06
Adobe Flash Player before 10.3.183.10 on Windows, Mac OS X, Linux, and Solaris, and before 10.3.186.7 on Android, allows remote attackers to execute arbitrary code via crafted streaming media, related to a "logic error vulnerability."
CVE-2011-2429Sep 22, 2011
Adobe Inc.
Flashplayer
risk 0.00cvss —epss 0.04
Adobe Flash Player before 10.3.183.10 on Windows, Mac OS X, Linux, and Solaris, and before 10.3.186.7 on Android, allows attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors, related to a "security control bypass."
CVE-2011-2428Sep 22, 2011
Adobe Inc.
Flashplayer
risk 0.00cvss —epss 0.05
Adobe Flash Player before 10.3.183.10 on Windows, Mac OS X, Linux, and Solaris, and before 10.3.186.7 on Android, allows attackers to execute arbitrary code or cause a denial of service (browser crash) via unspecified vectors, related to a "logic error issue."
CVE-2011-2427Sep 22, 2011
Adobe Inc.
Flashplayer
risk 0.01cvss —epss 0.06
Stack-based buffer overflow in the ActionScript Virtual Machine (AVM) component in Adobe Flash Player before 10.3.183.10 on Windows, Mac OS X, Linux, and Solaris, and before 10.3.186.7 on Android, allows attackers to execute arbitrary code or cause a denial of service via…
CVE-2011-2426Sep 22, 2011
Adobe Inc.
Flashplayer
risk 0.01cvss —epss 0.08
Stack-based buffer overflow in the ActionScript Virtual Machine (AVM) component in Adobe Flash Player before 10.3.183.10 on Windows, Mac OS X, Linux, and Solaris, and before 10.3.186.7 on Android, allows remote attackers to execute arbitrary code via unspecified vectors.
CVE-2011-3578Sep 21, 2011
Mantisbt
Mantisbt
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in bug_actiongroup_ext_page.php in MantisBT before 1.2.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter, related to bug_actiongroup_page.php, a different vulnerability than CVE-2011-3357.
CVE-2011-3358Sep 21, 2011
Mantisbt
Mantisbt
risk 0.00cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML via the (1) os, (2) os_build, or (3) platform parameter to (a) bug_report_page.php or (b) bug_update_advanced_page.php, related to use of…
CVE-2011-3357Sep 21, 2011
Mantisbt
Mantisbt
risk 0.00cvss —epss 0.09
Directory traversal vulnerability in bug_actiongroup_ext_page.php in MantisBT before 1.2.8 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the action parameter, related to bug_actiongroup_page.php.
CVE-2011-3356Sep 21, 2011
Mantisbt
Mantisbt
risk 0.00cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in config_defaults_inc.php in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO, as demonstrated by the PATH_INFO to (1) manage_config_email_page.php, (2)…
CVE-2011-3290Sep 21, 2011
Cisco Systems, Inc.
Identity Services Engine Software
risk 0.00cvss —epss 0.02
Cisco Identity Services Engine (ISE) before 1.0.4.MR2 has default Oracle database credentials, which allows remote attackers to modify settings or perform unspecified other administrative actions via unknown vectors, aka Bug ID CSCts59135.
CVE-2011-2938Sep 21, 2011
Mantisbt
Mantisbt
risk 0.00cvss —epss 0.05
Multiple cross-site scripting (XSS) vulnerabilities in filter_api.php in MantisBT before 1.2.7 allow remote attackers to inject arbitrary web script or HTML via a parameter, as demonstrated by the project_id parameter to search.php.
CVE-2011-2937Sep 21, 2011
Roundcube
Webmail
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in the UI messages functionality in Roundcube Webmail before 0.5.4 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI.
CVE-2011-2412Sep 21, 2011
Microfocus
Business Service Automation (BSA) Essentials
risk 0.01cvss —epss 0.08
Unspecified vulnerability in HP Business Service Automation (BSA) Essentials 2.01 allows remote attackers to execute arbitrary code via unknown vectors.
CVE-2011-3577Sep 20, 2011
IBM
Websphere Commerce
risk 0.00cvss —epss 0.02
IBM WebSphere Commerce 6.x through 6.0.0.11 and 7.x through 7.0.0.3 does not properly implement Activity Token authentication for Web Services, which has unspecified impact and attack vectors.
CVE-2011-3484Sep 20, 2011
Wireshark
Wireshark
risk 0.00cvss —epss 0.02
The unxorFrame function in epan/dissectors/packet-opensafety.c in the OpenSafety dissector in Wireshark 1.6.x before 1.6.2 does not properly validate a certain frame size, which allows remote attackers to cause a denial of service (loop and application crash) via a malformed…
CVE-2011-3483Sep 20, 2011
Wireshark
Wireshark
risk 0.03cvss —epss 0.06
Wireshark 1.6.x before 1.6.2 allows remote attackers to cause a denial of service (application crash) via a malformed capture file that leads to an invalid root tvbuff, related to a "buffer exception handling vulnerability."
CVE-2011-3482Sep 20, 2011
Wireshark
Wireshark
risk 0.00cvss —epss 0.02
The csnStreamDissector function in epan/dissectors/packet-csn1.c in the CSN.1 dissector in Wireshark 1.6.x before 1.6.2 does not initialize a certain structure member, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.
CVE-2011-3360Sep 20, 2011
Wireshark
Wireshark
risk 0.06cvss —epss 0.36
Untrusted search path vulnerability in Wireshark 1.4.x before 1.4.9 and 1.6.x before 1.6.2 allows local users to gain privileges via a Trojan horse Lua script in an unspecified directory.
CVE-2011-2672Sep 20, 2011
Semanticscuttle
Semanticscuttle
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in SemanticScuttle before 0.98 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2011-1911Sep 20, 2011
Jaspersoft
Jasperreports Server Community Project
risk 0.00cvss —epss 0.01
JasperServer in JasperReports Server Community Project 3.7.0 and 3.7.1 uses a predictable _flowExecutionKey parameter, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via a brute-force approach.
CVE-2011-1510Sep 20, 2011
Manageengine
Servicedesk Plus
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus (SDP) before 8012 allows remote attackers to inject arbitrary web script or HTML via the searchText parameter.
CVE-2011-1509Sep 20, 2011
Manageengine
Servicedesk Plus
risk 0.00cvss —epss 0.01
The encryptPassword function in Login.js in ManageEngine ServiceDesk Plus (SDP) 8012 and earlier uses a Caesar cipher for encryption of passwords in cookies, which makes it easier for remote attackers to obtain sensitive information by sniffing the network.
CVE-2011-3348Sep 20, 2011
Apache
HTTP Server
risk 0.02cvss —epss 0.22
The mod_proxy_ajp module in the Apache HTTP Server before 2.2.21, when used with mod_proxy_balancer in certain configurations, allows remote attackers to cause a denial of service (temporary "error state" in the backend server) via a malformed HTTP request.
CVE-2011-2925Sep 20, 2011
Red Hat
Cumin
risk 0.00cvss —epss 0.00
Cumin in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0 records broker authentication credentials in a log file, which allows local users to bypass authentication and perform unauthorized actions on jobs and message queues via a direct connection to the broker.
CVE-2011-3576Sep 19, 2011
IBM
Lotus Domino
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in IBM Lotus Domino 8.5.2 allows remote attackers to inject arbitrary web script or HTML via the PanelIcon parameter in an fmpgPanelHeader ReadForm action to WebAdmin.nsf.
CVE-2011-3575Sep 19, 2011
IBM
Lotus Domino
risk 0.04cvss —epss 0.11
Stack-based buffer overflow in the NSFComputeEvaluateExt function in Nnotes.dll in IBM Lotus Domino 8.5.2 allows remote authenticated users to execute arbitrary code via a long tHPRAgentName parameter in an fmHttpPostRequest OpenForm action to WebAdmin.nsf.
CVE-2011-3424Sep 19, 2011
TIBCO Software
Managed File Transfer Command Center
risk 0.00cvss —epss 0.01
Session fixation vulnerability in the Managed File Transfer server in TIBCO Managed File Transfer Internet Server before 7.1.1 and Managed File Transfer Command Center before 7.1.1, and the server in TIBCO Slingshot before 1.8.1, allows remote attackers to hijack web sessions…
CVE-2011-3423Sep 19, 2011
TIBCO Software
Managed File Transfer Command Center
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the Managed File Transfer server in TIBCO Managed File Transfer Internet Server before 7.1.1 and Managed File Transfer Command Center before 7.1.1, and the server in TIBCO Slingshot before 1.8.1, allows remote attackers to inject…
CVE-2011-3345Sep 19, 2011
Openfabrics
Enterprise Distribution
risk 0.00cvss —epss 0.00
ulp/sdp/sdp_proc.c in the ib_sdp module (aka ib_sdp.ko) in the ofa_kernel package in the InfiniBand driver implementation in OpenFabrics Enterprise Distribution (OFED) before 1.5.3 does not properly handle certain non-array variables, which allows local users to cause a denial…
CVE-2011-3234Sep 19, 2011
Google
Chrome
risk 0.00cvss —epss 0.02
Google Chrome before 14.0.835.163 does not properly handle boxes, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVE-2011-2875Sep 19, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Google V8, as used in Google Chrome before 14.0.835.163, does not properly perform object sealing, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage "type confusion."
CVE-2011-2874Sep 19, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Google Chrome before 14.0.835.163 does not perform an expected pin operation for a self-signed certificate during a session, which has unspecified impact and remote attack vectors.
CVE-2011-2864Sep 19, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Google Chrome before 14.0.835.163 does not properly handle Tibetan characters, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVE-2011-2862Sep 19, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Google V8, as used in Google Chrome before 14.0.835.163, does not properly restrict access to built-in objects, which has unspecified impact and remote attack vectors.
CVE-2011-2861Sep 19, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Google Chrome before 14.0.835.163 does not properly handle strings in PDF documents, which allows remote attackers to have an unspecified impact via a crafted document that triggers an incorrect read operation.
CVE-2011-2860Sep 19, 2011
Google
Chrome
risk 0.00cvss —epss 0.02
Use-after-free vulnerability in Google Chrome before 14.0.835.163 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to table styles.
CVE-2011-2859Sep 19, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Google Chrome before 14.0.835.163 uses incorrect permissions for non-gallery pages, which has unspecified impact and attack vectors.
CVE-2011-2858Sep 19, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Google Chrome before 14.0.835.163 does not properly handle triangle arrays, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVE-2011-2857Sep 19, 2011
Google
Chrome
risk 0.00cvss —epss 0.02
Use-after-free vulnerability in Google Chrome before 14.0.835.163 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the focus controller.
CVE-2011-2856Sep 19, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Google V8, as used in Google Chrome before 14.0.835.163, allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
CVE-2011-2855Sep 19, 2011
Google
Chrome
risk 0.00cvss —epss 0.02
Google Chrome before 14.0.835.163 does not properly handle Cascading Style Sheets (CSS) token sequences, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale node."