CVEs

346,118 total · page 6023 of 6,923

CVE	Vendor / Product	Risk	CVSS	EPSS	Published	Description
CVE-2011-0038	Microsoft Internet Explorer	0.01	—	0.11	Feb 10, 2011	Untrusted search path vulnerability in Microsoft Internet Explorer 8 might allow local users to gain privileges via a Trojan horse IEShims.dll in the current working directory, as demonstrated by a Desktop directory that contains an HTML file, aka "Internet Explorer Insecure…
CVE-2011-0036	Microsoft Internet Explorer	0.02	—	0.20	Feb 10, 2011	Microsoft Internet Explorer 6, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, related to a "dangling…
CVE-2011-0035	Microsoft Internet Explorer	0.02	—	0.20	Feb 10, 2011	Microsoft Internet Explorer 6, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "Uninitialized Memory…
CVE-2011-0033	Microsoft Windows	0.02	—	0.21	Feb 10, 2011	The OpenType Compact Font Format (CFF) driver in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly validate parameter values in OpenType fonts, which allows remote…
CVE-2010-4307	Adobe Inc. Shockwave Player	0.01	—	0.06	Feb 10, 2011	Buffer overflow in Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code via unspecified vectors.
CVE-2010-4306	Adobe Inc. Shockwave Player	0.00	—	0.04	Feb 10, 2011	Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-0555, CVE-2010-4093, CVE-2010-4187, CVE-2010-4190, CVE-2010-4191, and…
CVE-2010-4196	Adobe Inc. Shockwave Player	0.00	—	0.06	Feb 10, 2011	The Shockwave 3d Asset module in Adobe Shockwave Player before 11.5.9.620 does not properly validate unspecified input data, which allows attackers to execute arbitrary code via unknown vectors.
CVE-2010-4195	Adobe Inc. Shockwave Player	0.00	—	0.06	Feb 10, 2011	The TextXtra module in Adobe Shockwave Player before 11.5.9.620 does not properly validate unspecified input data, which allows attackers to execute arbitrary code via unknown vectors.
CVE-2010-4194	Adobe Inc. Shockwave Player	0.00	—	0.06	Feb 10, 2011	The dirapi.dll module in Adobe Shockwave Player before 11.5.9.620 does not properly validate unspecified input data, which allows attackers to execute arbitrary code via unknown vectors.
CVE-2010-4193	Adobe Inc. Shockwave Player	0.00	—	0.06	Feb 10, 2011	Adobe Shockwave Player before 11.5.9.620 does not properly validate unspecified input data, which allows attackers to execute arbitrary code via unknown vectors.
CVE-2010-4192	Adobe Inc. Shockwave Player	0.00	—	0.05	Feb 10, 2011	Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a Director movie with a crafted 3D Assets 0xFFFFFF88 type record that triggers an incorrect memory allocation, a different vulnerability than…
CVE-2010-4191	Adobe Inc. Shockwave Player	0.00	—	0.04	Feb 10, 2011	Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-0555, CVE-2010-4093, CVE-2010-4187, CVE-2010-4190, CVE-2010-4192, and…
CVE-2010-4190	Adobe Inc. Shockwave Player	0.00	—	0.05	Feb 10, 2011	Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a Director movie with a crafted CSWV RIFF chunk that causes an incorrect calculation of an offset for a substructure, which causes an…
CVE-2010-4189	Adobe Inc. Shockwave Player	0.00	—	0.04	Feb 10, 2011	The IML32 module in Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a Director movie containing a GIF image with a crafted global color table size value, which causes an out-of-range pointer…
CVE-2010-4188	Adobe Inc. Shockwave Player	0.01	—	0.07	Feb 10, 2011	The dirapi.dll module in Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a Director movie with an IFWV chunk with a size field of 0, which is used in the calculation of a file offset and…
CVE-2010-4187	Adobe Inc. Shockwave Player	0.00	—	0.04	Feb 10, 2011	Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a malformed chunk in a Director file, a different vulnerability than CVE-2011-0555, CVE-2010-4093, CVE-2010-4190, CVE-2010-4191,…
CVE-2010-4093	Adobe Inc. Shockwave Player	0.00	—	0.04	Feb 10, 2011	Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-0555, CVE-2010-4187, CVE-2010-4190, CVE-2010-4191, CVE-2010-4192, and…
CVE-2010-2589	Adobe Inc. Shockwave Player	0.00	—	0.05	Feb 10, 2011	Integer overflow in the dirapi.dll module in Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code via unspecified vectors.
CVE-2010-2588	Adobe Inc. Shockwave Player	0.00	—	0.04	Feb 10, 2011	The dirapi.dll module in Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-2587 and CVE-2010-4188.
CVE-2010-2587	Adobe Inc. Shockwave Player	0.00	—	0.04	Feb 10, 2011	The dirapi.dll module in Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-2588 and CVE-2010-4188.
CVE-2011-0924	Microfocus Storage Data Protector	0.00	—	0.05	Feb 9, 2011	The client in HP Data Protector does not verify the contents of files associated with the EXEC_CMD command, which allows remote attackers to execute arbitrary script code by providing this code with a trusted filename, as demonstrated by omni_chk_ds.sh.
CVE-2011-0923	Microfocus Storage Data Protector	0.09	—	0.81	Feb 9, 2011	The client in HP Data Protector does not properly validate EXEC_CMD arguments, which allows remote attackers to execute arbitrary Perl code via a crafted command, related to the "local bin directory."
CVE-2011-0922	Microfocus Storage Data Protector	0.08	—	0.64	Feb 9, 2011	The client in HP Data Protector allows remote attackers to execute arbitrary programs via an EXEC_SETUP command that references a UNC share pathname.
CVE-2011-0921	Microfocus Storage Data Protector	0.01	—	0.11	Feb 9, 2011	crs.exe in the Cell Manager Service in the client in HP Data Protector does not properly validate credentials associated with the hostname, domain, and username, which allows remote attackers to execute arbitrary code by sending unspecified data over TCP, related to the…
CVE-2011-0277	Microfocus Power Manager	0.00	—	0.02	Feb 9, 2011	Cross-site request forgery (CSRF) vulnerability in HP Power Manager (HPPM) 4.3.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that create new administrative accounts.
CVE-2011-0090	Microsoft Windows	0.00	—	0.02	Feb 9, 2011	win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly validate user-mode input, which allows local users to gain privileges via a…
CVE-2011-0089	Microsoft Windows	0.00	—	0.02	Feb 9, 2011	win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly validate user-mode input, which allows local users to gain privileges via a…
CVE-2011-0088	Microsoft Windows	0.00	—	0.02	Feb 9, 2011	win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly validate user-mode input, which allows local users to gain privileges via a…
CVE-2011-0087	Microsoft Windows	0.00	—	0.02	Feb 9, 2011	win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Server 2003 SP2, Vista SP1 and SP2, and Server 2008 Gold and SP2 does not properly validate user-mode input, which allows local users to gain privileges via a crafted application, aka "Win32k Insufficient…
CVE-2011-0086	Microsoft Windows	0.00	—	0.02	Feb 9, 2011	win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly validate user-mode input, which allows local users to gain privileges via a…
CVE-2011-0045	Microsoft Windows Xp	0.03	—	0.04	Feb 9, 2011	The Trace Events functionality in the kernel in Microsoft Windows XP SP3 does not properly perform type conversion, which causes integer truncation and insufficient memory allocation and triggers a buffer overflow, which allows local users to gain privileges via a crafted…
CVE-2011-0040	Microsoft Windows Server 2003	0.02	—	0.23	Feb 9, 2011	The server in Microsoft Active Directory on Windows Server 2003 SP2 does not properly handle an update request for a service principal name (SPN), which allows remote attackers to cause a denial of service (authentication downgrade or outage) via a crafted request that triggers…
CVE-2011-0039	Microsoft Windows Xp	0.00	—	0.02	Feb 9, 2011	The Local Security Authority Subsystem Service (LSASS) in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly process authentication requests, which allows local users to gain privileges via a request with a crafted length, aka "LSASS Length Validation…
CVE-2011-0031	Microsoft Windows Server 2008	0.01	—	0.17	Feb 9, 2011	The (1) JScript 5.8 and (2) VBScript 5.8 scripting engines in Microsoft Windows Server 2008 R2 and Windows 7 do not properly load decoded scripts obtained from web pages, which allows remote attackers to trigger memory corruption and consequently obtain sensitive information via…
CVE-2011-0030	Microsoft Windows Xp	0.00	—	0.02	Feb 9, 2011	The Client/Server Run-time Subsystem (CSRSS) in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly kill processes after a logout, which allows local users to obtain sensitive information or gain privileges via a crafted application that continues to execute…
CVE-2011-0920	IBM Lotus Domino	0.04	—	0.10	Feb 8, 2011	The Remote Console in IBM Lotus Domino, when a certain unsupported configuration involving UNC share pathnames is used, allows remote attackers to bypass authentication and execute arbitrary code via unspecified vectors, aka SPR PRAD89WGRS.
CVE-2011-0919	IBM Lotus Domino	0.00	—	0.06	Feb 8, 2011	Multiple stack-based buffer overflows in the (1) POP3 and (2) IMAP services in IBM Lotus Domino allow remote attackers to execute arbitrary code via non-printable characters in an envelope sender address, aka SPR KLYH87LLVJ.
CVE-2011-0918	IBM Lotus Domino	0.00	—	0.06	Feb 8, 2011	Stack-based buffer overflow in the NRouter (aka Router) service in IBM Lotus Domino allows remote attackers to execute arbitrary code via long filenames associated with Content-ID and ATTACH:CID headers in attachments in malformed calendar-request e-mail messages, aka SPR…
CVE-2011-0917	IBM Lotus Domino	0.04	—	0.14	Feb 8, 2011	Buffer overflow in nLDAP.exe in IBM Lotus Domino allows remote attackers to execute arbitrary code via a long string in an LDAP Bind operation, aka SPR KLYH87LMVX.
CVE-2011-0916	IBM Lotus Domino	0.00	—	0.06	Feb 8, 2011	Stack-based buffer overflow in the SMTP service in IBM Lotus Domino allows remote attackers to execute arbitrary code via long arguments in a filename parameter in a malformed MIME e-mail message, aka SPR KLYH889M8H.
CVE-2011-0915	IBM Lotus Domino	0.01	—	0.12	Feb 8, 2011	Stack-based buffer overflow in nrouter.exe in IBM Lotus Domino before 8.5.3 allows remote attackers to execute arbitrary code via a long name parameter in a Content-Type header in a malformed Notes calendar (aka iCalendar or iCal) meeting request, aka SPR KLYH87LL23.
CVE-2011-0914	IBM Lotus Domino	0.00	—	0.05	Feb 8, 2011	Integer signedness error in ndiiop.exe in the DIIOP implementation in the server in IBM Lotus Domino before 8.5.3 allows remote attackers to execute arbitrary code via a GIOP client request, leading to a heap-based buffer overflow.
CVE-2011-0913	IBM Lotus Domino	0.00	—	0.05	Feb 8, 2011	Stack-based buffer overflow in ndiiop.exe in the DIIOP implementation in the server in IBM Lotus Domino before 8.5.3 allows remote attackers to execute arbitrary code via a GIOP getEnvironmentString request, related to the local variable cache.
CVE-2011-0912	IBM Lotus Notes	0.00	—	0.04	Feb 8, 2011	Argument injection vulnerability in IBM Lotus Notes 8.0.x before 8.0.2 FP6 and 8.5.x before 8.5.1 FP5 allows remote attackers to execute arbitrary code via a cai:// URL containing a --launcher.library option that specifies a UNC share pathname for a DLL file, aka SPR PRAD82YJW2.
CVE-2011-0911	Zikula Zikula	0.00	—	0.01	Feb 8, 2011	Cross-site scripting (XSS) vulnerability in the Users module in Zikula before 1.2.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: it is possible that this overlaps CVE-2011-0535.
CVE-2011-0887	SMC Networks Smcd3g Ccr	0.03	—	0.05	Feb 8, 2011	The web management portal on the SMC SMCD3G-CCR (aka Comcast Business Gateway) with firmware before 1.4.0.49.2 uses predictable session IDs based on time values, which makes it easier for remote attackers to hijack sessions via a brute-force attack on the userid cookie.
CVE-2011-0886	SMC Networks Smcd3g Ccr	0.03	—	0.03	Feb 8, 2011	Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface on the SMC SMCD3G-CCR (aka Comcast Business Gateway) with firmware before 1.4.0.49.2 allow remote attackers to (1) hijack the intranet connectivity of arbitrary users for requests that perform a…
CVE-2011-0885	Smc SMCD3G-CCR	0.04	—	0.10	Feb 8, 2011	A certain Comcast Business Gateway configuration of the SMC SMCD3G-CCR with firmware before 1.4.0.49.2 has a default password of D0nt4g3tme for the mso account, which makes it easier for remote attackers to obtain administrative access via the (1) web interface or (2) TELNET…
CVE-2011-0538	Wireshark Wireshark	0.04	—	0.08	Feb 8, 2011	Wireshark 1.2.0 through 1.2.14, 1.4.0 through 1.4.3, and 1.5.0 frees an uninitialized pointer during processing of a .pcap file in the pcap-ng format, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a…
CVE-2011-0535	Zikula Zikula	0.03	—	0.01	Feb 8, 2011	Cross-site request forgery (CSRF) vulnerability in the Users module in Zikula before 1.2.5 allows remote attackers to hijack the authentication of administrators for requests that change account privileges via an edit access_permissions action to index.php.

CVE-2011-0038Feb 10, 2011
Microsoft
Internet Explorer
risk 0.01cvss —epss 0.11
Untrusted search path vulnerability in Microsoft Internet Explorer 8 might allow local users to gain privileges via a Trojan horse IEShims.dll in the current working directory, as demonstrated by a Desktop directory that contains an HTML file, aka "Internet Explorer Insecure…
CVE-2011-0036Feb 10, 2011
Microsoft
Internet Explorer
risk 0.02cvss —epss 0.20
Microsoft Internet Explorer 6, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, related to a "dangling…
CVE-2011-0035Feb 10, 2011
Microsoft
Internet Explorer
risk 0.02cvss —epss 0.20
Microsoft Internet Explorer 6, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "Uninitialized Memory…
CVE-2011-0033Feb 10, 2011
Microsoft
Windows
risk 0.02cvss —epss 0.21
The OpenType Compact Font Format (CFF) driver in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly validate parameter values in OpenType fonts, which allows remote…
CVE-2010-4307Feb 10, 2011
Adobe Inc.
Shockwave Player
risk 0.01cvss —epss 0.06
Buffer overflow in Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code via unspecified vectors.
CVE-2010-4306Feb 10, 2011
Adobe Inc.
Shockwave Player
risk 0.00cvss —epss 0.04
Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-0555, CVE-2010-4093, CVE-2010-4187, CVE-2010-4190, CVE-2010-4191, and…
CVE-2010-4196Feb 10, 2011
Adobe Inc.
Shockwave Player
risk 0.00cvss —epss 0.06
The Shockwave 3d Asset module in Adobe Shockwave Player before 11.5.9.620 does not properly validate unspecified input data, which allows attackers to execute arbitrary code via unknown vectors.
CVE-2010-4195Feb 10, 2011
Adobe Inc.
Shockwave Player
risk 0.00cvss —epss 0.06
The TextXtra module in Adobe Shockwave Player before 11.5.9.620 does not properly validate unspecified input data, which allows attackers to execute arbitrary code via unknown vectors.
CVE-2010-4194Feb 10, 2011
Adobe Inc.
Shockwave Player
risk 0.00cvss —epss 0.06
The dirapi.dll module in Adobe Shockwave Player before 11.5.9.620 does not properly validate unspecified input data, which allows attackers to execute arbitrary code via unknown vectors.
CVE-2010-4193Feb 10, 2011
Adobe Inc.
Shockwave Player
risk 0.00cvss —epss 0.06
Adobe Shockwave Player before 11.5.9.620 does not properly validate unspecified input data, which allows attackers to execute arbitrary code via unknown vectors.
CVE-2010-4192Feb 10, 2011
Adobe Inc.
Shockwave Player
risk 0.00cvss —epss 0.05
Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a Director movie with a crafted 3D Assets 0xFFFFFF88 type record that triggers an incorrect memory allocation, a different vulnerability than…
CVE-2010-4191Feb 10, 2011
Adobe Inc.
Shockwave Player
risk 0.00cvss —epss 0.04
Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-0555, CVE-2010-4093, CVE-2010-4187, CVE-2010-4190, CVE-2010-4192, and…
CVE-2010-4190Feb 10, 2011
Adobe Inc.
Shockwave Player
risk 0.00cvss —epss 0.05
Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a Director movie with a crafted CSWV RIFF chunk that causes an incorrect calculation of an offset for a substructure, which causes an…
CVE-2010-4189Feb 10, 2011
Adobe Inc.
Shockwave Player
risk 0.00cvss —epss 0.04
The IML32 module in Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a Director movie containing a GIF image with a crafted global color table size value, which causes an out-of-range pointer…
CVE-2010-4188Feb 10, 2011
Adobe Inc.
Shockwave Player
risk 0.01cvss —epss 0.07
The dirapi.dll module in Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a Director movie with an IFWV chunk with a size field of 0, which is used in the calculation of a file offset and…
CVE-2010-4187Feb 10, 2011
Adobe Inc.
Shockwave Player
risk 0.00cvss —epss 0.04
Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a malformed chunk in a Director file, a different vulnerability than CVE-2011-0555, CVE-2010-4093, CVE-2010-4190, CVE-2010-4191,…
CVE-2010-4093Feb 10, 2011
Adobe Inc.
Shockwave Player
risk 0.00cvss —epss 0.04
Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-0555, CVE-2010-4187, CVE-2010-4190, CVE-2010-4191, CVE-2010-4192, and…
CVE-2010-2589Feb 10, 2011
Adobe Inc.
Shockwave Player
risk 0.00cvss —epss 0.05
Integer overflow in the dirapi.dll module in Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code via unspecified vectors.
CVE-2010-2588Feb 10, 2011
Adobe Inc.
Shockwave Player
risk 0.00cvss —epss 0.04
The dirapi.dll module in Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-2587 and CVE-2010-4188.
CVE-2010-2587Feb 10, 2011
Adobe Inc.
Shockwave Player
risk 0.00cvss —epss 0.04
The dirapi.dll module in Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-2588 and CVE-2010-4188.
CVE-2011-0924Feb 9, 2011
Microfocus
Storage Data Protector
risk 0.00cvss —epss 0.05
The client in HP Data Protector does not verify the contents of files associated with the EXEC_CMD command, which allows remote attackers to execute arbitrary script code by providing this code with a trusted filename, as demonstrated by omni_chk_ds.sh.
CVE-2011-0923Feb 9, 2011
Microfocus
Storage Data Protector
risk 0.09cvss —epss 0.81
The client in HP Data Protector does not properly validate EXEC_CMD arguments, which allows remote attackers to execute arbitrary Perl code via a crafted command, related to the "local bin directory."
CVE-2011-0922Feb 9, 2011
Microfocus
Storage Data Protector
risk 0.08cvss —epss 0.64
The client in HP Data Protector allows remote attackers to execute arbitrary programs via an EXEC_SETUP command that references a UNC share pathname.
CVE-2011-0921Feb 9, 2011
Microfocus
Storage Data Protector
risk 0.01cvss —epss 0.11
crs.exe in the Cell Manager Service in the client in HP Data Protector does not properly validate credentials associated with the hostname, domain, and username, which allows remote attackers to execute arbitrary code by sending unspecified data over TCP, related to the…
CVE-2011-0277Feb 9, 2011
Microfocus
Power Manager
risk 0.00cvss —epss 0.02
Cross-site request forgery (CSRF) vulnerability in HP Power Manager (HPPM) 4.3.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that create new administrative accounts.
CVE-2011-0090Feb 9, 2011
Microsoft
Windows
risk 0.00cvss —epss 0.02
win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly validate user-mode input, which allows local users to gain privileges via a…
CVE-2011-0089Feb 9, 2011
Microsoft
Windows
risk 0.00cvss —epss 0.02
win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly validate user-mode input, which allows local users to gain privileges via a…
CVE-2011-0088Feb 9, 2011
Microsoft
Windows
risk 0.00cvss —epss 0.02
win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly validate user-mode input, which allows local users to gain privileges via a…
CVE-2011-0087Feb 9, 2011
Microsoft
Windows
risk 0.00cvss —epss 0.02
win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Server 2003 SP2, Vista SP1 and SP2, and Server 2008 Gold and SP2 does not properly validate user-mode input, which allows local users to gain privileges via a crafted application, aka "Win32k Insufficient…
CVE-2011-0086Feb 9, 2011
Microsoft
Windows
risk 0.00cvss —epss 0.02
win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly validate user-mode input, which allows local users to gain privileges via a…
CVE-2011-0045Feb 9, 2011
Microsoft
Windows Xp
risk 0.03cvss —epss 0.04
The Trace Events functionality in the kernel in Microsoft Windows XP SP3 does not properly perform type conversion, which causes integer truncation and insufficient memory allocation and triggers a buffer overflow, which allows local users to gain privileges via a crafted…
CVE-2011-0040Feb 9, 2011
Microsoft
Windows Server 2003
risk 0.02cvss —epss 0.23
The server in Microsoft Active Directory on Windows Server 2003 SP2 does not properly handle an update request for a service principal name (SPN), which allows remote attackers to cause a denial of service (authentication downgrade or outage) via a crafted request that triggers…
CVE-2011-0039Feb 9, 2011
Microsoft
Windows Xp
risk 0.00cvss —epss 0.02
The Local Security Authority Subsystem Service (LSASS) in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly process authentication requests, which allows local users to gain privileges via a request with a crafted length, aka "LSASS Length Validation…
CVE-2011-0031Feb 9, 2011
Microsoft
Windows Server 2008
risk 0.01cvss —epss 0.17
The (1) JScript 5.8 and (2) VBScript 5.8 scripting engines in Microsoft Windows Server 2008 R2 and Windows 7 do not properly load decoded scripts obtained from web pages, which allows remote attackers to trigger memory corruption and consequently obtain sensitive information via…
CVE-2011-0030Feb 9, 2011
Microsoft
Windows Xp
risk 0.00cvss —epss 0.02
The Client/Server Run-time Subsystem (CSRSS) in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly kill processes after a logout, which allows local users to obtain sensitive information or gain privileges via a crafted application that continues to execute…
CVE-2011-0920Feb 8, 2011
IBM
Lotus Domino
risk 0.04cvss —epss 0.10
The Remote Console in IBM Lotus Domino, when a certain unsupported configuration involving UNC share pathnames is used, allows remote attackers to bypass authentication and execute arbitrary code via unspecified vectors, aka SPR PRAD89WGRS.
CVE-2011-0919Feb 8, 2011
IBM
Lotus Domino
risk 0.00cvss —epss 0.06
Multiple stack-based buffer overflows in the (1) POP3 and (2) IMAP services in IBM Lotus Domino allow remote attackers to execute arbitrary code via non-printable characters in an envelope sender address, aka SPR KLYH87LLVJ.
CVE-2011-0918Feb 8, 2011
IBM
Lotus Domino
risk 0.00cvss —epss 0.06
Stack-based buffer overflow in the NRouter (aka Router) service in IBM Lotus Domino allows remote attackers to execute arbitrary code via long filenames associated with Content-ID and ATTACH:CID headers in attachments in malformed calendar-request e-mail messages, aka SPR…
CVE-2011-0917Feb 8, 2011
IBM
Lotus Domino
risk 0.04cvss —epss 0.14
Buffer overflow in nLDAP.exe in IBM Lotus Domino allows remote attackers to execute arbitrary code via a long string in an LDAP Bind operation, aka SPR KLYH87LMVX.
CVE-2011-0916Feb 8, 2011
IBM
Lotus Domino
risk 0.00cvss —epss 0.06
Stack-based buffer overflow in the SMTP service in IBM Lotus Domino allows remote attackers to execute arbitrary code via long arguments in a filename parameter in a malformed MIME e-mail message, aka SPR KLYH889M8H.
CVE-2011-0915Feb 8, 2011
IBM
Lotus Domino
risk 0.01cvss —epss 0.12
Stack-based buffer overflow in nrouter.exe in IBM Lotus Domino before 8.5.3 allows remote attackers to execute arbitrary code via a long name parameter in a Content-Type header in a malformed Notes calendar (aka iCalendar or iCal) meeting request, aka SPR KLYH87LL23.
CVE-2011-0914Feb 8, 2011
IBM
Lotus Domino
risk 0.00cvss —epss 0.05
Integer signedness error in ndiiop.exe in the DIIOP implementation in the server in IBM Lotus Domino before 8.5.3 allows remote attackers to execute arbitrary code via a GIOP client request, leading to a heap-based buffer overflow.
CVE-2011-0913Feb 8, 2011
IBM
Lotus Domino
risk 0.00cvss —epss 0.05
Stack-based buffer overflow in ndiiop.exe in the DIIOP implementation in the server in IBM Lotus Domino before 8.5.3 allows remote attackers to execute arbitrary code via a GIOP getEnvironmentString request, related to the local variable cache.
CVE-2011-0912Feb 8, 2011
IBM
Lotus Notes
risk 0.00cvss —epss 0.04
Argument injection vulnerability in IBM Lotus Notes 8.0.x before 8.0.2 FP6 and 8.5.x before 8.5.1 FP5 allows remote attackers to execute arbitrary code via a cai:// URL containing a --launcher.library option that specifies a UNC share pathname for a DLL file, aka SPR PRAD82YJW2.
CVE-2011-0911Feb 8, 2011
Zikula
Zikula
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the Users module in Zikula before 1.2.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: it is possible that this overlaps CVE-2011-0535.
CVE-2011-0887Feb 8, 2011
SMC Networks
Smcd3g Ccr
risk 0.03cvss —epss 0.05
The web management portal on the SMC SMCD3G-CCR (aka Comcast Business Gateway) with firmware before 1.4.0.49.2 uses predictable session IDs based on time values, which makes it easier for remote attackers to hijack sessions via a brute-force attack on the userid cookie.
CVE-2011-0886Feb 8, 2011
SMC Networks
Smcd3g Ccr
risk 0.03cvss —epss 0.03
Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface on the SMC SMCD3G-CCR (aka Comcast Business Gateway) with firmware before 1.4.0.49.2 allow remote attackers to (1) hijack the intranet connectivity of arbitrary users for requests that perform a…
CVE-2011-0885Feb 8, 2011
Smc
SMCD3G-CCR
risk 0.04cvss —epss 0.10
A certain Comcast Business Gateway configuration of the SMC SMCD3G-CCR with firmware before 1.4.0.49.2 has a default password of D0nt4g3tme for the mso account, which makes it easier for remote attackers to obtain administrative access via the (1) web interface or (2) TELNET…
CVE-2011-0538Feb 8, 2011
Wireshark
Wireshark
risk 0.04cvss —epss 0.08
Wireshark 1.2.0 through 1.2.14, 1.4.0 through 1.4.3, and 1.5.0 frees an uninitialized pointer during processing of a .pcap file in the pcap-ng format, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a…
CVE-2011-0535Feb 8, 2011
Zikula
Zikula
risk 0.03cvss —epss 0.01
Cross-site request forgery (CSRF) vulnerability in the Users module in Zikula before 1.2.5 allows remote attackers to hijack the authentication of administrators for requests that change account privileges via an edit access_permissions action to index.php.