CVEs

386,445 total · page 6771 of 7,729

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2011-2830	Google Chrome		0.00	—	0.01	Oct 28, 2011	Google V8, as used in Google Chrome before 14.0.835.163, does not properly implement script object wrappers, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via unknown vectors.
CVE-2011-1371	IBM Websphere Ilog Rule Team Server		0.00	—	0.01	Oct 28, 2011	Cross-site scripting (XSS) vulnerability in content/error.jsp in IBM WebSphere ILOG Rule Team Server 7.1.1 allows remote attackers to inject arbitrary web script or HTML via vectors that trigger an Unknown Error document, a different vulnerability than CVE-2011-4171.
CVE-2011-1360	IBM HTTP Server		0.00	—	0.02	Oct 28, 2011	Multiple cross-site scripting (XSS) vulnerabilities in IBM HTTP Server 2.0.47 and earlier, as used in WebSphere Application Server and other products, allow remote attackers to inject arbitrary web script or HTML via vectors involving unspecified documentation files in (1)…
CVE-2011-4004	Cisco Systems, Inc. Webex Recording Format Player		0.00	—	0.04	Oct 27, 2011	Buffer overflow in the ATAS32 processing functionality in the Cisco WebEx Recording Format (WRF) player T26 before SP49 EP40 and T27 before SP28 allows remote attackers to execute arbitrary code via a crafted WRF file.
CVE-2011-3319	Cisco Systems, Inc. Webex Recording Format Player		0.00	—	0.03	Oct 27, 2011	Buffer overflow in the WRF parsing functionality in the Cisco WebEx Recording Format (WRF) player T26 before SP49 EP40 and T27 before SP28 allows remote attackers to execute arbitrary code via a crafted WRF file.
CVE-2011-3318	Cisco Systems, Inc. Video Surveillance 2421		0.00	—	0.01	Oct 27, 2011	Cisco Video Surveillance 2421 and 2500 series cameras with software 1.1.x and 2.x before 2.4.0 and Video Surveillance 2600 series cameras with software before 4.2.0-13 allow remote attackers to cause a denial of service (device reload) by sending crafted RTSP packets over TCP,…
CVE-2011-3315	Cisco Systems, Inc. Unified Communications Manager		0.05	—	0.26	Oct 27, 2011	Directory traversal vulnerability in Cisco Unified Communications Manager (CUCM) 5.x and 6.x before 6.1(5)SU2, 7.x before 7.1(5b)SU2, and 8.x before 8.0(3), and Cisco Unified Contact Center Express (aka Unified CCX or UCCX) and Cisco Unified IP Interactive Voice Response…
CVE-2011-2569	Cisco Systems, Inc. Unified Computing System		0.00	—	0.00	Oct 27, 2011	Cisco Nexus OS (aka NX-OS) 4.2 and 5.0 and Cisco Unified Computing System with software 1.4 and 2.0 do not properly restrict command-line options, which allows local users to gain privileges via unspecified vectors, aka Bug IDs CSCtf40008, CSCtg18363, CSCtr44645, CSCts10195, and…
CVE-2011-4079	OpenLDAP Openldap		0.00	—	0.03	Oct 27, 2011	Off-by-one error in the UTF8StringNormalize function in OpenLDAP 2.4.26 and earlier allows remote attackers to cause a denial of service (slapd crash) via a zero-length string that triggers a heap-based buffer overflow, as demonstrated using an empty postalAddressAttribute value…
CVE-2011-3872	Puppet (software) Puppet		0.00	—	0.03	Oct 27, 2011	Puppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6, and Puppet Enterprise (PE) Users 1.0, 1.1, and 1.2 before 1.2.4, when signing an agent certificate, adds the Puppet master's certdnsnames values to the X.509 Subject Alternative Name field of the certificate, which allows remote…
CVE-2011-3871	Puppet (software) Puppet		0.00	—	0.00	Oct 27, 2011	Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in --edit mode, uses a predictable file name, which allows local users to run arbitrary Puppet code or trick a user into editing arbitrary files.
CVE-2011-3870	Puppet (software) Puppet		0.00	—	0.00	Oct 27, 2011	Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to modify the permissions of arbitrary files via a symlink attack on the SSH authorized_keys file.
CVE-2011-3869	Puppet (software) Puppet		0.00	—	0.00	Oct 27, 2011	Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to overwrite arbitrary files via a symlink attack on the .k5login file.
CVE-2011-3848	Puppet (software) Puppet		0.00	—	0.01	Oct 27, 2011	Directory traversal vulnerability in Puppet 2.6.x before 2.6.10 and 2.7.x before 2.7.4 allows remote attackers to write X.509 Certificate Signing Request (CSR) to arbitrary locations via (1) a double-encoded key parameter in the URI in 2.7.x, (2) the CN in the Subject of a CSR…
CVE-2011-3891	Google Chrome		0.00	—	0.01	Oct 25, 2011	Google Chrome before 15.0.874.102 does not properly restrict access to internal Google V8 functions, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVE-2011-3890	Google Chrome		0.00	—	0.01	Oct 25, 2011	Use-after-free vulnerability in Google Chrome before 15.0.874.102 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to video source handling.
CVE-2011-3889	Google Chrome		0.00	—	0.01	Oct 25, 2011	Heap-based buffer overflow in the Web Audio implementation in Google Chrome before 15.0.874.102 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVE-2011-3888	Google Chrome		0.00	—	0.02	Oct 25, 2011	Use-after-free vulnerability in Google Chrome before 15.0.874.102 allows user-assisted remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to editing operations in conjunction with an unknown plug-in.
CVE-2011-3887	Google Chrome		0.00	—	0.01	Oct 25, 2011	Google Chrome before 15.0.874.102 does not properly handle javascript: URLs, which allows remote attackers to bypass intended access restrictions and read cookies via unspecified vectors.
CVE-2011-3886	Google V8		0.00	—	0.01	Oct 25, 2011	Google V8, as used in Google Chrome before 15.0.874.102, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers out-of-bounds write operations.
CVE-2011-3885	Google Chrome		0.00	—	0.02	Oct 25, 2011	Use-after-free vulnerability in Google Chrome before 15.0.874.102 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to stale Cascading Style Sheets (CSS) token-sequence data.
CVE-2011-3884	Google Chrome		0.00	—	0.01	Oct 25, 2011	Google Chrome before 15.0.874.102 does not properly address timing issues during DOM traversal, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document.
CVE-2011-3883	Google Chrome		0.00	—	0.01	Oct 25, 2011	Use-after-free vulnerability in Google Chrome before 15.0.874.102 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to counters.
CVE-2011-3882	Google Chrome		0.00	—	0.01	Oct 25, 2011	Use-after-free vulnerability in Google Chrome before 15.0.874.102 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to media buffers.
CVE-2011-3881	Google Chrome		0.00	—	0.02	Oct 25, 2011	WebKit, as used in Google Chrome before 15.0.874.102 and Android before 4.4, allows remote attackers to bypass the Same Origin Policy and conduct Universal XSS (UXSS) attacks via vectors related to (1) the DOMWindow::clear function and use of a selection object, (2) the…
CVE-2011-3880	Google Chrome		0.00	—	0.01	Oct 25, 2011	Google Chrome before 15.0.874.102 does not prevent use of an unspecified special character as a delimiter in HTTP headers, which has unknown impact and remote attack vectors.
CVE-2011-3879	Google Chrome		0.00	—	0.01	Oct 25, 2011	Google Chrome before 15.0.874.102 does not prevent redirects to chrome: URLs, which has unspecified impact and remote attack vectors.
CVE-2011-3878	Google Chrome		0.00	—	0.01	Oct 25, 2011	Race condition in Google Chrome before 15.0.874.102 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to worker process initialization.
CVE-2011-3877	Google Chrome		0.00	—	0.01	Oct 25, 2011	Cross-site scripting (XSS) vulnerability in the appcache internals page in Google Chrome before 15.0.874.102 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2011-3876	Google Chrome		0.00	—	0.01	Oct 25, 2011	Google Chrome before 15.0.874.102 does not properly handle downloading files that have whitespace characters at the end of a filename, which has unspecified impact and user-assisted remote attack vectors.
CVE-2011-3875	Google Chrome		0.00	—	0.01	Oct 25, 2011	Google Chrome before 15.0.874.102 does not properly handle drag and drop operations on URL strings, which allows user-assisted remote attackers to spoof the URL bar via unspecified vectors.
CVE-2011-2845	Google Chrome		0.00	—	0.01	Oct 25, 2011	Google Chrome before 15.0.874.102 does not properly handle history data, which allows user-assisted remote attackers to spoof the URL bar via unspecified vectors.
CVE-2011-4173	Simple Machines Smf		0.00	—	0.01	Oct 24, 2011	Cross-site request forgery (CSRF) vulnerability in Simple Machines Forum (SMF) 2.x before 2.0.1 allows remote attackers to hijack the authentication of administrators or moderators via vectors involving image files, a different vulnerability than CVE-2011-3615. NOTE: some of…
CVE-2011-4172	Kent Web Web Forum		0.00	—	0.01	Oct 24, 2011	Multiple cross-site scripting (XSS) vulnerabilities in KENT-WEB WEB FORUM before 5.1 allow remote attackers to inject arbitrary web script or HTML via (1) an e-mail address field or (2) a cookie, a related issue to CVE-2011-3383, CVE-2011-3983, and CVE-2011-3984.
CVE-2011-4171	IBM Websphere Ilog Rule Team Server		0.00	—	0.01	Oct 24, 2011	Cross-site scripting (XSS) vulnerability in content/error.jsp in IBM WebSphere ILOG Rule Team Server 7.1.1 allows remote attackers to inject arbitrary web script or HTML via the project parameter to teamserver/faces/home.jsp.
CVE-2011-3984	Kent Web Web Forum		0.00	—	0.02	Oct 24, 2011	Cross-site scripting (XSS) vulnerability in KENT-WEB WEB FORUM 5.1 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors related to "web form entries."
CVE-2011-3983	Kent Web Web Forum		0.00	—	0.02	Oct 24, 2011	Cross-site scripting (XSS) vulnerability in KENT-WEB WEB FORUM 5.1 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors related to cookies.
CVE-2011-3615	Simple Machines Smf		0.00	—	0.01	Oct 24, 2011	Multiple SQL injection vulnerabilities in Simple Machines Forum (SMF) before 1.1.15 and 2.x before 2.0.1 allow remote attackers to execute arbitrary SQL commands via vectors involving a (1) HTML entity or (2) display name. NOTE: some of these details are obtained from third…
CVE-2011-3383	Kent Web Web Forum		0.00	—	0.01	Oct 24, 2011	Cross-site scripting (XSS) vulnerability in KENT-WEB WEB FORUM 5.1 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors related to "the web page to be output."
CVE-2011-2656	Novell Zenworks Handheld Management		0.00	—	0.04	Oct 24, 2011	Unspecified vulnerability in ZfHSrvr.exe in Novell ZENworks Handheld Management (ZHM) 7 allows remote attackers to execute arbitrary code via unknown vectors, a different vulnerability than CVE-2011-2655.
CVE-2011-2655	Novell Zenworks Handheld Management		0.00	—	0.04	Oct 24, 2011	Unspecified vulnerability in ZfHSrvr.exe in Novell ZENworks Handheld Management (ZHM) 7 allows remote attackers to execute arbitrary code via unknown vectors, a different vulnerability than CVE-2011-2656.
CVE-2011-4170	GNOME Foundation Empathy		0.00	—	0.01	Oct 23, 2011	Cross-site scripting (XSS) vulnerability in the theme_adium_append_message function in empathy-theme-adium.c in the Adium theme in libempathy-gtk in Empathy 3.2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted alias (aka nickname) in a…
CVE-2011-3635	GNOME Foundation Empathy		0.00	—	0.02	Oct 23, 2011	Cross-site scripting (XSS) vulnerability in the theme_adium_append_message function in empathy-theme-adium.c in the Adium theme in libempathy-gtk in Empathy 3.2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted alias (aka nickname).
CVE-2011-3163	Microfocus MFP Digital Sending Software		0.00	—	0.00	Oct 23, 2011	HP MFP Digital Sending Software 4.9x through 4.91.21 allows local users to obtain sensitive workflow-metadata information via unspecified vectors.
CVE-2011-1478	Linux Kernel		0.00	—	0.01	Oct 23, 2011	The napi_reuse_skb function in net/core/dev.c in the Generic Receive Offload (GRO) implementation in the Linux kernel before 2.6.38 does not reset the values of certain structure members, which might allow remote attackers to cause a denial of service (NULL pointer dereference)…
CVE-2011-2060	Cisco Systems, Inc. Cisco Adaptive Security Appliance		0.00	—	0.00	Oct 22, 2011	The platform-sw component on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 8.2 before 8.2(5.3), 8.3 before 8.3(2.20), and 8.4 before 8.4(2.1) does not properly handle non-ASCII characters in an interface description, which allows local users to cause…
CVE-2011-2059	Cisco Systems, Inc. Cisco iOS		0.00	—	0.02	Oct 22, 2011	The ipv6 component in Cisco IOS before 15.1(4)M1.3 allows remote attackers to conduct fingerprinting attacks and obtain potentially sensitive information about the presence of the IOS operating system via an ICMPv6 Echo Request packet containing a Hop-by-Hop (HBH) extension…
CVE-2011-2058	Cisco Systems, Inc. Cisco iOS	Hig	0.49	7.5	0.02	Oct 22, 2011	The cat6000-dot1x component in Cisco IOS 12.2 before 12.2(33)SXI7 does not properly handle an external loop between a pair of dot1x enabled ports, which allows remote attackers to cause a denial of service (traffic storm) via unspecified vectors that trigger many unicast EAPoL…
CVE-2011-2057	Cisco Systems, Inc. Cisco iOS	Hig	0.49	7.5	0.02	Oct 22, 2011	The cat6000-dot1x component in Cisco IOS 12.2 before 12.2(33)SXI7 does not properly handle (1) a loop between a dot1x enabled port and an open-authentication dot1x enabled port and (2) a loop between a dot1x enabled port and a non-dot1x port, which allows remote attackers to…
CVE-2011-2042	Cisco Systems, Inc. Ciscoworks Common Services		0.00	—	0.01	Oct 22, 2011	The Sybase SQL Anywhere database component in Cisco CiscoWorks Common Services 3.x and 4.x before 4.1 allows remote attackers to obtain potentially sensitive information about the engine name and database port via an unspecified request to UDP port 2638, aka Bug ID CSCsk35018.

CVE-2011-2830Oct 28, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Google V8, as used in Google Chrome before 14.0.835.163, does not properly implement script object wrappers, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via unknown vectors.
CVE-2011-1371Oct 28, 2011
IBM
Websphere Ilog Rule Team Server
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in content/error.jsp in IBM WebSphere ILOG Rule Team Server 7.1.1 allows remote attackers to inject arbitrary web script or HTML via vectors that trigger an Unknown Error document, a different vulnerability than CVE-2011-4171.
CVE-2011-1360Oct 28, 2011
IBM
HTTP Server
risk 0.00cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in IBM HTTP Server 2.0.47 and earlier, as used in WebSphere Application Server and other products, allow remote attackers to inject arbitrary web script or HTML via vectors involving unspecified documentation files in (1)…
CVE-2011-4004Oct 27, 2011
Cisco Systems, Inc.
Webex Recording Format Player
risk 0.00cvss —epss 0.04
Buffer overflow in the ATAS32 processing functionality in the Cisco WebEx Recording Format (WRF) player T26 before SP49 EP40 and T27 before SP28 allows remote attackers to execute arbitrary code via a crafted WRF file.
CVE-2011-3319Oct 27, 2011
Cisco Systems, Inc.
Webex Recording Format Player
risk 0.00cvss —epss 0.03
Buffer overflow in the WRF parsing functionality in the Cisco WebEx Recording Format (WRF) player T26 before SP49 EP40 and T27 before SP28 allows remote attackers to execute arbitrary code via a crafted WRF file.
CVE-2011-3318Oct 27, 2011
Cisco Systems, Inc.
Video Surveillance 2421
risk 0.00cvss —epss 0.01
Cisco Video Surveillance 2421 and 2500 series cameras with software 1.1.x and 2.x before 2.4.0 and Video Surveillance 2600 series cameras with software before 4.2.0-13 allow remote attackers to cause a denial of service (device reload) by sending crafted RTSP packets over TCP,…
CVE-2011-3315Oct 27, 2011
Cisco Systems, Inc.
Unified Communications Manager
risk 0.05cvss —epss 0.26
Directory traversal vulnerability in Cisco Unified Communications Manager (CUCM) 5.x and 6.x before 6.1(5)SU2, 7.x before 7.1(5b)SU2, and 8.x before 8.0(3), and Cisco Unified Contact Center Express (aka Unified CCX or UCCX) and Cisco Unified IP Interactive Voice Response…
CVE-2011-2569Oct 27, 2011
Cisco Systems, Inc.
Unified Computing System
risk 0.00cvss —epss 0.00
Cisco Nexus OS (aka NX-OS) 4.2 and 5.0 and Cisco Unified Computing System with software 1.4 and 2.0 do not properly restrict command-line options, which allows local users to gain privileges via unspecified vectors, aka Bug IDs CSCtf40008, CSCtg18363, CSCtr44645, CSCts10195, and…
CVE-2011-4079Oct 27, 2011
OpenLDAP
Openldap
risk 0.00cvss —epss 0.03
Off-by-one error in the UTF8StringNormalize function in OpenLDAP 2.4.26 and earlier allows remote attackers to cause a denial of service (slapd crash) via a zero-length string that triggers a heap-based buffer overflow, as demonstrated using an empty postalAddressAttribute value…
CVE-2011-3872Oct 27, 2011
Puppet (software)
Puppet
risk 0.00cvss —epss 0.03
Puppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6, and Puppet Enterprise (PE) Users 1.0, 1.1, and 1.2 before 1.2.4, when signing an agent certificate, adds the Puppet master's certdnsnames values to the X.509 Subject Alternative Name field of the certificate, which allows remote…
CVE-2011-3871Oct 27, 2011
Puppet (software)
Puppet
risk 0.00cvss —epss 0.00
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in --edit mode, uses a predictable file name, which allows local users to run arbitrary Puppet code or trick a user into editing arbitrary files.
CVE-2011-3870Oct 27, 2011
Puppet (software)
Puppet
risk 0.00cvss —epss 0.00
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to modify the permissions of arbitrary files via a symlink attack on the SSH authorized_keys file.
CVE-2011-3869Oct 27, 2011
Puppet (software)
Puppet
risk 0.00cvss —epss 0.00
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to overwrite arbitrary files via a symlink attack on the .k5login file.
CVE-2011-3848Oct 27, 2011
Puppet (software)
Puppet
risk 0.00cvss —epss 0.01
Directory traversal vulnerability in Puppet 2.6.x before 2.6.10 and 2.7.x before 2.7.4 allows remote attackers to write X.509 Certificate Signing Request (CSR) to arbitrary locations via (1) a double-encoded key parameter in the URI in 2.7.x, (2) the CN in the Subject of a CSR…
CVE-2011-3891Oct 25, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Google Chrome before 15.0.874.102 does not properly restrict access to internal Google V8 functions, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVE-2011-3890Oct 25, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Use-after-free vulnerability in Google Chrome before 15.0.874.102 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to video source handling.
CVE-2011-3889Oct 25, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Heap-based buffer overflow in the Web Audio implementation in Google Chrome before 15.0.874.102 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVE-2011-3888Oct 25, 2011
Google
Chrome
risk 0.00cvss —epss 0.02
Use-after-free vulnerability in Google Chrome before 15.0.874.102 allows user-assisted remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to editing operations in conjunction with an unknown plug-in.
CVE-2011-3887Oct 25, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Google Chrome before 15.0.874.102 does not properly handle javascript: URLs, which allows remote attackers to bypass intended access restrictions and read cookies via unspecified vectors.
CVE-2011-3886Oct 25, 2011
Google
V8
risk 0.00cvss —epss 0.01
Google V8, as used in Google Chrome before 15.0.874.102, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers out-of-bounds write operations.
CVE-2011-3885Oct 25, 2011
Google
Chrome
risk 0.00cvss —epss 0.02
Use-after-free vulnerability in Google Chrome before 15.0.874.102 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to stale Cascading Style Sheets (CSS) token-sequence data.
CVE-2011-3884Oct 25, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Google Chrome before 15.0.874.102 does not properly address timing issues during DOM traversal, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document.
CVE-2011-3883Oct 25, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Use-after-free vulnerability in Google Chrome before 15.0.874.102 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to counters.
CVE-2011-3882Oct 25, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Use-after-free vulnerability in Google Chrome before 15.0.874.102 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to media buffers.
CVE-2011-3881Oct 25, 2011
Google
Chrome
risk 0.00cvss —epss 0.02
WebKit, as used in Google Chrome before 15.0.874.102 and Android before 4.4, allows remote attackers to bypass the Same Origin Policy and conduct Universal XSS (UXSS) attacks via vectors related to (1) the DOMWindow::clear function and use of a selection object, (2) the…
CVE-2011-3880Oct 25, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Google Chrome before 15.0.874.102 does not prevent use of an unspecified special character as a delimiter in HTTP headers, which has unknown impact and remote attack vectors.
CVE-2011-3879Oct 25, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Google Chrome before 15.0.874.102 does not prevent redirects to chrome: URLs, which has unspecified impact and remote attack vectors.
CVE-2011-3878Oct 25, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Race condition in Google Chrome before 15.0.874.102 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to worker process initialization.
CVE-2011-3877Oct 25, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the appcache internals page in Google Chrome before 15.0.874.102 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2011-3876Oct 25, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Google Chrome before 15.0.874.102 does not properly handle downloading files that have whitespace characters at the end of a filename, which has unspecified impact and user-assisted remote attack vectors.
CVE-2011-3875Oct 25, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Google Chrome before 15.0.874.102 does not properly handle drag and drop operations on URL strings, which allows user-assisted remote attackers to spoof the URL bar via unspecified vectors.
CVE-2011-2845Oct 25, 2011
Google
Chrome
risk 0.00cvss —epss 0.01
Google Chrome before 15.0.874.102 does not properly handle history data, which allows user-assisted remote attackers to spoof the URL bar via unspecified vectors.
CVE-2011-4173Oct 24, 2011
Simple Machines
Smf
risk 0.00cvss —epss 0.01
Cross-site request forgery (CSRF) vulnerability in Simple Machines Forum (SMF) 2.x before 2.0.1 allows remote attackers to hijack the authentication of administrators or moderators via vectors involving image files, a different vulnerability than CVE-2011-3615. NOTE: some of…
CVE-2011-4172Oct 24, 2011
Kent Web
Web Forum
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in KENT-WEB WEB FORUM before 5.1 allow remote attackers to inject arbitrary web script or HTML via (1) an e-mail address field or (2) a cookie, a related issue to CVE-2011-3383, CVE-2011-3983, and CVE-2011-3984.
CVE-2011-4171Oct 24, 2011
IBM
Websphere Ilog Rule Team Server
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in content/error.jsp in IBM WebSphere ILOG Rule Team Server 7.1.1 allows remote attackers to inject arbitrary web script or HTML via the project parameter to teamserver/faces/home.jsp.
CVE-2011-3984Oct 24, 2011
Kent Web
Web Forum
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in KENT-WEB WEB FORUM 5.1 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors related to "web form entries."
CVE-2011-3983Oct 24, 2011
Kent Web
Web Forum
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in KENT-WEB WEB FORUM 5.1 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors related to cookies.
CVE-2011-3615Oct 24, 2011
Simple Machines
Smf
risk 0.00cvss —epss 0.01
Multiple SQL injection vulnerabilities in Simple Machines Forum (SMF) before 1.1.15 and 2.x before 2.0.1 allow remote attackers to execute arbitrary SQL commands via vectors involving a (1) HTML entity or (2) display name. NOTE: some of these details are obtained from third…
CVE-2011-3383Oct 24, 2011
Kent Web
Web Forum
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in KENT-WEB WEB FORUM 5.1 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors related to "the web page to be output."
CVE-2011-2656Oct 24, 2011
Novell
Zenworks Handheld Management
risk 0.00cvss —epss 0.04
Unspecified vulnerability in ZfHSrvr.exe in Novell ZENworks Handheld Management (ZHM) 7 allows remote attackers to execute arbitrary code via unknown vectors, a different vulnerability than CVE-2011-2655.
CVE-2011-2655Oct 24, 2011
Novell
Zenworks Handheld Management
risk 0.00cvss —epss 0.04
Unspecified vulnerability in ZfHSrvr.exe in Novell ZENworks Handheld Management (ZHM) 7 allows remote attackers to execute arbitrary code via unknown vectors, a different vulnerability than CVE-2011-2656.
CVE-2011-4170Oct 23, 2011
GNOME Foundation
Empathy
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the theme_adium_append_message function in empathy-theme-adium.c in the Adium theme in libempathy-gtk in Empathy 3.2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted alias (aka nickname) in a…
CVE-2011-3635Oct 23, 2011
GNOME Foundation
Empathy
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in the theme_adium_append_message function in empathy-theme-adium.c in the Adium theme in libempathy-gtk in Empathy 3.2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted alias (aka nickname).
CVE-2011-3163Oct 23, 2011
Microfocus
MFP Digital Sending Software
risk 0.00cvss —epss 0.00
HP MFP Digital Sending Software 4.9x through 4.91.21 allows local users to obtain sensitive workflow-metadata information via unspecified vectors.
CVE-2011-1478Oct 23, 2011
Linux
Kernel
risk 0.00cvss —epss 0.01
The napi_reuse_skb function in net/core/dev.c in the Generic Receive Offload (GRO) implementation in the Linux kernel before 2.6.38 does not reset the values of certain structure members, which might allow remote attackers to cause a denial of service (NULL pointer dereference)…
CVE-2011-2060Oct 22, 2011
Cisco Systems, Inc.
Cisco Adaptive Security Appliance
risk 0.00cvss —epss 0.00
The platform-sw component on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 8.2 before 8.2(5.3), 8.3 before 8.3(2.20), and 8.4 before 8.4(2.1) does not properly handle non-ASCII characters in an interface description, which allows local users to cause…
CVE-2011-2059Oct 22, 2011
Cisco Systems, Inc.
Cisco iOS
risk 0.00cvss —epss 0.02
The ipv6 component in Cisco IOS before 15.1(4)M1.3 allows remote attackers to conduct fingerprinting attacks and obtain potentially sensitive information about the presence of the IOS operating system via an ICMPv6 Echo Request packet containing a Hop-by-Hop (HBH) extension…
CVE-2011-2058HigOct 22, 2011
Cisco Systems, Inc.
Cisco iOS
risk 0.49cvss 7.5epss 0.02
The cat6000-dot1x component in Cisco IOS 12.2 before 12.2(33)SXI7 does not properly handle an external loop between a pair of dot1x enabled ports, which allows remote attackers to cause a denial of service (traffic storm) via unspecified vectors that trigger many unicast EAPoL…
CVE-2011-2057HigOct 22, 2011
Cisco Systems, Inc.
Cisco iOS
risk 0.49cvss 7.5epss 0.02
The cat6000-dot1x component in Cisco IOS 12.2 before 12.2(33)SXI7 does not properly handle (1) a loop between a dot1x enabled port and an open-authentication dot1x enabled port and (2) a loop between a dot1x enabled port and a non-dot1x port, which allows remote attackers to…
CVE-2011-2042Oct 22, 2011
Cisco Systems, Inc.
Ciscoworks Common Services
risk 0.00cvss —epss 0.01
The Sybase SQL Anywhere database component in Cisco CiscoWorks Common Services 3.x and 4.x before 4.1 allows remote attackers to obtain potentially sensitive information about the engine name and database port via an unspecified request to UDP port 2638, aka Bug ID CSCsk35018.