Archive
November 2010
Vulnerabilities first published in this month (UTC), newest first.
278 results · Feed
-
Unscored —
CRLF injection vulnerability in TransWARE Active! mail 6 build 6.40.010047750 and earlier allows remote attackers to in…
-
Unscored —
Array index error in the apply_rcs_change function in rcs.c in CVS 1.11.23 allows local users to gain privileges via an…
-
Unscored —
gnc-test-env in GnuCash 2.3.15 and earlier places a zero-length directory name in the LD_LIBRARY_PATH, which allows loc…
-
Medium —
Apache Shiro Path Traversal vulnerability
Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./accou…
-
Unscored —
festival_server in Centre for Speech Technology Research (CSTR) Festival, probably 2.0.95-beta and earlier, places a ze…
-
Unscored —
CRLF injection vulnerability in Bugzilla before 3.2.9, 3.4.x before 3.4.9, 3.6.x before 3.6.3, and 4.0.x before 4.0rc1,…
-
Unscored —
ipp.c in cupsd in CUPS 1.4.4 and earlier does not properly allocate memory for attribute values with invalid string dat…
-
Unscored —CVE-2010-4181 Public exploit
Directory traversal vulnerability in Yaws 1.89 allows remote attackers to read arbitrary files via ..\ (dot dot backsla…
-
Unscored —CVE-2010-4182 EPSS 24%
Untrusted search path vulnerability in the Data Access Objects (DAO) library (dao360.dll) in Microsoft Windows XP Profe…
-
Unscored —
ISC DHCP server 4.0 before 4.0.2, 4.1 before 4.1.2, and 4.2 before 4.2.0-P1 allows remote attackers to cause a denial o…
-
Unscored —
libguestfs before 1.5.23, as used in virt-v2v, virt-inspector 1.5.3 and earlier, and possibly other products, when a ra…
-
Unscored —CVE-2010-4151 Public exploit
SQL injection vulnerability in misc.php in DeluxeBB 1.3, and possibly earlier, when magic_quotes_gpc is disabled, allow…
-
Unscored —CVE-2010-4006 Public exploit
Multiple SQL injection vulnerabilities in search.php in WSN Links 5.0.x before 5.0.81, 5.1.x before 5.1.51, and 6.0.x b…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in eXV2 CMS 2.10 allow remote attackers to inject arbitrary web scr…
-
Unscored —
Directory traversal vulnerability in CrossFTP Pro 1.65a, and probably earlier, allows remote FTP servers to write arbit…
-
Unscored —CVE-2010-4152 Public exploit
SQL injection vulnerability in catalog/index.shtml in 4site CMS 2.6, and possibly earlier, allows remote attackers to e…
-
Unscored —
Directory traversal vulnerability in Rhino Software, Inc. FTP Voyager 15.2.0.11, and possibly earlier, allows remote FT…
-
Unscored —
Untrusted search path vulnerability in VIM Development Group GVim before 7.3.034, and possibly other versions before 7.…
-
Unscored —CVE-2010-3977 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in wp-content/plugins/cforms/lib_ajax.php in cforms WordPress plugi…
-
Unscored —
Stack-based buffer overflow in SonicWALL SSL-VPN End-Point Interrogator/Installer ActiveX control (Aventail.EPInstaller…
-
Unscored —CVE-2010-4144 Public exploit
SQL injection vulnerability in radyo.asp in Kisisel Radyo Script allows remote attackers to execute arbitrary SQL comma…
-
Unscored —
Cross-site scripting (XSS) vulnerability in Attachmate Reflection for the Web 2008 R2 (builds 10.1.569 and earlier), 20…
-
Unscored —
Directory traversal vulnerability in FreshWebMaster Fresh FTP 5.36, 5.37, and possibly earlier, allows remote FTP serve…
-
Unscored —
Multiple SQL injection vulnerabilities in Pentasoft Avactis Shopping Cart 1.9.1 build 8356 free edition and earlier all…
-
Unscored —
Directory traversal vulnerability in AnyConnect 1.2.3.0, and possibly earlier, allows remote FTP servers to write arbit…
-
Unscored —CVE-2010-4143 Public exploit
SQL injection vulnerability in chart.php in phpCheckZ 1.1.0, when magic_quotes_gpc is disabled, allows remote attackers…
-
Unscored —CVE-2010-4145 Public exploit
Kisisel Radyo Script stores sensitive information under the web root with insufficient access control, which allows rem…
-
Unscored —
Unspecified vulnerability in HP Insight Control Performance Management before 6.2 allows remote authenticated users to …
-
Unscored —
Unspecified vulnerability in HP Insight Orchestration before 6.2 allows remote attackers to bypass intended access rest…
-
Unscored —
Unspecified vulnerability in HP Insight Managed System Setup Wizard before 6.2 allows remote attackers to read arbitrar…
-
Unscored —
Unspecified vulnerability in HP Insight Orchestration before 6.2 allows remote attackers to read arbitrary files via un…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in HP Insight Control Performance Management before 6.2 allows remote a…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in HP Insight Control for Linux before 6.2 allows remote attackers to h…
-
Unscored —
Unspecified vulnerability in HP Insight Control Performance Management before 6.1 update 2 allows remote attackers to r…
-
Unscored —
Cross-site scripting (XSS) vulnerability in HP Insight Control Performance Management before 6.2 allows remote attacker…
-
Unscored —
Cross-site scripting (XSS) vulnerability in HP Insight Recovery before 6.2 allows remote attackers to inject arbitrary …
-
Unscored —
Unspecified vulnerability in HP Insight Recovery before 6.2 allows remote attackers to read arbitrary files via unknown…
-
Unscored —
Multiple stack-based buffer overflows in DATAC RealWin 2.0 Build 6.1.8.10 and earlier allow remote attackers to cause a…