Skip to content
OpenAdvisories

Archive

February 2011

Vulnerabilities first published in this month (UTC), newest first.

← January 2011 2011 / February March 2011 →
  1. 112
  2. 225
  3. 312
  4. 420
  5. 5 
  6. 6 
  7. 710
  8. 821
  9. 915
  10. 1095
  11. 11 
  12. 12 
  13. 13 
  14. 1418
  15. 15 
  16. 1610
  17. 1726
  18. 1826
  19. 19 
  20. 20 
  21. 2118
  22. 2213
  23. 2310
  24. 242
  25. 2537
  26. 26 
  27. 27 
  28. 287
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Medium 6.1
    CVE-2011-1058

    MoinMoin Cross-site Scripting (XSS) vulnerability

    Cross-site scripting (XSS) vulnerability in the reStructuredText (rst) parser in parser/text_rst.py in MoinMoin before 1.9.3, when docutils is installed or when "format rst" is set, allows remote attackers to inject arbitrary web script or HTML via a javascri…

    moin PyPI
  • Medium —
    CVE-2011-0013 EPSS 10%

    Improper Neutralization of Input During Web Page Generation in Apache Tomcat

    Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30, and 7.0 before 7.0.6 allow remote attackers to inject arbitrary web script or HTML, as demonstrated via the display-name t…

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2010-4476 Public exploit EPSS 23%

    Apache Tomcat affected by infinite loop in Double.parseDouble method in Java Runtime Environment

    The Double.parseDouble method in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier, as used in OpenJDK, Apache, JBossweb, and other products, allows remote attac…

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2011-0533

    Apache Continuum and Archiva vulnerable to Cross-site Scripting

    Cross-site scripting (XSS) vulnerability in Apache Continuum 1.1 through 1.2.3.1, 1.3.6, and 1.4.0 Beta; and Archiva 1.3.0 through 1.3.3 and 1.0 through 1.22 allows remote attackers to inject arbitrary web script or HTML via a crafted parameter, related to th…

    org.apache.archiva:archiva org.apache.continuum:continuum Maven
  • Medium —
    CVE-2011-0986

    phpMyAdmin allows remote attackers to obtain installation path via direct request for nonexistent file

    phpMyAdmin 2.11.x before 2.11.11.2, and 3.3.x before 3.3.9.1, does not properly handle the absence of the (1) README, (2) ChangeLog, and (3) LICENSE files, which allows remote attackers to obtain the installation path via a direct request for a nonexistent fi…

    phpmyadmin phpmyadmin/phpmyadmin Debian Packagist
  • Medium —
    CVE-2011-0447

    actionpack Cross-Site Request Forgery vulnerability

    Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via fo…

    rails actionpack Debian RubyGems
  • Medium 6.1
    CVE-2011-0697

    Cross-site scripting in django

    Cross-site scripting (XSS) vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 might allow remote attackers to inject arbitrary web script or HTML via a filename associated with a file upload.

    python-django django Debian PyPI
  • Medium —
    CVE-2011-0446

    Rails actionpack gem vulnerable to Cross-site Scripting

    Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email…

    rails actionpack actionview Debian RubyGems
  • Medium —
    CVE-2009-5054

    Smarty Does Not Consider Umask Values When Setting Permissions

    Smarty before 3.0.0 beta 4 does not consider the umask value when setting the permissions of files, which might allow attackers to bypass intended access restrictions via standard filesystem operations.

    smarty3 smarty/smarty Debian Packagist
  • Medium —
    CVE-2011-0451

    EC-CUBE XSS Vulnerabilities

    Multiple cross-site scripting (XSS) vulnerabilities in (1) data/Smarty/templates/default/list.tpl and (2) data/Smarty/templates/default/campaign/bloc/cart_tag.tpl in EC-CUBE before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via unspec…

    ec-cube/ec-cube Packagist
  • Medium —
    CVE-2011-0739

    Mail Improper Input Validation vulnerability

    The deliver function in the sendmail delivery agent (lib/mail/network/delivery_methods/sendmail.rb) in Ruby Mail gem 2.2.14 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an e-mail address.

    mail RubyGems
  • Medium 5.3
    CVE-2011-0736

    Adobe ColdFusion 9.0.1 CHF1 and earlier, when a web application is configured to use a DBMS, allows remote attackers to…

  • Medium 5.3
    CVE-2011-0737

    Adobe ColdFusion 9.0.1 CHF1 and earlier allows remote attackers to obtain sensitive information via an id=- query to a …