Archive
May 2011
Vulnerabilities first published in this month (UTC), newest first.
295 results · Feed
-
Unscored —
The socket implementation in net/core/sock.c in the Linux kernel before 2.6.34 does not properly manage a backlog of re…
-
Unscored —
The authoring tool in IBM Web Content Manager (WCM) 6.1.5, and 7.0.0.1 before CF003, allows remote authenticated users …
-
Unscored —CVE-2011-0418 Public exploit
The glob implementation in Pure-FTPd before 1.0.32, and in libc in NetBSD 5.1, does not properly expand expressions con…
-
Unscored —
The urllib and urllib2 modules in Python 2.x before 2.7.2 and 3.x before 3.2.1 process Location headers that specify re…
-
Unscored —
lib-mail/message-header-parser.c in Dovecot 1.2.x before 1.2.17 and 2.0.x before 2.0.13 does not properly handle '\0' c…
-
Unscored —CVE-2011-1928 EPSS 10%
The fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library 1.4.3 and 1.4.4, and the Apach…
-
Unscored —
The default configuration of ExShortcut\Web.config in EMC SourceOne Email Management before 6.6 SP1, when the Mobile Se…
-
Unscored —
SQL injection vulnerability in RADVISION iVIEW Suite before 7.5 allows remote attackers to execute arbitrary SQL comman…
-
Unscored —
Directory traversal vulnerability in the disk_create function in disk.c in rdesktop before 1.7.0, when disk redirection…
-
Unscored —
Google Chrome OS before R12 0.12.433.38 Beta, when Guest mode is enabled, does not prevent changes on the about:flags p…
-
Unscored —
script-login in Dovecot 2.0.x before 2.0.13 does not follow the chroot configuration setting, which might allow remote …
-
Unscored —
Unspecified vulnerability in the dbugs package in Google Chrome OS before R12 0.12.433.38 Beta has unknown impact and a…
-
Unscored —
Google Chrome OS before R12 0.12.433.38 Beta allows local users to gain privileges by creating a /var/lib/chromeos-alia…
-
Unscored —
Multiple integer overflows in the glob implementation in libc in OpenBSD before 4.9 might allow context-dependent attac…
-
Unscored —
script-login in Dovecot 2.0.x before 2.0.13 does not follow the user and group configuration settings, which might allo…
-
Unscored —
The STARTTLS implementation in ftp_parser.c in Pure-FTPd before 1.0.30 does not properly restrict I/O buffering, which …
-
Unscored —
The STARTTLS implementation in Cyrus IMAP Server before 2.4.7 does not properly restrict I/O buffering, which allows ma…
-
Unscored —
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.5, when Internet Explorer 6 or earlier is used, allow…
-
Unscored —
The make include files in NetBSD before 1.6.2, as used in pmake 1.111 and other products, allow local users to overwrit…
-
Unscored —
includes/User.php in MediaWiki before 1.16.5, when wgBlockDisablesLogin is enabled, does not clear certain cached data …
-
Unscored —CVE-2011-2165 Public exploit
The STARTTLS implementation in WatchGuard XCS 9.0 and 9.1 does not properly restrict I/O buffering, which allows man-in…
-
Unscored —
ViewVC before 1.1.11 allows remote attackers to bypass the cvsdb row_limit configuration setting, and consequently cond…
-
Unscored —CVE-2011-0962 Public exploit
Cross-site scripting (XSS) vulnerability in CSCOnm/servlet/com.cisco.nm.help.ServerHelpEngine in the Common Services De…
-
Unscored —CVE-2011-0960 Public exploit
Multiple SQL injection vulnerabilities in Cisco Unified Operations Manager (CUOM) before 8.6 allow remote attackers to …
-
Unscored —
FFmpeg 0.5.x, as used in MPlayer and other products, allows remote attackers to cause a denial of service (application …
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Cisco Unified Operations Manager (CUOM) before 8.6 allow remote …
-
Unscored —
Directory traversal vulnerability in cwhp/auditLog.do in the Homepage Auditing component in Cisco CiscoWorks Common Ser…
-
Unscored —
FFmpeg before 0.5.4, as used in MPlayer and other products, allows remote attackers to cause a denial of service (heap …
-
Unscored —CVE-2011-0961 Public exploit
Cross-site scripting (XSS) vulnerability in cwhp/device.center.do in the Help servlet in Cisco CiscoWorks Common Servic…
-
Unscored —
The Keystroke Encryption feature in Trend Micro Internet Security 2009 (aka Virus Buster 2009 and PC-cillin 2009) does …
-
Unscored —CVE-2011-1838 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in TemplateLogin.pm in TWiki before 5.0.2 allow remote attackers to…
-
Unscored —
The pidfile_write function in core/pidfile.c in keepalived 1.2.2 and earlier uses 0666 permissions for the (1) keepaliv…
-
Medium —
Access restriction bypass in Apache Tomcat
Apache Tomcat 7.0.12 and 7.0.13 processes the first request to a servlet without following security constraints that have been configured through annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests. NOTE: this v…
-
Unscored —
Openswan 2.2.x does not properly restrict permissions for (1) /var/run/starter.pid, related to starter.c in the IPsec s…
-
Unscored —
Admin/frmSite.aspx in the SmarterTools SmarterStats 6.0 web server allows remote attackers to execute arbitrary command…
-
Unscored —
The ape_read_header function in ape.c in libavformat in FFmpeg before 0.5.4, as used in MPlayer, VideoLAN VLC media pla…
-
Unscored —
The SmarterTools SmarterStats 6.0 web server omits the Content-Type header for certain resources, which might allow rem…
-
Unscored —
The VC-1 decoding functionality in FFmpeg before 0.5.4, as used in MPlayer and other products, does not properly restri…
-
Unscored —
Cross-site scripting (XSS) vulnerability in TIBCO iProcess Engine before 11.1.3 and iProcess Workspace before 11.3.1 al…
-
Unscored —
Login.aspx in the SmarterTools SmarterStats 6.0 web server generates a ctl00$MPH$txtPassword password form field withou…