Archive
October 2011
Vulnerabilities first published in this month (UTC), newest first.
484 results · Feed
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in _ah/admin/interactive/execute (aka the Interactive Console) in the S…
-
Unscored —
The sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly prevent os.popen calls, whic…
-
Unscored —
The FakeFile implementation in the sandbox environment in the Google App Engine Python SDK before 1.5.4 does not proper…
-
Unscored —
The sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly prevent use of the os module…
-
Unscored —
IBM WebSphere MQ 6.0 before 6.0.2.8 and 7.0 before 7.0.1.0 does not properly handle long group names, which might allow…
-
Unscored —
Heap-based buffer overflow in the client in IBM WebSphere MQ 6.0 before 6.0.2.7 and 7.0 before 7.0.1.0 allows local use…
-
Unscored —
Unspecified vulnerability in the Import feature in IBM Rational AppScan Enterprise and AppScan Reporting Console 5.2 th…
-
Unscored —
Unspecified vulnerability in the File Load feature in IBM Rational AppScan Standard and Express 7.8.x, 7.9.x, and 8.0.x…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Administration Console in IBM WebSphere Application Server (WAS) 6.1 be…
-
Unscored —
The Java Naming and Directory Interface (JNDI) implementation in IBM WebSphere Application Server (WAS) 6.0 before 6.0.…
-
Unscored —
The JavaServer Faces (JSF) application functionality in IBM WebSphere Application Server 8.x before 8.0.0.1 does not pr…
-
Unscored —
The default configuration of the Sametime configuration servlet (SCS) in the server in IBM Lotus Sametime 7.0 through 8…
-
Unscored —
IBM WebSphere MQ 7.x before 7.0.1.4 allows remote attackers to cause a denial of service (disk consumption) via multipl…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in IBM HTTP Server 2.0.47 and earlier, as used in WebSphere Applica…
-
Unscored —
Cross-site scripting (XSS) vulnerability in content/error.jsp in IBM WebSphere ILOG Rule Team Server 7.1.1 allows remot…
-
Unscored —
Integer overflow in Apple QuickTime before 7.7.1 allows remote attackers to execute arbitrary code or cause a denial of…
-
Unscored —
Integer overflow in Apple QuickTime before 7.7.1 on Windows allows remote attackers to execute arbitrary code or cause …
-
Unscored —
Apple QuickTime before 7.7.1 on Windows allows remote attackers to execute arbitrary code or cause a denial of service …
-
Unscored —
Integer signedness error in Apple QuickTime before 7.7.1 allows remote attackers to execute arbitrary code or cause a d…
-
Unscored —
Buffer overflow in Apple QuickTime before 7.7.1 allows remote attackers to execute arbitrary code or cause a denial of …
-
Unscored —
Google V8, as used in Google Chrome before 14.0.835.163, does not properly implement script object wrappers, which allo…
-
Unscored —
Untrusted search path vulnerability in Mozilla Network Security Services (NSS), as used in Google Chrome before 17 on W…
-
Unscored —
Buffer overflow in the ATAS32 processing functionality in the Cisco WebEx Recording Format (WRF) player T26 before SP49…
-
Unscored —
Directory traversal vulnerability in Cisco Unified Communications Manager (CUCM) 5.x and 6.x before 6.1(5)SU2, 7.x befo…
-
Unscored —
Cisco Video Surveillance 2421 and 2500 series cameras with software 1.1.x and 2.x before 2.4.0 and Video Surveillance 2…
-
Unscored —
Buffer overflow in the WRF parsing functionality in the Cisco WebEx Recording Format (WRF) player T26 before SP49 EP40 …
-
Unscored —
Cisco Nexus OS (aka NX-OS) 4.2 and 5.0 and Cisco Unified Computing System with software 1.4 and 2.0 do not properly res…
-
Unscored —
Off-by-one error in the UTF8StringNormalize function in OpenLDAP 2.4.26 and earlier allows remote attackers to cause a …
-
Medium —
Puppet arbitrary file overwrite
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to overwrite arbitrary files via a symlink attack on the .k5login file.
-
Unscored —
Directory traversal vulnerability in Puppet 2.6.x before 2.6.10 and 2.7.x before 2.7.4 allows remote attackers to write…
-
Unscored —CVE-2011-3872 Public exploit
Puppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6, and Puppet Enterprise (PE) Users 1.0, 1.1, and 1.2 before 1.2.4, whe…
-
Medium —
Puppet uses predictable filenames, allowing arbitrary file overwrite
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in --edit mode, uses a predictable file name, which allows local users to run arbitrary Puppet code or trick a user into editing arbitrary files.
-
Medium —
Puppet allows local users to modify the permissions of arbitrary files
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to modify the permissions of arbitrary files via a symlink attack on the SSH authorized_keys file.
-
Unscored —
Google Chrome before 15.0.874.102 does not properly address timing issues during DOM traversal, which allows remote att…
-
Unscored —
Google Chrome before 15.0.874.102 does not properly handle downloading files that have whitespace characters at the end…
-
Unscored —
Google Chrome before 15.0.874.102 does not prevent redirects to chrome: URLs, which has unspecified impact and remote a…
-
Unscored —
Google Chrome before 15.0.874.102 does not properly restrict access to internal Google V8 functions, which allows remot…
-
Unscored —
Use-after-free vulnerability in Google Chrome before 15.0.874.102 allows remote attackers to cause a denial of service …
-
Unscored —
Use-after-free vulnerability in Google Chrome before 15.0.874.102 allows remote attackers to cause a denial of service …
-
Unscored —
Race condition in Google Chrome before 15.0.874.102 allows remote attackers to cause a denial of service or possibly ha…