Skip to content
OpenAdvisories

Archive

November 2011

Vulnerabilities first published in this month (UTC), newest first.

← October 2011 2011 / November December 2011 →
  1. 145
  2. 254
  3. 317
  4. 412
  5. 5 
  6. 6 
  7. 72
  8. 811
  9. 916
  10. 102
  11. 1127
  12. 124
  13. 13 
  14. 14 
  15. 157
  16. 164
  17. 1710
  18. 18 
  19. 195
  20. 20 
  21. 214
  22. 229
  23. 2319
  24. 2422
  25. 25 
  26. 263
  27. 27 
  28. 2811
  29. 2915
  30. 3010
All Critical High Medium Low Exploited only Public exploit

309 results · Feed

  • Unscored —
    CVE-2011-4499

    The UPnP IGD implementation in the Broadcom UPnP stack on the Cisco Linksys WRT54G with firmware before 4.30.5, WRT54GS…

  • Unscored —
    CVE-2011-4504

    The UPnP IGD implementation in the Pseudo ICS UPnP software on the ZyXEL P-330W allows remote attackers to establish ar…

  • Unscored —
    CVE-2011-4500

    The UPnP IGD implementation on the Cisco Linksys WRT54GX with firmware 2.00.05, when UPnP is enabled, configures the SO…

  • Unscored —
    CVE-2011-4505

    The UPnP IGD implementation on SpeedTouch 5x6 devices with firmware before 6.2.29 allows remote attackers to establish …

  • Unscored —
    CVE-2011-4503

    The UPnP IGD implementation in Broadcom Linux on the Sitecom WL-111 allows remote attackers to establish arbitrary port…

  • Unscored —
    CVE-2011-4502

    The UPnP IGD implementation in Edimax EdiLinux on the Edimax BR-6104K with firmware before 3.25, Edimax 6114Wg, Canyon-…

  • Unscored —
    CVE-2011-4501

    The UPnP IGD implementation in Edimax EdiLinux on the Edimax BR-6104K with firmware before 3.25, Edimax 6114Wg, Canyon-…

  • Unscored —
    CVE-2011-4507

    The D-Link DIR-685 router, when certain WPA and WPA2 configurations are used, does not maintain an encrypted wireless n…

  • Unscored —
    CVE-2011-4506

    The UPnP IGD implementation on the Thomson (aka Technicolor) TG585 with firmware 7.x before 7.4.3.2 allows remote attac…

  • Unscored —
    CVE-2011-4496 Public exploit EPSS 11%

    Buffer overflow in Aviosoft DTV Player 1.0.1.2 allows remote attackers to execute arbitrary code via a crafted .plf (ak…

  • Unscored —
    CVE-2011-4040 Public exploit EPSS 65%

    Buffer overflow in MiniSmtp 3.0.11818 in NJStar Communicator allows remote attackers to execute arbitrary code via a cr…

  • Unscored —
    CVE-2011-4497

    QIS_wizard.htm on the ASUS RT-N56U router with firmware before 1.0.1.4o allows remote attackers to obtain the administr…

  • Unscored —
    CVE-2011-4498

    Cross-site request forgery (CSRF) vulnerability in the web console in Zenprise Device Manager 6.x through 6.1.8 allows …

  • Unscored —
    CVE-2011-4404 Public exploit EPSS 59%

    The default configuration of the HTTP server in Jetty in vSphere Update Manager in VMware vCenter Update Manager 4.0 be…

  • Unscored —
    CVE-2011-4159

    Unspecified vulnerability in System Administration Manager (SAM) in EMS before A.04.20.11.04_01 on HP HP-UX B.11.11, B.…

  • Unscored —
    CVE-2011-4311

    ResourceSpace before 4.2.2833 does not properly validate access keys, which allows remote attackers to bypass intended …

  • Unscored —
    CVE-2011-4465

    Cross-site scripting (XSS) vulnerability in IBM Lotus Mobile Connect (LMC) 6.1.4 allows remote attackers to inject arbi…

  • Unscored —
    CVE-2011-3849

    Unspecified vulnerability in dxserver before 6279 in CA Directory 8.1 and CA Directory r12 before SP7 CR1 allows remote…

  • Low —
    CVE-2011-4457

    OWASP HTML Sanitizer allows redirecting to an arbitrary URL when JavaScript is disabled

    OWASP HTML Sanitizer (aka owasp-java-html-sanitizer) before 88, when JavaScript is disabled, allows user-assisted remote attackers to obtain potentially sensitive information via a crafted FORM element within a NOSCRIPT element.

    com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer Maven
  • Unscored —
    CVE-2011-3900

    Google V8, as used in Google Chrome before 15.0.874.121, allows remote attackers to cause a denial of service or possib…

  • Medium 6.5
    CVE-2011-4107 Public exploit EPSS 13%

    phpMyAdmin vulnerable to XML external entity (XXE) injection attack

    The simplexml_load_string function in the XML import plug-in (libraries/import/xml.php) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before 3.3.10.5 allows remote authenticated users to read arbitrary files via XML data containing external entity references, …

    phpmyadmin phpmyadmin/phpmyadmin Debian Packagist
  • Unscored —
    CVE-2011-4122 Public exploit

    Directory traversal vulnerability in openpam_configure.c in OpenPAM before r478 on FreeBSD 8.1 allows local users to lo…

  • Unscored —
    CVE-2011-4096 EPSS 37%

    The idnsGrokReply function in Squid before 3.1.16 does not properly free memory, which allows remote attackers to cause…

  • Unscored —
    CVE-2011-4073

    Use-after-free vulnerability in the cryptographic helper handler functionality in Openswan 2.3.0 through 2.6.36 allows …

  • Unscored —
    CVE-2011-3380

    Openswan 2.6.29 through 2.6.35 allows remote attackers to cause a denial of service (NULL pointer dereference and pluto…

  • Unscored —
    CVE-2011-3646

    phpmyadmin.css.php in phpMyAdmin 3.4.x before 3.4.6 allows remote attackers to obtain sensitive information via an arra…

    phpmyadmin Debian
  • Unscored —
    CVE-2011-3627

    The bytecode engine in ClamAV before 0.97.3 allows remote attackers to cause a denial of service (crash) via vectors re…

    clamav Debian
  • Unscored —
    CVE-2011-2770

    Cross-site scripting (XSS) vulnerability in man2html.cgi.c in man2html 1.6, and possibly other version, allows remote a…

    man2html Debian
  • Unscored —
    CVE-2011-4155

    Cross-site scripting (XSS) vulnerability in HP Network Node Manager i (NNMi) 9.0x and 9.1x allows remote attackers to i…

  • Unscored —
    CVE-2011-4156

    Cross-site scripting (XSS) vulnerability in HP Network Node Manager i (NNMi) 9.0x and 9.1x allows remote attackers to i…

  • Unscored —
    CVE-2011-4158

    Unspecified vulnerability in HP Directories Support for ProLiant Management Processors 3.10 and 3.20 for Integrated Lig…

  • Unscored —
    CVE-2011-4157 EPSS 13%

    Stack-based buffer overflow in hydra.exe in HP SAN/iQ before 9.5 on the HP StorageWorks P4000 Virtual SAN Appliance all…

  • Unscored —
    CVE-2011-1516 Public exploit

    The kSBXProfileNoNetwork and kSBXProfileNoInternet sandbox profiles in Apple Mac OS X 10.5.x through 10.7.x do not prop…

  • Unscored —
    CVE-2008-7303

    The nonet and nointernet sandbox profiles in Apple Mac OS X 10.5.x do not propagate restrictions to all created process…

  • Unscored —
    CVE-2011-4118

    Mahara before 1.4.1, when MNet (aka the Moodle network feature) is used, allows remote authenticated users to gain priv…

  • Unscored —
    CVE-2011-2772

    The get_dataroot_image_path function in lib/file.php in Mahara before 1.4.1 does not properly validate uploaded image f…

  • Unscored —
    CVE-2011-2773

    Cross-site request forgery (CSRF) vulnerability in Mahara before 1.4.1 allows remote attackers to hijack the authentica…

  • Unscored —
    CVE-2011-2774

    The "Reply to message" feature in Mahara 1.3.x and 1.4.x before 1.4.1 allows remote authenticated users to read the mes…

  • Unscored —
    CVE-2011-2771

    Multiple cross-site scripting (XSS) vulnerabilities in Mahara before 1.4.1 allow remote attackers to inject arbitrary w…

  • Unscored —
    CVE-2011-4048

    The Dell KACE K2000 System Deployment Appliance has a default username and password for the read-only reporting account…