2011 CVEs (page 2)
Page 2 of 47 — CVEs published in 2011, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2011-3610 | Medium | 6.1 | 2020-01-22 | A Cross-site Scripting (XSS) vulnerability exists in the Serendipity freetag plugin before 3.30 in the tagcloud parameter to plugins/serendipity_event_freetag/… |
CVE-2011-3595 | Medium | 5.4 | 2020-01-22 | Multiple Cross-site Scripting (XSS) vulnerabilities exist in Joomla! through 1.7.0 in index.php in the search word, extension, asset, and author parameters. |
CVE-2011-3582 | High | 8.8 | 2020-01-22 | A Cross-site Request Forgery (CSRF) vulnerability exists in Advanced Electron Forums (AEF) through 1.0.9 due to inadequate confirmation for sensitive transacti… |
CVE-2011-4943 | Critical | 9.8 | 2020-01-22 | ImpressPages CMS v1.0.12 has Unspecified Remote Code Execution (fixed in v1.0.13) |
CVE-2011-5282 | Medium | 5.3 | 2020-01-21 | mIRC prior to 7.22 has a message leak because chopping of outbound messages is mishandled. |
CVE-2011-4322 | High | 7.5 | 2020-01-21 | websitebaker prior to and including 2.8.1 has an authentication error in backup module. |
CVE-2011-4095 | Medium | 6.1 | 2020-01-21 | Jara 1.6 has an XSS vulnerability |
CVE-2011-4094 | Critical | 9.8 | 2020-01-21 | Jara 1.6 has a SQL injection vulnerability. |
CVE-2011-2669 | Medium | 6.5 | 2020-01-21 | Mozilla Firefox prior to 3.6 has a DoS vulnerability due to an issue in the validation of certificates. |
CVE-2011-2668 | High | 8.8 | 2020-01-21 | Mozilla Firefox through 1.5.0.3 has a vulnerability in processing the content-length header |
CVE-2011-4907 | Medium | 5.3 | 2020-01-15 | Joomla! 1.5x through 1.5.12: Missing JEXEC Check |
CVE-2011-4336 | Medium | 6.1 | 2020-01-15 | Tiki Wiki CMS Groupware 7.0 has XSS via the GET "ajax" parameter to snarf_ajax.php. |
CVE-2011-2715 | Critical | 9.8 | 2020-01-14 | An SQL Injection vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table names or column names. |
CVE-2011-2714 | Medium | 6.1 | 2020-01-14 | A Cross-Site Scripting vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table descriptions, field names, or la… |
CVE-2011-3202 | Medium | 6.1 | 2020-01-14 | A Cross-Site Scripting (XSS) vulnerability exists in the g parameter to index.php in Jcow CMS 4.2 and earlier. |
CVE-2011-3183 | Medium | 6.1 | 2020-01-14 | A Cross-Site Scripting (XSS) vulnerability exists in the rcID parameter in Concrete CMS 5.4.1.1 and earlier. |
CVE-2011-2934 | High | 8.8 | 2020-01-14 | A Cross Site Request Forgery (CSRF) vulnerability exists in the administrator functions in WebsiteBaker 2.8.1 and earlier due to inadequate confirmation for se… |
CVE-2011-2933 | High | 7.2 | 2020-01-14 | An Arbitrary File Upload vulnerability exists in admin/media/upload.php in WebsiteBaker 2.8.1 and earlier due to a failure to restrict uploaded files with .hta… |
CVE-2011-2706 | Medium | 6.1 | 2020-01-14 | A Cross-Site Scripting (XSS) vulnerability exists in the reorder administrator functions in sNews 1.71. |
CVE-2011-3203 | Critical | 9.8 | 2020-01-14 | A Code Execution vulnerability exists the attachment parameter to index.php in Jcow CMS 4.x to 4.2 and 5.2 to 5.2. |
CVE-2011-2670 | Medium | 6.1 | 2020-01-13 | Mozilla Firefox before 3.6 is vulnerable to XSS via the rendering of Cascading Style Sheets |
CVE-2011-5020 | Critical | 9.8 | 2020-01-10 | An SQL Injection vulnerability exists in the ID parameter in Online TV Database 2011. |
CVE-2011-4595 | Medium | 6.1 | 2020-01-10 | Pretty-Link WordPress plugin 1.5.2 has XSS |
CVE-2011-5266 | Critical | 9.8 | 2020-01-08 | Imperva SecureSphere Web Application Firewall (WAF) before 12-august-2010 allows SQL injection filter bypass. |
CVE-2011-5250 | Medium | 6.5 | 2020-01-08 | Snare for Linux before 1.7.0 has CSRF in the web interface. |
CVE-2011-5247 | High | 7.5 | 2020-01-08 | Snare for Linux before 1.7.0 has password disclosure because the rendered page contains the field RemotePassword. |
CVE-2011-5018 | Medium | 6.1 | 2020-01-08 | Koala Framework before 2011-11-21 has XSS via the request_uri parameter. |
CVE-2011-3585 | Medium | 4.7 | 2019-12-31 | Multiple race conditions in the (1) mount.cifs and (2) umount.cifs programs in Samba 3.6 allow local users to cause a denial of service (mounting outage) via a… |
CVE-2011-1474 | Medium | 5.5 | 2019-12-26 | A locally locally exploitable DOS vulnerability was found in pax-linux versions 2.6.32.33-test79.patch, 2.6.38-test3.patch, and 2.6.37.4-test14.patch. A bad bo… |
CVE-2011-2717 | Critical | 9.8 | 2019-11-27 | The DHCPv6 client (dhcp6c) as used in the dhcpv6 project through 2011-07-25 allows remote DHCP servers to execute arbitrary commands via shell metacharacters i… |
CVE-2011-2523 | Critical | 9.8 | 2019-11-27 | vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp. |
CVE-2011-2515 | Medium | 5.3 | 2019-11-27 | PackageKit 0.6.17 allows installation of unsigned RPM packages as though they were signed which may allow installation of non-trusted packages and execution of… |
CVE-2011-2480 | High | 7.5 | 2019-11-27 | Information Disclosure vulnerability in the 802.11 stack, as used in FreeBSD before 8.2 and NetBSD when using certain non-x86 architectures. A signedness error… |
CVE-2011-2207 | Medium | 5.3 | 2019-11-27 | dirmngr before 2.1.0 improperly handles certain system calls, which allows remote attackers to cause a denial of service (DOS) via a specially-crafted certific… |
CVE-2011-2187 | High | 7.8 | 2019-11-27 | xscreensaver before 5.14 crashes during activation and leaves the screen unlocked when in Blank Only Mode and when DPMS is disabled, which allows local attacke… |
CVE-2011-2177 | High | 7.8 | 2019-11-27 | OpenOffice.org v3.3 allows execution of arbitrary code with the privileges of the user running the OpenOffice.org suite tools. |
CVE-2011-4310 | High | 7.5 | 2019-11-26 | The news module in CMSMS before 1.9.4.3 allows remote attackers to corrupt new articles. |
CVE-2011-1939 | Critical | 9.8 | 2019-11-26 | SQL injection vulnerability in Zend Framework 1.10.x before 1.10.9 and 1.11.x before 1.11.6 when using non-ASCII-compatible encodings in conjunction PDO_MySql… |
CVE-2011-1934 | Medium | 4.3 | 2019-11-26 | lilo-uuid-diskid causes lilo.conf to be world-readable in lilo 23.1. |
CVE-2011-1933 | Critical | 9.8 | 2019-11-26 | SQL injection vulnerability in Jifty::DBI before 0.68. |
CVE-2011-4350 | Medium | 6.5 | 2019-11-26 | Yaws 1.91 has a directory traversal vulnerability in the way certain URLs are processed. A remote authenticated user could use this flaw to obtain content of a… |
CVE-2011-4121 | Critical | 9.8 | 2019-11-26 | The OpenSSL extension of Ruby (Git trunk) versions after 2011-09-01 up to 2011-11-03 always generated an exponent value of '1' to be used for private RSA key g… |
CVE-2011-4120 | Critical | 9.8 | 2019-11-26 | Yubico PAM Module before 2.10 performed user authentication when 'use_first_pass' PAM configuration option was not used and the module was configured as 'suffi… |
CVE-2011-4090 | Medium | 6.1 | 2019-11-26 | Serendipity before 1.6 has an XSS issue in the karma plugin which may allow privilege escalation. |
CVE-2011-4082 | High | 7.5 | 2019-11-26 | A local file inclusion flaw was found in the way the phpLDAPadmin before 0.9.8 processed certain values of the "Accept-Language" HTTP header. A remote attacker… |
CVE-2011-4076 | Medium | 5.9 | 2019-11-26 | OpenStack Nova before 2012.1 allows someone with access to an EC2_ACCESS_KEY (equivalent to a username) to obtain the EC2_SECRET_KEY (equivalent to a password)… |
CVE-2011-3632 | High | 7.1 | 2019-11-26 | Hardlink before 0.1.2 operates on full file system objects path names which can allow a local attacker to use this flaw to conduct symlink attacks. |
CVE-2011-3631 | High | 8.8 | 2019-11-26 | Hardlink before 0.1.2 has multiple integer overflows leading to heap-based buffer overflows because of the way string lengths concatenation is done in the calc… |
CVE-2011-3630 | High | 8.8 | 2019-11-26 | Hardlink before 0.1.2 suffer from multiple stack-based buffer overflow flaws because of the way directory trees with deeply nested directories are processed. A… |
CVE-2011-3624 | Medium | 5.3 | 2019-11-26 | Various methods in WEBrick::HTTPRequest in Ruby 1.9.2 and 1.8.7 and earlier do not validate the X-Forwarded-For, X-Forwarded-Host and X-Forwarded-Server header… |
CVE-2011-3617 | Medium | 6.5 | 2019-11-26 | Tahoe-LAFS v1.3.0 through v1.8.2 could allow unauthorized users to delete immutable files in some cases. |
CVE-2011-3609 | Medium | 6.5 | 2019-11-26 | A CSRF issue was found in JBoss Application Server 7 before 7.1.0. JBoss did not properly restrict access to the management console information (for example vi… |
CVE-2011-3606 | Medium | 5.4 | 2019-11-26 | A DOM based cross-site scripting flaw was found in the JBoss Application Server 7 before 7.1.0 Beta 1 administration console. A remote attacker could provide a… |
CVE-2011-3600 | High | 7.5 | 2019-11-26 | The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable pa… |
CVE-2011-3596 | High | 7.5 | 2019-11-26 | Polipo before 1.0.4.1 suffers from a DoD vulnerability via specially-crafted HTTP POST / PUT request. |
CVE-2011-3584 | Critical | 9.8 | 2019-11-26 | The TYPO3 Core wec_discussion extension before 2.1.1 is vulnerable to SQL Injection due to improper sanitation of user-supplied input. |
CVE-2011-3583 | Critical | 9.8 | 2019-11-26 | It was found that Typo3 Core versions 4.5.0 - 4.5.5 uses prepared statements that, if the parameter values are not properly replaced, could lead to a SQL Injec… |
CVE-2011-3374 | Low | 3.7 | 2019-11-26 | It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack. |
CVE-2011-3373 | Medium | 6.1 | 2019-11-25 | Drupal Views Builk Operations (VBO) module 6.x-1.0 through 6.x-1.10 does not properly escape the vocabulary help when the vocabulary has had user tagging enabl… |
CVE-2011-3355 | High | 7.3 | 2019-11-25 | evolution-data-server3 3.0.3 through 3.2.1 used insecure (non-SSL) connection when attempting to store sent email messages into the Sent folder, when the Sent… |
CVE-2011-3351 | High | 7.1 | 2019-11-25 | openvas-scanner before 2011-09-11 creates a temporary file insecurely when generating OVAL system characteristics document with the ovaldi integrated tool enab… |
CVE-2011-4924 | Medium | 6.1 | 2019-11-25 | Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12… |
CVE-2011-4455 | Medium | 6.1 | 2019-11-20 | Multiple cross-site scripting vulnerabilities in Tiki 7.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the path info to (1) ti… |
CVE-2011-4454 | Medium | 6.1 | 2019-11-20 | Multiple cross-site scripting vulnerabilities in Tiki 8.0 RC1 and earlier allow remote attackers to inject arbitrary web script or HTML via the path info to (1… |
CVE-2011-0529 | High | 7.5 | 2019-11-20 | Weborf before 0.12.5 is affected by a Denial of Service (DOS) due to malformed fields in HTTP. |
CVE-2011-1028 | Critical | 9.8 | 2019-11-20 | The $smarty.template variable in Smarty3 allows attackers to possibly execute arbitrary PHP code via the sysplugins/smarty_internal_compile_private_special_var… |
CVE-2011-3352 | Medium | 4.8 | 2019-11-19 | Zikula 1.3.0 build #3168 and probably prior has XSS flaw due to improper sanitization of the 'themename' parameter by setting default, modifying and deleting t… |
CVE-2011-3350 | Critical | 9.8 | 2019-11-19 | masqmail 0.2.21 through 0.2.30 improperly calls seteuid() in src/log.c and src/masqmail.c that results in improper privilege dropping. |
CVE-2011-3349 | High | 7.8 | 2019-11-19 | lightdm before 0.9.6 writes in .dmrc and Xauthority files using root permissions while the files are in user controlled folders. A local user can overwrite roo… |
CVE-2011-2924 | Medium | 5.5 | 2019-11-19 | foomatic-rip filter v4.0.12 and prior used insecurely creates temporary files for storage of PostScript data by rendering the data when the debug mode was enab… |
CVE-2011-2923 | Medium | 5.5 | 2019-11-19 | foomatic-rip filter, all versions, used insecurely creates temporary files for storage of PostScript data by rendering the data when the debug mode was enabled… |
CVE-2011-2922 | High | 7.8 | 2019-11-19 | ktsuss versions 1.4 and prior spawns the GTK interface to run as root. This can allow a local attacker to escalate privileges to root and use the "GTK_MODULES"… |
CVE-2011-2921 | Critical | 9.8 | 2019-11-19 | ktsuss versions 1.4 and prior has the uid set to root and does not drop privileges prior to executing user specified commands, which can result in command exec… |
CVE-2011-4968 | Medium | 4.8 | 2019-11-19 | nginx http proxy module does not verify peer identity of https origin server which could facilitate man-in-the-middle attack (MITM) |
CVE-2011-4967 | High | 7.5 | 2019-11-19 | tog-Pegasus has a package hash collision DoS vulnerability |
CVE-2011-4954 | High | 7.8 | 2019-11-19 | cobbler has local privilege escalation via the use of insecure location for PYTHON_EGG_CACHE |
CVE-2011-4952 | High | 8.8 | 2019-11-19 | cobbler: Web interface lacks CSRF protection when using Django framework |
CVE-2011-4919 | High | 7.5 | 2019-11-19 | mpack 1.6 has information disclosure via eavesdropping on mails sent by other users |
CVE-2011-5331 | Critical | 9.8 | 2019-11-18 | Distributed Ruby (aka DRuby) 1.8 mishandles instance_eval. |
CVE-2011-5330 | Critical | 9.8 | 2019-11-18 | Distributed Ruby (aka DRuby) 1.8 mishandles the sending of syscalls. |
CVE-2011-2916 | Medium | 5.5 | 2019-11-15 | qtnx 0.9 stores non-custom SSH keys in a world-readable configuration file. If a user has a world-readable or world-executable home directory, another local sy… |
CVE-2011-2910 | Medium | 6.7 | 2019-11-15 | The AX.25 daemon (ax25d) in ax25-tools before 0.0.8-13 does not check the return value of a setuid call. The setuid call is responsible for dropping privileges… |
CVE-2011-2726 | High | 7.5 | 2019-11-15 | An access bypass issue was found in Drupal 7.x before version 7.5. If a Drupal site has the ability to attach File upload fields to any entity type in the syst… |
CVE-2011-0703 | Critical | 9.8 | 2019-11-15 | In gksu-polkit before 0.0.3, the source file for xauth may contain arbitrary commands that may allow an attacker to overtake an administrator X11 session. |
CVE-2011-1930 | Critical | 9.8 | 2019-11-14 | In klibc 1.5.20 and 1.5.21, the DHCP options written by ipconfig to /tmp/net-$DEVICE.conf are not properly escaped. This may allow a remote attacker to send a… |
CVE-2011-1588 | High | 7.8 | 2019-11-14 | Thunar before 1.3.1 could crash when copy and pasting a file name with % format characters due to a format string error. |
CVE-2011-1490 | Medium | 5.5 | 2019-11-14 | A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages are logged when multiple rulesets were used and some output batches co… |
CVE-2011-1489 | Medium | 5.5 | 2019-11-14 | A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages were logged when multiple rulesets were used and some output batches c… |
CVE-2011-1488 | Medium | 5.5 | 2019-11-14 | A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages are logged when $RepeatedMsgReduction was enabled. A local attacker co… |
CVE-2011-1145 | High | 7.8 | 2019-11-14 | The SQLDriverConnect() function in unixODBC before 2.2.14p2 have a possible buffer overflow condition when specifying a large value for SAVEFILE parameter in t… |
CVE-2011-1136 | Medium | 4.7 | 2019-11-14 | In tesseract 2.03 and 2.04, an attacker can rewrite an arbitrary user file by guessing the PID and creating a link to the user's file. |
CVE-2011-1070 | High | 7.8 | 2019-11-14 | v86d before 0.1.10 do not verify if received netlink messages are sent by the kernel. This could allow unprivileged users to manipulate the video mode and pote… |
CVE-2011-0544 | Medium | 6.1 | 2019-11-14 | phpbb 3.0.x-3.0.6 has an XSS vulnerability via the [flash] BB tag. |
CVE-2011-4972 | High | 7.5 | 2019-11-13 | hook_file_download in the CKEditor module 7.x-1.4 for Drupal does not properly restrict access to private files, which allows remote attackers to read private… |
CVE-2011-1803 | Medium | 6.5 | 2019-11-12 | An issue exists in third_party/WebKit/Source/WebCore/svg/animation/SVGSMILElement.h in WebKit in Google Chrome before Blink M11 and M12 when trying to access a… |
CVE-2011-1802 | Medium | 6.5 | 2019-11-12 | WebKit in Google Chrome before Blink M11 and M12 does not properly handle counter nodes, which allows remote attackers to cause a denial of service (memory cor… |
CVE-2011-2334 | Medium | 6.5 | 2019-11-12 | Use after free vulnerability exists in WebKit in Google Chrome before Blink M12 in RenderLayerwhen removing elements with reflections. |
CVE-2011-2335 | High | 7.5 | 2019-11-12 | A double-free vulnerability exists in WebKit in Google Chrome before Blink M12 in the WebCore::CSSSelector function. |
CVE-2011-3618 | High | 7.8 | 2019-11-12 | atop: symlink attack possible due to insecure tempfile handling |
CVE-2011-5271 | Medium | 5.5 | 2019-11-12 | Pacemaker before 1.1.6 configure script creates temporary files insecurely |