2011 CVEs (page 3)
Page 3 of 47 — CVEs published in 2011, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2011-3370 | Medium | 6.1 | 2019-11-12 | statusnet before 0.9.9 has XSS |
CVE-2011-2936 | Critical | 9.8 | 2019-11-12 | Elgg through 1.7.10 has a SQL injection vulnerability |
CVE-2011-2935 | Medium | 6.1 | 2019-11-12 | Elgg through 1.7.10 has XSS |
CVE-2011-2897 | Critical | 9.8 | 2019-11-12 | gdk-pixbuf through 2.31.1 has GIF loader buffer overflow when initializing decompression tables due to an input validation flaw |
CVE-2011-2337 | Critical | 9.8 | 2019-11-07 | A wrong type is used for a return value from strlen in WebKit in Google Chrome before Blink M12 on 64-bit platforms. |
CVE-2011-2336 | Medium | 6.5 | 2019-11-07 | An issue exists in WebKit in Google Chrome before Blink M12. when clearing lists in AnimationControllerPrivate that signal when a hardware animation starts. |
CVE-2011-2807 | Medium | 6.5 | 2019-11-07 | Incorrect handling of timer information in Timer.cpp in WebKit in Google Chrome before Blink M13. |
CVE-2011-2353 | Medium | 6.5 | 2019-11-07 | Use after free vulnerability in documentloader in WebKit in Google Chrome before Blink M13 in DocumentWriter::replaceDocument function. |
CVE-2011-2808 | Medium | 6.5 | 2019-11-06 | A stale layout root is set as an input element in WebKit in Google Chrome before Blink M13 when a child of a keygen with autofocus is accessed. |
CVE-2011-1298 | High | 7.5 | 2019-11-06 | An Integer Overflow exists in WebKit in Google Chrome before Blink M11 in the macOS WebCore::GraphicsContext::fillRect function. |
CVE-2011-4904 | Medium | 6.5 | 2019-11-06 | TYPO3 before 4.4.9 and 4.5.x before 4.5.4 does not apply proper access control on ExtDirect calls which allows remote attackers to retrieve ExtDirect endpoint… |
CVE-2011-4903 | Medium | 6.1 | 2019-11-06 | Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML vi… |
CVE-2011-4902 | Medium | 6.5 | 2019-11-06 | TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to delete arbitrary files on the webserver. |
CVE-2011-4901 | Medium | 6.5 | 2019-11-06 | TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to extract arbitrary information from the TYPO3 database. |
CVE-2011-4900 | Medium | 6.5 | 2019-11-06 | TYPO3 before 4.5.4 allows Information Disclosure in the backend. |
CVE-2011-4632 | Medium | 5.4 | 2019-11-06 | Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML vi… |
CVE-2011-4631 | Medium | 5.4 | 2019-11-06 | Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML vi… |
CVE-2011-4630 | Medium | 5.4 | 2019-11-06 | Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML vi… |
CVE-2011-4629 | Medium | 5.4 | 2019-11-06 | Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML vi… |
CVE-2011-4628 | Critical | 9.8 | 2019-11-06 | TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to bypass authentication mechanisms in the backend through a crafted re… |
CVE-2011-4627 | Medium | 6.5 | 2019-11-06 | TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows Information Disclosure on the backend. |
CVE-2011-4626 | Medium | 6.1 | 2019-11-06 | Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML vi… |
CVE-2011-4625 | High | 7.5 | 2019-11-06 | simplesamlphp before 1.6.3 (squeeze) and before 1.8.2 (sid) incorrectly handles XML encryption which could allow remote attackers to decrypt or forge messages. |
CVE-2011-1460 | Critical | 9.8 | 2019-11-05 | WebKit in Google Chrome before Blink M11 contains a bad cast to RenderBlock when anonymous blocks are renderblocks. |
CVE-2011-1459 | Medium | 6.5 | 2019-11-05 | The WebKit::WebPluginContainerImpl::handleEvent function in Google Chrome before Blink M11 allows an attacker to cause a denial of service (crash) via the html… |
CVE-2011-1135 | Medium | 6.1 | 2019-11-05 | Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code in plugins/Extended… |
CVE-2011-1134 | Critical | 9.8 | 2019-11-05 | Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code in the image manage… |
CVE-2011-1133 | Medium | 6.1 | 2019-11-05 | Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code via plugins/Extende… |
CVE-2011-3923 | Critical | 9.8 | 2019-11-01 | Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands. |
CVE-2011-1408 | High | 8.2 | 2019-10-29 | ikiwiki before 3.20110608 allows remote attackers to hijack root's tty and run symlink attacks. |
CVE-2011-4931 | High | 7.5 | 2019-10-29 | gpw generates shorter passwords than required |
CVE-2011-2538 | High | 7.2 | 2019-10-29 | Cisco Video Communications Server (VCS) before X7.0.3 contains a command injection vulnerability which allows remote, authenticated attackers to execute arbitr… |
CVE-2011-0428 | Medium | 6.1 | 2019-10-29 | Cross Site Scripting (XSS) in ikiwiki before 3.20110122 could allow remote attackers to insert arbitrary JavaScript due to insufficient checking in comments. |
CVE-2011-5329 | Medium | 6.1 | 2019-08-28 | The redirection plugin before 2.2.9 for WordPress has XSS in the admin menu, a different issue than CVE-2011-4562. |
CVE-2011-5328 | High | 8.8 | 2019-08-20 | The user-access-manager plugin before 1.2 for WordPress has CSRF. |
CVE-2011-5327 | Critical | 9.8 | 2019-07-27 | In the Linux kernel before 3.1, an off by one in the drivers/target/loopback/tcm_loop.c tcm_loop_make_naa_tpg() function could result in at least memory corrup… |
CVE-2011-3151 | Medium | 5.2 | 2019-04-22 | The Ubuntu SELinux initscript before version 1:0.10 used touch to create a lockfile in a world-writable directory. If the OS kernel does not have symlink prote… |
CVE-2011-3147 | High | 8.6 | 2019-04-22 | Versions of nova before 2012.1 could expose hypervisor host files to a guest operating system when processing a maliciously constructed qcow filesystem. |
CVE-2011-3145 | Low | 3.8 | 2019-04-22 | When mount.ecrpytfs_private before version 87-0ubuntu1.2 calls setreuid() it doesn't also set the effective group id. So when it creates the new version, mtab… |
CVE-2011-1830 | Medium | 5.7 | 2019-04-22 | Ekiga versions before 3.3.0 attempted to load a module from /tmp/ekiga_test.so. |
CVE-2011-2767 | Critical | 9.8 | 2018-08-26 | mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentatio… |
CVE-2011-2765 | High | 7.5 | 2018-08-20 | pyro before 3.15 unsafely handles pid files in temporary directory locations and opening the pid file as root. An attacker can use this flaw to overwrite arbit… |
CVE-2011-4183 | Medium | 6.5 | 2018-06-13 | A vulnerability in open build service allows remote attackers to upload arbitrary RPM files. Affected releases are SUSE open build service prior to 2.1.16. |
CVE-2011-4182 | High | 7.3 | 2018-06-12 | Missing escaping of ESSID values in sysconfig of SUSE Linux Enterprise allows attackers controlling an access point to cause execute arbitrary code. Affected r… |
CVE-2011-4181 | High | 7.5 | 2018-06-11 | A vulnerability in open build service allows remote attackers to gain access to source files even though source access is disabled. Affected releases are SUSE… |
CVE-2011-4190 | Medium | 5.9 | 2018-06-08 | The kdump implementation is missing the host key verification in the kdump and mkdumprd OpenSSH integration of kdump prior to version 2012-01-20. This is simil… |
CVE-2011-3172 | Medium | 5.4 | 2018-06-08 | A vulnerability in pam_modules of SUSE Linux Enterprise allows attackers to log into accounts that should have been disabled. Affected releases are SUSE Linux… |
CVE-2011-0467 | High | 8.8 | 2018-06-07 | A vulnerability in the listing of available software of SUSE Studio Onsite, SUSE Studio Onsite 1.1 Appliance allows authenticated users to execute arbitrary SQ… |
CVE-2011-0704 | Medium | 5.9 | 2018-05-04 | 389 Directory Server 1.2.7.5, when built with mozldap, allows remote attackers to cause a denial of service (replica crash) by sending an empty modify request. |
CVE-2011-3178 | High | 8.1 | 2018-03-20 | In the web ui of the openbuildservice before 2.3.0 a code injection of the project rebuildtimes statistics could be used by authorized attackers to execute she… |
CVE-2011-3477 | Medium | 5.5 | 2018-02-19 | GEAR Software CD DVD Filter driver (aka GEARAspiWDM.sys), as used in Symantec Backup Exec System Recovery 8.5 and BESR 2010, Symantec System Recovery 2011, Nor… |
CVE-2011-4973 | Critical | 9.8 | 2018-02-15 | Authentication bypass vulnerability in mod_nss 1.0.8 allows remote attackers to assume the identity of a valid user by using their certificate and entering 'pa… |
CVE-2011-4889 | Critical | 9.8 | 2018-02-08 | The javax.naming.directory.AttributeInUseException class in the Virtual Member Manager in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.43, 7.0 befor… |
CVE-2011-4069 | Critical | 9.8 | 2018-02-01 | html/admin/login.php in PacketFence before 3.0.2 allows remote attackers to conduct LDAP injection attacks and consequently bypass authentication via a crafted… |
CVE-2011-4068 | Critical | 9.8 | 2018-02-01 | The check_password function in html/admin/login.php in PacketFence before 3.0.2 allows remote attackers to bypass authentication via an empty password. |
CVE-2011-2902 | Medium | 5.3 | 2018-01-30 | zxpdf in xpdf before 3.02-19 as packaged in Debian unstable and 3.02-12+squeeze1 as packaged in Debian squeeze deletes temporary files insecurely, which allows… |
CVE-2011-4955 | Medium | 6.1 | 2017-12-20 | Multiple cross-site scripting (XSS) vulnerabilities in ui_stats.php in the bSuite plugin before 5 alpha 3 for WordPress allow remote attackers to inject arbitr… |
CVE-2011-4334 | High | 8.8 | 2017-10-23 | edit.php in LabWiki 1.1 and earlier does not properly verify uploaded user files, which allows remote authenticated users to upload arbitrary PHP files via a P… |
CVE-2011-4333 | Medium | 6.1 | 2017-10-23 | Multiple cross-site scripting (XSS) vulnerabilities in LabWiki 1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) from p… |
CVE-2011-2684 | Medium | 5.5 | 2017-10-23 | foo2zjs before 20110722dfsg-3ubuntu1 as packaged in Ubuntu, 20110722dfsg-1 as packaged in Debian unstable, and 20090908dfsg-5.1+squeeze0 as packaged in Debian… |
CVE-2011-2683 | Medium | 5.9 | 2017-10-23 | reseed seeds random numbers from an insecure HTTP request to random.org during installation, which makes it easier for remote attackers to defeat cryptographic… |
CVE-2011-1935 | Critical | 9.8 | 2017-10-20 | pcap-linux.c in libpcap 1.1.1 before commit ea9432fabdf4b33cbc76d9437200e028f1c47c93 when snaplen is set may truncate packets, which might allow remote attacke… |
CVE-2011-5320 | Medium | 6.2 | 2017-10-18 | scanf and related functions in glibc before 2.15 allow local users to cause a denial of service (segmentation fault) via a large string of 0s. |
CVE-2011-4667 | Medium | 5.9 | 2017-09-25 | The encryption library in Cisco IOS Software 15.2(1)T, 15.2(1)T1, and 15.2(2)T, Cisco NX-OS in Cisco MDS 9222i Multiservice Modular Switch, Cisco MDS 9000 18/4… |
CVE-2011-3177 | High | 7.8 | 2017-09-08 | The YaST2 network created files with world readable permissions which could have allowed local users to read sensitive material out of network configuration fi… |
CVE-2011-0469 | Critical | 9.8 | 2017-08-17 | Code injection in openSUSE when running some source services used in the open build service 2.1 before March 11 2011. |
CVE-2011-4343 | High | 7.5 | 2017-08-08 | Information disclosure vulnerability in Apache MyFaces Core 2.0.1 through 2.0.10 and 2.1.0 through 2.1.4 allows remote attackers to inject EL expressions via c… |
CVE-2011-5325 | High | 7.5 | 2017-08-07 | Directory traversal vulnerability in the BusyBox implementation of tar before 1.22.0 v5 allows remote attackers to point to files outside the current working d… |
CVE-2011-4650 | High | 7.5 | 2017-08-07 | Cisco Data Center Network Manager is affected by Excessive Logging During a TCP Flood on Java Ports. If the size of server.log becomes very big because of too… |
CVE-2011-3438 | High | 8.8 | 2017-04-24 | WebKit, as used in Safari 5.0.6, allows remote attackers to cause a denial of service (process crash) or arbitrary code execution. |
CVE-2011-3428 | Critical | 9.8 | 2017-04-24 | Buffer overflow in QuickTime before 7.7.1 for Windows allows remote attackers to execute arbitrary code. |
CVE-2011-5326 | High | 7.5 | 2016-05-13 | imlib2 before 1.4.9 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) by drawing a 2x1 ellipse. |
CVE-2011-5321 | Medium | 5.5 | 2016-05-02 | The tty_open function in drivers/tty/tty_io.c in the Linux kernel before 3.1.1 mishandles a driver-lookup failure, which allows local users to cause a denial o… |
CVE-2011-4600 | Medium | 5.9 | 2016-04-14 | The networkReloadIptablesRules function in network/bridge_driver.c in libvirt before 0.9.9 does not properly handle firewall rules on bridge networks when libv… |
CVE-2011-5324 | | 2015-08-04 | The TeraRecon server, as used in GE Healthcare Centricity PACS-IW 3.7.3.7, 3.7.3.8, and possibly other versions, has a password of (1) shared for the shared us… | |
CVE-2011-5323 | | 2015-08-04 | GE Healthcare Centricity PACS-IW 3.7.3.7, 3.7.3.8, and possibly other versions has a password of A11enda1e for the sa SQL server user, which has unspecified im… | |
CVE-2011-5322 | | 2015-08-04 | GE Healthcare Centricity Analytics Server 1.1 has a default password of (1) V0yag3r for the SQL Server sa user, (2) G3car3s for the analyst user, (3) G3car3s f… | |
CVE-2011-4403 | | 2015-04-24 | Multiple cross-site request forgery (CSRF) vulnerabilities in Zen Cart 1.3.9h allow remote attackers to hijack the authentication of administrators for request… | |
CVE-2011-5319 | | 2015-03-09 | content/renderer/device_sensors/device_motion_event_pump.cc in Google Chrome before 41.0.2272.76 does not properly restrict access to high-rate accelerometer d… | |
CVE-2011-5318 | | 2015-01-01 | Multiple cross-site request forgery (CSRF) vulnerabilities in diafan.CMS before 5.1 allow remote attackers to hijack the authentication of administrators for r… | |
CVE-2011-5317 | | 2015-01-01 | Cross-site scripting (XSS) vulnerability in editText.php in WonderCMS before 0.4 allows remote attackers to inject arbitrary web script or HTML via the content… | |
CVE-2011-5316 | | 2015-01-01 | Cross-site request forgery (CSRF) vulnerability in admin/index.php in Cambio 0.5a nightly r37 allows remote attackers to hijack the authentication of administr… | |
CVE-2011-5315 | | 2015-01-01 | Cross-site request forgery (CSRF) vulnerability in admin/index.php in whCMS 0.115 alpha allows remote attackers to hijack the authentication of administrators… | |
CVE-2011-5314 | | 2015-01-01 | templates/default/index.php in Redaxscript 0.3.2 allows remote attackers to obtain sensitive information via a direct request, which reveals the full path in a… | |
CVE-2011-5313 | | 2015-01-01 | Multiple SQL injection vulnerabilities in includes/password.php in Redaxscript 0.3.2 allow remote attackers to execute arbitrary SQL commands via the (1) id or… | |
CVE-2011-5312 | | 2015-01-01 | Multiple cross-site scripting (XSS) vulnerabilities in Gollos 2.8 allow remote attackers to inject arbitrary web script or HTML via the returnurl parameter to… | |
CVE-2011-5311 | | 2015-01-01 | Cross-site request forgery (CSRF) vulnerability in pages.php in Wikipad 1.6.0 allows remote attackers to hijack the authentication of administrators for reques… | |
CVE-2011-5310 | | 2015-01-01 | Directory traversal vulnerability in pages.php in Wikipad 1.6.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the id parameter. | |
CVE-2011-5309 | | 2015-01-01 | Cross-site scripting (XSS) vulnerability in pages.php in Wikipad 1.6.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter. | |
CVE-2011-5308 | | 2015-01-01 | Multiple SQL injection vulnerabilities in cdnvote-post.php in the cdnvote plugin before 0.4.2 for WordPress allow remote attackers to execute arbitrary SQL com… | |
CVE-2011-5307 | | 2015-01-01 | Cross-site scripting (XSS) vulnerability in index.php in the PhotoSmash plugin 1.0.1 for WordPress allows remote attackers to inject arbitrary web script or HT… | |
CVE-2011-5306 | | 2015-01-01 | Cross-site request forgery (CSRF) vulnerability in cgi-bin/admin/setup_edit.cgi in CosmoShop ePRO 10.05.00 allows remote attackers to hijack the authentication… | |
CVE-2011-5305 | | 2015-01-01 | Multiple cross-site scripting (XSS) vulnerabilities in CosmoShop ePRO 10.05.00 allow remote attackers to inject arbitrary web script or HTML via (1) the rcopy… | |
CVE-2011-5304 | | 2015-01-01 | Multiple cross-site scripting (XSS) vulnerabilities in the Sodahead Polls plugin before 2.0.4 for WordPress allow remote attackers to inject arbitrary web scri… | |
CVE-2011-5303 | | 2015-01-01 | Cross-site scripting (XSS) vulnerability in Spitfire CMS 1.0.436 allows remote attackers to inject arbitrary web script or HTML via a cms_username cookie. | |
CVE-2011-5302 | | 2015-01-01 | Cross-site request forgery (CSRF) vulnerability in adm/admin_edit.php in PHPDug 2.0.0 allows remote attackers to hijack the authentication of administrators fo… | |
CVE-2011-5301 | | 2015-01-01 | Multiple cross-site scripting (XSS) vulnerabilities in PHPDug 2.0.0 allow remote attackers to inject arbitrary web script or HTML via (1) the story_url paramet… | |
CVE-2011-5300 | | 2015-01-01 | Cross-site request forgery (CSRF) vulnerability in admin/setup/config/users.php in poMMo Aardvark PR16.1 allows remote attackers to hijack the authentication o… | |
CVE-2011-5299 | | 2015-01-01 | Multiple cross-site scripting (XSS) vulnerabilities in poMMo Aardvark PR16.1 allow remote attackers to inject arbitrary web script or HTML via (1) the referer… | |
CVE-2011-5298 | | 2015-01-01 | Multiple cross-site request forgery (CSRF) vulnerabilities in Argyle Social 2011-04-26 allow remote attackers to hijack the authentication of administrators fo… |