New vulnerabilities from the NVD: CVE-2011-4924 | | Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3, 3.1.1 through 3.4.1. allows remote attackers to inject arbitrary web script or HTML via vectors related to the way error messages perform sanitization. NOTE: this issue exists because of an incomplete fix for CVE-2010-1104 Published at: November 25, 2019 at 08:15PM View on website November 25, 2019 at 10:46PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2011-2924 (debian_linux, fedora, foomatic-filters) | | foomatic-rip filter v4.0.12 and prior used insecurely creates temporary files for storage of PostScript data by rendering the data when the debug mode was enabled. This flaw may be exploited by a local attacker to conduct symlink attacks by overwriting arbitrary files accessible with the privileges of the user running the foomatic-rip universal print filter. Published at: November 20, 2019 at 12:15AM View on website November 25, 2019 at 10:46PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2011-2923 (debian_linux, foomatic-filters) | | foomatic-rip filter, all versions, used insecurely creates temporary files for storage of PostScript data by rendering the data when the debug mode was enabled. This flaw may be exploited by a local attacker to conduct symlink attacks by overwriting arbitrary files accessible with the privileges of the user running the foomatic-rip universal print filter. Published at: November 19, 2019 at 11:15PM View on website November 25, 2019 at 10:46PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2011-3351 | | openvas-scanner before 2011-09-11 creates a temporary file insecurely when generating OVAL system characteristics document with the ovaldi integrated tool enabled. A local attacker could use this flaw to conduct symlink attacks to overwrite arbitrary files on the system. Published at: November 26, 2019 at 12:15AM View on website November 26, 2019 at 02:46AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2011-3596 | | Polipo before 1.0.4.1 suffers from a DoD vulnerability via specially-crafted HTTP POST / PUT request. Published at: November 26, 2019 at 02:15AM View on website November 26, 2019 at 04:46AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2011-3584 | | The TYPO3 Core wec_discussion extension before 2.1.1 is vulnerable to SQL Injection due to improper sanitation of user-supplied input. Published at: November 26, 2019 at 02:15AM View on website November 26, 2019 at 04:46AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2011-3583 | | It was found that Typo3 Core versions 4.5.0 - 4.5.5 uses prepared statements that, if the parameter values are not properly replaced, could lead to a SQL Injection vulnerability. This issue can only be exploited if two or more parameters are bound to the query and at least two come from user input. Published at: November 26, 2019 at 02:15AM View on website November 26, 2019 at 04:46AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2011-3374 | | It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack. Published at: November 26, 2019 at 02:15AM View on website November 26, 2019 at 04:46AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2011-3373 | | Drupal Views Builk Operations (VBO) module 6.x-1.0 through 6.x-1.10 does not properly escape the vocabulary help when the vocabulary has had user tagging enabled and the "Modify node taxonomy terms" action is used. A remote attacker could provide a specially-crafted URL that could lead to cross-site scripting (XSS) attack. Published at: November 26, 2019 at 01:15AM View on website November 26, 2019 at 04:46AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2011-3355 | | evolution-data-server3 3.0.3 through 3.2.1 used insecure (non-SSL) connection when attempting to store sent email messages into the Sent folder, when the Sent folder was located on the remote server. An attacker could use this flaw to obtain login credentials of the victim. Published at: November 26, 2019 at 01:15AM View on website November 26, 2019 at 04:46AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2011-4090 | | Serendipity before 1.6 has an XSS issue in the karma plugin which may allow privilege escalation. Published at: November 26, 2019 at 07:15AM View on website November 26, 2019 at 08:46AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2011-4082 | | A local file inclusion flaw was found in the way the phpLDAPadmin before 0.9.8 processed certain values of the "Accept-Language" HTTP header. A remote attacker could use this flaw to cause a denial of service via specially-crafted request. Published at: November 26, 2019 at 07:15AM View on website November 26, 2019 at 08:46AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2011-4076 | | OpenStack Nova before 2012.1 allows someone with access to an EC2_ACCESS_KEY (equivalent to a username) to obtain the EC2_SECRET_KEY (equivalent to a password). Exposing the EC2_ACCESS_KEY via http or tools that allow man-in-the-middle over https could allow an attacker to easily obtain the EC2_SECRET_KEY. An attacker could also presumably brute force values for EC2_ACCESS_KEY. Published at: November 26, 2019 at 06:15AM View on website November 26, 2019 at 08:46AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2011-3632 | | Hardlink before 0.1.2 operates on full file system objects path names which can allow a local attacker to use this flaw to conduct symlink attacks. Published at: November 26, 2019 at 06:15AM View on website November 26, 2019 at 08:46AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2011-3631 | | Hardlink before 0.1.2 has multiple integer overflows leading to heap-based buffer overflows because of the way string lengths concatenation is done in the calculation of the required memory space to be used. A remote attacker could provide a specially-crafted directory tree and trick the local user into consolidating it, leading to hardlink executable crash or potentially arbitrary code execution with user privileges. Published at: November 26, 2019 at 06:15AM View on website November 26, 2019 at 08:46AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2011-3630 | | Hardlink before 0.1.2 suffer from multiple stack-based buffer overflow flaws because of the way directory trees with deeply nested directories are processed. A remote attacker could provide a specially-crafted directory tree, and trick the local user into consolidating it, leading to hardlink executable crash, or, potentially arbitrary code execution with the privileges of the user running the hardlink executable. Published at: November 26, 2019 at 06:15AM View on website November 26, 2019 at 08:46AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2011-3624 | | Various methods in WEBrick::HTTPRequest in Ruby 1.9.2 and 1.8.7 and earlier do not validate the X-Forwarded-For, X-Forwarded-Host and X-Forwarded-Server headers in requests, which might allow remote attackers to inject arbitrary text into log files or bypass intended address parsing via a crafted header. Published at: November 26, 2019 at 05:15AM View on website November 26, 2019 at 08:46AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2011-3617 | | Tahoe-LAFS v1.3.0 through v1.8.2 could allow unauthorized users to delete immutable files in some cases. Published at: November 26, 2019 at 05:15AM View on website November 26, 2019 at 08:46AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2011-3609 | | A CSRF issue was found in JBoss Application Server 7 before 7.1.0. JBoss did not properly restrict access to the management console information (for example via the "Access-Control-Allow-Origin" HTTP access control flag). This can lead to unauthorized information leak if a user with admin privileges visits a specially-crafted web page provided by a remote attacker. Published at: November 26, 2019 at 05:15AM View on website November 26, 2019 at 08:46AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2011-3606 | | A DOM based cross-site scripting flaw was found in the JBoss Application Server 7 before 7.1.0 Beta 1 administration console. A remote attacker could provide a specially-crafted web page and trick the valid JBoss AS user, with the administrator privilege, to visit it, which would lead into the DOM environment modification and arbitrary HTML or web script execution. Published at: November 26, 2019 at 04:15AM View on website November 26, 2019 at 08:46AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2011-3600 | | The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it can also be used to probe for open network ports, and figure out from returned error messages whether a file exists or not. This affects OFBiz 16.11.01 to 16.11.04. Published at: November 26, 2019 at 03:15AM View on website November 26, 2019 at 08:46AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2011-1939 | | SQL injection vulnerability in Zend Framework 1.10.x before 1.10.9 and 1.11.x before 1.11.6 when using non-ASCII-compatible encodings in conjunction PDO_MySql in PHP before 5.3.6. Published at: November 27, 2019 at 12:15AM View on website November 27, 2019 at 02:46AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2011-1934 | | |
New vulnerabilities from the NVD: CVE-2011-1933 | | |
New vulnerabilities from the NVD: CVE-2011-2187 | | xscreensaver before 5.14 crashes during activation and leaves the screen unlocked when in Blank Only Mode and when DPMS is disabled, which allows local attackers to access resources without authentication. Published at: November 27, 2019 at 08:15PM View on website November 27, 2019 at 10:46PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2011-2177 | | OpenOffice.org v3.3 allows execution of arbitrary code with the privileges of the user running the OpenOffice.org suite tools. Published at: November 27, 2019 at 07:15PM View on website November 27, 2019 at 10:46PM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2011-2480 | | Information Disclosure vulnerability in the 802.11 stack, as used in FreeBSD before 8.2 and NetBSD when using certain non-x86 architectures. A signedness error in the IEEE80211_IOC_CHANINFO ioctl allows a local unprivileged user to cause the kernel to copy large amounts of kernel memory back to the user, disclosing potentially sensitive information. Published at: November 27, 2019 at 09:15PM View on website November 28, 2019 at 12:46AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2011-2207 | | dirmngr before 2.1.0 improperly handles certain system calls, which allows remote attackers to cause a denial of service (DOS) via a specially-crafted certificate. Published at: November 27, 2019 at 09:15PM View on website November 28, 2019 at 12:46AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2011-2717 | | The DHCPv6 client (dhcp6c) as used in the dhcpv6 project through 2011-07-25 allows remote DHCP servers to execute arbitrary commands via shell metacharacters in a hostname obtained from a DHCP message. Published at: November 27, 2019 at 11:15PM View on website November 28, 2019 at 02:46AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2011-2523 | | vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp. Published at: November 27, 2019 at 11:15PM View on website November 28, 2019 at 02:46AM via National Vulnerability Database |
New vulnerabilities from the NVD: CVE-2011-2515 | | PackageKit 0.6.17 allows installation of unsigned RPM packages as though they were signed which may allow installation of non-trusted packages and execution of arbitrary code. Published at: November 27, 2019 at 11:15PM View on website November 28, 2019 at 02:46AM via National Vulnerability Database |
Няма коментари:
Публикуване на коментар