CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 6 and 6.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
11401 CVE-2011-0213 119 DoS Exec Code Overflow 2011-06-24 2011-08-10
6.8
None Remote Medium Not required Partial Partial Partial
Buffer overflow in QuickTime in Apple Mac OS X before 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted JPEG file.
11402 CVE-2011-0212 399 DoS 2011-06-24 2011-10-26
6.4
None Remote Low Not required Partial None Partial
servermgrd in Apple Mac OS X before 10.6.8 allows remote attackers to read arbitrary files, and possibly send HTTP requests to intranet servers or cause a denial of service (CPU and memory consumption), via an XML-RPC request containing an entity declaration in conjunction with an entity reference, related to an XML External Entity (aka XXE) issue.
11403 CVE-2011-0211 189 DoS Exec Code Overflow 2011-06-24 2011-08-10
6.8
None Remote Medium Not required Partial Partial Partial
Integer overflow in QuickTime in Apple Mac OS X before 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file.
11404 CVE-2011-0210 119 DoS Exec Code Overflow Mem. Corr. 2011-06-24 2011-10-26
6.8
None Remote Medium Not required Partial Partial Partial
QuickTime in Apple Mac OS X before 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted sample tables in a movie file.
11405 CVE-2011-0209 189 DoS Exec Code Overflow 2011-06-24 2011-08-10
6.8
None Remote Medium Not required Partial Partial Partial
Integer overflow in QuickTime in Apple Mac OS X before 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted RIFF WAV file.
11406 CVE-2011-0208 119 DoS Exec Code Overflow Mem. Corr. 2011-06-24 2011-10-20
6.8
None Remote Medium Not required Partial Partial Partial
QuickLook in Apple Mac OS X 10.6 before 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Microsoft Office document.
11407 CVE-2011-0205 119 DoS Exec Code Overflow 2011-06-24 2011-10-26
6.8
None Remote Medium Not required Partial Partial Partial
Heap-based buffer overflow in ImageIO in Apple Mac OS X before 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted JPEG2000 image.
11408 CVE-2011-0204 119 DoS Exec Code Overflow 2011-06-24 2011-11-23
6.8
None Remote Medium Not required Partial Partial Partial
Heap-based buffer overflow in ImageIO in Apple Mac OS X before 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TIFF image.
11409 CVE-2011-0202 189 DoS Exec Code Overflow 2011-06-24 2011-07-22
6.8
None Remote Medium Not required Partial Partial Partial
Integer overflow in CoreGraphics in Apple Mac OS X before 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted embedded Type 1 font in a PDF document.
11410 CVE-2011-0200 189 DoS Exec Code Overflow 2011-06-24 2012-02-03
6.8
None Remote Medium Not required Partial Partial Partial
Integer overflow in ColorSync in Apple Mac OS X before 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an image containing a crafted embedded ColorSync profile that triggers a heap-based buffer overflow.
11411 CVE-2011-0198 119 Exec Code Overflow 2011-06-24 2011-10-26
6.8
None Remote Medium Not required Partial Partial Partial
Heap-based buffer overflow in Apple Type Services (ATS) in Apple Mac OS X before 10.6.8 allows remote attackers to execute arbitrary code via a crafted embedded TrueType font.
11412 CVE-2011-0194 189 DoS Exec Code Overflow 2011-03-22 2011-03-23
6.8
None Remote Medium Not required Partial Partial Partial
Integer overflow in ImageIO in Apple Mac OS X 10.6 before 10.6.7 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TIFF image with JPEG encoding.
11413 CVE-2011-0193 119 DoS Exec Code Overflow 2011-03-22 2011-03-23
6.8
None Remote Medium Not required Partial Partial Partial
Multiple buffer overflows in Image RAW in Apple Mac OS X before 10.6.7 allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Canon RAW image.
11414 CVE-2011-0188 189 DoS Exec Code 2011-03-22 2011-08-23
6.8
None Remote Medium Not required Partial Partial Partial
The VpMemAlloc function in bigdecimal.c in the BigDecimal class in Ruby 1.9.2-p136 and earlier, as used on Apple Mac OS X before 10.6.7 and other platforms, does not properly allocate memory, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving creation of a large BigDecimal value within a 64-bit process, related to an "integer truncation issue."
11415 CVE-2011-0186 119 DoS Exec Code Overflow Mem. Corr. 2011-03-22 2011-08-10
6.8
None Remote Medium Not required Partial Partial Partial
QuickTime in Apple Mac OS X before 10.6.7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted JPEG2000 image.
11416 CVE-2011-0184 119 DoS Exec Code Overflow Mem. Corr. 2011-03-22 2011-10-20
6.8
None Remote Medium Not required Partial Partial Partial
QuickLook in Apple Mac OS X 10.6 before 10.6.7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via an Excel spreadsheet with a crafted formula that uses unspecified opcodes.
11417 CVE-2011-0181 189 DoS Exec Code Overflow 2011-03-22 2011-06-27
6.8
None Remote Medium Not required Partial Partial Partial
Integer overflow in ImageIO in Apple Mac OS X before 10.6.7 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted XBM image.
11418 CVE-2011-0179 119 DoS Exec Code Overflow Mem. Corr. 2011-03-22 2011-03-24
6.8
None Remote Medium Not required Partial Partial Partial
CoreText in Apple Mac OS X before 10.6.7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a document that contains a crafted embedded font.
11419 CVE-2011-0177 119 Exec Code Overflow 2011-03-22 2011-03-24
6.8
None Remote Medium Not required Partial Partial Partial
Multiple buffer overflows in Apple Type Services (ATS) in Apple Mac OS X before 10.6.7 allow remote attackers to execute arbitrary code via a document that contains a crafted SFNT table in an embedded font.
11420 CVE-2011-0176 119 Exec Code Overflow 2011-03-22 2011-03-24
6.8
None Remote Medium Not required Partial Partial Partial
Multiple buffer overflows in Apple Type Services (ATS) in Apple Mac OS X before 10.6.7 allow remote attackers to execute arbitrary code via a document that contains a crafted embedded Type 1 font.
11421 CVE-2011-0175 119 Exec Code Overflow 2011-03-22 2011-03-24
6.8
None Remote Medium Not required Partial Partial Partial
Multiple buffer overflows in Apple Type Services (ATS) in Apple Mac OS X before 10.6.7 allow remote attackers to execute arbitrary code via a document that contains a crafted embedded TrueType font.
11422 CVE-2011-0174 119 Exec Code Overflow 2011-03-22 2011-03-24
6.8
None Remote Medium Not required Partial Partial Partial
Heap-based buffer overflow in Apple Type Services (ATS) in Apple Mac OS X before 10.6.7 allows remote attackers to execute arbitrary code via a document that contains a crafted embedded OpenType font.
11423 CVE-2011-0173 134 DoS Exec Code 2011-03-22 2011-03-24
6.8
None Remote Medium Not required Partial Partial Partial
Multiple format string vulnerabilities in AppleScript in Apple Mac OS X before 10.6.7 allow context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via format string specifiers in a (1) display dialog or (2) display alert command in a dialog in an AppleScript Studio application.
11424 CVE-2011-0091 287 +Info 2011-02-10 2018-10-30
6.4
None Remote Low Not required Partial Partial None
Kerberos in Microsoft Windows Server 2008 R2 and Windows 7 does not prevent a session from changing from strong encryption to DES encryption, which allows man-in-the-middle attackers to spoof network traffic and obtain sensitive information via a DES downgrade, aka "Kerberos Spoofing Vulnerability."
11425 CVE-2011-0064 DoS Exec Code 2011-03-07 2017-08-16
6.8
None Remote Medium Not required Partial Partial Partial
The hb_buffer_ensure function in hb-buffer.c in HarfBuzz, as used in Pango 1.28.3, Firefox, and other products, does not verify that memory reallocations succeed, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly execute arbitrary code via crafted OpenType font data that triggers use of an incorrect index.
11426 CVE-2011-0059 352 CSRF 2011-03-02 2017-09-18
6.8
None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12, allows remote attackers to hijack the authentication of arbitrary users for requests that were initiated by a plugin and received a 307 redirect to a page on a different web site.
11427 CVE-2011-0051 20 2011-03-02 2017-09-18
6.8
None Remote Medium Not required Partial Partial Partial
Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12, does not properly handle certain recursive eval calls, which makes it easier for remote attackers to force a user to respond positively to a dialog question, as demonstrated by a question about granting privileges.
11428 CVE-2011-0046 352 CSRF 2011-01-28 2017-08-16
6.8
None Remote Medium Not required Partial Partial Partial
Multiple cross-site request forgery (CSRF) vulnerabilities in Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 allow remote attackers to hijack the authentication of arbitrary users for requests related to (1) adding a saved search in buglist.cgi, (2) voting in votes.cgi, (3) sanity checking in sanitycheck.cgi, (4) creating or editing a chart in chart.cgi, (5) column changing in colchange.cgi, and (6) adding, deleting, or approving a quip in quips.cgi.
11429 CVE-2011-0025 20 2011-02-04 2017-08-16
6.8
None Remote Medium Not required Partial Partial Partial
IcedTea 1.7 before 1.7.8, 1.8 before 1.8.5, and 1.9 before 1.9.5 does not properly verify signatures for JAR files that (1) are "partially signed" or (2) signed by multiple entities, which allows remote attackers to trick users into executing code that appears to come from a trusted source.
11430 CVE-2011-0017 20 2011-02-01 2017-08-16
6.9
None Local Medium Not required Complete Complete Complete
The open_log function in log.c in Exim 4.72 and earlier does not check the return value from (1) setuid or (2) setgid system calls, which allows local users to append log data to arbitrary files via a symlink attack.
11431 CVE-2011-0008 +Priv 2011-01-20 2017-08-16
6.9
Admin Local Medium Not required Complete Complete Complete
A certain Fedora patch for parse.c in sudo before 1.7.4p5-1.fc14 on Fedora 14 does not properly interpret a system group (aka %group) in the sudoers file during authorization decisions for a user who belongs to that group, which allows local users to leverage an applicable sudoers file and gain root privileges via a sudo command. NOTE: this vulnerability exists because of a CVE-2009-0034 regression.
11432 CVE-2011-0002 310 2011-01-22 2017-08-16
6.4
None Remote Low Not required Partial Partial None
libuser before 0.57 uses a cleartext password value of (1) !! or (2) x for new LDAP user accounts, which makes it easier for remote attackers to obtain access by specifying one of these values.
11433 CVE-2010-5327 264 Exec Code 2017-01-13 2017-01-17
6.5
None Remote Low Single system Partial Partial Partial
Liferay Portal through 6.2.10 allows remote authenticated users to execute arbitrary shell commands via a crafted Velocity template.
11434 CVE-2010-5320 352 CSRF 2015-01-03 2015-01-05
6.8
None Remote Medium Not required Partial Partial Partial
Multiple cross-site request forgery (CSRF) vulnerabilities in MemHT Portal 4.0.1 allow remote attackers to hijack the authentication of administrators for requests that (1) modify settings via a configuration action to admin.php, (2) modify articles via an articles action to admin.php, or (3) modify credentials via a users action to admin.php.
11435 CVE-2010-5319 352 CSRF 2015-01-03 2015-01-05
6.8
None Remote Medium Not required Partial Partial Partial
Multiple cross-site request forgery (CSRF) vulnerabilities in Kandidat CMS 1.4.2 allow remote attackers to hijack the authentication of administrators for requests that (1) modify settings via a validate action to admin/settings.php, (2) modify pages via the what parameter to admin/edit.php, or (3) modify articles via the edit parameter to admin/news.php.
11436 CVE-2010-5315 352 CSRF 2015-01-03 2015-01-05
6.8
None Remote Medium Not required Partial Partial Partial
Multiple cross-site request forgery (CSRF) vulnerabilities in BEdita before 3.1 allow remote attackers to hijack the authentication of administrators for requests that (1) create categories via a data array to news/saveCategories or (2) modify credentials via a data array to admin/saveUser.
11437 CVE-2010-5300 119 1 DoS Exec Code Overflow 2014-06-11 2014-06-12
6.8
None Remote Medium Not required Partial Partial Partial
Stack-based buffer overflow in Jzip 1.3 through 2.0.0.132900 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long file name in a zip archive.
11438 CVE-2010-5299 119 3 Exec Code Overflow 2014-05-22 2014-06-30
6.8
None Remote Medium Not required Partial Partial Partial
Stack-based buffer overflow in MicroP 0.1.1.1600 allows remote attackers to execute arbitrary code via a crafted .mppl file. NOTE: it has been reported that the overflow is in the lpFileName parameter of the CreateFileA function, but the overflow is probably caused by a separate, unnamed function.
11439 CVE-2010-5291 264 2014-01-10 2014-01-10
6.4
None Remote Low Not required Partial Partial None
Amberdms Billing System (ABS) before 1.4.1 does not properly implement blacklisting after detection of invalid login attempts, which makes it easier for remote attackers to obtain access via a brute-force approach.
11440 CVE-2010-5285 352 2 CSRF 2012-11-26 2012-11-28
6.8
None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in admin.php in Collabtive 0.6.5 allows remote attackers to hijack the authentication of administrators for requests that add administrative users via the edituser action.
11441 CVE-2010-5283 352 1 CSRF 2012-11-26 2017-08-28
6.8
None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in OpenText ECM (formerly Livelink ECM) 9.7.1 allows remote attackers to hijack the authentication of administrators for requests that change folder and resource permissions.
11442 CVE-2010-5281 22 1 Dir. Trav. 2012-11-26 2017-08-28
6.8
None Remote Medium Not required Partial Partial Partial
Directory traversal vulnerability in ibrowser.php in the CMScout 2.09 IBrowser TinyMCE Plugin 1.4.1, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the lang parameter. NOTE: some of these details are obtained from third party information.
11443 CVE-2010-5274 +Priv 2012-09-07 2012-09-07
6.9
None Local Medium Not required Complete Complete Complete
Untrusted search path vulnerability in PKZIP before 12.50.0014 allows local users to gain privileges via a Trojan horse dwmapi.dll file in the current working directory, as demonstrated by a directory that contains a .zip file. NOTE: some of these details are obtained from third party information.
11444 CVE-2010-5273 +Priv 2012-09-07 2013-01-04
6.9
None Local Medium Not required Complete Complete Complete
Untrusted search path vulnerability in Altova DiffDog 2011 Enterprise Edition SP1 allows local users to gain privileges via a Trojan horse dwmapi.dll file in the current working directory, as demonstrated by a directory that contains a .dbdif file. NOTE: some of these details are obtained from third party information.
11445 CVE-2010-5272 +Priv 2012-09-07 2012-09-07
6.9
None Local Medium Not required Complete Complete Complete
Untrusted search path vulnerability in Altova DatabaseSpy 2011 Enterprise Edition SP1 allows local users to gain privileges via a Trojan horse dwmapi.dll file in the current working directory, as demonstrated by a directory that contains a .qprj file. NOTE: some of these details are obtained from third party information.
11446 CVE-2010-5271 +Priv 2012-09-07 2012-09-07
6.9
None Local Medium Not required Complete Complete Complete
Untrusted search path vulnerability in Altova MapForce 2011 Enterprise Edition SP1 allows local users to gain privileges via a Trojan horse dwmapi.dll file in the current working directory, as demonstrated by a directory that contains a .mfd file. NOTE: some of these details are obtained from third party information.
11447 CVE-2010-5270 +Priv 2012-09-07 2012-09-07
6.9
None Local Medium Not required Complete Complete Complete
Multiple untrusted search path vulnerabilities in Adobe Device Central CS4 2.0.0 0476 allow local users to gain privileges via a Trojan horse (1) ibfs32.dll or (2) amt_cdb.dll file in the current working directory, as demonstrated by a directory that contains a .adcp file. NOTE: some of these details are obtained from third party information.
11448 CVE-2010-5269 +Priv 2012-09-07 2012-09-10
6.9
None Local Medium Not required Complete Complete Complete
Untrusted search path vulnerability in tbb.dll in Intel Threading Building Blocks (TBB) 2.2.013 allows local users to gain privileges via a Trojan horse tbbmalloc.dll file in the current working directory, as demonstrated by a directory that contains a .pbk file. NOTE: some of these details are obtained from third party information.
11449 CVE-2010-5268 +Priv 2012-09-07 2012-09-10
6.9
None Local Medium Not required Complete Complete Complete
Untrusted search path vulnerability in Amazon Kindle for PC 1.3.0 30884 allows local users to gain privileges via a Trojan horse wintab32.dll file in the current working directory, as demonstrated by a directory that contains a .azw file. NOTE: some of these details are obtained from third party information.
11450 CVE-2010-5267 1 +Priv 2012-09-07 2012-09-07
6.9
None Local Medium Not required Complete Complete Complete
Untrusted search path vulnerability in MunSoft Easy Office Recovery 1.1 allows local users to gain privileges via a Trojan horse dwmapi.dll file in the current working directory, as demonstrated by a directory that contains a .doc, .xls, or .ppt file. NOTE: some of these details are obtained from third party information.
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.