CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 9 and 10)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
8701 CVE-2011-4220 264 DoS Exec Code 2011-11-01 2012-03-07
9.3
None Remote Medium Not required Complete Complete Complete
Investintech.com SlimPDF Reader does not properly restrict the arguments to unspecified function calls, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document.
8702 CVE-2011-4219 399 DoS Exec Code 2011-11-01 2017-08-28
9.3
None Remote Medium Not required Complete Complete Complete
Investintech.com SlimPDF Reader does not prevent faulting-address data from affecting branch selection, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document.
8703 CVE-2011-4218 399 DoS Exec Code 2011-11-01 2017-08-28
9.3
None Remote Medium Not required Complete Complete Complete
Investintech.com SlimPDF Reader does not prevent faulting-instruction data from affecting write operations, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document.
8704 CVE-2011-4217 264 DoS Exec Code 2011-11-01 2012-02-29
9.3
None Remote Medium Not required Complete Complete Complete
Investintech.com SlimPDF Reader does not properly restrict read operations during block data moves, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document.
8705 CVE-2011-4216 264 DoS Exec Code 2011-11-01 2017-08-28
9.3
None Remote Medium Not required Complete Complete Complete
Investintech.com SlimPDF Reader does not properly restrict write operations, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document.
8706 CVE-2011-4214 287 Bypass +Info 2011-11-01 2011-11-02
10.0
None Remote Low Not required Complete Complete Complete
OneOrZero Action & Information Management System (AIMS) 2.7.0 allows remote attackers to bypass authentication and obtain administrator privileges via a crafted oozimsrememberme cookie.
8707 CVE-2011-4201 94 Exec Code 2011-12-13 2011-12-13
9.3
Admin Remote Medium Not required Complete Complete Complete
remote_support.cgi in the Tadasoft Restorepoint 3.2 evaluation image allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) pid1 or (2) pid2 parameter in a stop_remote_support action.
8708 CVE-2011-4187 119 Exec Code Overflow 2012-02-21 2012-02-24
10.0
None Remote Low Not required Complete Complete Complete
Buffer overflow in the GetDriverSettings function in nipplib.dll in Novell iPrint Client before 5.78 on Windows allows remote attackers to execute arbitrary code via a long realm field, a different vulnerability than CVE-2011-3173.
8709 CVE-2011-4186 119 Exec Code Overflow 2012-02-21 2012-02-22
9.3
None Remote Medium Not required Complete Complete Complete
Heap-based buffer overflow in nipplib.dll in Novell iPrint Client before 5.78 on Windows allows remote attackers to execute arbitrary code via a crafted client-file-name parameter in a printer-url, a different vulnerability than CVE-2011-1705.
8710 CVE-2011-4185 119 DoS Exec Code Overflow Mem. Corr. 2012-02-21 2012-02-22
10.0
None Remote Low Not required Complete Complete Complete
The GetPrinterURLList2 method in the ActiveX control in Novell iPrint Client before 5.78 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2008-2431 and CVE-2008-2436.
8711 CVE-2011-4165 Exec Code 2011-12-29 2012-02-01
10.0
None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in HP Database Archiving Software 6.31 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1263.
8712 CVE-2011-4164 Exec Code 2011-12-29 2012-02-01
10.0
None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in HP Database Archiving Software 6.31 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1214.
8713 CVE-2011-4163 Exec Code 2011-12-29 2012-02-01
10.0
None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in HP Database Archiving Software 6.31 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1213.
8714 CVE-2011-4161 264 Exec Code 2011-12-01 2012-09-17
10.0
None Remote Low Not required Complete Complete Complete
The default configuration of the HP CM8060 Color MFP with Edgeline; Color LaserJet 3xxx, 4xxx, 5550, 9500, CMxxxx, CPxxxx, and Enterprise CPxxxx; Digital Sender 9200c and 9250c; LaserJet 4xxx, 5200, 90xx, Mxxxx, and Pxxxx; and LaserJet Enterprise 500 color M551, 600, M4555 MFP, and P3015 enables the Remote Firmware Update (RFU) setting, which allows remote attackers to execute arbitrary code by using a session on TCP port 9100 to upload a crafted firmware update.
8715 CVE-2011-4157 119 Exec Code Overflow 2011-11-16 2017-08-28
10.0
None Remote Low Not required Complete Complete Complete
Stack-based buffer overflow in hydra.exe in HP SAN/iQ before 9.5 on the HP StorageWorks P4000 Virtual SAN Appliance allows remote attackers to execute arbitrary code via a crafted login request.
8716 CVE-2011-4141 +Priv 2011-12-16 2017-08-28
9.3
None Remote Medium Not required Complete Complete Complete
Untrusted search path vulnerability in EMC RSA SecurID Software Token 4.1 before 4.1.1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a Software Token file.
8717 CVE-2011-4135 22 Exec Code Dir. Trav. 2012-01-19 2012-01-23
10.0
None Remote Low Not required Complete Complete Complete
Multiple directory traversal vulnerabilities in lmgrd in Flexera FlexNet Publisher 11.10 (aka FlexNet License Server Manager) allow remote attackers to execute arbitrary code via vectors related to save, rename, and load operations on log files. NOTE: this might overlap CVE-2011-1389.
8718 CVE-2011-4134 119 Exec Code Overflow 2012-01-19 2012-01-20
10.0
None Remote Low Not required Complete Complete Complete
Heap-based buffer overflow in lmadmin in Flexera FlexNet Publisher 11.10 (aka FlexNet License Server Manager) allows remote attackers to execute arbitrary code via a crafted 0x2f packet.
8719 CVE-2011-4130 399 Exec Code 2011-12-06 2011-12-08
9.0
None Remote Low Single system Complete Complete Complete
Use-after-free vulnerability in the Response API in ProFTPD before 1.3.3g allows remote authenticated users to execute arbitrary code via vectors involving an error that occurs after an FTP data transfer.
8720 CVE-2011-4109 399 2012-01-05 2017-08-28
9.3
None Remote Medium Not required Complete Complete Complete
Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, when X509_V_FLAG_POLICY_CHECK is enabled, allows remote attackers to have an unspecified impact by triggering failure of a policy check.
8721 CVE-2011-4055 119 Exec Code Overflow 2012-01-07 2017-08-28
9.3
None Remote Medium Not required Complete Complete Complete
Buffer overflow in the WebClient ActiveX control in Siemens Tecnomatix FactoryLink 6.6.1 (aka 6.6 SP1), 7.5.217 (aka 7.5 SP2), and 8.0.2.54 allows remote attackers to execute arbitrary code via a long string in a parameter associated with the location URL.
8722 CVE-2011-4053 +Priv 2012-01-19 2012-01-23
9.3
None Remote Medium Not required Complete Complete Complete
Untrusted search path vulnerability in 7-Technologies (7T) Interactive Graphical SCADA System (IGSS) before 9.0.0.11291 allows local users to gain privileges via a Trojan horse DLL in the current working directory.
8723 CVE-2011-4052 119 Exec Code Overflow 2011-12-05 2011-12-22
9.3
None Remote Medium Not required Complete Complete Complete
Stack-based buffer overflow in CEServer.exe in the CEServer component in the Remote Agent module in InduSoft Web Studio 6.1 and 7.0 allows remote attackers to execute arbitrary code via a crafted 0x15 (aka Remove File) operation for a file with a long name.
8724 CVE-2011-4051 287 Exec Code 2011-12-05 2011-12-08
10.0
None Remote Low Not required Complete Complete Complete
CEServer.exe in the CEServer component in the Remote Agent module in InduSoft Web Studio 6.1 and 7.0 does not require authentication, which allows remote attackers to execute arbitrary code via vectors related to creation of a file, loading a DLL, and process control.
8725 CVE-2011-4047 94 Exec Code 2011-11-11 2011-11-14
9.3
Admin Remote Medium Not required Complete Complete Complete
The Dell KACE K2000 System Deployment Appliance allows remote attackers to execute arbitrary commands by leveraging database write access.
8726 CVE-2011-4043 189 Exec Code Overflow 2012-04-02 2012-04-03
9.3
None Remote Medium Not required Complete Complete Complete
Integer overflow in an unspecified ActiveX control in SVUIGrd.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to execute arbitrary code via a large value for an integer parameter, leading to a buffer overflow.
8727 CVE-2011-4042 Exec Code 2012-04-02 2012-04-03
9.3
None Remote Medium Not required Complete Complete Complete
An unspecified ActiveX control in SVUIGrd.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to execute arbitrary code by using a crafted HTML document to obtain control of a function pointer.
8728 CVE-2011-4041 94 Exec Code 2012-02-06 2012-12-10
10.0
None Remote Low Not required Complete Complete Complete
webvrpcs.exe in Advantech/BroadWin WebAccess allows remote attackers to execute arbitrary code or obtain a security-code value via a long string in an RPC request to TCP port 4592.
8729 CVE-2011-4040 119 Exec Code Overflow 2011-11-21 2011-11-21
10.0
None Remote Low Not required Complete Complete Complete
Buffer overflow in MiniSmtp 3.0.11818 in NJStar Communicator allows remote attackers to execute arbitrary code via a crafted packet.
8730 CVE-2011-4039 264 Exec Code 2012-02-10 2012-02-14
9.3
None Remote Medium Not required Complete Complete Complete
Invensys Wonderware HMI Reports 3.42.835.0304 and earlier, as used in Ocean Data Systems Dream Report before 4.0 and other products, allows user-assisted remote attackers to execute arbitrary code via a malformed file that triggers a "write access violation."
8731 CVE-2011-4037 119 Exec Code Overflow 2011-12-22 2012-01-12
9.3
None Remote Medium Not required Complete Complete Complete
Buffer overflow in Sielco Sistemi Winlog PRO before 2.07.09 and Winlog Lite before 2.07.09 allows user-assisted remote attackers to execute arbitrary code via invalid data in unspecified fields of a project file.
8732 CVE-2011-4034 119 DoS Exec Code Overflow 2011-12-02 2012-03-08
9.3
None Remote Medium Not required Complete Complete Complete
Buffer overflow in the Steema TeeChart ActiveX control, as used in Schneider Electric Vijeo Historian 4.30 and earlier, CitectHistorian 4.30 and earlier, and CitectSCADAReports 4.10 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service via unspecified vectors.
8733 CVE-2011-4031 189 Exec Code 2012-05-09 2018-10-30
9.3
None Remote Medium Not required Complete Complete Complete
Integer underflow in the asfrtp_parse_packet function in libavformat/rtpdec_asf.c in FFmpeg before 0.8.3 allows remote attackers to execute arbitrary code via a crafted ASF packet.
8734 CVE-2011-4030 264 2011-10-10 2011-10-29
9.3
None Remote Medium Not required Complete Complete Complete
The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from being publishable, which allows remote attackers to access sub-objects via unspecified vectors, a different vulnerability than CVE-2011-3587.
8735 CVE-2011-4012 2012-05-02 2012-10-29
9.3
None Remote Medium Not required Complete Complete Complete
Cisco IOS 12.0, 15.0, and 15.1, when a Policy Feature Card 3C (PFC3C) is used, does not create a fragment entry during processing of an ICMPv6 ACL, which has unspecified impact and remote attack vectors, aka Bug ID CSCtj90091.
8736 CVE-2011-4005 352 Exec Code CSRF 2011-11-03 2017-08-28
9.3
None Remote Medium Not required Complete Complete Complete
Cross-site request forgery (CSRF) vulnerability in the Services Ready Platform Configuration Utility web interface on the Cisco Small Business SRP521W, SRP526W, and SRP527W with firmware before 1.1.24 and the Small Business SRP541W, SRP546W, and SRP547W with firmware before 1.2.1 allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary commands, aka Bug ID CSCtr45124.
8737 CVE-2011-4004 119 Exec Code Overflow 2011-10-27 2012-04-06
9.3
None Remote Medium Not required Complete Complete Complete
Buffer overflow in the ATAS32 processing functionality in the Cisco WebEx Recording Format (WRF) player T26 before SP49 EP40 and T27 before SP28 allows remote attackers to execute arbitrary code via a crafted WRF file.
8738 CVE-2011-4000 119 Exec Code Overflow 2011-11-08 2012-11-06
9.3
None Remote Medium Not required Complete Complete Complete
Buffer overflow in ChaSen 2.4.x allows remote attackers to execute arbitrary code via a crafted string.
8739 CVE-2011-3992 119 DoS Exec Code Overflow 2011-11-03 2018-10-30
10.0
None Remote Low Not required Complete Complete Complete
Buffer overflow in the SSH server functionality on the D-Link DES-3800 with firmware before 4.50B052, DWL-2100AP with firmware before 2.50RC548, and DWL-3200AP with firmware before 2.55RC549 allows remote attackers to execute arbitrary code or cause a denial of service via unspecified vectors.
8740 CVE-2011-3991 Exec Code 2011-11-04 2017-08-28
9.3
None Remote Medium Not required Complete Complete Complete
Untrusted search path vulnerability in FFFTP 1.98a and earlier allows local users to execute arbitrary code via unspecified functions.
8741 CVE-2011-3961 362 Exec Code 2012-02-08 2017-09-18
9.3
None Remote Medium Not required Complete Complete Complete
Race condition in Google Chrome before 17.0.963.46 allows remote attackers to execute arbitrary code via vectors that trigger a crash of a utility process.
8742 CVE-2011-3937 2013-01-04 2018-10-30
10.0
None Remote Low Not required Complete Complete Complete
The H.263 codec (libavcodec/h263dec.c) in FFmpeg 0.7.x before 0.7.12, 0.8.x before 0.8.11, and unspecified versions before 0.10, and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.5, and 0.8.x before 0.8.1 has unspecified impact and attack vectors related to "width/height changing with frame threads."
8743 CVE-2011-3874 119 Exec Code Overflow 2012-01-27 2012-02-06
9.3
None Remote Medium Not required Complete Complete Complete
Stack-based buffer overflow in libsysutils in Android 2.2.x through 2.2.2 and 2.3.x through 2.3.6 allows user-assisted remote attackers to execute arbitrary code via an application that calls the FrameworkListener::dispatchCommand method with the wrong number of arguments, as demonstrated by zergRush to trigger a use-after-free error.
8744 CVE-2011-3873 119 DoS Exec Code Overflow Mem. Corr. 2011-10-04 2017-09-18
9.3
None Remote Medium Not required Complete Complete Complete
Google Chrome before 14.0.835.202 does not properly implement shader translation, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
8745 CVE-2011-3868 119 Exec Code Overflow 2011-10-07 2018-10-09
9.3
None Remote Medium Not required Complete Complete Complete
Buffer overflow in VMware Workstation 7.x before 7.1.5, VMware Player 3.x before 3.1.5, VMware Fusion 3.1.x before 3.1.3, and VMware AMS allows remote attackers to execute arbitrary code via a crafted UDF filesystem in an ISO image.
8746 CVE-2011-3867 189 DoS Exec Code 2011-09-28 2011-09-29
9.3
None Remote Medium Not required Complete Complete Complete
Integer underflow in Mozilla Firefox 3.6.x before 3.6.23 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via JavaScript code containing a large RegExp expression.
8747 CVE-2011-3834 189 Exec Code Overflow 2011-12-16 2017-09-18
9.3
None Remote Medium Not required Complete Complete Complete
Multiple integer overflows in the in_avi.dll plugin in Winamp before 5.623 allow remote attackers to execute arbitrary code via an AVI file with a crafted value for (1) the number of streams or (2) the size of the RIFF INFO chunk, leading to a heap-based buffer overflow.
8748 CVE-2011-3828 94 Exec Code 2011-11-25 2018-10-09
9.3
None Remote Medium Not required Complete Complete Complete
DVRemoteAx.ax 2.1.0.39 in the DVR Remote ActiveX control allows remote attackers to execute arbitrary code via a crafted DVRobot.dll file in a manifest directory on a web server.
8749 CVE-2011-3691 426 +Priv 2011-09-27 2016-11-08
9.3
None Remote Medium Not required Complete Complete Complete
Untrusted search path vulnerability in Foxit Reader before 5.0.2.0718 allows local users to gain privileges via a Trojan horse dwmapi.dll, dwrite.dll, or msdrm.dll in the current working directory.
8750 CVE-2011-3690 +Priv 2011-09-27 2012-02-21
9.3
None Remote Medium Not required Complete Complete Complete
Untrusted search path vulnerability in PlotSoft PDFill PDF Editor 8.0 allows local users to gain privileges via a Trojan horse mfc70enu.dll or mfc80loc.dll in the current working directory.
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.