CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 9 and 10)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
10651 CVE-2011-3690 +Priv 2011-09-27 2012-02-21
9.3
None Remote Medium Not required Complete Complete Complete
Untrusted search path vulnerability in PlotSoft PDFill PDF Editor 8.0 allows local users to gain privileges via a Trojan horse mfc70enu.dll or mfc80loc.dll in the current working directory.
10652 CVE-2011-3691 426 +Priv 2011-09-27 2016-11-08
9.3
None Remote Medium Not required Complete Complete Complete
Untrusted search path vulnerability in Foxit Reader before 5.0.2.0718 allows local users to gain privileges via a Trojan horse dwmapi.dll, dwrite.dll, or msdrm.dll in the current working directory.
10653 CVE-2011-3828 94 Exec Code 2011-11-25 2018-10-09
9.3
None Remote Medium Not required Complete Complete Complete
DVRemoteAx.ax 2.1.0.39 in the DVR Remote ActiveX control allows remote attackers to execute arbitrary code via a crafted DVRobot.dll file in a manifest directory on a web server.
10654 CVE-2011-3834 189 Exec Code Overflow 2011-12-16 2017-09-18
9.3
None Remote Medium Not required Complete Complete Complete
Multiple integer overflows in the in_avi.dll plugin in Winamp before 5.623 allow remote attackers to execute arbitrary code via an AVI file with a crafted value for (1) the number of streams or (2) the size of the RIFF INFO chunk, leading to a heap-based buffer overflow.
10655 CVE-2011-3867 189 DoS Exec Code 2011-09-28 2011-09-29
9.3
None Remote Medium Not required Complete Complete Complete
Integer underflow in Mozilla Firefox 3.6.x before 3.6.23 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via JavaScript code containing a large RegExp expression.
10656 CVE-2011-3868 119 Exec Code Overflow 2011-10-07 2018-10-09
9.3
None Remote Medium Not required Complete Complete Complete
Buffer overflow in VMware Workstation 7.x before 7.1.5, VMware Player 3.x before 3.1.5, VMware Fusion 3.1.x before 3.1.3, and VMware AMS allows remote attackers to execute arbitrary code via a crafted UDF filesystem in an ISO image.
10657 CVE-2011-3873 119 DoS Exec Code Overflow Mem. Corr. 2011-10-04 2017-09-18
9.3
None Remote Medium Not required Complete Complete Complete
Google Chrome before 14.0.835.202 does not properly implement shader translation, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
10658 CVE-2011-3874 119 Exec Code Overflow 2012-01-27 2012-02-06
9.3
None Remote Medium Not required Complete Complete Complete
Stack-based buffer overflow in libsysutils in Android 2.2.x through 2.2.2 and 2.3.x through 2.3.6 allows user-assisted remote attackers to execute arbitrary code via an application that calls the FrameworkListener::dispatchCommand method with the wrong number of arguments, as demonstrated by zergRush to trigger a use-after-free error.
10659 CVE-2011-3961 362 Exec Code 2012-02-08 2017-09-18
9.3
None Remote Medium Not required Complete Complete Complete
Race condition in Google Chrome before 17.0.963.46 allows remote attackers to execute arbitrary code via vectors that trigger a crash of a utility process.
10660 CVE-2011-3991 Exec Code 2011-11-04 2017-08-28
9.3
None Remote Medium Not required Complete Complete Complete
Untrusted search path vulnerability in FFFTP 1.98a and earlier allows local users to execute arbitrary code via unspecified functions.
10661 CVE-2011-4000 119 Exec Code Overflow 2011-11-08 2012-11-06
9.3
None Remote Medium Not required Complete Complete Complete
Buffer overflow in ChaSen 2.4.x allows remote attackers to execute arbitrary code via a crafted string.
10662 CVE-2011-4004 119 Exec Code Overflow 2011-10-27 2012-04-06
9.3
None Remote Medium Not required Complete Complete Complete
Buffer overflow in the ATAS32 processing functionality in the Cisco WebEx Recording Format (WRF) player T26 before SP49 EP40 and T27 before SP28 allows remote attackers to execute arbitrary code via a crafted WRF file.
10663 CVE-2011-4005 352 Exec Code CSRF 2011-11-03 2017-08-28
9.3
None Remote Medium Not required Complete Complete Complete
Cross-site request forgery (CSRF) vulnerability in the Services Ready Platform Configuration Utility web interface on the Cisco Small Business SRP521W, SRP526W, and SRP527W with firmware before 1.1.24 and the Small Business SRP541W, SRP546W, and SRP547W with firmware before 1.2.1 allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary commands, aka Bug ID CSCtr45124.
10664 CVE-2011-4012 2012-05-02 2012-10-29
9.3
None Remote Medium Not required Complete Complete Complete
Cisco IOS 12.0, 15.0, and 15.1, when a Policy Feature Card 3C (PFC3C) is used, does not create a fragment entry during processing of an ICMPv6 ACL, which has unspecified impact and remote attack vectors, aka Bug ID CSCtj90091.
10665 CVE-2011-4030 264 2011-10-10 2011-10-29
9.3
None Remote Medium Not required Complete Complete Complete
The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from being publishable, which allows remote attackers to access sub-objects via unspecified vectors, a different vulnerability than CVE-2011-3587.
10666 CVE-2011-4031 189 Exec Code 2012-05-09 2018-10-30
9.3
None Remote Medium Not required Complete Complete Complete
Integer underflow in the asfrtp_parse_packet function in libavformat/rtpdec_asf.c in FFmpeg before 0.8.3 allows remote attackers to execute arbitrary code via a crafted ASF packet.
10667 CVE-2011-4034 119 DoS Exec Code Overflow 2011-12-02 2012-03-08
9.3
None Remote Medium Not required Complete Complete Complete
Buffer overflow in the Steema TeeChart ActiveX control, as used in Schneider Electric Vijeo Historian 4.30 and earlier, CitectHistorian 4.30 and earlier, and CitectSCADAReports 4.10 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service via unspecified vectors.
10668 CVE-2011-4037 119 Exec Code Overflow 2011-12-22 2012-01-12
9.3
None Remote Medium Not required Complete Complete Complete
Buffer overflow in Sielco Sistemi Winlog PRO before 2.07.09 and Winlog Lite before 2.07.09 allows user-assisted remote attackers to execute arbitrary code via invalid data in unspecified fields of a project file.
10669 CVE-2011-4039 264 Exec Code 2012-02-10 2012-02-14
9.3
None Remote Medium Not required Complete Complete Complete
Invensys Wonderware HMI Reports 3.42.835.0304 and earlier, as used in Ocean Data Systems Dream Report before 4.0 and other products, allows user-assisted remote attackers to execute arbitrary code via a malformed file that triggers a "write access violation."
10670 CVE-2011-4042 Exec Code 2012-04-02 2012-04-03
9.3
None Remote Medium Not required Complete Complete Complete
An unspecified ActiveX control in SVUIGrd.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to execute arbitrary code by using a crafted HTML document to obtain control of a function pointer.
10671 CVE-2011-4043 189 Exec Code Overflow 2012-04-02 2012-04-03
9.3
None Remote Medium Not required Complete Complete Complete
Integer overflow in an unspecified ActiveX control in SVUIGrd.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to execute arbitrary code via a large value for an integer parameter, leading to a buffer overflow.
10672 CVE-2011-4047 94 Exec Code 2011-11-11 2011-11-14
9.3
Admin Remote Medium Not required Complete Complete Complete
The Dell KACE K2000 System Deployment Appliance allows remote attackers to execute arbitrary commands by leveraging database write access.
10673 CVE-2011-4052 119 Exec Code Overflow 2011-12-05 2011-12-22
9.3
None Remote Medium Not required Complete Complete Complete
Stack-based buffer overflow in CEServer.exe in the CEServer component in the Remote Agent module in InduSoft Web Studio 6.1 and 7.0 allows remote attackers to execute arbitrary code via a crafted 0x15 (aka Remove File) operation for a file with a long name.
10674 CVE-2011-4053 +Priv 2012-01-19 2012-01-23
9.3
None Remote Medium Not required Complete Complete Complete
Untrusted search path vulnerability in 7-Technologies (7T) Interactive Graphical SCADA System (IGSS) before 9.0.0.11291 allows local users to gain privileges via a Trojan horse DLL in the current working directory.
10675 CVE-2011-4055 119 Exec Code Overflow 2012-01-07 2017-08-28
9.3
None Remote Medium Not required Complete Complete Complete
Buffer overflow in the WebClient ActiveX control in Siemens Tecnomatix FactoryLink 6.6.1 (aka 6.6 SP1), 7.5.217 (aka 7.5 SP2), and 8.0.2.54 allows remote attackers to execute arbitrary code via a long string in a parameter associated with the location URL.
10676 CVE-2011-4109 399 2012-01-05 2017-08-28
9.3
None Remote Medium Not required Complete Complete Complete
Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, when X509_V_FLAG_POLICY_CHECK is enabled, allows remote attackers to have an unspecified impact by triggering failure of a policy check.
10677 CVE-2011-4141 +Priv 2011-12-16 2017-08-28
9.3
None Remote Medium Not required Complete Complete Complete
Untrusted search path vulnerability in EMC RSA SecurID Software Token 4.1 before 4.1.1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a Software Token file.
10678 CVE-2011-4186 119 Exec Code Overflow 2012-02-21 2012-02-22
9.3
None Remote Medium Not required Complete Complete Complete
Heap-based buffer overflow in nipplib.dll in Novell iPrint Client before 5.78 on Windows allows remote attackers to execute arbitrary code via a crafted client-file-name parameter in a printer-url, a different vulnerability than CVE-2011-1705.
10679 CVE-2011-4201 94 Exec Code 2011-12-13 2011-12-13
9.3
Admin Remote Medium Not required Complete Complete Complete
remote_support.cgi in the Tadasoft Restorepoint 3.2 evaluation image allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) pid1 or (2) pid2 parameter in a stop_remote_support action.
10680 CVE-2011-4216 264 DoS Exec Code 2011-11-01 2017-08-28
9.3
None Remote Medium Not required Complete Complete Complete
Investintech.com SlimPDF Reader does not properly restrict write operations, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document.
10681 CVE-2011-4217 264 DoS Exec Code 2011-11-01 2012-02-29
9.3
None Remote Medium Not required Complete Complete Complete
Investintech.com SlimPDF Reader does not properly restrict read operations during block data moves, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document.
10682 CVE-2011-4218 399 DoS Exec Code 2011-11-01 2017-08-28
9.3
None Remote Medium Not required Complete Complete Complete
Investintech.com SlimPDF Reader does not prevent faulting-instruction data from affecting write operations, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document.
10683 CVE-2011-4219 399 DoS Exec Code 2011-11-01 2017-08-28
9.3
None Remote Medium Not required Complete Complete Complete
Investintech.com SlimPDF Reader does not prevent faulting-address data from affecting branch selection, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document.
10684 CVE-2011-4220 264 DoS Exec Code 2011-11-01 2012-03-07
9.3
None Remote Medium Not required Complete Complete Complete
Investintech.com SlimPDF Reader does not properly restrict the arguments to unspecified function calls, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document.
10685 CVE-2011-4221 DoS Exec Code 2011-11-01 2017-08-28
9.3
None Remote Medium Not required Complete Complete Complete
Unspecified vulnerability in Investintech.com Able2Doc and Able2Doc Professional allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted document.
10686 CVE-2011-4222 DoS Exec Code 2011-11-01 2017-08-28
9.3
None Remote Medium Not required Complete Complete Complete
Unspecified vulnerability in Investintech.com Able2Extract and Able2Extract Server allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted document.
10687 CVE-2011-4223 DoS Exec Code 2011-11-01 2017-08-28
9.3
None Remote Medium Not required Complete Complete Complete
Unspecified vulnerability in Investintech.com Absolute PDF Server allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document.
10688 CVE-2011-4247 94 Exec Code 2011-11-24 2012-03-08
9.3
None Remote Medium Not required Complete Complete Complete
RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via a crafted QCELP stream.
10689 CVE-2011-4248 94 Exec Code 2011-11-24 2012-03-08
9.3
None Remote Medium Not required Complete Complete Complete
RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via a malformed AAC file.
10690 CVE-2011-4251 94 Exec Code 2011-11-24 2012-03-08
9.3
None Remote Medium Not required Complete Complete Complete
RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via a crafted sample size in a RealAudio file.
10691 CVE-2011-4252 94 Exec Code 2011-11-24 2012-03-08
9.3
None Remote Medium Not required Complete Complete Complete
The RV10 codec in RealNetworks RealPlayer before 15.0.0 and Mac RealPlayer before 12.0.0.1703 allows remote attackers to execute arbitrary code via a crafted sample height.
10692 CVE-2011-4257 94 Exec Code 2011-11-24 2012-03-08
9.3
None Remote Medium Not required Complete Complete Complete
The Cook codec in RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via crafted channel data.
10693 CVE-2011-4258 94 Exec Code 2011-11-24 2012-03-08
9.3
None Remote Medium Not required Complete Complete Complete
RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via a crafted length of an MLTI chunk in an IVR file.
10694 CVE-2011-4259 189 Exec Code 2011-11-24 2012-03-08
9.3
None Remote Medium Not required Complete Complete Complete
Integer underflow in RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via a crafted width value in an MPG file.
10695 CVE-2011-4260 94 Exec Code 2011-11-24 2012-03-08
9.3
None Remote Medium Not required Complete Complete Complete
RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via a malformed header in an MP4 file.
10696 CVE-2011-4261 119 DoS Exec Code Overflow Mem. Corr. 2011-11-24 2012-03-08
9.3
None Remote Medium Not required Complete Complete Complete
RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted video dimensions in an MP4 file.
10697 CVE-2011-4262 Exec Code 2011-11-24 2012-03-08
9.3
None Remote Medium Not required Complete Complete Complete
Unspecified vulnerability in RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via a crafted MP4 file.
10698 CVE-2011-4266 +Priv 2011-12-13 2012-02-21
9.3
None Remote Medium Not required Complete Complete Complete
Untrusted search path vulnerability in FFFTP before 1.98d allows local users to gain privileges via a Trojan horse executable file in a directory that is accessed for reading an extensionless file, as demonstrated by executing the README.exe file when a user attempts to access the README file, a different vulnerability than CVE-2011-3991.
10699 CVE-2011-4496 119 Exec Code Overflow 2011-11-21 2011-11-21
9.3
None Remote Medium Not required Complete Complete Complete
Buffer overflow in Aviosoft DTV Player 1.0.1.2 allows remote attackers to execute arbitrary code via a crafted .plf (aka playlist) file.
10700 CVE-2011-4508 287 Bypass 2012-02-03 2012-02-07
9.3
None Remote Medium Not required Complete Complete Complete
The HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; WinCC V11 (aka TIA portal) before SP2 Update 1; the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime generates predictable authentication tokens for cookies, which makes it easier for remote attackers to bypass authentication via a crafted cookie.
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.