CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 6 and 6.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
17151 CVE-2011-1724 +Priv 2011-05-03 2011-09-22
6.0
None Remote Medium ??? Partial Partial Partial
Unspecified vulnerability in HP Virtual Server Environment before 6.3 allows remote authenticated users to gain privileges via unknown vectors.
17152 CVE-2011-1720 119 DoS Exec Code Overflow Mem. Corr. 2011-05-13 2018-10-09
6.8
None Remote Medium Not required Partial Partial Partial
The SMTP server in Postfix before 2.5.13, 2.6.x before 2.6.10, 2.7.x before 2.7.4, and 2.8.x before 2.8.3, when certain Cyrus SASL authentication methods are enabled, does not create a new server handle after client authentication fails, which allows remote attackers to cause a denial of service (heap memory corruption and daemon crash) or possibly execute arbitrary code via an invalid AUTH command with one method followed by an AUTH command with a different method.
17153 CVE-2011-1686 89 Exec Code Sql 2011-04-22 2017-08-17
6.5
None Remote Low ??? Partial Partial Partial
Multiple SQL injection vulnerabilities in Best Practical Solutions RT 2.0.0 through 3.6.10, 3.8.0 through 3.8.9, and 4.0.0rc through 4.0.0rc7 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors, as demonstrated by reading data.
17154 CVE-2011-1684 119 DoS Exec Code Overflow 2011-05-03 2017-09-19
6.8
None Remote Medium Not required Partial Partial Partial
Heap-based buffer overflow in the MP4_ReadBox_skcr function in libmp4.c in the MP4 demultiplexer in VideoLAN VLC media player 1.x before 1.1.9 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted MP4 file.
17155 CVE-2011-1683 264 2011-04-13 2011-04-21
6.8
None Remote Medium Not required Partial Partial Partial
IBM WebSphere Application Server (WAS) 6.0.x through 6.0.2.43, 6.1.x before 6.1.0.37, and 7.0.x before 7.0.0.17 on z/OS, when a Local OS user registry or Federated Repository with RACF adapter is used, allows remote attackers to obtain unspecified application access via unknown vectors.
17156 CVE-2011-1674 287 Bypass 2011-04-10 2017-08-17
6.8
None Remote Medium Not required Partial Partial Partial
The NetGear ProSafe WNAP210 with firmware 2.0.12 allows remote attackers to bypass authentication and obtain access to the configuration page by visiting recreate.php and then visiting index.php.
17157 CVE-2011-1664 352 CSRF 2011-04-10 2017-08-17
6.8
None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in the Translation Management module 6.x before 6.x-1.21 for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
17158 CVE-2011-1610 89 Exec Code Sql 2011-05-03 2018-10-09
6.4
None Remote Low Not required Partial Partial None
Multiple SQL injection vulnerabilities in xmldirectorylist.jsp in the embedded Apache HTTP Server component in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before 6.1(5)su3, 7.x before 7.1(5)su4, 8.0 before 8.0(3a)su2, and 8.5 before 8.5(1)su1 allow remote attackers to execute arbitrary SQL commands via the (1) f, (2) l, or (3) n parameter, aka Bug ID CSCtj42064.
17159 CVE-2011-1607 22 Dir. Trav. 2011-05-03 2017-08-17
6.5
None Remote Low ??? Partial Partial Partial
Directory traversal vulnerability in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before 6.1(5)su3, 7.x before 7.1(5b)su3, 8.0 before 8.0(3a)su1, and 8.5 before 8.5(1) allows remote authenticated users to upload files to arbitrary directories via a modified pathname in an upload request, aka Bug ID CSCti81603.
17160 CVE-2011-1603 264 +Priv 2011-06-02 2011-10-27
6.6
None Local Medium ??? Complete Complete Complete
Cisco Unified IP Phones 7900 devices (aka TNP phones) with software before 9.2.1 allow local users to gain privileges via unspecified vectors, aka Bug ID CSCtn65815.
17161 CVE-2011-1602 264 +Priv 2011-06-02 2011-11-22
6.6
None Local Medium ??? Complete Complete Complete
The su utility on Cisco Unified IP Phones 7900 devices (aka TNP phones) with software before 9.0.3 allows local users to gain privileges via unspecified vectors, aka Bug ID CSCtf07426.
17162 CVE-2011-1597 434 Exec Code 2020-02-06 2020-02-10
6.5
None Remote Low ??? Partial Partial Partial
OpenVAS Manager v2.0.3 allows plugin remote code execution.
17163 CVE-2011-1588 134 2019-11-14 2019-11-19
6.8
None Remote Medium Not required Partial Partial Partial
Thunar before 1.3.1 could crash when copy and pasting a file name with % format characters due to a format string error.
17164 CVE-2011-1584 264 Exec Code 2011-06-08 2012-04-27
6.5
None Remote Low ??? Partial Partial Partial
The updateFile function in inc/core/class.dc.media.php in the Media Manager in Dotclear before 2.2.3 does not properly restrict pathnames, which allows remote authenticated users to upload and execute arbitrary PHP code via the media_path or media_file parameter. NOTE: some of these details are obtained from third party information.
17165 CVE-2011-1583 189 DoS Exec Code Overflow 2011-08-12 2011-08-24
6.9
None Local Medium Not required Complete Complete Complete
Multiple integer overflows in tools/libxc/xc_dom_bzimageloader.c in Xen 3.2, 3.3, 4.0, and 4.1 allow local users to cause a denial of service and possibly execute arbitrary code via a crafted paravirtualised guest kernel image that triggers (1) a buffer overflow during a decompression loop or (2) an out-of-bounds read in the loader involving unspecified length fields.
17166 CVE-2011-1574 119 Exec Code Overflow 2011-05-09 2016-12-08
6.8
None Remote Medium Not required Partial Partial Partial
Stack-based buffer overflow in the ReadS3M method in load_s3m.cpp in libmodplug before 0.8.8.2 allows remote attackers to execute arbitrary code via a crafted S3M file.
17167 CVE-2011-1572 22 Exec Code Dir. Trav. 2011-10-04 2019-09-09
6.8
None Remote Medium Not required Partial Partial Partial
Directory traversal vulnerability in the Admin Defined Commands (ADC) feature in gitolite before 1.5.9.1 allows remote attackers to execute arbitrary commands via .. (dot dot) sequences in admin-defined commands.
17168 CVE-2011-1571 Exec Code 2011-05-07 2020-07-23
6.8
None Remote Medium Not required Partial Partial Partial
Unspecified vulnerability in the XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote attackers to execute arbitrary commands via unknown vectors.
17169 CVE-2011-1561 287 Bypass 2011-04-05 2011-04-05
6.8
None Remote Medium Not required Partial Partial Partial
The LDAP login feature in bos.rte.security 6.1.6.4 in IBM AIX 6.1, when ldap_auth is enabled in ldap.cfg, allows remote attackers to bypass authentication via a login attempt with an arbitrary password.
17170 CVE-2011-1556 89 1 Exec Code Sql 2011-04-04 2017-08-17
6.8
None Remote Medium Not required Partial Partial Partial
SQL injection vulnerability in plugins/pdfClasses/pdfgen.php in Andy's PHP Knowledgebase (Aphpkb) 0.95.4 allows remote attackers to execute arbitrary SQL commands via the pdfa parameter.
17171 CVE-2011-1555 89 Exec Code Sql 2011-04-04 2011-04-05
6.8
None Remote Medium Not required Partial Partial Partial
SQL injection vulnerability in saa.php in Andy's PHP Knowledgebase (Aphpkb) 0.95.3 and earlier allows remote attackers to execute arbitrary SQL commands via the aid parameter, a different vulnerability than CVE-2011-1546. NOTE: some of these details are obtained from third party information.
17172 CVE-2011-1551 264 +Priv 2011-03-30 2017-08-17
6.9
None Local Medium Not required Complete Complete Complete
SUSE openSUSE Factory assigns ownership of the /var/log/cobbler/ directory tree to the web-service user account, which might allow local users to gain privileges by leveraging access to this account during root filesystem operations by the Cobbler daemon.
17173 CVE-2011-1550 264 2011-03-30 2011-04-07
6.3
None Local Medium Not required None Complete Complete
The default configuration of logrotate on SUSE openSUSE Factory uses root privileges to process files in directories that permit non-root write access, which allows local users to conduct symlink and hard link attacks by leveraging logrotate's lack of support for untrusted directories, as demonstrated by directories for the (1) cobbler, (2) inn, (3) safte-monitor, and (4) uucp packages.
17174 CVE-2011-1549 264 2011-03-30 2011-04-21
6.3
None Local Medium Not required None Complete Complete
The default configuration of logrotate on Gentoo Linux uses root privileges to process files in directories that permit non-root write access, which allows local users to conduct symlink and hard link attacks by leveraging logrotate's lack of support for untrusted directories, as demonstrated by directories under /var/log/ for packages.
17175 CVE-2011-1548 264 2011-03-30 2011-04-21
6.3
None Local Medium Not required None Complete Complete
The default configuration of logrotate on Debian GNU/Linux uses root privileges to process files in directories that permit non-root write access, which allows local users to conduct symlink and hard link attacks by leveraging logrotate's lack of support for untrusted directories, as demonstrated by /var/log/postgresql/.
17176 CVE-2011-1547 119 DoS Overflow Mem. Corr. 2011-05-09 2011-09-07
6.8
None Remote Medium Not required Partial Partial Partial
Multiple stack consumption vulnerabilities in the kernel in NetBSD 4.0, 5.0 before 5.0.3, and 5.1 before 5.1.1, when IPsec is enabled, allow remote attackers to cause a denial of service (memory corruption and panic) or possibly have unspecified other impact via a crafted (1) IPv4 or (2) IPv6 packet with nested IPComp headers.
17177 CVE-2011-1545 352 CSRF 2011-05-03 2011-09-22
6.8
None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in HP Insight Control Performance Management before 6.3 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
17178 CVE-2011-1544 +Priv 2011-05-03 2011-09-22
6.0
None Remote Medium ??? Partial Partial Partial
Unspecified vulnerability in HP Insight Control Performance Management before 6.3 allows remote authenticated users to gain privileges via unknown vectors.
17179 CVE-2011-1535 DoS +Info 2011-04-29 2017-08-17
6.0
None Remote Medium ??? Partial Partial Partial
Unspecified vulnerability in HP Insight Control for Linux (aka IC-Linux) before 6.3 allows remote authenticated users to obtain sensitive information, modify data, or cause a denial of service via unknown vectors.
17180 CVE-2011-1534 2011-04-22 2016-08-23
6.5
None Remote Low ??? Partial Partial Partial
Unspecified vulnerability in HP Network Node Manager i (NNMi) 9.0x allows remote authenticated users to obtain access to processes via unknown vectors.
17181 CVE-2011-1530 399 DoS 2011-12-08 2018-10-09
6.8
None Remote Low ??? None None Complete
The process_tgs_req function in do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.9 through 1.9.2 allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted TGS request that triggers an error other than the KRB5_KDB_NOENTRY error.
17182 CVE-2011-1526 269 Bypass 2011-07-11 2021-02-02
6.5
None Remote Low ??? Partial Partial Partial
ftpd.c in the GSS-API FTP daemon in MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.1 and earlier does not check the krb5_setegid return value, which allows remote authenticated users to bypass intended group access restrictions, and create, overwrite, delete, or read files, via standard FTP commands, related to missing autoconf tests in a configure script.
17183 CVE-2011-1521 399 DoS +Info 2011-05-24 2019-10-25
6.4
None Remote Low Not required Partial None Partial
The urllib and urllib2 modules in Python 2.x before 2.7.2 and 3.x before 3.2.1 process Location headers that specify redirection to file: URLs, which makes it easier for remote attackers to obtain sensitive information or cause a denial of service (resource consumption) via a crafted URL, as demonstrated by the file:///etc/passwd and file:///dev/zero URLs.
17184 CVE-2011-1511 Exec Code 2011-07-20 2011-12-21
6.4
None Remote Low Not required Partial Partial None
Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Sun Products Suite 2.1.1 and 3.0.1 allows remote attackers to execute arbitrary code via unknown vectors related to Administration.
17185 CVE-2011-1506 20 2011-03-22 2017-08-17
6.8
None Remote Medium Not required Partial Partial Partial
The STARTTLS implementation in Kerio Connect 7.1.4 build 2985 and MailServer 6.x does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411. NOTE: some of these details are obtained from third party information.
17186 CVE-2011-1494 189 DoS Overflow +Priv Mem. Corr. 2011-05-03 2018-10-09
6.9
None Local Medium Not required Complete Complete Complete
Integer overflow in the _ctl_do_mpt_command function in drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel 2.6.38 and earlier might allow local users to gain privileges or cause a denial of service (memory corruption) via an ioctl call specifying a crafted value that triggers a heap-based buffer overflow.
17187 CVE-2011-1485 362 +Priv 2011-05-31 2012-12-19
6.9
None Local Medium Not required Complete Complete Complete
Race condition in the pkexec utility and polkitd daemon in PolicyKit (aka polkit) 0.96 allows local users to gain privileges by executing a setuid program from pkexec, related to the use of the effective user ID instead of the real user ID.
17188 CVE-2011-1484 264 Exec Code 2011-07-27 2011-10-26
6.8
None Remote Medium Not required Partial Partial Partial
jboss-seam.jar in the JBoss Seam 2 framework 2.2.x and earlier, as distributed in Red Hat JBoss Enterprise SOA Platform 4.3.0.CP04 and 5.1.0 and JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3.0.CP09 and 5.1.0, does not properly restrict use of Expression Language (EL) statements in FacesMessages during page exception handling, which allows remote attackers to execute arbitrary Java code via a crafted URL to an application.
17189 CVE-2011-1482 352 CSRF 2011-06-21 2018-08-13
6.8
None Remote Medium Not required Partial Partial Partial
Multiple cross-site request forgery (CSRF) vulnerabilities in mainfile.php in Francisco Burzi PHP-Nuke 8.0 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add user accounts or (2) grant the administrative privilege to a user account, related to a Referer check that uses a substring comparison.
17190 CVE-2011-1456 20 DoS 2011-05-03 2020-05-22
6.8
None Remote Medium Not required Partial Partial Partial
Google Chrome before 11.0.696.57 does not properly handle PDF forms, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to "stale pointers."
17191 CVE-2011-1455 125 DoS 2011-05-03 2020-05-22
6.8
None Remote Medium Not required Partial Partial Partial
Google Chrome before 11.0.696.57 does not properly handle PDF documents with multipart encoding, which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted document.
17192 CVE-2011-1454 416 DoS 2011-05-03 2020-05-22
6.8
None Remote Medium Not required Partial Partial Partial
Use-after-free vulnerability in the DOM id handling functionality in Google Chrome before 11.0.696.57 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted HTML document.
17193 CVE-2011-1449 416 DoS 2011-05-03 2020-05-22
6.8
None Remote Medium Not required Partial Partial Partial
Use-after-free vulnerability in the WebSockets implementation in Google Chrome before 11.0.696.57 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
17194 CVE-2011-1448 20 DoS 2011-05-03 2020-05-22
6.8
None Remote Medium Not required Partial Partial Partial
Google Chrome before 11.0.696.57 does not properly perform height calculations, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."
17195 CVE-2011-1447 20 DoS 2011-05-03 2020-05-22
6.8
None Remote Medium Not required Partial Partial Partial
Google Chrome before 11.0.696.57 does not properly handle drop-down lists, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."
17196 CVE-2011-1445 125 DoS 2011-05-03 2020-05-22
6.8
None Remote Medium Not required Partial Partial Partial
Google Chrome before 11.0.696.57 does not properly handle SVG documents, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
17197 CVE-2011-1444 362 DoS 2011-05-03 2020-05-29
6.8
None Remote Medium Not required Partial Partial Partial
Race condition in the sandbox launcher implementation in Google Chrome before 11.0.696.57 on Linux allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
17198 CVE-2011-1443 20 DoS 2011-05-03 2020-05-22
6.8
None Remote Medium Not required Partial Partial Partial
Google Chrome before 11.0.696.57 does not properly implement layering, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to "stale pointers."
17199 CVE-2011-1442 20 DoS 2011-05-03 2020-05-22
6.8
None Remote Medium Not required Partial Partial Partial
Google Chrome before 11.0.696.57 does not properly handle mutation events, which allows remote attackers to cause a denial of service (node tree corruption) or possibly have unspecified other impact via unknown vectors.
17200 CVE-2011-1441 704 DoS 2011-05-03 2020-05-22
6.8
None Remote Medium Not required Partial Partial Partial
Google Chrome before 11.0.696.57 does not properly perform a cast of an unspecified variable during handling of floating select lists, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted HTML document.
Total number of vulnerabilities : 22306   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 (This Page)345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.