CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In July 2011

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2011-2964 94 Exec Code 2011-07-29 2017-08-28
6.8
 None Remote Medium Not required Partial Partial Partial
foomaticrip.c in foomatic-rip in foomatic-filters in Foomatic 4.0.6 allows remote attackers to execute arbitrary code via a crafted *FoomaticRIPCommandLine field in a .ppd file, a different vulnerability than CVE-2011-2697.
2 CVE-2011-2963 287 1 DoS +Info 2011-07-29 2011-08-01
10.0
 None Remote Low Not required Complete Complete Complete
TCPUploadServer.exe in Progea Movicon 11.2 before Build 1084 does not require authentication for critical functions, which allows remote attackers to obtain sensitive information, delete files, execute arbitrary programs, or cause a denial of service (crash) via a crafted packet to TCP port 10651.
3 CVE-2011-2962 119 DoS Exec Code Overflow 2011-07-29 2017-08-28
9.3
 None Remote Medium Not required Complete Complete Complete
Multiple stack-based buffer overflows in Invensys Wonderware Information Server 3.1, 4.0, and 4.0 SP1 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via two unspecified ActiveX controls.
4 CVE-2011-2961 119 DoS Exec Code Overflow 2011-07-29 2011-08-01
10.0
 None Remote Low Not required Complete Complete Complete
Heap-based buffer overflow in AngelServer.exe 6.0.11.3 in Sunway pNetPower allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted UDP packet.
5 CVE-2011-2960 119 DoS Exec Code Overflow 2011-07-29 2011-08-01
10.0
 None Remote Low Not required Complete Complete Complete
Heap-based buffer overflow in httpsvr.exe 6.0.5.3 in Sunway ForceControl 6.1 SP1, SP2, and SP3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted URL.
6 CVE-2011-2959 119 DoS Exec Code Overflow 2011-07-29 2011-08-01
10.0
 None Remote Low Not required Complete Complete Complete
Stack-based buffer overflow in the Open Database Connectivity (ODBC) service (Odbcixv9se.exe) in 7-Technologies Interactive Graphical SCADA System (IGSS) 9 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted packet to TCP port 22202.
7 CVE-2011-2958 79 XSS 2011-07-28 2017-08-28
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Ecava IntegraXor before 3.60 (Build 4080) allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
8 CVE-2011-2957 Exec Code Mem. Corr. 2011-07-28 2011-08-11
6.9
 None Local Medium Not required Complete Complete Complete
Unspecified vulnerability in Rockwell Automation FactoryTalk Diagnostics Viewer before V2.30.00 (CPR9 SR3) allows local users to execute arbitrary code via a crafted FactoryTalk Diagnostics Viewer (.ftd) configuration file, which triggers memory corruption.
9 CVE-2011-2956 287 DoS 2011-07-28 2011-07-29
7.8
 None Remote Low Not required None None Complete
AzeoTech DAQFactory before 5.85 (Build 1842) does not perform authentication for certain signals, which allows remote attackers to cause a denial of service (system reboot or shutdown) via a signal.
10 CVE-2011-2893 399 DoS 2011-07-27 2017-08-28
4.3
 None Remote Medium Not required None None Partial
The DataPilot feature in IBM Lotus Symphony 3 before FP3 allows user-assisted remote attackers to cause a denial of service (application crash) via a large .xls spreadsheet with an invalid Value reference.
11 CVE-2011-2892 20 2011-07-27 2011-07-29
4.3
 None Remote Medium Not required None Partial None
Joomla! 1.6.x before 1.6.2 does not prevent page rendering inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.
12 CVE-2011-2891 200 +Info 2011-07-27 2017-08-28
5.0
 None Remote Low Not required Partial None None
Joomla! 1.6.x before 1.6.2 allows remote attackers to obtain sensitive information via an empty Itemid array parameter to index.php, which reveals the installation path in an error message, a different vulnerability than CVE-2011-2488.
13 CVE-2011-2890 200 +Info 2011-07-27 2017-08-28
5.0
 None Remote Low Not required Partial None None
The MediaViewMedia class in administrator/components/com_media/views/media/view.html.php in Joomla! 1.5.23 and earlier allows remote attackers to obtain sensitive information via vectors involving the base variable, leading to disclosure of the installation path, a different vulnerability than CVE-2011-2488.
14 CVE-2011-2889 200 +Info 2011-07-27 2017-08-28
5.0
 None Remote Low Not required Partial None None
templates/system/error.php in Joomla! before 1.5.23 might allow remote attackers to obtain sensitive information via unspecified vectors that trigger an undefined value of a certain error field, leading to disclosure of the installation path. NOTE: this might overlap CVE-2011-2488.
15 CVE-2011-2888 399 DoS 2011-07-27 2017-08-28
4.3
 None Remote Medium Not required None None Partial
IBM Lotus Symphony 3 before FP3 allows remote attackers to cause a denial of service (application hang) via complex graphics in a presentation.
16 CVE-2011-2887 399 DoS 2011-07-27 2017-08-28
4.3
 None Remote Medium Not required None None Partial
IBM Lotus Symphony 3 before FP3 on Linux allows remote attackers to cause a denial of service (application crash) via a certain sample document.
17 CVE-2011-2886 399 DoS 2011-07-27 2017-08-28
4.3
 None Remote Medium Not required None None Partial
IBM Lotus Symphony 3 before FP3 allows remote attackers to cause a denial of service (application crash) via a .docx document with empty bullet styles for parent bullets.
18 CVE-2011-2885 399 DoS 2011-07-27 2017-08-28
4.3
 None Remote Medium Not required None None Partial
IBM Lotus Symphony 3 before FP3 allows remote attackers to cause a denial of service (application crash) via the sample .doc document that incorporates a user-defined toolbar.
19 CVE-2011-2884 2011-07-27 2017-08-28
10.0
 None Remote Low Not required Complete Complete Complete
Multiple unspecified vulnerabilities in IBM Lotus Symphony 3 before FP3 have unknown impact and attack vectors, related to "critical security vulnerability issues."
20 CVE-2011-2883 20 Exec Code 2011-07-21 2011-07-22
9.3
 None Remote Medium Not required Complete Complete Complete
The NSEPA.NsepaCtrl.1 ActiveX control in nsepa.ocx in Citrix Access Gateway Enterprise Edition 8.1 before 8.1-67.7, 9.0 before 9.0-70.5, and 9.1 before 9.1-96.4 attempts to validate signed DLLs by checking the certificate subject, not the signature, which allows man-in-the-middle attackers to execute arbitrary code via HTTP header data referencing a DLL that was signed with a crafted certificate.
21 CVE-2011-2882 119 Exec Code Overflow 2011-07-21 2011-09-21
9.3
 None Remote Medium Not required Complete Complete Complete
Stack-based buffer overflow in the NSEPA.NsepaCtrl.1 ActiveX control in nsepa.ocx in Citrix Access Gateway Enterprise Edition 8.1 before 8.1-67.7, 9.0 before 9.0-70.5, and 9.1 before 9.1-96.4 allows remote attackers to execute arbitrary code via crafted HTTP header data.
22 CVE-2011-2780 22 Dir. Trav. 2011-07-19 2017-08-28
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in includes/lib/gz.php in Chyrp 2.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, a different vulnerability than CVE-2011-2744.
23 CVE-2011-2779 264 2011-07-19 2017-08-28
3.6
 None Local Low Not required None Partial Partial
Windows Event Log SmartConnector in HP ArcSight Connector Appliance before 6.1 uses world-writable permissions for exported report files, which allows local users to change or delete log data by modifying a file, a different vulnerability than CVE-2011-0770.
24 CVE-2011-2761 399 DoS 2011-07-18 2017-09-18
4.3
 None Remote Medium Not required None None Partial
Google Chrome 14.0.794.0 does not properly handle a reload of a page generated in response to a POST, which allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted web site, related to GetWidget methods.
25 CVE-2011-2760 264 Bypass 2011-07-17 2017-08-28
5.0
 None Remote Low Not required None Partial None
Brocade BigIron RX switches allow remote attackers to bypass ACL rules by using 179 as the source port of a packet.
26 CVE-2011-2759 200 +Info 2011-07-17 2017-08-28
5.0
 None Remote Low Not required Partial None None
The login page of IDSWebApp in the Web Administration Tool in IBM Tivoli Directory Server (TDS) 6.2 before 6.2.0.3-TIV-ITDS-IF0004 does not have an off autocomplete attribute for authentication fields, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.
27 CVE-2011-2758 287 +Info 2011-07-17 2011-07-19
5.0
 None Remote Low Not required Partial None None
IDSWebApp in the Web Administration Tool in IBM Tivoli Directory Server (TDS) 6.2 before 6.2.0.3-TIV-ITDS-IF0004 does not require authentication for access to LDAP Server log files, which allows remote attackers to obtain sensitive information via a crafted URL.
28 CVE-2011-2757 22 1 Dir. Trav. 2011-07-17 2011-07-19
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0.0.12 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the FILENAME parameter. NOTE: this might overlap the US-CERT VU#543310 issue.
29 CVE-2011-2756 287 2011-07-17 2011-07-19
5.0
 None Remote Low Not required Partial None None
FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0 before Build 8012 does not require authentication, which allows remote attackers to read files from a specific directory via unspecified vectors.
30 CVE-2011-2755 22 Dir. Trav. 2011-07-17 2011-07-19
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0 before Build 8012 allows remote attackers to read arbitrary files via unspecified vectors.
31 CVE-2011-2754 79 XSS 2011-07-17 2011-07-19
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the PageBuilder2 (aka Page Builder) theme in IBM WebSphere Portal 7.x before 7.0.0.1 CF006, as used in IBM Web Content Manager (WCM) and other products, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
32 CVE-2011-2753 352 CSRF 2011-07-17 2017-08-28
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to hijack the authentication of unspecified victims via vectors involving (1) the empty trash implementation and (2) the Index Order (aka options_order) page, a different issue than CVE-2010-4555.
33 CVE-2011-2752 94 2011-07-17 2017-08-28
5.8
 None Remote Medium Not required None Partial Partial
CRLF injection vulnerability in SquirrelMail 1.4.21 and earlier allows remote attackers to modify or add preference values via a \n (newline) character, a different vulnerability than CVE-2010-4555.
34 CVE-2011-2751 89 Exec Code Sql 2011-07-17 2011-07-19
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Parodia before 6.809 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
35 CVE-2011-2750 399 2011-07-17 2011-09-21
5.0
 None Remote Low Not required None None Partial
NFRAgent.exe in Novell File Reporter 1.0.4.2 and earlier allows remote attackers to delete arbitrary files via a full pathname in an SRS OPERATION 4 CMD 5 request to /FSF/CMD.
36 CVE-2011-2747 94 Exec Code 2011-07-28 2017-08-28
9.3
 None Remote Medium Not required Complete Complete Complete
Google Picasa before 3.6 Build 105.67 does not properly handle invalid properties in JPEG images, which allows remote attackers to execute arbitrary code via a crafted image file.
37 CVE-2011-2745 264 Exec Code 2011-07-26 2011-09-21
6.5
 None Remote Low Single system Partial Partial Partial
upload_handler.php in the swfupload extension in Chyrp 2.0 and earlier relies on client-side JavaScript code to restrict the file extensions of uploaded files, which allows remote authenticated users to upload a .php file, and consequently execute arbitrary PHP code, via a write_post action to the default URI under admin/.
38 CVE-2011-2744 22 Exec Code Dir. Trav. 2011-07-19 2017-08-28
6.8
 None Remote Medium Not required Partial Partial Partial
Directory traversal vulnerability in Chyrp 2.1 and earlier allows remote attackers to include and execute arbitrary local files via a ..%2F (encoded dot dot slash) in the action parameter to the default URI.
39 CVE-2011-2743 79 XSS 2011-07-19 2017-08-28
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Chyrp 2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the action parameter to (1) the default URI or (2) includes/javascript.php, or the (3) title or (4) body parameter to admin/help.php.
40 CVE-2011-2710 79 XSS 2011-07-27 2011-11-25
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.7.0 allow remote attackers to inject arbitrary web script or HTML via (1) the URI to includes/application.php, reachable through index.php; and, when Internet Explorer or Konqueror is used, (2) allow remote attackers to inject arbitrary web script or HTML via the searchword parameter in a search action to index.php in the com_search component. NOTE: vector 2 exists because of an incomplete fix for CVE-2011-2509.5.
41 CVE-2011-2697 20 Exec Code 2011-07-29 2017-08-28
6.8
 None Remote Medium Not required Partial Partial Partial
foomatic-rip-hplip in HP Linux Imaging and Printing (HPLIP) 3.11.5 allows remote attackers to execute arbitrary code via a crafted *FoomaticRIPCommandLine field in a .ppd file.
42 CVE-2011-2696 119 DoS Exec Code Overflow 2011-07-26 2011-10-05
6.8
 None Remote Medium Not required Partial Partial Partial
Integer overflow in libsndfile before 1.0.25 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PARIS Audio Format (PAF) file that triggers a heap-based buffer overflow.
43 CVE-2011-2695 189 DoS 2011-07-28 2012-03-19
4.9
 None Local Low Not required None None Complete
Multiple off-by-one errors in the ext4 subsystem in the Linux kernel before 3.0-rc5 allow local users to cause a denial of service (BUG_ON and system crash) by accessing a sparse file in extent format with a write operation involving a block number corresponding to the largest possible 32-bit unsigned integer.
44 CVE-2011-2694 79 XSS 2011-07-29 2017-08-28
2.6
 None Remote High Not required None Partial None
Cross-site scripting (XSS) vulnerability in the chg_passwd function in web/swat.c in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.10 allows remote authenticated administrators to inject arbitrary web script or HTML via the username parameter to the passwd program (aka the user field to the Change Password page).
45 CVE-2011-2692 119 DoS Overflow Mem. Corr. 2011-07-17 2017-08-28
4.3
 None Remote Medium Not required None None Partial
The png_handle_sCAL function in pngrutil.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4 does not properly handle invalid sCAL chunks, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a crafted PNG image that triggers the reading of uninitialized memory.
46 CVE-2011-2691 DoS 2011-07-17 2017-08-28
5.0
 None Remote Low Not required None None Partial
The png_err function in pngerror.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4 makes a function call using a NULL pointer argument instead of an empty-string argument, which allows remote attackers to cause a denial of service (application crash) via a crafted PNG image.
47 CVE-2011-2690 119 Overflow 2011-07-17 2017-08-28
6.8
 None Remote Medium Not required Partial Partial Partial
Buffer overflow in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4, when used by an application that calls the png_rgb_to_gray function but not the png_set_expand function, allows remote attackers to overwrite memory with an arbitrary amount of data, and possibly have unspecified other impact, via a crafted PNG image.
48 CVE-2011-2689 399 DoS 2011-07-28 2017-08-28
4.9
 None Local Low Not required None None Complete
The gfs2_fallocate function in fs/gfs2/file.c in the Linux kernel before 3.0-rc1 does not ensure that the size of a chunk allocation is a multiple of the block size, which allows local users to cause a denial of service (BUG and system crash) by arranging for all resource groups to have too little free space.
49 CVE-2011-2688 89 Exec Code Sql 2011-07-28 2017-08-28
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in mysql/mysql-auth.pl in the mod_authnz_external module 3.2.5 and earlier for the Apache HTTP Server allows remote attackers to execute arbitrary SQL commands via the user field.
50 CVE-2011-2687 264 Bypass 2011-07-26 2015-09-03
7.5
 None Remote Low Not required Partial Partial Partial
Drupal 7.x before 7.3 allows remote attackers to bypass intended node_access restrictions via vectors related to a listing that shows nodes but lacks a JOIN clause for the node table.
Total number of vulnerabilities : 307   Page : 1 (This Page)2 3 4 5 6 7
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.