CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In January 2011

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Copy Results Download Results Select Table
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2011-0688 287 Exec Code 2011-01-31 2013-02-06
9.3
 None Remote Medium Not required Complete Complete Complete
Intel Alert Management System (aka AMS or AMS2), as used in Symantec Antivirus Corporate Edition (SAVCE) 10.x before 10.1 MR10, Symantec System Center (SSC) 10.x, and Symantec Quarantine Server 3.5 and 3.6, allows remote attackers to execute arbitrary commands via crafted messages over TCP, as discovered by Junaid Bohio, a different vulnerability than CVE-2010-0110 and CVE-2010-0111. NOTE: some of these details are obtained from third party information.
2 CVE-2011-0687 20 DoS 2011-01-31 2011-07-18
4.3
 None Remote Medium Not required None None Partial
Opera before 11.01 does not properly implement Wireless Application Protocol (WAP) dropdown lists, which allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted WAP document.
3 CVE-2011-0686 DoS 2011-01-31 2011-07-18
5.0
 None Remote Low Not required None None Partial
Unspecified vulnerability in Opera before 11.01 allows remote attackers to cause a denial of service (application crash) via unknown content on a web page, as demonstrated by vkontakte.ru.
4 CVE-2011-0685 20 2011-01-31 2011-07-18
2.1
 None Local Low Not required None Partial None
The Delete Private Data feature in Opera before 11.01 does not properly implement the "Clear all email account passwords" option, which might allow physically proximate attackers to access an e-mail account via an unattended workstation.
5 CVE-2011-0684 20 +Info 2011-01-31 2011-07-18
5.0
 None Remote Low Not required Partial None None
Opera before 11.01 does not properly handle redirections and unspecified other HTTP responses, which allows remote web servers to obtain sufficient access to local files to use these files as page resources, and consequently obtain potentially sensitive information from the contents of the files, via an unknown response manipulation.
6 CVE-2011-0683 264 2011-01-31 2011-07-18
4.3
 None Remote Medium Not required None Partial None
Opera before 11.01 does not properly restrict the use of opera: URLs, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.
7 CVE-2011-0682 119 DoS Exec Code Overflow Mem. Corr. 2011-01-31 2011-08-26
9.3
 None Remote Medium Not required Complete Complete Complete
Integer truncation error in opera.dll in Opera before 11.01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via an HTML form with a select element that contains a large number of children.
8 CVE-2011-0681 Bypass 2011-01-31 2011-07-18
4.3
 None Remote Medium Not required None Partial None
The Cascading Style Sheets (CSS) Extensions for XML implementation in Opera before 11.01 recognizes links to javascript: URLs in the -o-link property, which makes it easier for remote attackers to bypass CSS filtering via a crafted URL.
9 CVE-2011-0680 2011-01-31 2011-02-12
5.0
 None Remote Low Not required Partial None None
data/WorkingMessage.java in the Mms application in Android before 2.2.2 and 2.3.x before 2.3.2 does not properly manage the draft cache, which allows remote attackers to read SMS messages intended for other recipients in opportunistic circumstances via a standard text messaging service.
10 CVE-2011-0679 200 +Info 2011-01-28 2011-05-27
5.0
 None Remote Low Not required Partial None None
IBM WebSphere Portal 6.0.1.1 through 7.0.0.0, as used in IBM Lotus Web Content Management (WCM) and IBM Lotus Quickr for WebSphere Portal, allows remote attackers to obtain sensitive information via a "modified message."
11 CVE-2011-0678 Exec Code 2011-01-28 2011-02-17
6.8
 None Remote Medium Not required Partial Partial Partial
Unrestricted file upload vulnerability in the EasyEdit module in Lomtec ActiveWeb Professional 3.0 allows remote attackers to execute arbitrary code by uploading an executable file via the UploadDirectory and Accepted Extensions fields in the getImagefile component of EasyEdit.cfm.
12 CVE-2011-0652 20 1 DoS 2011-01-28 2011-02-04
2.1
 None Local Low Not required None None Partial
lnsfw1.sys 6.0.2900.5512 in Look 'n' Stop Firewall 2.06p4 and 2.07 allows local users to cause a denial of service (crash) via a crafted 0x80000064 IOCTL request that triggers an assertion failure. NOTE: some of these details are obtained from third party information.
13 CVE-2011-0651 119 Exec Code Overflow 2011-01-28 2011-01-31
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in the key exchange functionality in Icon Labs Iconfidant SSL Server before 1.3.0 allows remote attackers to execute arbitrary code via a client master key packet in which the sum of unspecified length fields is greater than a certain value.
14 CVE-2011-0650 352 Bypass CSRF 2011-01-28 2011-02-17
6.8
 None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in Greenbone Security Assistant (GSA) allows remote attackers to hijack the authentication of users for requests that send email via an OMP request to OpenVAS Manager. NOTE: this issue can be leveraged to bypass authentication requirements for exploiting CVE-2011-0018.
15 CVE-2011-0646 89 1 Exec Code Sql 2011-01-25 2011-01-28
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in viewfaqs.php in PHP LOW BIDS allows remote attackers to execute arbitrary SQL commands via the cat parameter.
16 CVE-2011-0645 89 Exec Code Sql 2011-01-25 2011-02-04
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in data.php in PHPCMS 2008 V2 allows remote attackers to execute arbitrary SQL commands via the where_time parameter in a get action.
17 CVE-2011-0644 89 1 Exec Code Sql 2011-01-25 2011-04-26
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in include/admin/model_field.class.php in PHPCMS 2008 V2 allows remote attackers to execute arbitrary SQL commands via the modelid parameter to flash_upload.php.
18 CVE-2011-0643 352 1 CSRF 2011-01-25 2011-02-05
6.8
 None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in admin/conf_users_edit.php in PHP Link Directory (phpLD) 4.1.0 allows remote attackers to hijack the authentication of administrators for requests that add an administrator via the N action.
19 CVE-2011-0642 352 1 CSRF 2011-01-25 2011-04-26
4.3
 None Remote Medium Not required None Partial None
Cross-site request forgery (CSRF) vulnerability in news/admin.php in N-13 News 3.4, 3.7, and 4.0 allows remote attackers to hijack the authentication of administrators for requests that create new users via the options action. NOTE: some of these details are obtained from third party information.
20 CVE-2011-0641 79 XSS 2011-01-25 2011-02-05
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/admin.php in the StatPressCN plugin 1.9.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) what1, (2) what2, (3) what3, (4) what4, and (5) what5 parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
21 CVE-2011-0640 16 2011-01-24 2011-04-28
6.9
 None Local Medium Not required Complete Complete Complete
The default configuration of udev on Linux does not warn the user before enabling additional Human Interface Device (HID) functionality over USB, which allows user-assisted attackers to execute arbitrary programs via crafted USB data, as demonstrated by keyboard and mouse data sent by malware on a smartphone that the user connected to the computer.
22 CVE-2011-0639 16 2011-01-24 2011-04-28
6.9
 None Local Medium Not required Complete Complete Complete
Apple Mac OS X does not properly warn the user before enabling additional Human Interface Device (HID) functionality over USB, which allows user-assisted attackers to execute arbitrary programs via crafted USB data, as demonstrated by keyboard and mouse data sent by malware on a smartphone that the user connected to the computer.
23 CVE-2011-0638 16 2011-01-24 2011-07-18
6.9
 None Local Medium Not required Complete Complete Complete
Microsoft Windows does not properly warn the user before enabling additional Human Interface Device (HID) functionality over USB, which allows user-assisted attackers to execute arbitrary programs via crafted USB data, as demonstrated by keyboard and mouse data sent by malware on a smartphone that the user connected to the computer.
24 CVE-2011-0637 DoS 2011-01-24 2011-02-05
4.9
 None Local Low Not required None None Complete
The FC SCSI protocol driver in IBM AIX 6.1 does not verify that a timer is unused before deallocating this timer, which might allow attackers to cause a denial of service (system crash) via unspecified vectors.
25 CVE-2011-0636 200 +Info 2011-01-22 2011-09-16
2.1
 None Local Low Not required Partial None None
The (1) cudaHostAlloc and (2) cuMemHostAlloc functions in the NVIDIA CUDA Toolkit 3.2 developer drivers for Linux 260.19.26, and possibly other versions, do not initialize pinned memory, which allows local users to read potentially sensitive memory, such as file fragments during read or write operations.
26 CVE-2011-0635 94 1 2011-01-22 2011-02-05
6.0
 None Remote Medium Single system Partial Partial Partial
Static code injection vulnerability in Simploo CMS 1.7.1 and earlier allows remote authenticated users to inject arbitrary PHP code into config/custom/base.ini.php via the ftpserver parameter (FTP-Server field) to the sicore/updates/optionssav operation for index.php.
27 CVE-2011-0520 119 DoS Exec Code Overflow 2011-01-28 2011-04-08
7.5
 None Remote Low Not required Partial Partial Partial
The compress_add_dlabel_points function in dns/Compress.c in MaraDNS 1.4.03, 1.4.05, and probably other versions allows remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a long DNS hostname with a large number of labels, which triggers a heap-based buffer overflow.
28 CVE-2011-0519 89 1 Exec Code Sql 2011-01-20 2011-01-24
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in gallery.php in Gallarific PHP Photo Gallery script 2.1 and possibly other versions allows remote attackers to execute arbitrary SQL commands via the id parameter.
29 CVE-2011-0518 22 1 Dir. Trav. 2011-01-20 2011-01-24
5.1
 None Remote High Not required Partial Partial Partial
Directory traversal vulnerability in core/lib/router.php in LotusCMS Fraise 3.0, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via the system parameter to index.php.
30 CVE-2011-0517 119 1 DoS Exec Code Overflow 2011-01-20 2011-09-21
9.3
 None Remote Medium Not required Complete Complete Complete
Stack-based buffer overflow in Sielco Sistemi Winlog Pro 2.07.00 and earlier, when Run TCP/IP server is enabled, allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a crafted 0x02 opcode to TCP port 46823.
31 CVE-2011-0516 89 1 Exec Code Sql 2011-01-20 2011-01-21
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in mainx_a.php in E-PROMPT C BetMore Site Suite 4.0 through 4.2.0 allows remote attackers to execute arbitrary SQL commands via the bid parameter.
32 CVE-2011-0515 1 DoS 2011-01-20 2011-01-21
2.1
 None Local Low Not required None None Partial
KisKrnl.sys 2011.1.13.89 and earlier in Kingsoft AntiVirus 2011 SP5.2 allows local users to cause a denial of service (crash) via a crafted request that is not properly handled by the KiFastCallEntry hook.
33 CVE-2011-0514 119 1 DoS Overflow 2011-01-20 2011-01-24
5.0
 None Remote Low Not required None None Partial
The RDS service (rds.exe) in HP Data Protector Manager 6.11 allows remote attackers to cause a denial of service (crash) via a packet with a large data size to TCP port 1530.
34 CVE-2011-0513 20 1 Exec Code 2011-01-20 2011-01-21
7.2
 None Local Low Not required Complete Complete Complete
DCR.sys driver in SecurStar DriveCrypt 5.4, 5.3, and earlier allows local users to execute arbitrary code via a crafted argument to the 0x00073800 IOCTL.
35 CVE-2011-0512 89 1 Exec Code Sql 2011-01-20 2011-01-24
6.8
 None Remote Medium Not required Partial Partial Partial
SQL injection vulnerability in team.php in the Teams Structure module 3.0 for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the team_id parameter.
36 CVE-2011-0511 89 1 Exec Code Sql 2011-01-20 2011-01-27
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the allCineVid component (com_allcinevid) 1.0.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.
37 CVE-2011-0510 89 1 Exec Code Sql 2011-01-20 2011-01-21
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in cart.php in Advanced Webhost Billing System (AWBS) 2.9.2 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the oid parameter in an add_other action.
38 CVE-2011-0509 79 XSS 2011-01-20 2011-01-24
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Vaadin before 6.4.9 allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to the index page.
39 CVE-2011-0508 79 XSS 2011-01-20 2011-01-24
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in system/modules/comments/Comments.php in Contao CMS 2.9.2, and possibly other versions before 2.9.3, allows remote attackers to inject arbitrary web script or HTML via the HTTP X_FORWARDED_FOR header, which is stored by system/libraries/Environment.php but not properly handled by a comments action to main.php.
40 CVE-2011-0507 1 DoS 2011-01-20 2011-01-21
4.3
 None Remote Medium Not required None None Partial
FTPService.exe in Blackmoon FTP 3.1 Build 1735 and Build 1736 (3.1.7.1736), and possibly other versions before 3.1.8.1737, allows remote attackers to cause a denial of service (crash) via a large number of PORT commands with long arguments, which triggers a NULL pointer dereference. NOTE: some of these details are obtained from third party information.
41 CVE-2011-0506 22 1 Exec Code Dir. Trav. 2011-01-20 2011-01-24
6.8
 None Remote Medium Not required Partial Partial Partial
Directory traversal vulnerability in modules/profile/user.php in Ax Developer CMS (AxDCMS) 0.1.1 allows remote attackers to execute arbitrary code via a .. (dot dot) in the aXconf[default_language] parameter.
42 CVE-2011-0505 22 1 Dir. Trav. 2011-01-20 2011-01-24
5.1
 None Remote High Not required Partial Partial Partial
Directory traversal vulnerability in system/system.php in Zwii 2.1.1, when magic_quotes_gpc is disabled and register_globals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the set[template][value] parameter.
43 CVE-2011-0504 79 1 XSS 2011-01-20 2011-01-21
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in VaM Shop 1.6, 1.6.1, and probably earlier versions llow remote attackers to inject arbitrary web script or HTML via the (1) status parameter to admin/orders.php, (2) search parameter to admin/customers.php, or (3) STORE_NAME parameter to admin/configuration.php.
44 CVE-2011-0503 352 1 CSRF 2011-01-20 2011-01-24
6.8
 None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in VaM Shop 1.6, 1.6.1, and probably earlier versions allows remote attackers to hijack the authentication of administrators for requests that (1) change user status via admin/customers.php or (2) change user permissions via admin/accounting.php. NOTE: some of these details are obtained from third party information.
45 CVE-2011-0502 1 DoS 2011-01-20 2011-01-21
9.3
 None Remote Medium Not required Complete Complete Complete
Music Animation Machine MIDI Player 2006aug19 Release 035 and possibly other versions allows user-assisted remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a long line in a MIDI (.mid) file.
46 CVE-2011-0501 119 1 Exec Code Overflow 2011-01-20 2011-01-24
9.3
 None Remote Medium Not required Complete Complete Complete
Stack-based buffer overflow in Music Animation Machine MIDI Player 2006aug19 Release 035 and possibly other versions allows user-assisted remote attackers to execute arbitrary code via a long line in a .mamx file.
47 CVE-2011-0500 119 1 Exec Code Overflow 2011-01-20 2011-01-21
9.3
 None Remote Medium Not required Complete Complete Complete
Buffer overflow in VideoSpirit Pro 1.6.8.1, 1.68, and earlier; and VideoSpirit Lite 1.4.0.1 and possibly other versions; allows user-assisted remote attackers to execute arbitrary code via a VideoSpirit project (.visprj) file containing a valitem element with a long "value" attribute, as demonstrated using a valitem with the mp3 name.
48 CVE-2011-0499 119 Exec Code Overflow 2011-01-20 2011-02-01
9.3
 None Remote Medium Not required Complete Complete Complete
Buffer overflow in VideoSpirit Pro 1.6.8.1 and possibly earlier versions, and VideoSpirit Lite 1.4.0.1 and possibly other versions, allows user-assisted remote attackers to execute arbitrary code via a VideoSpirit project (.visprj) file containing a valitem element with a long "name" attribute. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
49 CVE-2011-0498 119 1 DoS Exec Code Overflow 2011-01-20 2011-01-24
9.3
 None Remote Medium Not required Complete Complete Complete
Stack-based buffer overflow in Nokia Multimedia Player 1.00.55.5010, and possibly other versions, allows user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long entry in a playlist (.npl) file.
50 CVE-2011-0497 22 Dir. Trav. 2011-01-20 2011-01-26
7.8
 None Remote Low Not required Complete None None
Directory traversal vulnerability in Sybase EAServer 6.x before 6.3 ESD#2, as used in Appeon, Replication Server Messaging Edition (RSME), and WorkSpace, allows remote attackers to read arbitrary files via "../\" (dot dot forward-slash backslash) sequences in a crafted request.
Total number of vulnerabilities : 396   Page : 1 (This Page)2 3 4 5 6 7 8
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.