CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In August 2011

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Copy Results Download Results Select Table
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2011-3268 119 Overflow 2011-08-25 2012-02-03
10.0
 None Remote Low Not required Complete Complete Complete
Buffer overflow in the crypt function in PHP before 5.3.7 allows context-dependent attackers to have an unspecified impact via a long salt argument, a different vulnerability than CVE-2011-2483.
2 CVE-2011-3267 399 DoS 2011-08-25 2012-02-03
5.0
 None Remote Low Not required None None Partial
PHP before 5.3.7 does not properly implement the error_log function, which allows context-dependent attackers to cause a denial of service (application crash) via unspecified vectors.
3 CVE-2011-3266 399 DoS 2011-08-23 2012-08-13
2.6
 None Remote High Not required None None Partial
The proto_tree_add_item function in Wireshark 1.6.0 through 1.6.1 and 1.4.0 through 1.4.8, when the IKEv1 protocol dissector is used, allows user-assisted remote attackers to cause a denial of service (infinite loop) via vectors involving a malformed IKE packet and many items in a tree.
4 CVE-2011-3265 200 +Info 2011-08-19 2011-09-22
5.0
 None Remote Low Not required Partial None None
popup.php in Zabbix before 1.8.7 allows remote attackers to read the contents of arbitrary database tables via a modified srctbl parameter.
5 CVE-2011-3264 200 +Info 2011-08-19 2011-09-06
5.0
 None Remote Low Not required Partial None None
Zabbix before 1.8.6 allows remote attackers to obtain sensitive information via an invalid srcfld2 parameter to popup.php, which reveals the installation path in an error message.
6 CVE-2011-3263 399 DoS 2011-08-19 2011-09-06
5.0
 None Remote Low Not required None None Partial
zabbix_agentd in Zabbix before 1.8.6 and 1.9.x before 1.9.4 allows context-dependent attackers to cause a denial of service (CPU consumption) by executing the vfs.file.cksum command for a special device, as demonstrated by the /dev/urandom device.
7 CVE-2011-3262 399 DoS 2011-08-19 2011-09-06
2.1
 None Local Low Not required None None Partial
tools/libxc/xc_dom_bzimageloader.c in Xen 3.2, 3.3, 4.0, and 4.1 allows local users to cause a denial of service (management software infinite loop and management domain resource consumption) via unspecified vectors related to "Lack of error checking in the decompression loop."
8 CVE-2011-3192 399 1 DoS 2011-08-29 2012-10-29
7.8
 None Remote Low Not required None None Complete
The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086.
9 CVE-2011-3190 264 Bypass +Info 2011-08-31 2013-06-04
7.5
 None Remote Low Not required Partial Partial Partial
Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, 5.5.0 through 5.5.33, and possibly other versions allow remote attackers to spoof AJP requests, bypass authentication, and obtain sensitive information by causing the connector to interpret a request body as a new request.
10 CVE-2011-3189 310 Bypass 2011-08-25 2012-02-03
4.3
 None Remote Medium Not required Partial None None
The crypt function in PHP 5.3.7, when the MD5 hash type is used, returns the value of the salt argument instead of the hashed string, which might allow remote attackers to bypass authentication via an arbitrary password, a different vulnerability than CVE-2011-2483.
11 CVE-2011-3187 20 Bypass 2011-08-29 2012-07-06
4.3
 None Remote Medium Not required None Partial None
The to_s method in actionpack/lib/action_dispatch/middleware/remote_ip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For header in requests from IP addresses on a Class C network, which might allow remote attackers to inject arbitrary text into log files or bypass intended address parsing via a crafted header.
12 CVE-2011-3186 94 Http R.Spl. 2011-08-29 2012-07-06
4.3
 None Remote Medium Not required None Partial None
CRLF injection vulnerability in actionpack/lib/action_controller/response.rb in Ruby on Rails 2.3.x before 2.3.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the Content-Type header.
13 CVE-2011-3185 20 2011-08-29 2011-08-30
9.3
 None Remote Medium Not required Complete Complete Complete
gtkutils.c in Pidgin before 2.10.0 on Windows allows user-assisted remote attackers to execute arbitrary programs via a file: URL in a message.
14 CVE-2011-3184 399 DoS 2011-08-29 2011-09-22
4.3
 None Remote Medium Not required None None Partial
The msn_httpconn_parse_data function in httpconn.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.0 does not properly handle HTTP 100 responses, which allows remote attackers to cause a denial of service (incorrect memory access and application crash) via vectors involving a crafted server message.
15 CVE-2011-3182 DoS Overflow 2011-08-25 2012-02-03
5.0
 None Remote Low Not required None None Partial
PHP before 5.3.7 does not properly check the return values of the malloc, calloc, and realloc library functions, which allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) or trigger a buffer overflow by leveraging the ability to provide an arbitrary value for a function argument, related to (1) ext/curl/interface.c, (2) ext/date/lib/parse_date.c, (3) ext/date/lib/parse_iso_intervals.c, (4) ext/date/lib/parse_tz.c, (5) ext/date/lib/timelib.c, (6) ext/pdo_odbc/pdo_odbc.c, (7) ext/reflection/php_reflection.c, (8) ext/soap/php_sdl.c, (9) ext/xmlrpc/libxmlrpc/base64.c, (10) TSRM/tsrm_win32.c, and (11) the strtotime function.
16 CVE-2011-3181 79 XSS 2011-08-29 2012-11-06
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in the Tracking feature in phpMyAdmin 3.3.x before 3.3.10.4 and 3.4.x before 3.4.4 allow remote attackers to inject arbitrary web script or HTML via a (1) table name, (2) column name, or (3) index name.
17 CVE-2011-3170 119 Exec Code Overflow 2011-08-19 2013-05-14
5.1
 None Remote High Not required Partial Partial Partial
The gif_read_lzw function in filter/image-gif.c in CUPS 1.4.8 and earlier does not properly handle the first code word in an LZW stream, which allows remote attackers to trigger a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted stream, a different vulnerability than CVE-2011-2896.
18 CVE-2011-3144 79 XSS 2011-08-16 2012-03-15
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Control Microsystems ClearSCADA 2005, 2007, and 2009 before R2.3 and R1.4, as used in SCX before 67 R4.5 and 68 R3.9, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
19 CVE-2011-3143 399 DoS Exec Code Mem. Corr. 2011-08-16 2012-03-15
10.0
 None Remote Low Not required Complete Complete Complete
Use-after-free vulnerability in Control Microsystems ClearSCADA 2005, 2007, and 2009 before R2.3 and R1.4, as used in SCX before 67 R4.5 and 68 R3.9, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified long strings that trigger heap memory corruption.
20 CVE-2011-3142 119 1 Exec Code Overflow 2011-08-16 2012-03-16
10.0
 None Remote Low Not required Complete Complete Complete
Stack-based buffer overflow in an ActiveX control in KVWebSvr.dll in WellinTech KingView 6.52 and 6.53 allows remote attackers to execute arbitrary code via a long second argument to the ValidateUser method.
21 CVE-2011-3141 119 DoS Exec Code Overflow 2011-08-16 2012-03-16
9.3
 None Remote Medium Not required Complete Complete Complete
Buffer overflow in the InBatch BatchField ActiveX control for Invensys Wonderware InBatch 8.1 SP1, 9.0, and 9.0 SP1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
22 CVE-2011-3140 264 Bypass 2011-08-15 2011-09-21
5.0
 None Remote Low Not required None Partial None
IBM Web Application Firewall, as used on the G400 IPS-G400-IB-1 and GX4004 IPS-GX4004-IB-2 appliances with update 31.030, does not properly handle query strings with multiple instances of the same parameter, which allows remote attackers to bypass intended intrusion prevention by dividing a dangerous parameter value into substrings, as demonstrated by a SQL statement that is split across multiple iid parameters and then sent to a .aspx file on an IIS web server.
23 CVE-2011-3138 Bypass 2011-08-12 2011-09-06
5.0
 None Remote Low Not required None Partial None
The LTPA STS module support implementation in IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.9 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.2.0 before 6.2.0.9 relies on a static instance of a Java Development Kit (JDK) class, which might allow attackers to bypass LTPA token signature verification by leveraging lack of thread safety.
24 CVE-2011-3137 2011-08-12 2011-09-06
10.0
 None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in the Management Console in IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.9 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.2.0 before 6.2.0.9 has unknown impact and attack vectors, aka APAR IV03050.
25 CVE-2011-3136 2011-08-12 2012-04-25
10.0
 None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in the Management Console in IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.9 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.2.0 before 6.2.0.9 has unknown impact and attack vectors, aka APAR IV03048.
26 CVE-2011-3135 2011-08-12 2011-09-06
10.0
 None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in the Runtime in IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.9 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.2.0 before 6.2.0.9 has unknown impact and attack vectors.
27 CVE-2011-3130 89 Sql 2011-08-10 2012-06-28
7.5
 User Remote Low Not required Partial Partial Partial
wp-includes/taxonomy.php in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Taxonomy query hardening," possibly involving SQL injection.
28 CVE-2011-3129 264 2011-08-10 2012-06-28
9.3
 None Remote Medium Not required Complete Complete Complete
The file upload functionality WordPress 3.1 before 3.1.3 and 3.2 before Beta 2, when running "on hosts with dangerous security settings," has unknown impact and attack vectors, possibly related to dangerous filenames.
29 CVE-2011-3128 200 +Info 2011-08-10 2012-06-28
5.0
 None Remote Low Not required Partial None None
WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 treats unattached attachments as published, which might allow remote attackers to obtain sensitive data via vectors related to wp-includes/post.php.
30 CVE-2011-3127 20 2011-08-10 2012-06-28
5.8
 None Remote Medium Not required Partial Partial None
WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 does not prevent rendering for (1) admin or (2) login pages inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.
31 CVE-2011-3126 200 +Info 2011-08-10 2012-06-28
5.0
 None Remote Low Not required Partial None None
WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 allows remote attackers to determine usernames of non-authors via canonical redirects.
32 CVE-2011-3125 2011-08-10 2012-06-28
10.0
 None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Various security hardening."
33 CVE-2011-3124 264 +Priv 2011-08-10 2012-06-15
7.2
 None Local Low Not required Complete Complete Complete
IBM InfoSphere Information Server 8.5 and 8.5.0.1 on Unix and Linux, as used in IBM InfoSphere DataStage 8.5 and 8.5.0.1 and other products, assigns incorrect ownership to unspecified files, which allows local users to gain privileges via unknown vectors.
34 CVE-2011-3123 264 +Priv 2011-08-10 2012-06-15
7.2
 None Local Low Not required Complete Complete Complete
IBM InfoSphere Information Server 8.5 and 8.5.0.1 on Unix and Linux, as used in IBM InfoSphere DataStage 8.5 and 8.5.0.1 and other products, uses weak permissions for unspecified files, which allows local users to gain privileges via unknown vectors.
35 CVE-2011-3122 2011-08-10 2012-06-28
10.0
 None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Media security."
36 CVE-2011-3014 264 +Info 2011-08-09 2011-09-06
5.0
 None Remote Low Not required Partial None None
The Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 does not properly restrict caching of HTTPS responses, which makes it easier for remote attackers to obtain sensitive information by leveraging an unattended workstation.
37 CVE-2011-3013 310 2011-08-09 2011-09-06
5.0
 None Remote Low Not required Partial None None
WebAdmin in the Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 supports weak SSL ciphers, which makes it easier for remote attackers to obtain access via a brute-force attack.
38 CVE-2011-3012 20 Exec Code 2011-08-09 2011-09-21
10.0
 None Remote Low Not required Complete Complete Complete
The ioQuake3 engine, as used in World of Padman 1.2 and earlier, Tremulous 1.1.0, and ioUrbanTerror 2007-12-20, does not check for dangerous file extensions before writing to the quake3 directory, which allows remote attackers to execute arbitrary code via a crafted third-party addon that creates a Trojan horse DLL file, a different vulnerability than CVE-2011-2764.
39 CVE-2011-3011 200 Exec Code +Info 2011-08-15 2011-09-21
5.0
 None Remote Low Not required Partial None None
BaseServiceImpl.class in CA ARCserve D2D r15 does not properly handle sessions, which allows remote attackers to obtain credentials, and consequently execute arbitrary commands, via unspecified vectors.
40 CVE-2011-3009 310 2011-08-05 2012-11-06
5.0
 None Remote Low Not required Partial None None
Ruby before 1.8.6-p114 does not reset the random seed upon forking, which makes it easier for context-dependent attackers to predict the values of random numbers by leveraging knowledge of the number sequence obtained in a different child process, a related issue to CVE-2003-0900.
41 CVE-2011-3008 16 +Info 2011-08-05 2011-08-08
5.0
 None Remote Low Not required Partial None None
The default configuration of Avaya Secure Access Link (SAL) Gateway 1.5, 1.8, and 2.0 contains certain domain names in the Secondary Core Server URL and Secondary Remote Server URL fields, which allows remote attackers to obtain sensitive information by leveraging administrative access to these domain names, as demonstrated by alarm and log information.
42 CVE-2011-3007 94 2011-08-10 2011-09-06
6.8
 None Remote Medium Not required Partial Partial Partial
The myCIOScn ActiveX control (myCIOScn.dll) in McAfee SaaS Endpoint Protection 5.2.1 and earlier allows remote attackers to write to arbitrary files by specifying an arbitrary filename in the MyCioScan.Scan.ReportFile parameter, as demonstrated by injecting script into a log file and executing arbitrary code using the MyCioScan.Scan.Start method.
43 CVE-2011-3006 264 Exec Code XSS Bypass 2011-08-10 2011-09-06
6.8
 None Remote Medium Not required Partial Partial Partial
The MyAsUtil ActiveX control in MyAsUtil5.2.0.603.dll in McAfee SaaS Endpoint Protection 5.2.1 and earlier allows remote attackers to bypass the MyASUtil.SecureObjectFactory.CreateSecureObject domain execution policy using a cross-site scripting (XSS) attack, execute arbitrary code using the MyASUtil.InstallInfo.RunUserProgram function, and possibly conduct other unspecified attacks.
44 CVE-2011-2993 264 +Priv Bypass 2011-08-18 2012-04-24
9.3
 None Remote Medium Not required Complete Complete Complete
The implementation of digital signatures for JAR files in Mozilla Firefox 4.x through 5, SeaMonkey 2.x before 2.3, and possibly other products does not prevent calls from unsigned JavaScript code to signed code, which allows remote attackers to bypass the Same Origin Policy and gain privileges via a crafted web site, a different vulnerability than CVE-2008-2801.
45 CVE-2011-2992 119 DoS Exec Code Overflow Mem. Corr. 2011-08-18 2012-12-18
10.0
 None Remote Low Not required Complete Complete Complete
The Ogg reader in the browser engine in Mozilla Firefox 4.x through 5, SeaMonkey 2.x before 2.3, Thunderbird before 6, and possibly other products allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors.
46 CVE-2011-2991 119 DoS Exec Code Overflow Mem. Corr. 2011-08-18 2012-12-18
10.0
 None Remote Low Not required Complete Complete Complete
The browser engine in Mozilla Firefox 4.x through 5, SeaMonkey 2.x before 2.3, Thunderbird before 6, and possibly other products does not properly implement JavaScript, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors.
47 CVE-2011-2990 255 +Info 2011-08-18 2011-10-27
5.0
 None Remote Low Not required Partial None None
The implementation of Content Security Policy (CSP) violation reports in Mozilla Firefox 4.x through 5, SeaMonkey 2.x before 2.3, and possibly other products does not remove proxy-authorization credentials from the listed request headers, which allows attackers to obtain sensitive information by reading a report, related to incorrect host resolution that occurs with certain redirects.
48 CVE-2011-2989 119 DoS Exec Code Overflow Mem. Corr. 2011-08-18 2012-12-18
10.0
 None Remote Low Not required Complete Complete Complete
The browser engine in Mozilla Firefox 4.x through 5, SeaMonkey 2.x before 2.3, Thunderbird before 6, and possibly other products does not properly implement WebGL, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors.
49 CVE-2011-2988 119 DoS Exec Code Overflow 2011-08-18 2012-12-18
10.0
 None Remote Low Not required Complete Complete Complete
Buffer overflow in an unspecified string class in the WebGL shader implementation in Mozilla Firefox 4.x through 5, Thunderbird before 6, SeaMonkey 2.x before 2.3, and possibly other products allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a long source-code block for a shader.
50 CVE-2011-2987 119 Exec Code Overflow 2011-08-18 2012-12-18
10.0
 None Remote Low Not required Complete Complete Complete
Heap-based buffer overflow in Almost Native Graphics Layer Engine (ANGLE), as used in the WebGL implementation in Mozilla Firefox 4.x through 5, Thunderbird before 6, SeaMonkey 2.x before 2.3, and possibly other products might allow remote attackers to execute arbitrary code via unspecified vectors.
Total number of vulnerabilities : 294   Page : 1 (This Page)2 3 4 5 6
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.