CVE-2011-5049

MySQL 5.5.8, when running on Windows, allows remote attackers to cause a denial of service NULL pointer dereference via a crafted packet to TCP port 3306...

CVE-2011-5051

Summary: CVE-2011-5051 affects the WP Symposium WordPress plugin prior to 11.12.24. The vulnerability is an unrestricted file upload in two endpoints (uploadify/upload_admin_avatar.php and uploadify/upload_profile_avatar.php). An attacker could upload a file with an executable extension and then ...

CVE-2011-4921

The CVE-2011-4921 entry describes a SQL injection in e107:9 usersettings.php affecting e107 0.7.26 and possibly earlier versions before 1.0.0. The flaw allows remote attackers to execute arbitrary SQL commands via the username parameter. Connected sources corroborate the vulnerability but do not ...

CVE-2011-5050

SQL injection vulnerability in corporate/Controller in Elitecore Technologies Cyberoam UTM before 10.01.2 build 059 allows remote authenticated administrators to execute arbitrary SQL commands via the tableid parameter. NOTE: some of these details are obtained from third party information...

CVE-2011-4920

CVE-2011-4920 describes multiple cross-site scripting (XSS) vulnerabilities in e107 0.7.26 and other versions before 1.0.0. The issues allow remote attackers to inject arbitrary web script or HTML via specific URLs/components: (1) e107_images/thumb.php, (2) rate.php, (3) the resend_name parameter...

CVE-2011-5050

An active CVE describes an SQL injection in Elitecore Technologies’ Cyberoam UTM (corporate/Controller) prior to version 10.01.2 build 059. The vulnerability allows remote authenticated administrators to inject arbitrary SQL via the tableid parameter, enabling potential data exposure or modificat...

CVE-2011-5049

CVE-2011-5049 affects MySQL 5.5.8 on Windows. A remote attacker can trigger a denial-of-service through a crafted packet sent to TCP port 3306, caused by a NULL pointer dereference in the server. Connected advisories corroborate a remote DoS due to a NULL pointer dereference in the MySQL database...

CVE-2011-5052

CVE-2011-5052 affects CoCSoft Stream Down (Windows) up to version 6.8.0. The vulnerability is a stack-based buffer overflow in the HTTP client implementation when handling responses, allowing a remote attacker to trigger arbitrary code execution by delivering a specially crafted long HTTP respons...

CVE-2011-1384

CVE-2011-1384 affects IBM Inventory Scout (invscout.rte) on AIX: the binaries bin/invscoutClient_VPD_Survey and sbin/invscout_lsvpd prior to 2.2.0.19 are exposed to a symlink attack that lets local users delete arbitrary files or cause inventory scout operations on arbitrary files. Affected platf...

CVE-2011-1386

The CVE concerns IBM Tivoli Federated Identity Manager (TFIM) and TFIMBG versions 6.1.1, 6.2.0, and 6.2.1, where signature validation for SAML 1.0/1.1/2.0 is not performed correctly. This allows remote attackers to bypass authentication or authorization by submitting a non-conforming SAML signatu...

CVE-2011-3337

CVE-2011-3337 affects eEye Retina Network Security Scanner (HP-UX, IRIX, Solaris). An audit script (Audit ID 2499) can execute arbitrary code via a Trojan gauntlet placed under /usr/local, enabling local privilege escalation to the same privileges as the Retina scanner. The issue stems from the a...

phpMyAdmin 3.4.9之前版本多个跨站脚本执行漏洞

BUGTRAQ ID: 51226 CVE ID: CVE-2011-4780 phpMyAdmin是一个用PHP编写的，可以通过web方式控制和操作MySQL数据库。 phpMyAdmin在libraries/displayexport.lib.php的实现上存在多个跨站脚本执行漏洞，通过特制的URL参数，攻击者可利用这些漏洞在服务器、数据库、表格的导出面板上造成XSS，可在受影响站点的用户浏览器中执行任意脚本代码，窃取Cookie身份验证凭证。 0 phpMyAdmin 3.4.x 厂商补丁： phpMyAdmin ----------...

CVE-2011-4614

creationtimestamp| type| source ---|---|--- 2012-01-04 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/18308...

CVE-2011-5209

creationtimestamp| type| source ---|---|--- 2012-01-04 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/36492...

CVE-2011-5252

creationtimestamp| type| source ---|---|--- 2012-01-04 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/36493...

Adobe Reader U3D Memory Corruption

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' require 'zlib' class Metasploit3...

CVE-2011-4197

etc/inc/certs.inc in the PKI implementation in pfSense before 2.0.1 creates each X.509 certificate with a true value for the CA basic constraint, which allows remote attackers to create sub-certificates for arbitrary subjects by leveraging the private key...

CVE-2011-4197

CVE-2011-4197 concerns pfSense PKI before 2.0.1, where etc/inc/certs.inc sets the CA basic constraint to true for every issued X.509 certificate. This allows a holder of a pfSense-issued private key to create sub-certificates for arbitrary subjects. The entry is supported by NVD details and Matta...

CVE-2011-5048

IBM Web Experience Factory (WEF, aka WebSphere Portlet Factory) versions 7.0 and 7.0.1 are reported vulnerable to multiple XSS issues. The vulnerabilities allow remote attackers to inject arbitrary script/HTML through (1) text INPUT elements and (2) TEXTAREA elements, with the issue described as ...

CVE-2011-5047

The CVE-2011-5047 issue affects pfSense prior to 2.0.1, where an XSS vulnerability exists in status_rrd_graph.php via the style parameter. An unauthenticated or remote attacker could inject arbitrary web script or HTML, potentially impacting basic web UI integrity. Remediation, per the sources, i...