CVE-2011-5032

The CVE-2011-5032 entry affects WinMount: WMDrive.sys driver IOCTL handling (WMDrive.sys 3.4.181.224 in WinMount 3.5.1018). The vulnerability is a local denial of service caused by a NULL pointer dereference in response to a crafted IOCTL (0x87342000) to the WMDriver device, leading to a system c...

CVE-2011-5029

CVE-2011-5029 affects Simple PHP Blog, version 0.7.0 (and possibly earlier). The vulnerability is a cross-site scripting (XSS) flaw in which an attacker can inject arbitrary web script or HTML via the following parameters: (1) entry parameter to delete.php and (2) category parameter to index.php....

CVE-2011-5032

WMDrive.sys 3.4.181.224 in WinMount 3.5.1018 allows local users to cause a denial of service NULL pointer dereference and system crash via a crafted 0x87342000 IOCTL request to the WMDriver device...

CVE-2011-5033

ConfigServer Security & Firewall (CSF) contains a stack-based buffer overflow in CFS.c affecting CSF before 5.43 when run on a DirectAdmin server. Local users can crash the service by supplying a long string in the admin.list file, per CVE-2011-5033. The vulnerability details are supported by mul...

CVE-2011-5028

CVE-2011-5028 is a directory traversal vulnerability in Novell Sentinel Log Manager, affecting 1.2.0.1_938 and earlier versions when used in Novell Sentinel before 7.0.1.0. The issue resides in novelllogmanager/FileDownload, where an authenticated user can supply a filename parameter containing a...

CVE-2011-5029

Multiple cross-site scripting XSS vulnerabilities in Simple PHP Blog 0.7.0 and possibly earlier allow remote attackers to inject arbitrary web script or HTML via the 1 entry parameter to delete.php or 2 category parameter to index.php...

CVE-2011-5031

CVE-2011-5031 describes multiple SQL injection vulnerabilities in the servlet/capexweb.parentvalidatepassword routine of cApexWEB 1.1 . The defects allow remote attackers to inject arbitrary SQL through the parameters dfuserid and dfpassword , potentially compromising data confidentiality and int...

CVE-2011-4615

CVE-2011-4615 affects Zabbix before 1.8.10, with multiple XSS vulnerabilities exploitable via the gname parameter on hostgroups.php, usergrps.php, and the update/maintenance-related actions (hosts.php, scripts.php, maintenance.php). Connected documents confirm Fedora advisories updating zabbix to...

Check Point response to "DoS through hash table against Web Application Platforms" (CVE-2011-4838)

...

CVE-2011-5027

The CVE-2011-5027 entry describes an XSS vulnerability in ZABBIX prior to version 1.8.10, exploitable via unspecified vectors related to the profiler. Public references in the connected documents indicate Fedora updates (FEDORA-2011-17559/17560) and OpenVAS entries recommending 1.8.10 as the fixe...

CVE-2011-5030

The CVE refers to a Cross-site scripting (XSS) vulnerability in the Drupal Meta tags quick module (7.x-2.x) prior to version 7.x-2.3. It allows remote authenticated users with certain permissions to inject arbitrary scripts/HTML via unspecified vectors (likely related to entity bundle names). Rem...

CVE-2011-4163

Summary of CVE-2011-4163 (HP Database Archiving Software 6.31) : The vulnerability arises in how the HP Database Archiving Software parses a received packet, using a signed length to copy data into a fixed stack buffer, causing a stack-based buffer overflow. This leads to remote code execution wi...

CVE-2011-4165

Summary (CVE-2011-4165) : HP Database Archiving Software 6.31 is affected by a remote code execution vulnerability identified as ZDI-12-099. The issue arises from how the application parses a received packet: it uses a signed length to copy data into a heap-based, fixed-size buffer, enabling heap...

CVE-2011-4164

Unspecified vulnerability in HP Database Archiving Software 6.31 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1214...

CVE-2011-4164

HP Database Archiving Software 6.31 is affected by CVE-2011-4164 via a GIOP parsing buffer overflow in HP DataDirect/OpenAccess components (SequeLink), enabling remote code execution. The advisory notes a trust of a packet size field into a fixed-size buffer leading to overflow and code execution...

CVE-2011-5025

Multiple cross-site scripting XSS vulnerabilities in the wiki application in Yaws 1.88 allow remote attackers to inject arbitrary web script or HTML via 1 the tag parameter to editTag.yaws, 2 the index parameter to showOldPage.yaws, 3 the node parameter to allRefsToMe.yaws, or 4 the text paramete...

CVE-2011-5025

Multiple cross-site scripting XSS vulnerabilities in the wiki application in Yaws 1.88 allow remote attackers to inject arbitrary web script or HTML via 1 the tag parameter to editTag.yaws, 2 the index parameter to showOldPage.yaws, 3 the node parameter to allRefsToMe.yaws, or 4 the text paramete...

CVE-2011-5023

The CVE-2011-5023 entry concerns a Cross-site Scripting (XSS) vulnerability in Pligg CMS 1.1.4 triggered by PATH_INFO to the search program. Root cause: improper handling of PATH_INFO leads to script/HTML injection. Impact: remote attackers could inject arbitrary web scripts or HTML. Affected sof...

CVE-2011-5022

Summary: CVE-2011-5022 affects Pligg CMS 1.1.2, with an SQL injection in search.php via the status parameter. The root cause is improper handling of user-supplied input in the search functionality, enabling arbitrary SQL execution by remote attackers. Impact (as stated): Remote attackers can exec...

CVE-2011-5025

CVE-2011-5025 concerns multiple XSS vulnerabilities in the Yaws wiki application (version 1.88). The affected component is the wiki web interface, with exploitable vectors including tag (editTag.yaws), index (showOldPage.yaws), node (allRefsToMe.yaws), and text (editPage.yaws). Root cause is impr...