CVE-2011-2501

The pngformatbuffer function in pngerror.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4 allows remote attackers to cause a denial of service application crash via a crafted PNG image that triggers an out-of-bounds read during the copying of...

CVE-2011-2507

libraries/serversynchronize.lib.php in the Synchronize implementation in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly quote regular expressions, which allows remote authenticated users to inject a PCRE e aka PREGREPLACEEVAL modifier, and consequently execute arbitrary...

CVE-2011-1860

CVE-2011-1860 affects HP Service Manager (versions 7.02, 7.11, 9.20, 9.21) and HP Service Center 6.2.8. The vulnerability enables remote attackers to capture HTTP session credentials, via unspecified vectors, with a CVSSv2 base score of 5.0 (Network, Low complexity, no authentication, partial con...

CVE-2011-2160

The VC-1 decoding functionality in FFmpeg before 0.5.4, as used in MPlayer and other products, does not properly restrict read operations, which allows remote attackers to have an unspecified impact via a crafted VC-1 file, a related issue to CVE-2011-0723...

Adobe Flash Player ActionScript DoABC Tag Integer Overflow (APSB11-12; CVE-2011-0618)

The Adobe Flash Player is a multimedia and application player that renders Shockwave Flash SWF files. A memory corruption vulnerability has been reported in Adobe Flash Player. The vulnerability is due to an integer overflow in the Adobe Flash Player when parsing specially crafted SWF files. A...

CVE-2011-1400

The default configuration of the shellescapecommands directive in conf/texmf.d/95NonPath.cnf in the tex-common package before 2.08.1 in Debian GNU/Linux squeeze, Ubuntu 10.10 and 10.04 LTS, and possibly other operating systems lists certain programs, which might allow remote attackers to execute...

CVE-2011-0430

Double free vulnerability in the Rx server process in OpenAFS 1.4.14, 1.4.12, 1.4.7, and possibly other versions allows remote attackers to cause a denial of service and execute arbitrary code via unknown vectors...

CVE-2011-0430

Double free vulnerability in the Rx server process in OpenAFS 1.4.14, 1.4.12, 1.4.7, and possibly other versions allows remote attackers to cause a denial of service and execute arbitrary code via unknown vectors...

CVE-2011-0986

phpMyAdmin 2.11.x before 2.11.11.2, and 3.3.x before 3.3.9.1, does not properly handle the absence of the 1 README, 2 ChangeLog, and 3 LICENSE files, which allows remote attackers to obtain the installation path via a direct request for a nonexistent file...

Directory traversal

Directory traversal vulnerability in osTicket 1.6 allows remote attackers to read arbitrary files via a .. dot dot in the file parameter to module.php, a different vector than CVE-2005-1439. NOTE: this issue has been disputed by a reliable third party...

Apple iOS Safari - 'decodeURIComponent' Remote Crash

Apple iPhone 3 Safari JavaScript - decodeURIComponent Remote Crash decodeURIComponent'$string'; "; iffileputcontents"./crash.html", $code echo"Point your safari mobile browser to crash.html.\r\n"; else echo"Cannot create file.\r\n"; ?...

CVE-2010-4020

MIT Kerberos 5 aka krb5 1.8.x through 1.8.3 does not reject RC4 key-derivation checksums, which might allow remote authenticated users to forge a 1 AD-SIGNEDPATH or 2 AD-KDC-ISSUED signature, and possibly gain privileges, by leveraging the small key space that results from certain one-byte...

Sql injection

SQL injection vulnerability in index.php in Jurpopage 0.2.0 allows remote attackers to execute arbitrary SQL commands via the category parameter...

Code injection

programs/pluto/xauth.c in the client in Openswan 2.6.26 through 2.6.28 allows remote authenticated gateways to execute arbitrary commands via shell metacharacters in the ciscobanner aka serverbanner field, a different vulnerability than CVE-2010-3308...

Mandriva Update for perl-libwww-perl MDVSA-2010:167 (perl-libwww-perl)

Check for the Version of perl-libwww-perl OpenVAS Vulnerability Test Mandriva Update for perl-libwww-perl MDVSA-2010:167 perl-libwww-perl Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribu...

KLA10361 ACE vulnerability in TeamViewer

An untrusted path vulnerability was found in TeamViewer. By exploiting this vulnerability malicious users can execute arbitrary code. This vulnerability can be exploited remotely via a library hijack. Original advisories - Exploitation Public exploits exist for this vulnerability. Related product...

VUPEN Security Research - Microsoft Internet Explorer "CIframeElement" Object Use-after-free Vulnerability (CVE-2010-2558)

VUPEN Security Research - Microsoft Internet Explorer "CIframeElement" Object Use-after-free Vulnerability CVE-2010-2558 http://www.vupen.com/english/research.php I. BACKGROUND --------------------- "Microsoft Internet Explorer is a web browser developed by Microsoft and included as part of the...

CVE-2010-2425

CVE-2010-2425 affects South River Technologies Titan FTP Server 8.10.1125 and earlier, with a directory traversal flaw in COMB command due to improper handling of ..// sequences that allows remote authenticated users to read or delete arbitrary files. OpenVAS entries classify Titan FTP Server

CVE-2010-2262

Galileo Students Team Weborf before 0.12.1 allows remote attackers to cause a denial of service crash via a crafted Range header...

MS10-040: Vulnerability in Internet Information Services Could Allow Remote Code Execution (982666)

A remote code execution vulnerability exists in Internet Information Services IIS. The vulnerability, which requires that the Extended Protection for Authentication feature be installed and enabled, is due to improper parsing of authentication information. An attacker who successfully exploited...