CVE-2010-5049

The CVE-2010-5049 entry describes a SQL injection in Zabbix, reported for versions 1.8.1 and earlier, exploitable via the nav_time parameter in events.php. The underlying issue is improper input handling leading to arbitrary SQL execution on remote systems. Affected software/component: Zabbix (ev...

CVE-2011-4502

The UPnP IGD implementation in Edimax EdiLinux on the Edimax BR-6104K with firmware before 3.25, Edimax 6114Wg, Canyon-Tech CN-WF512 with firmware 1.83, Canyon-Tech CN-WF514 with firmware 2.08, Sitecom WL-153 with firmware before 1.39, and Sweex LB000021 with firmware 3.15 allows remote attackers...

ManageEngine ADSelfService Plus <= 4.5 Build 4521 XSS Vulnerability - Active Check

ManageEngine ADSelfService Plus is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

CVE-2011-3896

Buffer overflow in Google Chrome before 15.0.874.120 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to shader variable mapping...

iGuard Biometric Access Control - Multiple Vulnerabilities

Document Title: =============== iGuard Biometric Access Control - Multiple Vulnerabilities References Source: ==================== 2011/Q3-4 Release Date: ============= 2011-11-08 Vulnerability Laboratory ID VL-ID: ==================================== 104 Product & Service Introduction:...

Integer overflow

Integer signedness error in Apple QuickTime before 7.7.1 allows remote attackers to execute arbitrary code or cause a denial of service application crash via a crafted font table in a QuickTime movie file...

Design/Logic Flaw

Use-after-free vulnerability in Google Chrome before 15.0.874.102 allows user-assisted remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to editing operations in conjunction with an unknown plug-in...

CVE-2011-3881

WebKit, as used in Google Chrome before 15.0.874.102 and Android before 4.4, allows remote attackers to bypass the Same Origin Policy and conduct Universal XSS UXSS attacks via vectors related to 1 the DOMWindow::clear function and use of a selection object, 2 the...

Design/Logic Flaw

The ipv6 component in Cisco IOS before 15.14M1.3 allows remote attackers to conduct fingerprinting attacks and obtain potentially sensitive information about the presence of the IOS operating system via an ICMPv6 Echo Request packet containing a Hop-by-Hop HBH extension header EH with a 0x0c01050...

CVE-2011-3988

SQL injection vulnerability in data/class/SCQuery.php in EC-CUBE 2.11.0 through 2.11.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2011-3545

CVE-2011-3545 affects multiple Java runtimes: Oracle Java SE/JDK and JRE 6u27 and earlier, 5.0u31 and earlier, 1.4.2_33 and earlier, and JRockit R28.1.4 and earlier. The description credits an unspecified vulnerability in the Java Runtime Environment component related to Sound, allowing remote at...

CVE-2011-3294

Cross-site scripting XSS vulnerability in the login page in the administrative interface on Cisco TelePresence Video Communication Servers VCS with software before X7.0 allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header, aka Bug ID CSCts80342...

CVE-2011-3506

Unspecified vulnerability in the Oracle OpenSSO component in Oracle Sun Products Suite 7.1 and 8.0 allows remote attackers to affect integrity via unknown vectors related to Authentication...

Microsoft Patches 22 Security Holes, 12 Highly Exploitable, in October

Microsoft released eight security updates on Tuesday, repairing 22 security holes in its October patch release, with 12 of the 22 described as “consistently exploitable” by the company. The October patch release includes two bulletins that Microsoft rated “critical” to patch holes. The two...

CVE-2010-4933

SQL injection vulnerability in filemgmt/singlefile.php in Geeklog 1.3.8 allows remote attackers to execute arbitrary SQL commands via the lid parameter...

Remote file inclusion

PHP remote file inclusion vulnerability in formmailer.php in Kontakt Formular 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the scriptpfad parameter...

Sql injection

SQL injection vulnerability in the Yet Another Calendar keyac extension before 1.1.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2011-1768

The tunnels implementation in the Linux kernel before 2.6.34, when tunnel functionality is configured as a module, allows remote attackers to cause a denial of service OOPS by sending a packet during module loading...

Directory traversal

Directory traversal vulnerability in the Admin Defined Commands ADC feature in gitolite before 1.5.9.1 allows remote attackers to execute arbitrary commands via .. dot dot sequences in admin-defined commands...

Memory corruption

Memory leak in the Data-link switching aka DLSw feature in Cisco IOS 12.1 through 12.4 and 15.0 through 15.1, and IOS XE 3.1.xS before 3.1.3S and 3.2.xS before 3.2.1S, when implemented over Fast Sequence Transport FST, allows remote attackers to cause a denial of service memory consumption and...