CVE-2011-0488: Improper Restriction of Operations within the Bounds of a Memory Buffer

Stack-based buffer overflow in NTWebServer.exe in the test web service in InduSoft NTWebServer, as distributed in Advantech Studio 6.1 and InduSoft Web Studio 7.0, allows remote attackers to cause a denial of service daemon crash or possibly execute arbitrary code via a long request to TCP port 8...

CVE-2010-3925: Undefined Security Weakness

Contents-Mall before 15 does not properly handle passwords, which allows remote attackers to discover the administrative password, and consequently obtain sensitive information or modify data, via unspecified vectors...

CVE-2010-4592: Undefined Security Weakness

The Mobile Network Connections functionality in the Connection Manager in IBM Lotus Mobile Connect before 6.1.4, when HTTP Access Services HTTP-AS is enabled, does not properly handle failed attempts at establishing HTTP-TCP sessions, which allows remote attackers to cause a denial of service...

CVE-2010-3943: Undefined Security Weakness

win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly link driver objects, which allows local users to gain privileges via a crafted application that...

CVE-2010-2579: Undefined Security Weakness

The cook codec in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.4, RealPlayer Enterprise 2.1.2, Mac RealPlayer 11.0 through 11.1, and Linux RealPlayer 11.0.2.1744 does not properly initialize the number of channels, which allows attackers to obtain unspecified "memory...

CVE-2010-4406: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in gallery.php in Brunetton LittlePhpGallery 1.0.2, when magicquotesgpc is disabled, allows remote attackers to list, include, and execute arbitrary local files via a ..// dot dot slash slash in the repertoire parameter...

CVE-2010-3715: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 the RemoveXSS function, and allow remote authenticated users to inject arbitrary web...

CVE-2010-4048: Improper Input Validation

Opera before 10.63 allows user-assisted remote web servers to cause a denial of service application crash by sending a redirect during the saving of a file...

CVE-2010-4047: Improper Neutralization of Input During Web Page Generation

Opera before 10.63 does not properly select the security context of JavaScript code associated with an error page, which allows user-assisted remote attackers to conduct cross-site scripting XSS attacks via a crafted web site...

CVE-2010-3550: Undefined Security Weakness

Unspecified vulnerability in the Java Web Start component in Oracle Java SE and Java for Business 6 Update 21 and 5.0 Update 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors...

CVE-2010-3501: Undefined Security Weakness

Unspecified vulnerability in the OID component in Oracle Fusion Middleware 10.1.2.3, 10.1.4.3, and 11.1.1.2.0 allows remote attackers to affect availability via unknown vectors...

CVE-2010-3490: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in page.recordings.php in the System Recordings component in the configuration interface in FreePBX 2.8.0 and earlier allows remote authenticated administrators to create arbitrary files via a .. dot dot in the usersnum parameter to admin/config.php, as...

CVE-2010-3477: Undefined Security Weakness

The tcfactpolicedump function in net/sched/actpolice.c in the actions implementation in the network queueing functionality in the Linux kernel before 2.6.36-rc4 does not properly initialize certain structure members, which allows local users to obtain potentially sensitive information from kernel...

CVE-2009-4984: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Accessories Me PHP Affiliate Script 1.4 allow remote attackers to inject arbitrary web script or HTML via the 1 Keywords parameter to search.php and 2 SearchIndex parameter to browse.php...

CVE-2010-2995: Undefined Security Weakness

The SigComp Universal Decompressor Virtual Machine UDVM in Wireshark 0.10.8 through 1.0.14 and 1.2.0 through 1.2.9 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via vectors related to sigcomp-udvm.c and an off-by-one error, which triggers a buffer...

CVE-2010-1901: Improper Control of Generation of Code

Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP2; Microsoft Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Word Viewer; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2 do not properly handle unspecified properties in rich tex...

CVE-2010-1894: Undefined Security Weakness

The Windows kernel-mode drivers in win32k.sys in Microsoft Windows XP SP2 and SP3, and Windows Server 2003 SP2, do not properly handle unspecified exceptions, which allows local users to gain privileges via a crafted application, aka "Win32k Exception Handling Vulnerability."...

CVE-2010-1578: Undefined Security Weakness

Unspecified vulnerability in the SunRPC inspection feature on Cisco Adaptive Security Appliances ASA 5500 series devices with software 7.2 before 7.25, 8.0 before 8.05.19, 8.1 before 8.12.47, and 8.2 before 8.22 and Cisco PIX Security Appliances 500 series devices allows remote attackers to cause...

CVE-2010-0912: Undefined Security Weakness

Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.2 allows remote attackers to affect integrity via unknown vectors...

CVE-2010-2252: Improper Input Validation

GNU Wget 1.12 and earlier uses a server-provided filename instead of the original URL to determine the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a 3xx redirect to a URL with a .wgetrc filename followed by a 3xx redirect to a URL wit...

CVE-2010-2091: Improper Neutralization of Input During Web Page Generation

Microsoft Outlook Web Access OWA 8.2.254.0, when Internet Explorer 7 on Windows Server 2003 is used, does not properly handle the id parameter in a Folder IPF.Note action to the default URI, which might allow remote attackers to obtain sensitive information or conduct cross-site scripting XSS...

CVE-2010-2000: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Bibliography Biblio module 5.x through 5.x-1.17 and 6.x through 6.x-1.9 for Drupal allows remote authenticated users, with "administer biblio" privileges, to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than...

CVE-2010-1917: Undefined Security Weakness

Stack consumption vulnerability in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to cause a denial of service PHP crash via a crafted first argument to the fnmatch function, as demonstrated using a long string...

CVE-2010-1664: Improper Restriction of Operations within the Bounds of a Memory Buffer

Google Chrome before 4.1.249.1064 does not properly handle HTML5 media, which allows remote attackers to cause a denial of service memory corruption and possibly have unspecified other impact via unknown vectors...

CVE-2010-1470: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the Web TV comwebtv component 1.0 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. dot dot in the controller parameter to index.php...

CVE-2010-0750: Exposure of Sensitive Information to an Unauthorized Actor

pkexec.c in pkexec in libpolkit in PolicyKit 0.96 allows local users to determine the existence of arbitrary files via the argument...

CVE-2010-1025: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the TGM-Newsletter tgmnewsletter extension 0.0.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2010-0931: Improper Input Validation

The Perforce service p4s.exe in Perforce Server 2008.1 allows remote attackers to cause a denial of service daemon crash via crafted data, possibly involving a large sndbuf value...

CVE-2010-0715: Undefined Security Weakness

Open redirect vulnerability in login.jsp in IBM WebSphere Portal, IBM Lotus Web Content Management WCM, and IBM Lotus Workplace Web Content Management 5.1.0.0 through 5.1.0.5, 6.0.0.0 through 6.0.0.4, 6.0.1.0 through 6.0.1.7, 6.1.0.0 through 6.1.0.3, and 6.1.5.0; and IBM Lotus Quickr services 8.0...

CVE-2010-0567: Undefined Security Weakness

Unspecified vulnerability in Cisco ASA 5500 Series Adaptive Security Appliance 7.0 before 7.08.10, 7.2 before 7.24.45, 8.0 before 8.05.1, 8.1 before 8.12.37, and 8.2 before 8.21.15; and Cisco PIX 500 Series Security Appliance; allows remote attackers to cause a denial of service active IPsec tunn...

CVE-2010-0149: Undefined Security Weakness

Unspecified vulnerability in Cisco ASA 5500 Series Adaptive Security Appliance 7.2 before 7.24.46, 8.0 before 8.04.38, 8.1 before 8.12.29, and 8.2 before 8.21.5; and Cisco PIX 500 Series Security Appliance; allows remote attackers to cause a denial of service prevention of new connections via...

CVE-2009-4629: Exposure of Sensitive Information to an Unauthorized Actor

Mozilla Necko, as used in Thunderbird 3.0.1, SeaMonkey, and other applications, performs DNS prefetching even when the app type is APPTYPEMAIL or APPTYPEEDITOR, which makes it easier for remote attackers to determine the network location of the application's user by logging DNS requests, as...

CVE-2010-0142: Undefined Security Weakness

MeetingTime in Cisco Unified MeetingPlace 6 before MR5, and possibly 5, allows remote authenticated users to gain privileges via a modified authentication sequence, aka Bug ID CSCsv66530...

CVE-2009-4183: Undefined Security Weakness

Unspecified vulnerability in HP OpenView Storage Data Protector 6.00 and 6.10 allows local users to obtain unspecified "access" via unknown vectors...

CVE-2008-7253: Undefined Security Weakness

The default configuration of the web server in IBM Lotus Domino Server, possibly 6.0 through 8.0, enables the HTTP TRACE method, which makes it easier for remote attackers to steal cookies and authentication credentials via a cross-site tracing XST attack, a related issue to CVE-2004-2763 and...

CVE-2010-0037: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in Image RAW in Apple Mac OS X 10.5.8 and 10.6.2 allows remote attackers to execute arbitrary code or cause a denial of service application crash via a crafted DNG image...

CVE-2009-4318: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in Real Estate Manager 1.0.1 allows remote attackers to inject arbitrary web script or HTML via the lang parameter. NOTE: some of these details are obtained from third party information...

CVE-2009-3799: Undefined Security Weakness

Integer overflow in the Verifier::parseExceptionHandlers function in Adobe Flash Player before 10.0.42.34 and Adobe AIR before 1.5.3 allows remote attackers to execute arbitrary code via an SWF file with a large exceptioncount value that triggers memory corruption, related to "generation of...

CVE-2009-3632: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the traditional frontend editing feature in the Frontend Editing subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote authenticated users to execute arbitrary SQL commands via unspecified...

CVE-2009-3801: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in OpenDocMan 1.2.5 allows remote attackers to execute arbitrary SQL commands via the frmpass aka Password parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2009-2815: Undefined Security Weakness

The Telephony component in Apple iPhone OS before 3.1 does not properly handle SMS arrival notifications, which allows remote attackers to cause a denial of service NULL pointer dereference and service interruption via a crafted SMS message...

CVE-2008-7161: Undefined Security Weakness

Fortinet FortiGuard Fortinet FortiGate-1000 3.00 build 040075,070111 allows remote attackers to bypass URL filtering via fragmented GET or POST requests that use HTTP/1.0 without the Host header. NOTE: this issue might be related to CVE-2005-3058...

CVE-2008-7166: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in the web interface in BitTorrent 6.0.1 build 7859 and earlier, and uTorrent 1.7.6 build 7859 and earlier, allows remote attackers to cause a denial of service memory consumption and crash via a crafted Range header. NOTE: this is probably a different vulnerability than...

CVE-2009-3062: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in messagebox.php in OSI Codes PHP Live! 3.3 allows remote attackers to execute arbitrary SQL commands via the deptid parameter...

CVE-2008-7132: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in Nuked-Klan 1.3 beta allows remote attackers to inject arbitrary web script or HTML via the nukednude parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2009-3008: Undefined Security Weakness

K-Meleon 1.5.3 allows context-dependent attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary file: URL after a victim has visited any file: URL, as demonstrated by a visit to a file: document written by the attacker...

CVE-2009-2965: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in entry/index.jsp in Radvision Scopia 5.7, and possibly other versions before SD 7.0.100, allows remote attackers to inject arbitrary web script or HTML via the page parameter...

CVE-2008-6947: Improper Authentication

Collabtive 0.4.8 allows remote attackers to bypass authentication and create new users, including administrators, via unspecified vectors associated with the added mode in a users action to admin.php...

CVE-2009-2663: Undefined Security Weakness

libvorbis before r16182, as used in Mozilla Firefox 3.5.x before 3.5.2 and other products, allows context-dependent attackers to cause a denial of service memory corruption and application crash or possibly execute arbitrary code via a crafted .ogg file...

CVE-2009-2029: Undefined Security Weakness

Unspecified vulnerability in rpc.nisd in Sun Solaris 8 through 10, and OpenSolaris before snv104, allows remote authenticated users to cause a denial of service NIS+ daemon hang via unspecified vectors related to NIS+ callbacks...