Overview 46,324 matches · 1,123 in Waratek scope · 52 protected · 374 exploited · 53 CISA KEV · 16,326 public PoC · 828 EPSS ≥ 0.5
46,324matches
1,123in Waratek scope2.4%
52protected0.1%
374exploited0.8%
53CISA KEV0.1%
16,326public PoC35.2%
828EPSS ≥ 0.51.8%
Protected by Waratek
52
0.1%
Rule in development
0
0.0%
Mitigation candidate
82
0.2%
No exploit published
989
2.1%
Outside Waratek scope
466
1.0%
Not applicable
44,312
95.7%
Withdrawn CVE
423
0.9%
blocked by ARMR today
52
0.1%
partly blocked
0
0.0%
not blocked
46,272
99.9%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 6,659 / year
19882
Not applicable2
High2
not blocked2
Working exploit published1
No public exploit1
19893
Not applicable3
High2
Medium1
not blocked3
No public exploit3
199011
Not applicable11
High8
Medium2
Low1
not blocked11
Working exploit published1
No public exploit10
199115
Not applicable15
High11
Medium4
not blocked15
Working exploit published2
No public exploit13
199214
Not applicable13
Withdrawn CVE1
High12
Low1
Unknown1
not blocked14
No public exploit14
199313
Not applicable13
High8
Medium3
Low2
not blocked13
No public exploit13
199426
Not applicable25
Withdrawn CVE1
High14
Medium10
Low1
Unknown1
not blocked26
Working exploit published6
No public exploit20
199525
Not applicable25
Critical1
High17
Medium6
Low1
not blocked25
Working exploit published5
No public exploit20
199675
No exploit published1
Not applicable73
Withdrawn CVE1
Critical1
High43
Medium21
Low9
Unknown1
not blocked75
Working exploit published18
Forecast only1
No public exploit56
1997253
Not applicable252
Withdrawn CVE1
Critical1
High143
Medium89
Low19
Unknown1
not blocked253
Exploited2
Working exploit published73
Forecast only2
No public exploit176
1998247
Not applicable246
Withdrawn CVE1
Critical1
High137
Medium85
Low23
Unknown1
not blocked247
Exploited1
Working exploit published50
No public exploit196
1999923
No exploit published2
Outside Waratek scope1
Not applicable891
Withdrawn CVE29
Critical3
High423
Medium357
Low111
Unknown29
not blocked923
Exploited2
Working exploit published282
No public exploit639
20001,020
Mitigation candidate6
No exploit published6
Outside Waratek scope2
Not applicable1,005
Withdrawn CVE1
Critical2
High454
Medium467
Low96
Unknown1
not blocked1,020
Exploited5
Working exploit published427
Forecast only1
No public exploit587
20011,679
Protected by Waratek1
Mitigation candidate2
No exploit published10
Outside Waratek scope14
Not applicable1,649
Withdrawn CVE3
Critical12
High776
Medium706
Low182
Unknown3
blocked by ARMR today1
not blocked1,678
Exploited14
Working exploit published480
Forecast only2
No public exploit1,183
20022,170
Protected by Waratek3
Mitigation candidate8
No exploit published26
Outside Waratek scope12
Not applicable2,107
Withdrawn CVE14
Critical10
High1,023
Medium980
Low143
Unknown14
blocked by ARMR today3
not blocked2,167
Exploited12
Working exploit published545
Forecast only9
No public exploit1,604
20031,548
Protected by Waratek2
Mitigation candidate7
No exploit published30
Outside Waratek scope6
Not applicable1,482
Withdrawn CVE21
Critical9
High674
Medium747
Low97
Unknown21
blocked by ARMR today2
not blocked1,546
Exploited10
Working exploit published499
Forecast only1
No public exploit1,038
20042,479
Protected by Waratek2
Mitigation candidate1
No exploit published24
Outside Waratek scope8
Not applicable2,416
Withdrawn CVE28
Critical10
High973
Medium1,265
Low203
Unknown28
blocked by ARMR today2
not blocked2,477
Exploited21
Working exploit published755
Forecast only1
No public exploit1,702
20055,010
Protected by Waratek3
Mitigation candidate4
No exploit published75
Outside Waratek scope17
Not applicable4,833
Withdrawn CVE78
Critical13
High2,048
Medium2,430
Low441
Unknown78
blocked by ARMR today3
not blocked5,007
Exploited22
Working exploit published1,341
Forecast only11
No public exploit3,636
20066,659
Protected by Waratek8
Mitigation candidate4
No exploit published121
Outside Waratek scope67
Not applicable6,408
Withdrawn CVE51
Critical12
High2,763
Medium3,324
Low509
Unknown51
blocked by ARMR today8
not blocked6,651
Exploited37
Working exploit published2,440
Proof of concept only1
Forecast only6
No public exploit4,175
20076,596
Protected by Waratek6
Mitigation candidate10
No exploit published134
Outside Waratek scope83
Not applicable6,283
Withdrawn CVE80
Critical21
High3,162
Medium3,101
Low232
Unknown80
blocked by ARMR today6
not blocked6,590
Exploited47
Working exploit published2,495
Proof of concept only5
Forecast only5
No public exploit4,044
20085,664
Protected by Waratek7
Mitigation candidate9
No exploit published120
Outside Waratek scope74
Not applicable5,422
Withdrawn CVE32
Critical19
High2,846
Medium2,582
Low185
Unknown32
blocked by ARMR today7
not blocked5,657
Exploited42
Working exploit published2,518
Proof of concept only4
Forecast only9
No public exploit3,091
20095,778
Protected by Waratek9
Mitigation candidate13
No exploit published181
Outside Waratek scope62
Not applicable5,467
Withdrawn CVE46
Critical15
High2,734
Medium2,786
Low197
Unknown46
blocked by ARMR today9
not blocked5,769
Exploited73
Working exploit published2,591
Proof of concept only2
Forecast only3
No public exploit3,109
20104,667
Protected by Waratek9
Mitigation candidate12
No exploit published162
Outside Waratek scope86
Not applicable4,370
Withdrawn CVE28
Critical28
High2,093
Medium2,241
Low277
Unknown28
blocked by ARMR today9
not blocked4,658
Exploited73
Working exploit published1,313
Proof of concept only1
Forecast only9
No public exploit3,271
20111,447
Protected by Waratek2
Mitigation candidate6
No exploit published97
Outside Waratek scope34
Not applicable1,301
Withdrawn CVE7
Critical1
High605
Medium724
Low110
Unknown7
blocked by ARMR today2
not blocked1,445
Exploited13
Working exploit published228
Forecast only2
No public exploit1,204
198919911993199519971999200120032005200720092011
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2011-1592 | Medium | 2011-04-29 | Not applicable | No public exploit | The NFS dissector in epan/dissectors/packet-nfs.c in Wireshark 1.4.x before 1.4.5 on Windows uses an incorrect integer data type during decoding of SETCLIENTID calls, which allows remote attackers to cause a denial of service (application crash) via a crafted .pcap file. |
| CVE-2011-1591 | High | 2011-04-29 | Not applicable | Working exploit published | Stack-based buffer overflow in the DECT dissector in epan/dissectors/packet-dect.c in Wireshark 1.4.x before 1.4.5 allows remote attackers to execute arbitrary code via a crafted .pcap file. |
| CVE-2011-1590 | Medium | 2011-04-29 | Not applicable | No public exploit | The X.509if dissector in Wireshark 1.2.x before 1.2.16 and 1.4.x before 1.4.5 does not properly initialize certain global variables, which allows remote attackers to cause a denial of service (application crash) via a crafted .pcap file. |
| CVE-2011-1589 | Medium | 2011-04-29 | Not applicable | No public exploit | Directory traversal vulnerability in Path.pm in Mojolicious before 1.16 allows remote attackers to read arbitrary files via a %2f..%2f (encoded slash dot dot slash) in a URI. |
| CVE-2011-1543 | Medium | 2011-04-29 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in HP Systems Insight Manager (SIM) before 6.3 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. |
| CVE-2011-1542 | Medium | 2011-04-29 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in HP Systems Insight Manager (SIM) before 6.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2011-1541 | High | 2011-04-29 | Not applicable | No public exploit | Unspecified vulnerability in HP System Management Homepage (SMH) before 6.3 allows remote attackers to bypass intended access restrictions, and consequently execute arbitrary code, via unknown vectors. |
| CVE-2011-1540 | High | 2011-04-29 | Not applicable | No public exploit | Unspecified vulnerability in HP System Management Homepage (SMH) before 6.3 allows remote authenticated users to execute arbitrary code via unknown vectors. |
| CVE-2011-1536 | Medium | 2011-04-29 | Not applicable | No public exploit | Unspecified vulnerability in HP Performance Insight 5.0, 5.1x. 5.2x, 5.3x, 5.4, 5.41, and 5.41.002 allows remote attackers to obtain sensitive information via unknown vectors. |
| CVE-2011-1535 | Medium | 2011-04-29 | Not applicable | No public exploit | Unspecified vulnerability in HP Insight Control for Linux (aka IC-Linux) before 6.3 allows remote authenticated users to obtain sensitive information, modify data, or cause a denial of service via unknown vectors. |
| CVE-2011-1499 | Low | 2011-04-29 | Not applicable | No public exploit | acl.c in Tinyproxy before 1.8.3, when an Allow configuration setting specifies a CIDR block, permits TCP connections from all IP addresses, which makes it easier for remote attackers to hide the origin of web traffic by leveraging the open HTTP proxy server. |
| CVE-2011-0729 | High | 2011-04-29 | Not applicable | No public exploit | dbus_backend/ls-dbus-backend in the D-Bus backend in language-selector before 0.6.7 does not restrict access on the basis of a PolicyKit check result, which allows local users to modify the /etc/default/locale and /etc/environment files via a (1) SetSystemDefaultLangEnv or (2) SetSystemDefaultLanguageEnv call. |
| CVE-2011-1839 | Medium | 2011-04-28 | Not applicable | No public exploit | IBM Rational Build Forge 7.1.0 uses the HTTP GET method during redirection from the authentication servlet to a PHP script, which makes it easier for context-dependent attackers to discover session IDs by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history. |
| CVE-2011-1725 | Medium | 2011-04-27 | Not applicable | No public exploit | Unspecified vulnerability in HP Network Automation 7.2x, 7.5x, 7.6x, 9.0, and 9.10 allows remote attackers to obtain sensitive information via unknown vectors. |
| CVE-2011-1719 | High | 2011-04-27 | Not applicable | No public exploit | Multiple stack-based buffer overflows in the Web Viewer ActiveX controls in CA Output Management Web Viewer 11.0 and 11.5 allow remote attackers to execute arbitrary code via (1) a long SRC property value to the PPSViewer ActiveX control in PPSView.ocx before 1.0.0.7 or (2) a long Title property value to the UOMWV_Helper ActiveX control in UOMWV_HelperActiveX.ocx before 11.5.0.1. |
| CVE-2011-1718 | Medium | 2011-04-27 | Not applicable | No public exploit | The Web Agents component in CA SiteMinder R6 before SP6 CR2 and R12 before SP3 CR2 does not properly handle multi-line headers, which allows remote authenticated users to conduct impersonation attacks and gain privileges via crafted data. |
| CVE-2011-1599 | High | 2011-04-27 | Not applicable | No public exploit | manager.c in the Manager Interface in Asterisk Open Source 1.4.x before 1.4.40.1, 1.6.1.x before 1.6.1.25, 1.6.2.x before 1.6.2.17.3, and 1.8.x before 1.8.3.3 and Asterisk Business Edition C.x.x before C.3.6.4 does not properly check for the system privilege, which allows remote authenticated users to execute arbitrary commands via an Originate action that has an Async header in conjunction with an Application header. |
| CVE-2011-1587 | Medium | 2011-04-27 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.4, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .html located before a ? (question mark) in a query string, in conjunction with a modified URI path that has a %2E sequence in place of the . (dot) character. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1578. |
| CVE-2011-1586 | Medium | 2011-04-27 | Not applicable | No public exploit | Directory traversal vulnerability in the KGetMetalink::File::isValidNameAttr function in ui/metalinkcreator/metalinker.cpp in KGet in KDE SC 4.6.2 and earlier allows remote attackers to create arbitrary files via a .. (dot dot) in the name attribute of a file element in a metalink file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-1000. |
| CVE-2011-1580 | Low | 2011-04-27 | Not applicable | No public exploit | The transwiki import functionality in MediaWiki before 1.16.3 does not properly check privileges, which allows remote authenticated users to perform imports from any wgImportSources wiki via a crafted POST request. |
| CVE-2011-1579 | Medium | 2011-04-27 | Not applicable | No public exploit | The checkCss function in includes/Sanitizer.php in the wikitext parser in MediaWiki before 1.16.3 does not properly validate Cascading Style Sheets (CSS) token sequences, which allows remote attackers to conduct cross-site scripting (XSS) attacks or obtain sensitive information by using the \2f\2a and \2a\2f hex strings to surround CSS comments. |
| CVE-2011-1578 | Medium | 2011-04-27 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.3, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .html at the end of the query string, in conjunction with a modified URI path that has a %2E sequence in place of the . (dot) character. |
| CVE-2011-1507 | Medium | 2011-04-27 | Not applicable | No public exploit | Asterisk Open Source 1.4.x before 1.4.40.1, 1.6.1.x before 1.6.1.25, 1.6.2.x before 1.6.2.17.3, and 1.8.x before 1.8.3.3 and Asterisk Business Edition C.x.x before C.3.6.4 do not restrict the number of unauthenticated sessions to certain interfaces, which allows remote attackers to cause a denial of service (file descriptor exhaustion and disk space exhaustion) via a series of TCP connections. |
| CVE-2010-4801 | Medium | 2011-04-27 | Not applicable | Working exploit published | Directory traversal vulnerability in admin/updatelist.php in BaconMap 1.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the filepath parameter. |
| CVE-2010-4800 | High | 2011-04-27 | Not applicable | Working exploit published | SQL injection vulnerability in doadd.php in BaconMap 1.0 allows remote attackers to execute arbitrary SQL commands via the type parameter. |
| CVE-2010-4799 | Medium | 2011-04-27 | Not applicable | Working exploit published | Multiple SQL injection vulnerabilities in Chipmunk Pwngame 1.0, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters to authenticate.php and the (3) ID parameter to pwn.php. NOTE: some of these details are obtained from third party information. |
| CVE-2010-4798 | Medium | 2011-04-27 | Not applicable | Working exploit published | Directory traversal vulnerability in index.php in OrangeHRM 2.6.0.1 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the uri parameter. |
| CVE-2010-4797 | High | 2011-04-27 | Not applicable | Working exploit published | Multiple SQL injection vulnerabilities in the log-in form in Truworth Flex Timesheet allow remote attackers to execute arbitrary SQL commands via the (1) Username and (2) Password fields. |
| CVE-2010-4796 | High | 2011-04-27 | Not applicable | No public exploit | Multiple SQL injection vulnerabilities in PHPYun 1.1.6 allow remote attackers to execute arbitrary SQL commands via the (1) provinceid parameter to search.php and the (2) e parameter to resumeview.php. |
| CVE-2010-4795 | High | 2011-04-27 | Not applicable | Working exploit published | SQL injection vulnerability in the JS Calendar (com_jscalendar) component 1.5.1 and 1.5.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the ev_id parameter in a details action to index.php. NOTE: some of these details are obtained from third party information. |
| CVE-2010-4794 | Medium | 2011-04-27 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in the JoomlaSeller JS Calendar (com_jscalendar) component 1.5.1 and 1.5.4 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) month and (2) year parameters in a jscalendar action to index.php. NOTE: some of these details are obtained from third party information. |
| CVE-2010-4793 | High | 2011-04-27 | Not applicable | Working exploit published | SQL injection vulnerability in detail.asp in Site2Nite Auto e-Manager allows remote attackers to execute arbitrary SQL commands via the ID parameter. |
| CVE-2010-4792 | Medium | 2011-04-27 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in title.php in OPEN IT OverLook 5.0 allows remote attackers to inject arbitrary web script or HTML via the frame parameter. |
| CVE-2010-4791 | High | 2011-04-27 | Not applicable | Working exploit published | SQL injection vulnerability in infusions/mg_user_fotoalbum_panel/mg_user_fotoalbum.php in the MG User-Fotoalbum (mg_user_fotoalbum_panel) module 1.0.1 for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the album_id parameter. |
| CVE-2010-4790 | Medium | 2011-04-27 | Not applicable | No public exploit | Directory traversal vulnerability in FilterFTP 2.0.3, 2.0.5, and probably earlier versions, allows remote FTP servers to write arbitrary files via a "..\" (dot dot backslash) in a filename. NOTE: some of these details are obtained from third party information. |
| CVE-2010-3260 | Medium | 2011-04-27 | Not applicable | No public exploit | oxf/xml/xerces/XercesSAXParserFactoryImpl.java in the xforms-server component in the XForms service in Orbeon Forms before 3.9 does not properly restrict DTDs in Ajax requests, which allows remote attackers to read arbitrary files or send HTTP requests to intranet servers via an entity declaration in conjunction with an entity reference, related to an "XML injection" issue. |
| CVE-2010-2789 | Medium | 2011-04-27 | Not applicable | No public exploit | PHP remote file inclusion vulnerability in MediaWikiParserTest.php in MediaWiki 1.16 beta, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via unspecified vectors. |
| CVE-2010-2788 | Low | 2011-04-27 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in profileinfo.php in MediaWiki before 1.15.5, when wgEnableProfileInfo is enabled, allows remote attackers to inject arbitrary web script or HTML via the filter parameter. |
| CVE-2010-2787 | Medium | 2011-04-27 | Not applicable | No public exploit | api.php in MediaWiki before 1.15.5 does not prevent use of public caching headers for private data, which allows remote attackers to bypass intended access restrictions and obtain sensitive information by retrieving documents from an HTTP proxy cache that has been used by a victim. |
| CVE-2011-1690 | Medium | 2011-04-22 | Not applicable | No public exploit | Best Practical Solutions RT 3.6.0 through 3.6.10 and 3.8.0 through 3.8.8 allows remote attackers to trick users into sending credentials to an arbitrary server via unspecified vectors. |
| CVE-2011-1689 | Medium | 2011-04-22 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in Best Practical Solutions RT 2.0.0 through 3.6.10, 3.8.0 through 3.8.9, and 4.0.0rc through 4.0.0rc7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2011-1688 | Medium | 2011-04-22 | Not applicable | No public exploit | Directory traversal vulnerability in Best Practical Solutions RT 3.2.0 through 3.6.10, 3.8.0 through 3.8.9, and 4.0.0rc through 4.0.0rc7 allows remote attackers to read arbitrary files via a crafted HTTP request. |
| CVE-2011-1687 | Medium | 2011-04-22 | Not applicable | No public exploit | Best Practical Solutions RT 3.0.0 through 3.6.10, 3.8.0 through 3.8.9, and 4.0.0rc through 4.0.0rc7 allows remote authenticated users to obtain sensitive information by using the search interface, as demonstrated by retrieving encrypted passwords. |
| CVE-2011-1686 | Medium | 2011-04-22 | Not applicable | No public exploit | Multiple SQL injection vulnerabilities in Best Practical Solutions RT 2.0.0 through 3.6.10, 3.8.0 through 3.8.9, and 4.0.0rc through 4.0.0rc7 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors, as demonstrated by reading data. |
| CVE-2011-1685 | Medium | 2011-04-22 | Not applicable | No public exploit | Best Practical Solutions RT 3.8.0 through 3.8.9 and 4.0.0rc through 4.0.0rc7, when the CustomFieldValuesSources (aka external custom field) option is enabled, allows remote authenticated users to execute arbitrary code via unspecified vectors, as demonstrated by a cross-site request forgery (CSRF) attack. |
| CVE-2011-1534 | Medium | 2011-04-22 | Not applicable | No public exploit | Unspecified vulnerability in HP Network Node Manager i (NNMi) 9.0x allows remote authenticated users to obtain access to processes via unknown vectors. |
| CVE-2011-1422 | Medium | 2011-04-22 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in an unspecified Shockwave Flash file in EMC RSA Adaptive Authentication On-Premise (AAOP) 2.x, 5.7.x, and 6.x allows remote attackers to inject arbitrary web script or HTML via unknown vectors. |
| CVE-2011-1421 | Medium | 2011-04-22 | Not applicable | No public exploit | EMC NetWorker 7.5.x before 7.5.4.3 and 7.6.x before 7.6.1.5, when the client push feature is enabled, uses weak permissions for an unspecified file, which allows local users to gain privileges via unknown vectors. |
| CVE-2011-1822 | Low | 2011-04-21 | Not applicable | No public exploit | The LDAP_ADD implementation in IBM Tivoli Directory Server (TDS) 5.2 before 5.2.0.5-TIV-ITDS-IF0009 stores a cleartext SHA password in the change log, which might allow local users to obtain sensitive information by reading this log. |
| CVE-2011-1821 | Medium | 2011-04-21 | Not applicable | No public exploit | IBM Tivoli Directory Server (TDS) 5.2 before 5.2.0.5-TIV-ITDS-IF0010 on Windows allows remote authenticated users to cause a denial of service (daemon hang) via a cn=changelog search. |
| CVE-2011-1820 | Low | 2011-04-21 | Not applicable | No public exploit | IBM Tivoli Directory Server (TDS) 5.2 before 5.2.0.5-TIV-ITDS-IF0010, 6.0 before 6.0.0.67 (aka 6.0.0.8-TIV-ITDS-IF0009), 6.1 before 6.1.0.40 (aka 6.1.0.5-TIV-ITDS-IF0003), 6.2 before 6.2.0.16 (aka 6.2.0.3-TIV-ITDS-IF0002), and 6.3 before 6.3.0.3 (aka 6.3.0.0-TIV-ITDS-IF0003) does not properly handle the ibm-auditAttributesOnGroupEvalOp setting for auditing of extended operations, which might allow attackers to obtain sensitive information by reading the audit log. |
| CVE-2011-1206 | High | 2011-04-21 | Not applicable | Working exploit published | Stack-based buffer overflow in the server process in ibmslapd.exe in IBM Tivoli Directory Server (TDS) 5.2 before 5.2.0.5-TIV-ITDS-IF0010, 6.0 before 6.0.0.67 (aka 6.0.0.8-TIV-ITDS-IF0009), 6.1 before 6.1.0.40 (aka 6.1.0.5-TIV-ITDS-IF0003), 6.2 before 6.2.0.16 (aka 6.2.0.3-TIV-ITDS-IF0002), and 6.3 before 6.3.0.3 (aka 6.3.0.0-TIV-ITDS-IF0003) allows remote attackers to execute arbitrary code via a crafted LDAP request. NOTE: some of these details are obtained from third party information. |
| CVE-2011-1149 | High | 2011-04-21 | Not applicable | No public exploit | Android before 2.3 does not properly restrict access to the system property space, which allows local applications to bypass the application sandbox and gain privileges, as demonstrated by psneuter and KillingInTheNameOf, related to the use of Android shared memory (ashmem) and ASHMEM_SET_PROT_MASK. |
| CVE-2010-4789 | Medium | 2011-04-21 | Not applicable | No public exploit | Use-after-free vulnerability in the proxy-server implementation in IBM Tivoli Directory Server (TDS) 6.0 before 6.0.0.65 (aka 6.0.0.8-TIV-ITDS-IF0007) and 6.3 before 6.3.0.1 (aka 6.3.0.0-TIV-ITDS-IF0001) allows remote authenticated users to cause a denial of service (daemon crash) via a paged search that is interrupted by an LDAP Unbind operation. |
| CVE-2010-4788 | Medium | 2011-04-21 | Not applicable | No public exploit | IBM Tivoli Directory Server (TDS) 6.0 before 6.0.0.62 (aka 6.0.0.8-TIV-ITDS-IF0004) does not perform certain locking of linked-list access, which allows remote authenticated users to cause a denial of service (daemon crash) via a paged search. |
| CVE-2010-4787 | Medium | 2011-04-21 | Not applicable | No public exploit | IBM Tivoli Directory Server (TDS) 6.0 before 6.0.0.63 (aka 6.0.0.8-TIV-ITDS-IF0005) allows remote authenticated users to cause a denial of service (daemon hang) via a paged search that triggers improper mutex processing. |
| CVE-2010-4786 | Medium | 2011-04-21 | Not applicable | No public exploit | IBM Tivoli Directory Server (TDS) 6.0 before 6.0.0.63 (aka 6.0.0.8-TIV-ITDS-IF0005) allows remote authenticated users to cause a denial of service (daemon crash or hang) via a paged search, as demonstrated by a certain idsldapsearch command, related to an improper ibm-slapdIdleTimeOut configuration setting. |
| CVE-2010-4785 | Medium | 2011-04-21 | Not applicable | No public exploit | The do_extendedOp function in ibmslapd in IBM Tivoli Directory Server (TDS) 6.0 before 6.0.0.62 (aka 6.0.0.8-TIV-ITDS-IF0004) on Linux, Solaris, and Windows allows remote authenticated users to cause a denial of service (ABEND) via a malformed LDAP extended operation that triggers certain comparisons involving the NULL operation OID. |
| CVE-2009-5073 | Medium | 2011-04-21 | Not applicable | No public exploit | IBM Tivoli Directory Server (TDS) 6.0 before 6.0.0.59 (aka 6.0.0.8-TIV-ITDS-IF0001) allows remote authenticated users to cause a denial of service (infinite loop and daemon hang) by adding a nested group that contains the Distinguished Name (DN) of its parent entry. |
| CVE-2009-5072 | Medium | 2011-04-21 | Not applicable | No public exploit | Memory leak in the ldap_explode_dn function in IBM Tivoli Directory Server (TDS) 6.0 before 6.0.0.61 (aka 6.0.0.8-TIV-ITDS-IF0003) allows remote authenticated users to cause a denial of service (memory consumption) via an empty string argument. |
| CVE-2008-7290 | Medium | 2011-04-21 | Not applicable | No public exploit | Memory leak in the ldap_explode_rdn API function in IBM Tivoli Directory Server (TDS) 5.2 before 5.2.0.5-TIV-ITDS-LA0007 allows remote authenticated users to cause a denial of service (memory consumption) by making many function calls. |
| CVE-2008-7289 | Medium | 2011-04-21 | Not applicable | No public exploit | IBM Tivoli Directory Server (TDS) 5.2 before 5.2.0.5-TIV-ITDS-LA0007 does not properly handle the simultaneous changing of multiple passwords, which makes it easier for remote authenticated users to cause a denial of service (DB2 daemon deadlock) by making password changes that trigger updates to a DB2 password-history table. |
| CVE-2008-7288 | Medium | 2011-04-21 | Not applicable | No public exploit | IBM Tivoli Directory Server (TDS) 5.2 before 5.2.0.5-TIV-ITDS-LA0007 on AIX allows remote attackers to cause a denial of service (server destabilization) via an anonymous DIGEST-MD5 LDAP Bind operation. |
| CVE-2008-7287 | Medium | 2011-04-21 | Not applicable | No public exploit | Multiple memory leaks in the (1) ldap_init and (2) ldap_url_search_direct API functions in IBM Tivoli Directory Server (TDS) 5.2 before 5.2.0.5-TIV-ITDS-LA0007 allow remote authenticated users to cause a denial of service (memory consumption) by making many function calls. |
| CVE-2007-6743 | Medium | 2011-04-21 | Not applicable | No public exploit | Double free vulnerability in IBM Tivoli Directory Server (TDS) 5.2 before 5.2.0.5-TIV-ITDS-LA0005 allows remote authenticated users to cause a denial of service (ABEND) via search operations that trigger recursive filter_free calls. |
| CVE-2007-6742 | Medium | 2011-04-21 | Not applicable | No public exploit | The get_filter_list function in IBM Tivoli Directory Server (TDS) 5.2 before 5.2.0.5-TIV-ITDS-LA0006 does not properly perform certain sub filter parsing, which allows remote authenticated users to cause a denial of service (infinite loop) via a malformed search filter. |
| CVE-2011-0861 | Medium | 2011-04-20 | No exploit published | No public exploit | Unspecified vulnerability in Oracle PeopleSoft Enterprise HRMS 9.0 Update 2011-B and 9.1 Update 2011-B allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Global Payroll Core. |
| CVE-2011-0860 | Medium | 2011-04-20 | No exploit published | No public exploit | Unspecified vulnerability in Oracle PeopleSoft Enterprise HRMS 9.0 Update 2011-B and 9.1 Update 2011-B allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Global Payroll - Spain. |
| CVE-2011-0859 | Medium | 2011-04-20 | No exploit published | No public exploit | Unspecified vulnerability in Oracle PeopleSoft Enterprise HRMS 9.0 Tax Update 11-B and 9.1 Tax Update 11-B allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Global Payroll - North America. |
| CVE-2011-0858 | Medium | 2011-04-20 | No exploit published | No public exploit | Unspecified vulnerability in Oracle PeopleSoft Enterprise HRMS 9.0 Bundle #15 and 9.1 Bundle #5 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Talent Acquisition Manager. |
| CVE-2011-0857 | Medium | 2011-04-20 | No exploit published | No public exploit | Unspecified vulnerability in Oracle PeopleSoft Enterprise HRMS 9.0 Bundle #15 and 9.1 Bundle #5 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Pension Administration. |
| CVE-2011-0856 | Medium | 2011-04-20 | No exploit published | No public exploit | Unspecified vulnerability in Oracle PeopleSoft Enterprise 8.49 GA through 8.49.30, 8.50 GA through 8.50.17, and 8.51 GA through 8.51.07 allows remote authenticated users to affect confidentiality via unknown vectors. |
| CVE-2011-0855 | Medium | 2011-04-20 | No exploit published | No public exploit | Unspecified vulnerability in the InForm component in Oracle Industry Applications 4.5, 4.6, and 5.0 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Core. |
| CVE-2011-0854 | Medium | 2011-04-20 | No exploit published | No public exploit | Unspecified vulnerability in Oracle PeopleSoft Enterprise HRMS 9.1 Bundle #5 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to ePerformance. |
| CVE-2011-0853 | Medium | 2011-04-20 | No exploit published | No public exploit | Unspecified vulnerability in Oracle PeopleSoft Enterprise HRMS 9.0 Bundle #15 and 9.1 Bundle #5 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to ePerformance. |
| CVE-2011-0851 | Medium | 2011-04-20 | No exploit published | No public exploit | Unspecified vulnerability in Oracle PeopleSoft Enterprise ELS 9.0 Bundle #19 and 9.1 Bundle #5 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Enterprise Learning Mgmt. |
| CVE-2011-0850 | Medium | 2011-04-20 | No exploit published | No public exploit | Unspecified vulnerability in Oracle PeopleSoft Enterprise CRM 8.9 Bundle #41 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Order Capture. |
| CVE-2011-0849 | Medium | 2011-04-20 | Not applicable | No public exploit | Unspecified vulnerability in Oracle Java Dynamic Management Kit 5.1 allows remote attackers to affect integrity, related to HTML Adaptor. |
| CVE-2011-0847 | Medium | 2011-04-20 | Not applicable | No public exploit | Unspecified vulnerability in the OpenSSO Enterprise and Sun Java System Access Manager components in Oracle Sun Products Suite 7.1 and 8.0 allows remote authenticated users to affect confidentiality via unknown vectors related to Authentication. |
| CVE-2011-0846 | Medium | 2011-04-20 | Not applicable | No public exploit | Unspecified vulnerability in the Oracle Sun Java System Access Manager Policy Agent 2.2 allows remote attackers to affect availability via unknown vectors related to Web Proxy Agent. |
| CVE-2011-0844 | Medium | 2011-04-20 | Not applicable | No public exploit | Unspecified vulnerability in the OpenSSO Enterprise and Sun Java System Access Manager components in Oracle Sun Products Suite 7.1 and 8.0 allows remote attackers to affect integrity via unknown vectors related to Authentication. |
| CVE-2011-0843 | Medium | 2011-04-20 | No exploit published | No public exploit | Unspecified vulnerability in the Siebel CRM Core component in Oracle Siebel CRM 7.8.2, 8.0.0, and 8.1.1 allows remote attackers to affect integrity via unknown vectors related to Globalization - Automotive. |
| CVE-2011-0841 | High | 2011-04-20 | Not applicable | No public exploit | Unspecified vulnerability in Oracle Solaris 11 Express allows remote attackers to affect availability, related to TCP/IP. |
| CVE-2011-0840 | Medium | 2011-04-20 | No exploit published | No public exploit | Unspecified vulnerability in Oracle PeopleSoft Enterprise PeopleTools 8.49 GA through 8.49.30 allows remote authenticated users to affect confidentiality via unknown vectors related to File Processing. |
| CVE-2011-0839 | Low | 2011-04-20 | Not applicable | No public exploit | Unspecified vulnerability in Oracle Solaris 9, 10, and 11 Express allows local users to affect availability, related to LOFS. |
| CVE-2011-0837 | Medium | 2011-04-20 | No exploit published | No public exploit | Unspecified vulnerability in the Agile Technology Platform component in Oracle Supply Chain Products Suite 9.3.0.2 and 9.3.1 allows remote attackers to affect confidentiality via unknown vectors related to Security. |
| CVE-2011-0836 | Low | 2011-04-20 | Mitigation candidate | Working exploit published | Unspecified vulnerability in Oracle JD Edwards EnterpriseOne Tools 8.9 GA through 8.98.4.1 and OneWorld Tools through 24.1.3 allows remote authenticated users to affect integrity, related to Web Runtime SEC. |
| CVE-2011-0834 | Medium | 2011-04-20 | No exploit published | No public exploit | Unspecified vulnerability in the Siebel CRM Core component in Oracle Siebel CRM 8.0.0 and 8.1.1 allows remote attackers to affect integrity via unknown vectors related to Globalization - Automotive. |
| CVE-2011-0833 | Medium | 2011-04-20 | No exploit published | No public exploit | Unspecified vulnerability in the Siebel CRM Core component in Oracle Siebel CRM 7.8.2, 8.0.0, and 8.1.1 allows remote attackers to affect integrity, related to UIF Client. |
| CVE-2011-0829 | Medium | 2011-04-20 | Not applicable | No public exploit | Unspecified vulnerability in Oracle Solaris 10 and 11 Express allows local users to affect availability, related to Kernel/SPARC. |
| CVE-2011-0828 | Medium | 2011-04-20 | No exploit published | No public exploit | Unspecified vulnerability in Oracle PeopleSoft Enterprise 8.8 Bundle #13 allows remote attackers to affect integrity via unknown vectors related to Application Portal. |
| CVE-2011-0827 | Low | 2011-04-20 | No exploit published | No public exploit | Unspecified vulnerability in the PeopleSoft Enterprise component in Oracle PeopleSoft Products 8.50 GA through 8.50.17 and 8.51 GA through 8.51.07 allows remote authenticated users to affect integrity via unknown vectors related to PeopleTools. |
| CVE-2011-0826 | Low | 2011-04-20 | No exploit published | No public exploit | Unspecified vulnerability in Oracle PeopleSoft Enterprise 8.8 Bundle #13, 8.9 Bundle #7, 9.0 Bundle #7, and 9.1 Bundle #4 allows remote authenticated users to affect integrity via unknown vectors related to Application Portal. |
| CVE-2011-0825 | Medium | 2011-04-20 | No exploit published | No public exploit | Unspecified vulnerability in Oracle JD Edwards EnterpriseOne Tools 8.9 GA through 8.98.4.1 and OneWorld Tools through 24.1.3 allows remote attackers to affect confidentiality, integrity, and availability, related to Enterprise Infrastructure SEC. |
| CVE-2011-0824 | Medium | 2011-04-20 | No exploit published | No public exploit | Unspecified vulnerability in Oracle JD Edwards EnterpriseOne Tools 8.9 GA through 8.98.4.1 and OneWorld Tools through 24.1.3 allows remote attackers to affect confidentiality and integrity, related to Enterprise Infrastructure SEC. |
| CVE-2011-0823 | Medium | 2011-04-20 | No exploit published | No public exploit | Unspecified vulnerability in Oracle JD Edwards EnterpriseOne Tools 8.9 GA through 8.98.4.1 and OneWorld Tools through 24.1.3 allows remote attackers to affect integrity, related to Enterprise Infrastructure SEC, a different vulnerability than CVE-2011-0819. |
| CVE-2011-0821 | Low | 2011-04-20 | Not applicable | No public exploit | Unspecified vulnerability in Oracle Solaris 8, 9, and 10 allows local users to affect confidentiality and integrity via unknown vectors related to uucp. |
| CVE-2011-0820 | Medium | 2011-04-20 | Not applicable | No public exploit | Unspecified vulnerability in Oracle Solaris 10, and 11 Express allows remote attackers to affect availability via unknown vectors related to Kernel. |
| CVE-2011-0819 | Medium | 2011-04-20 | No exploit published | No public exploit | Unspecified vulnerability in Oracle JD Edwards EnterpriseOne Tools 8.9 GA through 8.98.4.1 and OneWorld Tools through 24.1.3 allows remote attackers to affect integrity, related to Enterprise Infrastructure SEC, a different vulnerability than CVE-2011-0823. |
| CVE-2011-0818 | Medium | 2011-04-20 | No exploit published | No public exploit | Unspecified vulnerability in Oracle JD Edwards EnterpriseOne Tools 8.9 GA through 8.98.4.1 and OneWorld Tools through 24.1.3 allows remote attackers to affect availability, related to Enterprise Infrastructure SEC. |