Overview 44,871 matches · 0 in Waratek scope · 0 protected · 373 exploited · 50 CISA KEV · 16,174 public PoC · 781 EPSS ≥ 0.5
44,871matches
0in Waratek scope0.0%
0protected0.0%
373exploited0.8%
50CISA KEV0.1%
16,174public PoC36.0%
781EPSS ≥ 0.51.7%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
44,871
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
44,871
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 6,408 / year
19882
Not applicable2
High2
not blocked2
Working exploit published1
No public exploit1
19893
Not applicable3
High2
Medium1
not blocked3
No public exploit3
199011
Not applicable11
High8
Medium2
Low1
not blocked11
Working exploit published1
No public exploit10
199115
Not applicable15
High11
Medium4
not blocked15
Working exploit published2
No public exploit13
199213
Not applicable13
High12
Low1
not blocked13
No public exploit13
199313
Not applicable13
High8
Medium3
Low2
not blocked13
No public exploit13
199425
Not applicable25
High14
Medium10
Low1
not blocked25
Working exploit published6
No public exploit19
199525
Not applicable25
Critical1
High17
Medium6
Low1
not blocked25
Working exploit published5
No public exploit20
199673
Not applicable73
Critical1
High42
Medium21
Low9
not blocked73
Working exploit published17
Forecast only1
No public exploit55
1997252
Not applicable252
Critical1
High143
Medium89
Low19
not blocked252
Exploited2
Working exploit published73
Forecast only2
No public exploit175
1998246
Not applicable246
Critical1
High137
Medium85
Low23
not blocked246
Exploited1
Working exploit published50
No public exploit195
1999891
Not applicable891
Critical3
High421
Medium356
Low111
not blocked891
Exploited2
Working exploit published280
No public exploit609
20001,005
Not applicable1,005
Critical2
High447
Medium460
Low96
not blocked1,005
Exploited5
Working exploit published420
No public exploit580
20011,649
Not applicable1,649
Critical12
High764
Medium693
Low180
not blocked1,649
Exploited14
Working exploit published474
Forecast only2
No public exploit1,159
20022,107
Not applicable2,107
Critical10
High1,004
Medium953
Low140
not blocked2,107
Exploited12
Working exploit published531
Forecast only7
No public exploit1,557
20031,482
Not applicable1,482
Critical9
High661
Medium722
Low90
not blocked1,482
Exploited10
Working exploit published488
Forecast only1
No public exploit983
20042,416
Not applicable2,416
Critical10
High963
Medium1,243
Low200
not blocked2,416
Exploited21
Working exploit published753
Forecast only1
No public exploit1,641
20054,833
Not applicable4,833
Critical12
High2,008
Medium2,378
Low435
not blocked4,833
Exploited22
Working exploit published1,327
Forecast only11
No public exploit3,473
20066,408
Not applicable6,408
Critical12
High2,634
Medium3,265
Low497
not blocked6,408
Exploited36
Working exploit published2,425
Proof of concept only1
Forecast only6
No public exploit3,940
20076,283
Not applicable6,283
Critical21
High3,068
Medium2,977
Low217
not blocked6,283
Exploited47
Working exploit published2,470
Proof of concept only4
Forecast only5
No public exploit3,757
20085,422
Not applicable5,422
Critical18
High2,756
Medium2,473
Low175
not blocked5,422
Exploited40
Working exploit published2,495
Proof of concept only4
Forecast only8
No public exploit2,875
20095,467
Not applicable5,467
Critical15
High2,656
Medium2,626
Low170
not blocked5,467
Exploited72
Working exploit published2,560
Proof of concept only2
Forecast only3
No public exploit2,830
20104,370
Not applicable4,370
Critical26
High2,025
Medium2,074
Low245
not blocked4,370
Exploited64
Working exploit published1,290
Proof of concept only1
Forecast only8
No public exploit3,007
20111,860
Not applicable1,860
Critical2
High830
Medium905
Low123
not blocked1,860
Exploited25
Working exploit published259
Forecast only2
No public exploit1,574
198919911993199519971999200120032005200720092011
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2011-2607 | Medium | 2011-06-30 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in IBM Rational Team Concert (RTC) 3.0 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Work Item 165513. |
| CVE-2011-2606 | Medium | 2011-06-30 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Web UI in IBM Rational Team Concert (RTC) 3.0 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Work Item 165511. |
| CVE-2011-2605 | Medium | 2011-06-30 | Not applicable | No public exploit | CRLF injection vulnerability in the nsCookieService::SetCookieStringInternal function in netwerk/cookie/nsCookieService.cpp in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, and Thunderbird before 3.1.11, allows remote attackers to bypass intended access restrictions via a string containing a \n (newline) character, which is not properly handled in a JavaScript "document.cookie =" expression, a different vulnerability than CVE-2011-2374. |
| CVE-2011-2604 | High | 2011-06-30 | Not applicable | No public exploit | The Intel G41 driver 6.14.10.5355 on Windows XP SP3 allows remote attackers to cause a denial of service (system crash) via a crafted web page that is visited with Google Chrome or Mozilla Firefox, as demonstrated by the lots-of-polys-example.html test page in the Khronos WebGL SDK. |
| CVE-2011-2603 | High | 2011-06-30 | Not applicable | No public exploit | The NVIDIA 9400M driver 6.2.6 on Mac OS X 10.6.7 allows remote attackers to cause a denial of service (desktop hang) via a crafted web page that is visited with Google Chrome or Mozilla Firefox, as demonstrated by the lots-of-polys-example.html test page in the Khronos WebGL SDK. |
| CVE-2011-2602 | High | 2011-06-30 | Not applicable | No public exploit | The NVIDIA Geforce 310 driver 6.14.12.7061 on Windows XP SP3 allows remote attackers to cause a denial of service (system crash) via a crafted web page that is visited with Google Chrome or Mozilla Firefox, as demonstrated by the lots-of-polys-example.html test page in the Khronos WebGL SDK. |
| CVE-2011-2601 | High | 2011-06-30 | Not applicable | No public exploit | The GPU support functionality in Mac OS X does not properly restrict rendering time, which allows remote attackers to cause a denial of service (desktop hang) via vectors involving WebGL and (1) shader programs or (2) complex 3D geometry, as demonstrated by using Mozilla Firefox or Google Chrome to visit the lots-of-polys-example.html test page in the Khronos WebGL SDK. |
| CVE-2011-2600 | High | 2011-06-30 | Not applicable | No public exploit | The GPU support functionality in Windows XP does not properly restrict rendering time, which allows remote attackers to cause a denial of service (system crash) via vectors involving WebGL and (1) shader programs or (2) complex 3D geometry, as demonstrated by using Mozilla Firefox or Google Chrome to visit the lots-of-polys-example.html test page in the Khronos WebGL SDK. |
| CVE-2011-2599 | Medium | 2011-06-30 | Not applicable | No public exploit | Google Chrome 11 does not block use of a cross-domain image as a WebGL texture, which allows remote attackers to obtain approximate copies of arbitrary images via a timing attack involving a crafted WebGL fragment shader. |
| CVE-2011-2598 | Medium | 2011-06-30 | Not applicable | No public exploit | The WebGL implementation in Mozilla Firefox 4.x allows remote attackers to obtain screenshots of the windows of arbitrary desktop applications via vectors involving an SVG filter, an IFRAME element, and uninitialized data in graphics memory. |
| CVE-2011-2377 | Medium | 2011-06-30 | Not applicable | No public exploit | Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a multipart/x-mixed-replace image. |
| CVE-2011-2376 | High | 2011-06-30 | Not applicable | No public exploit | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.6.18 and Thunderbird before 3.1.11 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. |
| CVE-2011-2375 | High | 2011-06-30 | Not applicable | No public exploit | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 5.0 and Thunderbird through 3.1.11 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. |
| CVE-2011-2374 | High | 2011-06-30 | Not applicable | No public exploit | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, and Thunderbird before 3.1.11, allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. |
| CVE-2011-2373 | High | 2011-06-30 | Not applicable | No public exploit | Use-after-free vulnerability in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14, when JavaScript is disabled, allows remote attackers to execute arbitrary code via a crafted XUL document. |
| CVE-2011-2371 | High | 2011-06-30 | Not applicable | Working exploit published | Integer overflow in the Array.reduceRight method in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14 allows remote attackers to execute arbitrary code via vectors involving a long JavaScript Array object. |
| CVE-2011-2370 | Medium | 2011-06-30 | Not applicable | No public exploit | Mozilla Firefox before 5.0 does not properly enforce the whitelist for the xpinstall functionality, which allows remote attackers to trigger an installation dialog for a (1) add-on or (2) theme via unspecified vectors. |
| CVE-2011-2369 | Medium | 2011-06-30 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Mozilla Firefox 4.x through 4.0.1 allows remote attackers to inject arbitrary web script or HTML via an SVG element containing an HTML-encoded entity. |
| CVE-2011-2368 | High | 2011-06-30 | Not applicable | No public exploit | The WebGL implementation in Mozilla Firefox 4.x through 4.0.1 does not properly restrict write operations, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors. |
| CVE-2011-2367 | Medium | 2011-06-30 | Not applicable | No public exploit | The WebGL implementation in Mozilla Firefox 4.x through 4.0.1 does not properly restrict read operations, which allows remote attackers to obtain sensitive information from GPU memory associated with an arbitrary process, or cause a denial of service (application crash), via unspecified vectors. |
| CVE-2011-2366 | Medium | 2011-06-30 | Not applicable | No public exploit | Mozilla Gecko before 5.0, as used in Firefox before 5.0 and Thunderbird before 5.0, does not block use of a cross-domain image as a WebGL texture, which allows remote attackers to obtain approximate copies of arbitrary images via a timing attack involving a crafted WebGL fragment shader. |
| CVE-2011-2365 | High | 2011-06-30 | Not applicable | No public exploit | Unspecified vulnerability in the browser engine in Mozilla Firefox 3.6.x before 3.6.18 and Thunderbird before 3.1.11 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors, a different vulnerability than CVE-2011-2364. |
| CVE-2011-2364 | High | 2011-06-30 | Not applicable | No public exploit | Unspecified vulnerability in the browser engine in Mozilla Firefox 3.6.x before 3.6.18 and Thunderbird before 3.1.11 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors, a different vulnerability than CVE-2011-2365. |
| CVE-2011-2363 | High | 2011-06-30 | Not applicable | No public exploit | Use-after-free vulnerability in the nsSVGPointList::AppendElement function in the implementation of SVG element lists in Mozilla Firefox before 3.6.18, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors involving a user-supplied callback. |
| CVE-2011-2362 | Medium | 2011-06-30 | Not applicable | No public exploit | Mozilla Firefox before 3.6.18, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14 do not distinguish between cookies for two domain names that differ only in a trailing dot, which allows remote web servers to bypass the Same Origin Policy via Set-Cookie headers. |
| CVE-2011-2197 | Medium | 2011-06-30 | Not applicable | No public exploit | The cross-site scripting (XSS) prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does not properly handle mutation of safe buffers, which makes it easier for remote attackers to conduct XSS attacks via crafted strings to an application that uses a problematic string method, as demonstrated by the sub method. |
| CVE-2011-0085 | High | 2011-06-30 | Not applicable | No public exploit | Use-after-free vulnerability in the nsXULCommandDispatcher function in Mozilla Firefox before 3.6.18, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14 allows remote attackers to execute arbitrary code via a crafted XUL document that dequeues the current command updater. |
| CVE-2011-0083 | High | 2011-06-30 | Not applicable | No public exploit | Use-after-free vulnerability in the nsSVGPathSegList::ReplaceItem function in the implementation of SVG element lists in Mozilla Firefox before 3.6.18, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors involving a user-supplied callback. |
| CVE-2009-5082 | Low | 2011-06-30 | Not applicable | No public exploit | The (1) configure and (2) config.guess scripts in GNU troff (aka groff) 1.20.1 on Openwall GNU/*/Linux (aka Owl) improperly create temporary files upon a failure of the mktemp function, which makes it easier for local users to overwrite arbitrary files via a symlink attack on a temporary file. |
| CVE-2009-5081 | Low | 2011-06-30 | Not applicable | No public exploit | The (1) config.guess, (2) contrib/groffer/perl/groffer.pl, and (3) contrib/groffer/perl/roff2.pl scripts in GNU troff (aka groff) 1.21 and earlier use an insufficient number of X characters in the template argument to the tempfile function, which makes it easier for local users to overwrite arbitrary files via a symlink attack on a temporary file, a different vulnerability than CVE-2004-0969. |
| CVE-2009-5080 | Low | 2011-06-30 | Not applicable | No public exploit | The (1) contrib/eqn2graph/eqn2graph.sh, (2) contrib/grap2graph/grap2graph.sh, and (3) contrib/pic2graph/pic2graph.sh scripts in GNU troff (aka groff) 1.21 and earlier do not properly handle certain failed attempts to create temporary directories, which might allow local users to overwrite arbitrary files via a symlink attack on a file in a temporary directory, a different vulnerability than CVE-2004-1296. |
| CVE-2009-5079 | Low | 2011-06-30 | Not applicable | No public exploit | The (1) gendef.sh, (2) doc/fixinfo.sh, and (3) contrib/gdiffmk/tests/runtests.in scripts in GNU troff (aka groff) 1.21 and earlier allow local users to overwrite arbitrary files via a symlink attack on a gro#####.tmp or /tmp/##### temporary file. |
| CVE-2009-5078 | Medium | 2011-06-30 | Not applicable | No public exploit | contrib/pdfmark/pdfroff.sh in GNU troff (aka groff) before 1.21 launches the Ghostscript program without the -dSAFER option, which allows remote attackers to create, overwrite, rename, or delete arbitrary files via a crafted document. |
| CVE-2011-2470 | Medium | 2011-06-29 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in chat/base/admin/login.php in A Really Simple Chat (ARSC) 3.3-rc2 allows remote attackers to inject arbitrary web script or HTML via the arsc_message parameter. |
| CVE-2011-2351 | Medium | 2011-06-29 | Not applicable | No public exploit | Use-after-free vulnerability in Google Chrome before 12.0.742.112 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving SVG use elements. |
| CVE-2011-2350 | Medium | 2011-06-29 | Not applicable | No public exploit | The HTML parser in Google Chrome before 12.0.742.112 does not properly address "lifetime and re-entrancy issues," which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. |
| CVE-2011-2349 | Medium | 2011-06-29 | Not applicable | No public exploit | Use-after-free vulnerability in Google Chrome before 12.0.742.112 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to text selection. |
| CVE-2011-2348 | Medium | 2011-06-29 | Not applicable | No public exploit | Google V8, as used in Google Chrome before 12.0.742.112, performs an incorrect bounds check, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. |
| CVE-2011-2347 | Medium | 2011-06-29 | Not applicable | No public exploit | Google Chrome before 12.0.742.112 does not properly handle Cascading Style Sheets (CSS) token sequences, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors. |
| CVE-2011-2346 | Medium | 2011-06-29 | Not applicable | No public exploit | Use-after-free vulnerability in Google Chrome before 12.0.742.112 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving SVG fonts. |
| CVE-2011-2345 | Medium | 2011-06-29 | Not applicable | No public exploit | The NPAPI implementation in Google Chrome before 12.0.742.112 does not properly handle strings, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors. |
| CVE-2011-2181 | High | 2011-06-29 | Not applicable | No public exploit | Multiple SQL injection vulnerabilities in A Really Simple Chat (ARSC) 3.3-rc2 allow remote attackers to execute arbitrary SQL commands via the (1) arsc_user parameter to base/admin/edit_user.php, (2) arsc_layout_id parameter in base/admin/edit_layout.php, or (3) arsc_room parameter to base/admin/edit_room.php. |
| CVE-2011-2180 | Medium | 2011-06-29 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in dereferer.php in A Really Simple Chat (ARSC) 3.3-rc2 allows remote attackers to inject arbitrary web script or HTML via the arsc_link parameter. |
| CVE-2011-1335 | Medium | 2011-06-29 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Cybozu Office 6, 7, and 8 before 8.1.1 allows remote attackers to inject arbitrary web script or HTML via vectors related to the "address book and user list functions." |
| CVE-2011-1334 | Medium | 2011-06-29 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Cybozu Office 6, Cybozu Garoon 2.0.0 through 2.1.3, Cybozu Dezie before 6.1, Cybozu MailWise before 3.1, and Cybozu Collaborex before 1.5 allows remote attackers to inject arbitrary web script or HTML via vectors related to "downloading graphic files from the mail system." |
| CVE-2011-1333 | Medium | 2011-06-29 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Cybozu Office 6 and Cybozu Garoon 2.0.0 through 2.1.3 allows remote attackers to inject arbitrary web script or HTML via vectors related to "downloading graphic files from the bulletin board system." |
| CVE-2011-1332 | Medium | 2011-06-29 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Cybozu Garoon 2.0.0 through 2.1.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2008-6570. |
| CVE-2011-2484 | Medium | 2011-06-24 | Not applicable | No public exploit | The add_del_listener function in kernel/taskstats.c in the Linux kernel 2.6.39.1 and earlier does not prevent multiple registrations of exit handlers, which allows local users to cause a denial of service (memory and CPU consumption), and bypass the OOM Killer, via a crafted application. |
| CVE-2011-2194 | High | 2011-06-24 | Not applicable | Working exploit published | Integer overflow in the XSPF playlist parser in VideoLAN VLC media player 0.8.5 through 1.1.9 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors that trigger a heap-based buffer overflow. |
| CVE-2011-2193 | High | 2011-06-24 | Not applicable | No public exploit | Multiple buffer overflows in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 2.x before 2.4.14, 2.5.x before 2.5.6, and 3.x before 3.0.2 allow (1) remote authenticated users to gain privileges via a long Job_Name field in a qsub command to the server, and might allow (2) local users to gain privileges via vectors involving a long host variable in pbs_iff. |
| CVE-2011-1908 | High | 2011-06-24 | Not applicable | No public exploit | Integer overflow in the Type 1 font decoder in the FreeType engine in Foxit Reader before 4.0.0.0619 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted font in a PDF document. |
| CVE-2011-1770 | High | 2011-06-24 | Not applicable | No public exploit | Integer underflow in the dccp_parse_options function (net/dccp/options.c) in the Linux kernel before 2.6.33.14 allows remote attackers to cause a denial of service via a Datagram Congestion Control Protocol (DCCP) packet with an invalid feature options length, which triggers a buffer over-read. |
| CVE-2011-1409 | Medium | 2011-06-24 | Not applicable | No public exploit | Frams's Fast File EXchange (F*EX, aka fex) 20100208, and possibly other versions before 20110610, allows remote attackers to bypass authentication and upload arbitrary files via a request that lacks an authentication ID. |
| CVE-2011-1132 | Medium | 2011-06-24 | Not applicable | No public exploit | The IPv6 implementation in the kernel in Apple Mac OS X before 10.6.8 allows local users to cause a denial of service (NULL pointer dereference and reboot) via vectors involving socket options. |
| CVE-2011-0213 | Medium | 2011-06-24 | Not applicable | No public exploit | Buffer overflow in QuickTime in Apple Mac OS X before 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted JPEG file. |
| CVE-2011-0212 | Medium | 2011-06-24 | Not applicable | No public exploit | servermgrd in Apple Mac OS X before 10.6.8 allows remote attackers to read arbitrary files, and possibly send HTTP requests to intranet servers or cause a denial of service (CPU and memory consumption), via an XML-RPC request containing an entity declaration in conjunction with an entity reference, related to an XML External Entity (aka XXE) issue. |
| CVE-2011-0211 | Medium | 2011-06-24 | Not applicable | No public exploit | Integer overflow in QuickTime in Apple Mac OS X before 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file. |
| CVE-2011-0210 | Medium | 2011-06-24 | Not applicable | No public exploit | QuickTime in Apple Mac OS X before 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted sample tables in a movie file. |
| CVE-2011-0209 | Medium | 2011-06-24 | Not applicable | No public exploit | Integer overflow in QuickTime in Apple Mac OS X before 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted RIFF WAV file. |
| CVE-2011-0208 | Medium | 2011-06-24 | Not applicable | No public exploit | QuickLook in Apple Mac OS X 10.6 before 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Microsoft Office document. |
| CVE-2011-0207 | Medium | 2011-06-24 | Not applicable | No public exploit | The MobileMe component in Apple Mac OS X before 10.6.8 uses a cleartext HTTP session for the Mail application to read e-mail aliases, which allows remote attackers to obtain potentially sensitive alias information by sniffing the network. |
| CVE-2011-0206 | High | 2011-06-24 | Not applicable | No public exploit | Buffer overflow in International Components for Unicode (ICU) in Apple Mac OS X before 10.6.8 allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving uppercase strings. |
| CVE-2011-0205 | Medium | 2011-06-24 | Not applicable | No public exploit | Heap-based buffer overflow in ImageIO in Apple Mac OS X before 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted JPEG2000 image. |
| CVE-2011-0204 | Medium | 2011-06-24 | Not applicable | No public exploit | Heap-based buffer overflow in ImageIO in Apple Mac OS X before 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TIFF image. |
| CVE-2011-0203 | Medium | 2011-06-24 | Not applicable | No public exploit | Absolute path traversal vulnerability in xftpd in the FTP Server component in Apple Mac OS X before 10.6.8 allows remote attackers to list arbitrary directories by using the root directory as the starting point of a recursive listing. |
| CVE-2011-0202 | Medium | 2011-06-24 | Not applicable | No public exploit | Integer overflow in CoreGraphics in Apple Mac OS X before 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted embedded Type 1 font in a PDF document. |
| CVE-2011-0201 | High | 2011-06-24 | Not applicable | No public exploit | Off-by-one error in the CoreFoundation framework in Apple Mac OS X before 10.6.8 allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a CFString object that triggers a buffer overflow. |
| CVE-2011-0200 | Medium | 2011-06-24 | Not applicable | No public exploit | Integer overflow in ColorSync in Apple Mac OS X before 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an image containing a crafted embedded ColorSync profile that triggers a heap-based buffer overflow. |
| CVE-2011-0199 | Medium | 2011-06-24 | Not applicable | No public exploit | The Certificate Trust Policy component in Apple Mac OS X before 10.6.8 does not perform CRL checking for Extended Validation (EV) certificates that lack OCSP URLs, which might allow man-in-the-middle attackers to spoof an SSL server via a revoked certificate. |
| CVE-2011-0198 | Medium | 2011-06-24 | Not applicable | No public exploit | Heap-based buffer overflow in Apple Type Services (ATS) in Apple Mac OS X before 10.6.8 allows remote attackers to execute arbitrary code via a crafted embedded TrueType font. |
| CVE-2011-0197 | Low | 2011-06-24 | Not applicable | No public exploit | App Store in Apple Mac OS X before 10.6.8 creates a log entry containing a user's AppleID password, which might allow local users to obtain sensitive information by reading a log file, as demonstrated by a log file that has non-default permissions. |
| CVE-2011-0196 | High | 2011-06-24 | Not applicable | No public exploit | AirPort in Apple Mac OS X 10.5.8 allows remote attackers to cause a denial of service (out-of-bounds read and reboot) via Wi-Fi frames on the local wireless network. |
| CVE-2009-5044 | Low | 2011-06-24 | Not applicable | No public exploit | contrib/pdfmark/pdfroff.sh in GNU troff (aka groff) before 1.21 allows local users to overwrite arbitrary files via a symlink attack on a pdf#####.tmp temporary file. |
| CVE-2011-2534 | High | 2011-06-22 | Not applicable | No public exploit | Buffer overflow in the clusterip_proc_write function in net/ipv4/netfilter/ipt_CLUSTERIP.c in the Linux kernel before 2.6.39 might allow local users to cause a denial of service or have unspecified other impact via a crafted write operation, related to string data that lacks a terminating '\0' character. |
| CVE-2011-2533 | Low | 2011-06-22 | Not applicable | No public exploit | The configure script in D-Bus (aka DBus) 1.2.x before 1.2.28 allows local users to overwrite arbitrary files via a symlink attack on an unspecified file in /tmp/. |
| CVE-2011-2532 | Medium | 2011-06-22 | Not applicable | No public exploit | The json.decode function in util/json.lua in Prosody 0.8.x before 0.8.1 might allow remote attackers to cause a denial of service (infinite loop) via invalid JSON data, as demonstrated by truncated data. |
| CVE-2011-2531 | Medium | 2011-06-22 | Not applicable | No public exploit | Prosody 0.8.x before 0.8.1, when MySQL is used, assigns an incorrect data type to the value column in certain tables, which might allow remote attackers to cause a denial of service (data truncation) by sending a large amount of data. |
| CVE-2011-2530 | High | 2011-06-22 | Not applicable | No public exploit | Buffer overflow in RSEds.dll in RSHWare.exe in the EDS Hardware Installation Tool 1.0.5.1 and earlier in Rockwell Automation RSLinx Classic before 2.58 allows user-assisted remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a malformed .eds file. |
| CVE-2011-2206 | Medium | 2011-06-22 | Not applicable | No public exploit | XMLParser.pm in DJabberd before 0.85 allows remote authenticated users to read arbitrary files, and possibly send HTTP requests to intranet servers or cause a denial of service (CPU and memory consumption), via an XML external entity declaration in conjunction with an entity reference, a different vulnerability than CVE-2011-1757. |
| CVE-2011-2205 | Medium | 2011-06-22 | Not applicable | No public exploit | Prosody before 0.8.1 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564. |
| CVE-2011-2200 | Medium | 2011-06-22 | Not applicable | No public exploit | The _dbus_header_byteswap function in dbus-marshal-header.c in D-Bus (aka DBus) 1.2.x before 1.2.28, 1.4.x before 1.4.12, and 1.5.x before 1.5.4 does not properly handle a non-native byte order, which allows local users to cause a denial of service (connection loss), obtain potentially sensitive information, or conduct unspecified state-modification attacks via crafted messages. |
| CVE-2011-1330 | Medium | 2011-06-22 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in WeblyGo 5.0 Pro/LE, 5.02 Pro/LE, 5.03 Pro/LE, 5.04 Pro/LE, and 5.10 Pro/LE allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2011-1173 | Medium | 2011-06-22 | Not applicable | No public exploit | The econet_sendmsg function in net/econet/af_econet.c in the Linux kernel before 2.6.39 on the x86_64 platform allows remote attackers to obtain potentially sensitive information from kernel stack memory by reading uninitialized data in the ah field of an Acorn Universal Networking (AUN) packet. |
| CVE-2011-1172 | Low | 2011-06-22 | Not applicable | No public exploit | net/ipv6/netfilter/ip6_tables.c in the IPv6 implementation in the Linux kernel before 2.6.39 does not place the expected '\0' character at the end of string data in the values of certain structure members, which allows local users to obtain potentially sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting modprobe process. |
| CVE-2011-1171 | Low | 2011-06-22 | Not applicable | No public exploit | net/ipv4/netfilter/ip_tables.c in the IPv4 implementation in the Linux kernel before 2.6.39 does not place the expected '\0' character at the end of string data in the values of certain structure members, which allows local users to obtain potentially sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting modprobe process. |
| CVE-2011-1170 | Low | 2011-06-22 | Not applicable | No public exploit | net/ipv4/netfilter/arp_tables.c in the IPv4 implementation in the Linux kernel before 2.6.39 does not place the expected '\0' character at the end of string data in the values of certain structure members, which allows local users to obtain potentially sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting modprobe process. |
| CVE-2011-2188 | Medium | 2011-06-21 | Not applicable | No public exploit | LuaExpat before 1.2.0 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564. |
| CVE-2011-1757 | Medium | 2011-06-21 | Not applicable | No public exploit | DJabberd 0.84 and earlier does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564. |
| CVE-2011-1756 | Medium | 2011-06-21 | Not applicable | No public exploit | modules/xmpp/serv_xmpp.c in Citadel 7.86 and earlier does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564. |
| CVE-2011-1755 | High | 2011-06-21 | Not applicable | No public exploit | jabberd2 before 2.2.14 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564. |
| CVE-2011-1754 | Medium | 2011-06-21 | Not applicable | No public exploit | jabberd14 1.6.1.1 and earlier does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564. |
| CVE-2011-1753 | Medium | 2011-06-21 | Not applicable | No public exploit | expat_erl.c in ejabberd before 2.1.7 and 3.x before 3.0.0-alpha-3, and exmpp before 0.9.7, does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564. |
| CVE-2011-1482 | Medium | 2011-06-21 | Not applicable | No public exploit | Multiple cross-site request forgery (CSRF) vulnerabilities in mainfile.php in Francisco Burzi PHP-Nuke 8.0 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add user accounts or (2) grant the administrative privilege to a user account, related to a Referer check that uses a substring comparison. |
| CVE-2011-1481 | Medium | 2011-06-21 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in Francisco Burzi PHP-Nuke 8.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) sender_name or (2) sender_email parameter in a Feedback action to modules.php. |
| CVE-2011-1480 | High | 2011-06-21 | Not applicable | No public exploit | SQL injection vulnerability in admin.php in the administration backend in Francisco Burzi PHP-Nuke 8.0 and earlier allows remote attackers to execute arbitrary SQL commands via the chng_uid parameter. |
| CVE-2011-1131 | Medium | 2011-06-21 | Not applicable | No public exploit | The PlushSearch2 function in Search.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, uses certain cached data in a situation where a temporary table has been created, even though this cached data is intended only for situations where a temporary table has not been created, which might allow remote attackers to obtain sensitive information via a search. |
| CVE-2011-1130 | High | 2011-06-21 | Not applicable | No public exploit | Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, does not properly validate the start parameter, which might allow remote attackers to conduct SQL injection attacks, obtain sensitive information, or cause a denial of service via a crafted value, related to the cleanRequest function in QueryString.php and the constructPageIndex function in Subs.php. |
| CVE-2011-1129 | Low | 2011-06-21 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the EditNews function in ManageNews.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, might allow remote authenticated users to inject arbitrary web script or HTML via a save_items action. |
| CVE-2011-1128 | High | 2011-06-21 | Not applicable | No public exploit | The loadUserSettings function in Load.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, does not properly handle invalid login attempts, which might make it easier for remote attackers to obtain access or cause a denial of service via a brute-force attack. |
| CVE-2011-1127 | High | 2011-06-21 | Not applicable | No public exploit | SSI.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, does not properly restrict guest access, which allows remote attackers to have an unspecified impact via unknown vectors. |