Overview 22,003 matches · 349 in Waratek scope · 19 protected · 290 exploited · 44 CISA KEV · 8,914 public PoC · 645 EPSS ≥ 0.5
22,003matches
349in Waratek scope1.6%
19protected0.1%
290exploited1.3%
44CISA KEV0.2%
8,914public PoC40.5%
645EPSS ≥ 0.52.9%
Protected by Waratek
19
0.1%
Rule in development
0
0.0%
Mitigation candidate
16
0.1%
No exploit published
314
1.4%
Outside Waratek scope
277
1.3%
Not applicable
21,377
97.2%
Withdrawn CVE
0
0.0%
blocked by ARMR today
19
0.1%
partly blocked
0
0.0%
not blocked
21,984
99.9%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 3,162 / year
19882
Not applicable2
High2
not blocked2
Working exploit published1
No public exploit1
19892
Not applicable2
High2
not blocked2
No public exploit2
19908
Not applicable8
High8
not blocked8
No public exploit8
199111
Not applicable11
High11
not blocked11
Working exploit published2
No public exploit9
199212
Not applicable12
High12
not blocked12
No public exploit12
19938
Not applicable8
High8
not blocked8
No public exploit8
199414
Not applicable14
High14
not blocked14
Working exploit published3
No public exploit11
199517
Not applicable17
High17
not blocked17
Working exploit published2
No public exploit15
199643
No exploit published1
Not applicable42
High43
not blocked43
Working exploit published12
Forecast only1
No public exploit30
1997143
Not applicable143
High143
not blocked143
Exploited2
Working exploit published51
No public exploit90
1998137
Not applicable137
High137
not blocked137
Exploited1
Working exploit published33
No public exploit103
1999423
No exploit published2
Not applicable421
High423
not blocked423
Exploited2
Working exploit published132
No public exploit289
2000454
Mitigation candidate2
No exploit published3
Outside Waratek scope2
Not applicable447
High454
not blocked454
Exploited3
Working exploit published197
Forecast only1
No public exploit253
2001776
Protected by Waratek1
No exploit published6
Outside Waratek scope5
Not applicable764
High776
blocked by ARMR today1
not blocked775
Exploited11
Working exploit published219
No public exploit546
20021,023
Protected by Waratek1
Mitigation candidate2
No exploit published8
Outside Waratek scope8
Not applicable1,004
High1,023
blocked by ARMR today1
not blocked1,022
Exploited9
Working exploit published276
Forecast only3
No public exploit735
2003674
Mitigation candidate2
No exploit published7
Outside Waratek scope4
Not applicable661
High674
not blocked674
Exploited10
Working exploit published236
No public exploit428
2004973
Protected by Waratek1
No exploit published5
Outside Waratek scope4
Not applicable963
High973
blocked by ARMR today1
not blocked972
Exploited10
Working exploit published302
No public exploit661
20052,048
No exploit published30
Outside Waratek scope10
Not applicable2,008
High2,048
not blocked2,048
Exploited11
Working exploit published658
Forecast only5
No public exploit1,374
20062,763
Protected by Waratek4
No exploit published62
Outside Waratek scope63
Not applicable2,634
High2,763
blocked by ARMR today4
not blocked2,759
Exploited26
Working exploit published1,197
Proof of concept only1
Forecast only4
No public exploit1,535
20073,162
Protected by Waratek3
Mitigation candidate1
No exploit published64
Outside Waratek scope26
Not applicable3,068
High3,162
blocked by ARMR today3
not blocked3,159
Exploited32
Working exploit published1,405
Proof of concept only1
Forecast only4
No public exploit1,720
20082,846
Protected by Waratek3
Mitigation candidate1
No exploit published42
Outside Waratek scope44
Not applicable2,756
High2,846
blocked by ARMR today3
not blocked2,843
Exploited33
Working exploit published1,492
Proof of concept only2
Forecast only8
No public exploit1,311
20092,734
Protected by Waratek3
Mitigation candidate4
No exploit published45
Outside Waratek scope26
Not applicable2,656
High2,734
blocked by ARMR today3
not blocked2,731
Exploited54
Working exploit published1,424
No public exploit1,256
20102,093
Protected by Waratek2
Mitigation candidate1
No exploit published24
Outside Waratek scope41
Not applicable2,025
High2,093
blocked by ARMR today2
not blocked2,091
Exploited53
Working exploit published730
Forecast only6
No public exploit1,304
20111,637
Protected by Waratek1
Mitigation candidate3
No exploit published15
Outside Waratek scope44
Not applicable1,574
High1,637
blocked by ARMR today1
not blocked1,636
Exploited33
Working exploit published337
Proof of concept only1
Forecast only2
No public exploit1,264
198919911993199519971999200120032005200720092011
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2011-4542 | High | 2011-11-30 | Not applicable | Working exploit published | Hastymail2 2.1.1 before RC2 allows remote attackers to execute arbitrary commands via the (1) rs or (2) rsargs[] parameter in a mailbox Drafts action to the default URI. |
| CVE-2011-4191 | High | 2011-11-30 | Not applicable | Working exploit published | Stack-based buffer overflow in the xdrDecodeString function in XNFS.NLM in Novell NetWare 6.5 SP8 allows remote attackers to execute arbitrary code or cause a denial of service (abend or NFS outage) via long packets. |
| CVE-2011-4002 | High | 2011-11-30 | Not applicable | No public exploit | HP no Mawashimono Nikki 6.6 and earlier allows remote attackers to execute arbitrary commands via unspecified vectors, related to a "command injection vulnerability." |
| CVE-2011-3173 | High | 2011-11-30 | Not applicable | No public exploit | Stack-based buffer overflow in the GetDriverSettings function in nipplib.dll in the iPrint client in Novell Open Enterprise Server 2 (aka OES2) SP3 allows remote attackers to execute arbitrary code via a long (1) hostname or (2) port field. |
| CVE-2009-5028 | High | 2011-11-30 | Not applicable | No public exploit | Stack-based buffer overflow in Namazu before 2.0.20 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted request containing an empty uri field. |
| CVE-2011-4571 | High | 2011-11-29 | Not applicable | Working exploit published | SQL injection vulnerability in the Estate Agent (com_estateagent) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a showEO action to index.php. |
| CVE-2011-4570 | High | 2011-11-29 | Not applicable | Working exploit published | SQL injection vulnerability in the Time Returns (com_timereturns) component 2.0 and possibly earlier versions for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a timereturns action to index.php. |
| CVE-2011-4569 | High | 2011-11-29 | Not applicable | Working exploit published | SQL injection vulnerability in userbarsettings.php in the Userbar plugin 2.2 for MyBB Forum allows remote attackers to execute arbitrary SQL commands via the image2 parameter. |
| CVE-2011-4405 | High | 2011-11-29 | Not applicable | No public exploit | The cupshelpers scripts in system-config-printer in Ubuntu 11.04 and 11.10, as used by the automatic printer driver download service, uses an "insecure connection" for queries to the OpenPrinting database, which allows remote attackers to execute arbitrary code via a man-in-the-middle (MITM) attack that modifies packages or repositories. |
| CVE-2011-4559 | High | 2011-11-28 | Not applicable | Working exploit published | SQL injection vulnerability in the Calendar module in vTiger CRM 5.2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the onlyforuser parameter in an index action to index.php. |
| CVE-2011-3828 | High | 2011-11-26 | Not applicable | No public exploit | DVRemoteAx.ax 2.1.0.39 in the DVR Remote ActiveX control allows remote attackers to execute arbitrary code via a crafted DVRobot.dll file in a manifest directory on a web server. |
| CVE-2011-4548 | High | 2011-11-24 | Not applicable | No public exploit | Multiple unspecified vulnerabilities in Google Chrome before 16.0.912.44 on the Acer AC700, Samsung Series 5, and Cr-48 Chromebook platforms have unknown impact and attack vectors. |
| CVE-2011-4262 | High | 2011-11-24 | Not applicable | No public exploit | Unspecified vulnerability in RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via a crafted MP4 file. |
| CVE-2011-4261 | High | 2011-11-24 | Not applicable | No public exploit | RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted video dimensions in an MP4 file. |
| CVE-2011-4260 | High | 2011-11-24 | Not applicable | No public exploit | RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via a malformed header in an MP4 file. |
| CVE-2011-4259 | High | 2011-11-24 | Not applicable | No public exploit | Integer underflow in RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via a crafted width value in an MPG file. |
| CVE-2011-4258 | High | 2011-11-24 | Not applicable | No public exploit | RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via a crafted length of an MLTI chunk in an IVR file. |
| CVE-2011-4257 | High | 2011-11-24 | Not applicable | No public exploit | The Cook codec in RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via crafted channel data. |
| CVE-2011-4256 | High | 2011-11-24 | Not applicable | No public exploit | The RV30 codec in RealNetworks RealPlayer before 15.0.0 and Mac RealPlayer before 12.0.0.1703 does not initialize an unspecified index value, which allows remote attackers to execute arbitrary code via unknown vectors. |
| CVE-2011-4255 | High | 2011-11-24 | Not applicable | No public exploit | Unspecified vulnerability in RealNetworks RealPlayer before 15.0.0 and Mac RealPlayer before 12.0.0.1703 allows remote attackers to execute arbitrary code via an invalid codec name. |
| CVE-2011-4254 | High | 2011-11-24 | Not applicable | No public exploit | RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via a crafted RTSP SETUP request. |
| CVE-2011-4253 | High | 2011-11-24 | Not applicable | No public exploit | Unspecified vulnerability in the RV20 codec in RealNetworks RealPlayer before 15.0.0 and Mac RealPlayer before 12.0.0.1703 allows remote attackers to execute arbitrary code via unknown vectors. |
| CVE-2011-4252 | High | 2011-11-24 | Not applicable | No public exploit | The RV10 codec in RealNetworks RealPlayer before 15.0.0 and Mac RealPlayer before 12.0.0.1703 allows remote attackers to execute arbitrary code via a crafted sample height. |
| CVE-2011-4251 | High | 2011-11-24 | Not applicable | No public exploit | RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via a crafted sample size in a RealAudio file. |
| CVE-2011-4250 | High | 2011-11-24 | Not applicable | No public exploit | Unspecified vulnerability in the ATRC codec in RealNetworks RealPlayer before 15.0.0 and Mac RealPlayer before 12.0.0.1703 allows remote attackers to execute arbitrary code via unknown vectors. |
| CVE-2011-4249 | High | 2011-11-24 | Not applicable | No public exploit | Array index error in the RV30 codec in RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via unspecified vectors. |
| CVE-2011-4248 | High | 2011-11-24 | Not applicable | No public exploit | RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via a malformed AAC file. |
| CVE-2011-4247 | High | 2011-11-24 | Not applicable | No public exploit | RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via a crafted QCELP stream. |
| CVE-2011-4246 | High | 2011-11-24 | Not applicable | No public exploit | The AAC codec in RealNetworks RealPlayer before 15.0.0 and Mac RealPlayer before 12.0.0.1703 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors. |
| CVE-2011-4245 | High | 2011-11-24 | Not applicable | No public exploit | The RealVideo renderer in RealNetworks RealPlayer before 15.0.0 and Mac RealPlayer before 12.0.0.1703 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors. |
| CVE-2011-4244 | High | 2011-11-24 | Not applicable | No public exploit | Heap-based buffer overflow in the RealVideo renderer in RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via unspecified vectors. |
| CVE-2010-5062 | High | 2011-11-23 | Not applicable | Working exploit published | SQL injection vulnerability in search.php in MH Products kleinanzeigenmarkt allows remote attackers to execute arbitrary SQL commands via the c parameter. |
| CVE-2010-5061 | High | 2011-11-23 | Not applicable | No public exploit | SQL injection vulnerability in index.php in RSStatic allows remote attackers to execute arbitrary SQL commands via the maxarticles parameter. |
| CVE-2010-5060 | High | 2011-11-23 | Not applicable | Working exploit published | SQL injection vulnerability in Nus.php in NUs Newssystem 1.02 allows remote attackers to execute arbitrary SQL commands via the id parameter. |
| CVE-2010-5059 | High | 2011-11-23 | Not applicable | Working exploit published | SQL injection vulnerability in index.php in CMScout 2.0.8 allows remote attackers to execute arbitrary SQL commands via the album parameter in a photos action. |
| CVE-2010-5058 | High | 2011-11-23 | Not applicable | Working exploit published | SQL injection vulnerability in detResolucion.php in CMS Ariadna 1.1 allows remote attackers to execute arbitrary SQL commands via the res_id parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. |
| CVE-2010-5057 | High | 2011-11-23 | Not applicable | Working exploit published | SQL injection vulnerability in detResolucion.php in CMS Ariadna 1.1 allows remote attackers to execute arbitrary SQL commands via the tipodoc_id parameter. |
| CVE-2010-5056 | High | 2011-11-23 | Not applicable | Working exploit published | SQL injection vulnerability in the GBU Facebook (com_gbufacebook) component 1.0.5 for Joomla! allows remote attackers to execute arbitrary SQL commands via the face_id parameter in a show_face action to index.php. |
| CVE-2010-5055 | High | 2011-11-23 | Not applicable | Working exploit published | SQL injection vulnerability in index.php in Almnzm 2.1 allows remote attackers to execute arbitrary SQL commands via the id parameter. |
| CVE-2010-5053 | High | 2011-11-23 | Not applicable | Working exploit published | SQL injection vulnerability in the XOBBIX (com_xobbix) component 1.0.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the prodid parameter in a prod_desc action to index.php. |
| CVE-2010-5049 | High | 2011-11-23 | Not applicable | No public exploit | SQL injection vulnerability in events.php in Zabbix 1.8.1 and earlier allows remote attackers to execute arbitrary SQL commands via the nav_time parameter. |
| CVE-2010-5047 | High | 2011-11-23 | Not applicable | Working exploit published | SQL injection vulnerability in page.php in V-EVA Press Release Script allows remote attackers to execute arbitrary SQL commands via the id parameter. |
| CVE-2011-4507 | High | 2011-11-22 | Not applicable | No public exploit | The D-Link DIR-685 router, when certain WPA and WPA2 configurations are used, does not maintain an encrypted wireless network during transfer of a large amount of network traffic, which allows remote attackers to obtain sensitive information or bypass authentication via a Wi-Fi device. |
| CVE-2011-4506 | High | 2011-11-22 | Not applicable | No public exploit | The UPnP IGD implementation on the Thomson (aka Technicolor) TG585 with firmware 7.x before 7.4.3.2 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an "external forwarding" vulnerability. |
| CVE-2011-4505 | High | 2011-11-22 | Not applicable | No public exploit | The UPnP IGD implementation on SpeedTouch 5x6 devices with firmware before 6.2.29 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an "external forwarding" vulnerability. |
| CVE-2011-4504 | High | 2011-11-22 | Not applicable | No public exploit | The UPnP IGD implementation in the Pseudo ICS UPnP software on the ZyXEL P-330W allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an "external forwarding" vulnerability. |
| CVE-2011-4503 | High | 2011-11-22 | Not applicable | No public exploit | The UPnP IGD implementation in Broadcom Linux on the Sitecom WL-111 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an "external forwarding" vulnerability. |
| CVE-2011-4502 | High | 2011-11-22 | Not applicable | No public exploit | The UPnP IGD implementation in Edimax EdiLinux on the Edimax BR-6104K with firmware before 3.25, Edimax 6114Wg, Canyon-Tech CN-WF512 with firmware 1.83, Canyon-Tech CN-WF514 with firmware 2.08, Sitecom WL-153 with firmware before 1.39, and Sweex LB000021 with firmware 3.15 allows remote attackers to execute arbitrary commands via shell metacharacters. |
| CVE-2011-4501 | High | 2011-11-22 | Not applicable | No public exploit | The UPnP IGD implementation in Edimax EdiLinux on the Edimax BR-6104K with firmware before 3.25, Edimax 6114Wg, Canyon-Tech CN-WF512 with firmware 1.83, Canyon-Tech CN-WF514 with firmware 2.08, Sitecom WL-153 with firmware before 1.39, and Sweex LB000021 with firmware 3.15 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an "external forwarding" vulnerability. |
| CVE-2011-4500 | High | 2011-11-22 | Not applicable | No public exploit | The UPnP IGD implementation on the Cisco Linksys WRT54GX with firmware 2.00.05, when UPnP is enabled, configures the SOAP server to listen on the WAN port, which allows remote attackers to administer the firewall via SOAP requests. |
| CVE-2011-4499 | High | 2011-11-22 | Not applicable | No public exploit | The UPnP IGD implementation in the Broadcom UPnP stack on the Cisco Linksys WRT54G with firmware before 4.30.5, WRT54GS v1 through v3 with firmware before 4.71.1, and WRT54GS v4 with firmware before 1.06.1 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an "external forwarding" vulnerability. |
| CVE-2011-4496 | High | 2011-11-21 | Not applicable | Working exploit published | Buffer overflow in Aviosoft DTV Player 1.0.1.2 allows remote attackers to execute arbitrary code via a crafted .plf (aka playlist) file. |
| CVE-2011-4040 | High | 2011-11-21 | Not applicable | Working exploit published | Buffer overflow in MiniSmtp 3.0.11818 in NJStar Communicator allows remote attackers to execute arbitrary code via a crafted packet. |
| CVE-2011-3900 | High | 2011-11-17 | Not applicable | No public exploit | Google V8, as used in Google Chrome before 15.0.874.121, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger an out-of-bounds write operation. |
| CVE-2011-4157 | High | 2011-11-16 | Not applicable | No public exploit | Stack-based buffer overflow in hydra.exe in HP SAN/iQ before 9.5 on the HP StorageWorks P4000 Virtual SAN Appliance allows remote attackers to execute arbitrary code via a crafted login request. |
| CVE-2011-1516 | High | 2011-11-15 | Not applicable | Working exploit published | The kSBXProfileNoNetwork and kSBXProfileNoInternet sandbox profiles in Apple Mac OS X 10.5.x through 10.7.x do not propagate restrictions to all created processes, which allows remote attackers to access network resources via a crafted application, as demonstrated by use of osascript to send Apple events to the launchd daemon, a related issue to CVE-2008-7303. |
| CVE-2008-7303 | High | 2011-11-15 | Not applicable | No public exploit | The nonet and nointernet sandbox profiles in Apple Mac OS X 10.5.x do not propagate restrictions to all created processes, which allows remote attackers to access network resources via a crafted application, as demonstrated by use of launchctl to trigger the launchd daemon's execution of a script file, a related issue to CVE-2011-1516. |
| CVE-2011-4047 | High | 2011-11-12 | Not applicable | No public exploit | The Dell KACE K2000 System Deployment Appliance allows remote attackers to execute arbitrary commands by leveraging database write access. |
| CVE-2011-3898 | High | 2011-11-11 | Not applicable | No public exploit | Google Chrome before 15.0.874.120, when Java Runtime Environment (JRE) 7 is used, does not request user confirmation before applet execution begins, which allows remote attackers to have an unspecified impact via a crafted applet. |
| CVE-2011-3896 | High | 2011-11-11 | Not applicable | No public exploit | Buffer overflow in Google Chrome before 15.0.874.120 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to shader variable mapping. |
| CVE-2011-3895 | High | 2011-11-11 | Not applicable | No public exploit | Heap-based buffer overflow in the Vorbis decoder in Google Chrome before 15.0.874.120 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted stream. |
| CVE-2011-3894 | High | 2011-11-11 | Not applicable | No public exploit | Google Chrome before 15.0.874.120 does not properly perform VP8 decoding, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted stream. |
| CVE-2011-3892 | High | 2011-11-11 | Not applicable | No public exploit | Double free vulnerability in the Theora decoder in Google Chrome before 15.0.874.120 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted stream. |
| CVE-2011-3442 | High | 2011-11-11 | Not applicable | No public exploit | The kernel in Apple iOS before 5.0.1 does not ensure the validity of flag combinations for an mmap system call, which allows local users to execute arbitrary unsigned code via a crafted app. |
| CVE-2011-3439 | High | 2011-11-11 | Not applicable | No public exploit | FreeType in CoreGraphics in Apple iOS before 5.0.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font in a document. |
| CVE-2011-2460 | High | 2011-11-11 | Not applicable | No public exploit | Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2445, CVE-2011-2451, CVE-2011-2452, CVE-2011-2453, CVE-2011-2454, CVE-2011-2455, and CVE-2011-2459. |
| CVE-2011-2459 | High | 2011-11-11 | Not applicable | No public exploit | Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2445, CVE-2011-2451, CVE-2011-2452, CVE-2011-2453, CVE-2011-2454, CVE-2011-2455, and CVE-2011-2460. |
| CVE-2011-2458 | High | 2011-11-11 | Not applicable | No public exploit | Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, when Internet Explorer is used, allows remote attackers to bypass the cross-domain policy via a crafted web site. |
| CVE-2011-2457 | High | 2011-11-11 | Not applicable | No public exploit | Stack-based buffer overflow in Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code via unspecified vectors. |
| CVE-2011-2456 | High | 2011-11-11 | Not applicable | No public exploit | Buffer overflow in Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code via unspecified vectors. |
| CVE-2011-2455 | High | 2011-11-11 | Not applicable | No public exploit | Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2445, CVE-2011-2451, CVE-2011-2452, CVE-2011-2453, CVE-2011-2454, CVE-2011-2459, and CVE-2011-2460. |
| CVE-2011-2454 | High | 2011-11-11 | Not applicable | No public exploit | Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2445, CVE-2011-2451, CVE-2011-2452, CVE-2011-2453, CVE-2011-2455, CVE-2011-2459, and CVE-2011-2460. |
| CVE-2011-2453 | High | 2011-11-11 | Not applicable | No public exploit | Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2445, CVE-2011-2451, CVE-2011-2452, CVE-2011-2454, CVE-2011-2455, CVE-2011-2459, and CVE-2011-2460. |
| CVE-2011-2452 | High | 2011-11-11 | Not applicable | No public exploit | Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2445, CVE-2011-2451, CVE-2011-2453, CVE-2011-2454, CVE-2011-2455, CVE-2011-2459, and CVE-2011-2460. |
| CVE-2011-2451 | High | 2011-11-11 | Not applicable | No public exploit | Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2445, CVE-2011-2452, CVE-2011-2453, CVE-2011-2454, CVE-2011-2455, CVE-2011-2459, and CVE-2011-2460. |
| CVE-2011-2450 | High | 2011-11-11 | Not applicable | No public exploit | Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors. |
| CVE-2011-2445 | High | 2011-11-11 | Not applicable | No public exploit | Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2451, CVE-2011-2452, CVE-2011-2453, CVE-2011-2454, CVE-2011-2455, CVE-2011-2459, and CVE-2011-2460. |
| CVE-2011-3997 | High | 2011-11-09 | Not applicable | No public exploit | Opengear console servers with firmware before 2.2.1 allow remote attackers to bypass authentication, and modify settings or access connected equipment, via unspecified vectors. |
| CVE-2011-3655 | High | 2011-11-09 | Not applicable | No public exploit | Mozilla Firefox 4.x through 7.0 and Thunderbird 5.0 through 7.0 perform access control without checking for use of the NoWaiverWrapper wrapper, which allows remote attackers to gain privileges via a crafted web site. |
| CVE-2011-3654 | High | 2011-11-09 | Not applicable | No public exploit | The browser engine in Mozilla Firefox before 8.0 and Thunderbird before 8.0 does not properly handle links from SVG mpath elements to non-SVG elements, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors. |
| CVE-2011-3652 | High | 2011-11-09 | Not applicable | No public exploit | The browser engine in Mozilla Firefox before 8.0 and Thunderbird before 8.0 does not properly allocate memory, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors. |
| CVE-2011-3651 | High | 2011-11-09 | Not applicable | No public exploit | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 7.0 and Thunderbird 7.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. |
| CVE-2011-3650 | High | 2011-11-09 | Not applicable | No public exploit | Mozilla Firefox before 3.6.24 and 4.x through 7.0 and Thunderbird before 3.1.6 and 5.0 through 7.0 do not properly handle JavaScript files that contain many functions, which allows user-assisted remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a crafted file that is accessed by debugging APIs, as demonstrated by Firebug. |
| CVE-2011-3647 | High | 2011-11-09 | Not applicable | No public exploit | The JSSubScriptLoader in Mozilla Firefox before 3.6.24 and Thunderbird before 3.1.6 does not properly handle XPCNativeWrappers during calls to the loadSubScript method in an add-on, which makes it easier for remote attackers to gain privileges via a crafted web site that leverages certain unwrapping behavior, a related issue to CVE-2011-3004. |
| CVE-2011-2740 | High | 2011-11-09 | Not applicable | No public exploit | EMC RSA Key Manager (RKM) Appliance 2.7 SP1 before 2.7.1.6, when Firefox 4.x or 5.0 is used, does not properly terminate a user session upon a logout action, which makes it easier for remote attackers to execute arbitrary code by leveraging an unattended workstation. |
| CVE-2011-2739 | High | 2011-11-09 | Not applicable | No public exploit | The file-blocking feature in EMC Documentum eRoom 7.3.x and 7.4.x before 7.4.3.g does not properly restrict the uploading and opening of files with dangerous file types, which allows remote authenticated users to execute arbitrary code via an uploaded file. |
| CVE-2011-4000 | High | 2011-11-08 | Not applicable | No public exploit | Buffer overflow in ChaSen 2.4.x allows remote attackers to execute arbitrary code via a crafted string. |
| CVE-2011-2449 | High | 2011-11-08 | Not applicable | No public exploit | The TextXtra module in Adobe Shockwave Player before 11.6.3.633 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors. |
| CVE-2011-2448 | High | 2011-11-08 | Not applicable | No public exploit | The DIRapi library in Adobe Shockwave Player before 11.6.3.633 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2446. |
| CVE-2011-2447 | High | 2011-11-08 | Not applicable | No public exploit | Adobe Shockwave Player before 11.6.3.633 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors. |
| CVE-2011-2446 | High | 2011-11-08 | Not applicable | No public exploit | The DIRapi library in Adobe Shockwave Player before 11.6.3.633 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2448. |
| CVE-2011-2016 | High | 2011-11-08 | Not applicable | No public exploit | Untrusted search path vulnerability in Windows Mail and Windows Meeting Space in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .eml or .wcinv file, aka "Windows Mail Insecure Library Loading Vulnerability." |
| CVE-2011-2014 | High | 2011-11-08 | Not applicable | No public exploit | The LDAP over SSL (aka LDAPS) implementation in Active Directory, Active Directory Application Mode (ADAM), and Active Directory Lightweight Directory Service (AD LDS) in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not examine Certificate Revocation Lists (CRLs), which allows remote authenticated users to bypass intended certificate restrictions and access Active Directory resources by leveraging a revoked X.509 certificate for a domain account, aka "LDAPS Authentication Bypass Vulnerability." |
| CVE-2011-2004 | High | 2011-11-08 | Not applicable | No public exploit | Array index error in win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1 allows remote attackers to cause a denial of service (reboot) via a crafted TrueType font file, aka "TrueType Font Parsing Vulnerability," a different vulnerability than CVE-2011-3402. |
| CVE-2011-4066 | High | 2011-11-04 | Not applicable | Working exploit published | SQL injection vulnerability in bbs/tb.php in Gnuboard 4.33.02 and earlier allows remote attackers to execute arbitrary SQL commands via the PATH_INFO. |
| CVE-2011-3991 | High | 2011-11-04 | Not applicable | No public exploit | Untrusted search path vulnerability in FFFTP 1.98a and earlier allows local users to execute arbitrary code via unspecified functions. |
| CVE-2011-3989 | High | 2011-11-04 | Not applicable | No public exploit | SQL injection vulnerability in DBD::mysqlPP 0.04 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors. |
| CVE-2011-3402 | High | 2011-11-04 | Not applicable | Exploited | Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page, as exploited in the wild in November 2011 by Duqu, aka "TrueType Font Parsing Vulnerability." |
| CVE-2011-3330 | High | 2011-11-04 | Not applicable | No public exploit | Buffer overflow in the UnitelWay Windows Device Driver, as used in Schneider Electric Unity Pro 6 and earlier, OPC Factory Server 3.34, Vijeo Citect 7.20 and earlier, Telemecanique Driver Pack 2.6 and earlier, Monitor Pro 7.6 and earlier, and PL7 Pro 4.5 and earlier, allows local users, and possibly remote attackers, to execute arbitrary code via an unspecified system parameter. |
| CVE-2011-1513 | High | 2011-11-04 | Not applicable | Working exploit published | Static code injection vulnerability in install_.php in e107 CMS 0.7.24 and probably earlier versions, when the installation script is not removed, allows remote attackers to inject arbitrary PHP code into e107_config.php via a crafted MySQL server name. |