Overview 46,518 matches · 0 in Waratek scope · 0 protected · 388 exploited · 52 CISA KEV · 16,519 public PoC · 804 EPSS ≥ 0.5
46,518matches
0in Waratek scope0.0%
0protected0.0%
388exploited0.8%
52CISA KEV0.1%
16,519public PoC35.5%
804EPSS ≥ 0.51.7%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
46,518
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
46,518
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 6,408 / year
19882
Not applicable2
High2
not blocked2
Working exploit published1
No public exploit1
19893
Not applicable3
High2
Medium1
not blocked3
No public exploit3
199011
Not applicable11
High8
Medium2
Low1
not blocked11
Working exploit published1
No public exploit10
199115
Not applicable15
High11
Medium4
not blocked15
Working exploit published2
No public exploit13
199213
Not applicable13
High12
Low1
not blocked13
No public exploit13
199313
Not applicable13
High8
Medium3
Low2
not blocked13
No public exploit13
199425
Not applicable25
High14
Medium10
Low1
not blocked25
Working exploit published6
No public exploit19
199525
Not applicable25
Critical1
High17
Medium6
Low1
not blocked25
Working exploit published5
No public exploit20
199673
Not applicable73
Critical1
High42
Medium21
Low9
not blocked73
Working exploit published17
Forecast only1
No public exploit55
1997252
Not applicable252
Critical1
High143
Medium89
Low19
not blocked252
Exploited2
Working exploit published73
Forecast only2
No public exploit175
1998246
Not applicable246
Critical1
High137
Medium85
Low23
not blocked246
Exploited1
Working exploit published50
No public exploit195
1999891
Not applicable891
Critical3
High421
Medium356
Low111
not blocked891
Exploited2
Working exploit published280
No public exploit609
20001,005
Not applicable1,005
Critical2
High447
Medium460
Low96
not blocked1,005
Exploited5
Working exploit published420
No public exploit580
20011,649
Not applicable1,649
Critical12
High764
Medium693
Low180
not blocked1,649
Exploited14
Working exploit published474
Forecast only2
No public exploit1,159
20022,107
Not applicable2,107
Critical10
High1,004
Medium953
Low140
not blocked2,107
Exploited12
Working exploit published531
Forecast only7
No public exploit1,557
20031,482
Not applicable1,482
Critical9
High661
Medium722
Low90
not blocked1,482
Exploited10
Working exploit published488
Forecast only1
No public exploit983
20042,416
Not applicable2,416
Critical10
High963
Medium1,243
Low200
not blocked2,416
Exploited21
Working exploit published753
Forecast only1
No public exploit1,641
20054,833
Not applicable4,833
Critical12
High2,008
Medium2,378
Low435
not blocked4,833
Exploited22
Working exploit published1,327
Forecast only11
No public exploit3,473
20066,408
Not applicable6,408
Critical12
High2,634
Medium3,265
Low497
not blocked6,408
Exploited36
Working exploit published2,425
Proof of concept only1
Forecast only6
No public exploit3,940
20076,283
Not applicable6,283
Critical21
High3,068
Medium2,977
Low217
not blocked6,283
Exploited47
Working exploit published2,470
Proof of concept only4
Forecast only5
No public exploit3,757
20085,422
Not applicable5,422
Critical18
High2,756
Medium2,473
Low175
not blocked5,422
Exploited40
Working exploit published2,495
Proof of concept only4
Forecast only8
No public exploit2,875
20095,467
Not applicable5,467
Critical15
High2,656
Medium2,626
Low170
not blocked5,467
Exploited72
Working exploit published2,560
Proof of concept only2
Forecast only3
No public exploit2,830
20104,370
Not applicable4,370
Critical26
High2,025
Medium2,074
Low245
not blocked4,370
Exploited64
Working exploit published1,290
Proof of concept only1
Forecast only8
No public exploit3,007
20113,507
Not applicable3,507
Critical3
High1,574
Medium1,722
Low208
not blocked3,507
Exploited40
Working exploit published593
Proof of concept only3
Forecast only3
No public exploit2,868
198919911993199519971999200120032005200720092011
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2011-4647 | Medium | 2011-11-30 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in the story creation feature in Geeklog 1.8.0 allow remote attackers to inject arbitrary web script or HTML via the (1) code or (2) raw BBcode tags. |
| CVE-2011-4646 | Medium | 2011-11-30 | Not applicable | No public exploit | SQL injection vulnerability in wp-postratings.php in the WP-PostRatings plugin 1.50, 1.61, and probably other versions before 1.62 for WordPress allows remote authenticated users with the Author role to execute arbitrary SQL commands via the id attribute of the ratings shortcode when creating a post. NOTE: some of these details are obtained from third party information. |
| CVE-2011-4542 | High | 2011-11-30 | Not applicable | Working exploit published | Hastymail2 2.1.1 before RC2 allows remote attackers to execute arbitrary commands via the (1) rs or (2) rsargs[] parameter in a mailbox Drafts action to the default URI. |
| CVE-2011-4345 | Low | 2011-11-30 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Namazu before 2.0.21, when Internet Explorer 6 or 7 is used, allows remote attackers to inject arbitrary web script or HTML via a cookie. |
| CVE-2011-4317 | Medium | 2011-11-30 | Not applicable | Working exploit published | The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an @ (at sign) character and a : (colon) character in invalid positions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368. |
| CVE-2011-4191 | High | 2011-11-30 | Not applicable | Working exploit published | Stack-based buffer overflow in the xdrDecodeString function in XNFS.NLM in Novell NetWare 6.5 SP8 allows remote attackers to execute arbitrary code or cause a denial of service (abend or NFS outage) via long packets. |
| CVE-2011-4002 | High | 2011-11-30 | Not applicable | No public exploit | HP no Mawashimono Nikki 6.6 and earlier allows remote attackers to execute arbitrary commands via unspecified vectors, related to a "command injection vulnerability." |
| CVE-2011-3639 | Medium | 2011-11-30 | Not applicable | Working exploit published | The mod_proxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers by using the HTTP/0.9 protocol with a malformed URI containing an initial @ (at sign) character. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368. |
| CVE-2011-3173 | High | 2011-11-30 | Not applicable | No public exploit | Stack-based buffer overflow in the GetDriverSettings function in nipplib.dll in the iPrint client in Novell Open Enterprise Server 2 (aka OES2) SP3 allows remote attackers to execute arbitrary code via a long (1) hostname or (2) port field. |
| CVE-2009-5028 | High | 2011-11-30 | Not applicable | No public exploit | Stack-based buffer overflow in Namazu before 2.0.20 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted request containing an empty uri field. |
| CVE-2011-4572 | Medium | 2011-11-29 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in inc/tesmodrewite.php in CF Image Hosting Script 1.3.82, 1.4.1, and probably other versions before 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the q parameter. NOTE: this was originally reported as a file disclosure vulnerability, but this is likely inaccurate. |
| CVE-2011-4571 | High | 2011-11-29 | Not applicable | Working exploit published | SQL injection vulnerability in the Estate Agent (com_estateagent) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a showEO action to index.php. |
| CVE-2011-4570 | High | 2011-11-29 | Not applicable | Working exploit published | SQL injection vulnerability in the Time Returns (com_timereturns) component 2.0 and possibly earlier versions for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a timereturns action to index.php. |
| CVE-2011-4569 | High | 2011-11-29 | Not applicable | Working exploit published | SQL injection vulnerability in userbarsettings.php in the Userbar plugin 2.2 for MyBB Forum allows remote attackers to execute arbitrary SQL commands via the image2 parameter. |
| CVE-2011-4568 | Medium | 2011-11-29 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in view/frontend-head.php in the Flowplayer plugin before 1.2.12 for WordPress allows remote attackers to inject arbitrary web script or HTML via the URI. |
| CVE-2011-4567 | Medium | 2011-11-29 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in includes/templates/template_default/templates/tpl_gv_send_default.php in Zen Cart before 1.5 allows remote attackers to inject arbitrary web script or HTML via the message parameter in a gv_send action to index.php, a different vulnerability than CVE-2011-4547. |
| CVE-2011-4566 | Medium | 2011-11-29 | Not applicable | No public exploit | Integer overflow in the exif_process_IFD_TAG function in exif.c in the exif extension in PHP 5.4.0beta2 on 32-bit platforms allows remote attackers to read the contents of arbitrary memory locations or cause a denial of service via a crafted offset_val value in an EXIF header in a JPEG file, a different vulnerability than CVE-2011-0708. |
| CVE-2011-4547 | Medium | 2011-11-29 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in includes/templates/template_default/common/tpl_header_test_info.php in Zen Cart 1.3.9h, when debugging is enabled, might allow remote attackers to inject arbitrary web script or HTML via the (1) main_page parameter or (2) PATH_INFO, a different vulnerability than CVE-2011-4567. |
| CVE-2011-4541 | Medium | 2011-11-29 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in index.php in Hastymail2 2.1.1 before RC2 allows remote attackers to inject arbitrary web script or HTML via the rs parameter in a mailbox Drafts action. |
| CVE-2011-4405 | High | 2011-11-29 | Not applicable | No public exploit | The cupshelpers scripts in system-config-printer in Ubuntu 11.04 and 11.10, as used by the automatic printer driver download service, uses an "insecure connection" for queries to the OpenPrinting database, which allows remote attackers to execute arbitrary code via a man-in-the-middle (MITM) attack that modifies packages or repositories. |
| CVE-2011-4313 | Medium | 2011-11-29 | Not applicable | No public exploit | query.c in ISC BIND 9.0.x through 9.6.x, 9.4-ESV through 9.4-ESV-R5, 9.6-ESV through 9.6-ESV-R5, 9.7.0 through 9.7.4, 9.8.0 through 9.8.1, and 9.9.0a1 through 9.9.0b1 allows remote attackers to cause a denial of service (assertion failure and named exit) via unknown vectors related to recursive DNS queries, error logging, and the caching of an invalid record by the resolver. |
| CVE-2011-3367 | Medium | 2011-11-29 | Not applicable | No public exploit | Arora, possibly 0.11 and other versions, does not use a certain font when rendering certificate fields in a security dialog, which allows remote attackers to spoof the common name (CN) of a certificate via rich text. |
| CVE-2011-3366 | Medium | 2011-11-29 | Not applicable | No public exploit | Rekonq 0.7.0 and earlier does not use a certain font when rendering certificate fields in a security dialog, which allows remote attackers to spoof the common name (CN) of a certificate via rich text. |
| CVE-2011-3365 | Medium | 2011-11-29 | Not applicable | No public exploit | The KDE SSL Wrapper (KSSL) API in KDE SC 4.6.0 through 4.7.1, and possibly earlier versions, does not use a certain font when rendering certificate fields in a security dialog, which allows remote attackers to spoof the common name (CN) of a certificate via rich text. |
| CVE-2011-3150 | Medium | 2011-11-29 | Not applicable | No public exploit | Software Center in Ubuntu 11.10, 11.04 10.10 does not properly validate server certificates, which allows remote attackers to execute arbitrary code or obtain sensitive information via a man-in-the-middle (MITM) attack. |
| CVE-2011-4565 | Medium | 2011-11-28 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 2.5.1.a, and possibly earlier versions, allow remote attackers to inject arbitrary web script or HTML via the (1) text parameter to include/formdhtmltextarea_preview.php or (2) img BBCODE tag within the message parameter to pmlite.php (aka Private Message). NOTE: some of these details are obtained from third party information. |
| CVE-2011-4564 | Medium | 2011-11-28 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in the admin script in Active CMS 1.2 allows remote attackers to inject arbitrary web script or HTML via the mod parameter in a module action. |
| CVE-2011-4563 | Medium | 2011-11-28 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in index.php in JAKCMS 2.0.4.1, and possibly other versions before 2.2.6 2011-09-23, allows remote attackers to inject arbitrary web script or HTML via the userpost parameter in a PM request, related to tinymce. NOTE: some of these details are obtained from third party information. |
| CVE-2011-4562 | Medium | 2011-11-28 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in (1) view/admin/log_item.php and (2) view/admin/log_item_details.php in the Redirection plugin 2.2.9 for WordPress allow remote attackers to inject arbitrary web script or HTML via the Referer HTTP header in a request to a post that does not exist. |
| CVE-2011-4561 | Medium | 2011-11-28 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in admin.php in Phorum 5.2.18 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to admin/index.php. NOTE: some of these details are obtained from third party information. |
| CVE-2011-4560 | Low | 2011-11-28 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Petition Node module 6.x-1.x before 6.x-1.5 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to signing a petition. |
| CVE-2011-4559 | High | 2011-11-28 | Not applicable | Working exploit published | SQL injection vulnerability in the Calendar module in vTiger CRM 5.2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the onlyforuser parameter in an index action to index.php. |
| CVE-2011-4335 | Medium | 2011-11-28 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in Contao before 2.10.2 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php in a (1) teachers.html or (2) teachers/ action. |
| CVE-2011-4329 | Medium | 2011-11-28 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 3.1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the username parameter in a setup action to admin/company.php, or the PATH_INFO to (2) admin/security_other.php, (3) admin/events.php, or (4) admin/user.php. |
| CVE-2011-4319 | Medium | 2011-11-28 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the i18n translations helper method in Ruby on Rails 3.0.x before 3.0.11 and 3.1.x before 3.1.2, and the rails_xss plugin in Ruby on Rails 2.3.x, allows remote attackers to inject arbitrary web script or HTML via vectors related to a translations string whose name ends with an "html" substring. |
| CVE-2011-1372 | Medium | 2011-11-28 | Not applicable | No public exploit | The Web User Interface on the IBM TS3100 and TS3200 tape libraries with firmware before A.60 allows remote attackers to bypass authentication and obtain administrative access via unspecified vectors. |
| CVE-2011-4275 | Medium | 2011-11-26 | Not applicable | Exploited | Multiple cross-site scripting (XSS) vulnerabilities in iTop (aka IT Operations Portal) 1.1.181 and 1.2.0-RC-282 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted company name, (2) a crafted database server name, (3) a crafted CSV file, (4) a crafted copy-and-paste action, (5) the auth_user parameter in a suggest_pwd action to UI.php, (6) the c[menu] parameter to UniversalSearch.php, (7) the description parameter in a SearchFormToAdd_document_list action to UI.php, (8) the category parameter in an errors action to audit.php, or (9) the suggest_pwd parameter to UI.php. |
| CVE-2011-3828 | High | 2011-11-26 | Not applicable | No public exploit | DVRemoteAx.ax 2.1.0.39 in the DVR Remote ActiveX control allows remote attackers to execute arbitrary code via a crafted DVRobot.dll file in a manifest directory on a web server. |
| CVE-2011-1378 | Low | 2011-11-26 | Not applicable | No public exploit | IBM WebSphere MQ 6.0 on OpenVMS, when the default rights of the MQM group are established, does not properly verify User Authorization File (UAF) data, which allows local users to kill listener processes and the command server via a control command. |
| CVE-2011-4548 | High | 2011-11-24 | Not applicable | No public exploit | Multiple unspecified vulnerabilities in Google Chrome before 16.0.912.44 on the Acer AC700, Samsung Series 5, and Cr-48 Chromebook platforms have unknown impact and attack vectors. |
| CVE-2011-4312 | Medium | 2011-11-24 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in the commenting system in Review Board before 1.5.7 and 1.6.x before 1.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving the (1) diff viewer or (2) screenshot component. |
| CVE-2011-4262 | High | 2011-11-24 | Not applicable | No public exploit | Unspecified vulnerability in RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via a crafted MP4 file. |
| CVE-2011-4261 | High | 2011-11-24 | Not applicable | No public exploit | RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted video dimensions in an MP4 file. |
| CVE-2011-4260 | High | 2011-11-24 | Not applicable | No public exploit | RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via a malformed header in an MP4 file. |
| CVE-2011-4259 | High | 2011-11-24 | Not applicable | No public exploit | Integer underflow in RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via a crafted width value in an MPG file. |
| CVE-2011-4258 | High | 2011-11-24 | Not applicable | No public exploit | RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via a crafted length of an MLTI chunk in an IVR file. |
| CVE-2011-4257 | High | 2011-11-24 | Not applicable | No public exploit | The Cook codec in RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via crafted channel data. |
| CVE-2011-4256 | High | 2011-11-24 | Not applicable | No public exploit | The RV30 codec in RealNetworks RealPlayer before 15.0.0 and Mac RealPlayer before 12.0.0.1703 does not initialize an unspecified index value, which allows remote attackers to execute arbitrary code via unknown vectors. |
| CVE-2011-4255 | High | 2011-11-24 | Not applicable | No public exploit | Unspecified vulnerability in RealNetworks RealPlayer before 15.0.0 and Mac RealPlayer before 12.0.0.1703 allows remote attackers to execute arbitrary code via an invalid codec name. |
| CVE-2011-4254 | High | 2011-11-24 | Not applicable | No public exploit | RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via a crafted RTSP SETUP request. |
| CVE-2011-4253 | High | 2011-11-24 | Not applicable | No public exploit | Unspecified vulnerability in the RV20 codec in RealNetworks RealPlayer before 15.0.0 and Mac RealPlayer before 12.0.0.1703 allows remote attackers to execute arbitrary code via unknown vectors. |
| CVE-2011-4252 | High | 2011-11-24 | Not applicable | No public exploit | The RV10 codec in RealNetworks RealPlayer before 15.0.0 and Mac RealPlayer before 12.0.0.1703 allows remote attackers to execute arbitrary code via a crafted sample height. |
| CVE-2011-4251 | High | 2011-11-24 | Not applicable | No public exploit | RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via a crafted sample size in a RealAudio file. |
| CVE-2011-4250 | High | 2011-11-24 | Not applicable | No public exploit | Unspecified vulnerability in the ATRC codec in RealNetworks RealPlayer before 15.0.0 and Mac RealPlayer before 12.0.0.1703 allows remote attackers to execute arbitrary code via unknown vectors. |
| CVE-2011-4249 | High | 2011-11-24 | Not applicable | No public exploit | Array index error in the RV30 codec in RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via unspecified vectors. |
| CVE-2011-4248 | High | 2011-11-24 | Not applicable | No public exploit | RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via a malformed AAC file. |
| CVE-2011-4247 | High | 2011-11-24 | Not applicable | No public exploit | RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via a crafted QCELP stream. |
| CVE-2011-4246 | High | 2011-11-24 | Not applicable | No public exploit | The AAC codec in RealNetworks RealPlayer before 15.0.0 and Mac RealPlayer before 12.0.0.1703 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors. |
| CVE-2011-4245 | High | 2011-11-24 | Not applicable | No public exploit | The RealVideo renderer in RealNetworks RealPlayer before 15.0.0 and Mac RealPlayer before 12.0.0.1703 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors. |
| CVE-2011-4244 | High | 2011-11-24 | Not applicable | No public exploit | Heap-based buffer overflow in the RealVideo renderer in RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via unspecified vectors. |
| CVE-2011-4160 | Low | 2011-11-24 | Not applicable | No public exploit | Unspecified vulnerability in HP Operations Agent 11.00 and Performance Agent 4.73 and 5.0 on AIX, HP-UX, Linux, and Solaris allows local users to bypass intended directory-access restrictions via unknown vectors. |
| CVE-2011-4332 | Medium | 2011-11-23 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in Joomla! 1.6.3 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2011-4321 | Medium | 2011-11-23 | Not applicable | No public exploit | The password reset functionality in Joomla! 1.5.x through 1.5.24 uses weak random numbers, which makes it easier for remote attackers to change the passwords of arbitrary users via unspecified vectors. |
| CVE-2010-5062 | High | 2011-11-23 | Not applicable | Working exploit published | SQL injection vulnerability in search.php in MH Products kleinanzeigenmarkt allows remote attackers to execute arbitrary SQL commands via the c parameter. |
| CVE-2010-5061 | High | 2011-11-23 | Not applicable | No public exploit | SQL injection vulnerability in index.php in RSStatic allows remote attackers to execute arbitrary SQL commands via the maxarticles parameter. |
| CVE-2010-5060 | High | 2011-11-23 | Not applicable | Working exploit published | SQL injection vulnerability in Nus.php in NUs Newssystem 1.02 allows remote attackers to execute arbitrary SQL commands via the id parameter. |
| CVE-2010-5059 | High | 2011-11-23 | Not applicable | Working exploit published | SQL injection vulnerability in index.php in CMScout 2.0.8 allows remote attackers to execute arbitrary SQL commands via the album parameter in a photos action. |
| CVE-2010-5058 | High | 2011-11-23 | Not applicable | Working exploit published | SQL injection vulnerability in detResolucion.php in CMS Ariadna 1.1 allows remote attackers to execute arbitrary SQL commands via the res_id parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. |
| CVE-2010-5057 | High | 2011-11-23 | Not applicable | Working exploit published | SQL injection vulnerability in detResolucion.php in CMS Ariadna 1.1 allows remote attackers to execute arbitrary SQL commands via the tipodoc_id parameter. |
| CVE-2010-5056 | High | 2011-11-23 | Not applicable | Working exploit published | SQL injection vulnerability in the GBU Facebook (com_gbufacebook) component 1.0.5 for Joomla! allows remote attackers to execute arbitrary SQL commands via the face_id parameter in a show_face action to index.php. |
| CVE-2010-5055 | High | 2011-11-23 | Not applicable | Working exploit published | SQL injection vulnerability in index.php in Almnzm 2.1 allows remote attackers to execute arbitrary SQL commands via the id parameter. |
| CVE-2010-5054 | Medium | 2011-11-23 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Special:Login in JAMWiki before 0.8.4 allows remote attackers to inject arbitrary web script or HTML via the message parameter. |
| CVE-2010-5053 | High | 2011-11-23 | Not applicable | Working exploit published | SQL injection vulnerability in the XOBBIX (com_xobbix) component 1.0.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the prodid parameter in a prod_desc action to index.php. |
| CVE-2010-5052 | Medium | 2011-11-23 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in admin/components.php in GetSimple CMS 2.01 allows remote attackers to inject arbitrary web script or HTML via the val[] parameter. |
| CVE-2010-5051 | Medium | 2011-11-23 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in admin/core/admin_func.php in razorCMS 1.0 stable allows remote attackers to inject arbitrary web script or HTML via the content parameter in an edit action to admin/index.php. |
| CVE-2010-5050 | Medium | 2011-11-23 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in jsp/admin/tools/remote_share.jsp in ManageEngine ADManager Plus 4.4.0 allows remote attackers to inject arbitrary web script or HTML via the computerName parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. |
| CVE-2010-5049 | High | 2011-11-23 | Not applicable | No public exploit | SQL injection vulnerability in events.php in Zabbix 1.8.1 and earlier allows remote attackers to execute arbitrary SQL commands via the nav_time parameter. |
| CVE-2010-5048 | Medium | 2011-11-23 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in admin.jcomments.php in the JoomlaTune JComments (com_jcomments) component 2.1.0.0 for Joomla! allows remote authenticated users to inject arbitrary web script or HTML via the name parameter to index.php. |
| CVE-2010-5047 | High | 2011-11-23 | Not applicable | Working exploit published | SQL injection vulnerability in page.php in V-EVA Press Release Script allows remote attackers to execute arbitrary SQL commands via the id parameter. |
| CVE-2010-5046 | Medium | 2011-11-23 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in admin.php in ecoCMS allows remote attackers to inject arbitrary web script or HTML via the p parameter. |
| CVE-2011-4507 | High | 2011-11-22 | Not applicable | No public exploit | The D-Link DIR-685 router, when certain WPA and WPA2 configurations are used, does not maintain an encrypted wireless network during transfer of a large amount of network traffic, which allows remote attackers to obtain sensitive information or bypass authentication via a Wi-Fi device. |
| CVE-2011-4506 | High | 2011-11-22 | Not applicable | No public exploit | The UPnP IGD implementation on the Thomson (aka Technicolor) TG585 with firmware 7.x before 7.4.3.2 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an "external forwarding" vulnerability. |
| CVE-2011-4505 | High | 2011-11-22 | Not applicable | No public exploit | The UPnP IGD implementation on SpeedTouch 5x6 devices with firmware before 6.2.29 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an "external forwarding" vulnerability. |
| CVE-2011-4504 | High | 2011-11-22 | Not applicable | No public exploit | The UPnP IGD implementation in the Pseudo ICS UPnP software on the ZyXEL P-330W allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an "external forwarding" vulnerability. |
| CVE-2011-4503 | High | 2011-11-22 | Not applicable | No public exploit | The UPnP IGD implementation in Broadcom Linux on the Sitecom WL-111 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an "external forwarding" vulnerability. |
| CVE-2011-4502 | High | 2011-11-22 | Not applicable | No public exploit | The UPnP IGD implementation in Edimax EdiLinux on the Edimax BR-6104K with firmware before 3.25, Edimax 6114Wg, Canyon-Tech CN-WF512 with firmware 1.83, Canyon-Tech CN-WF514 with firmware 2.08, Sitecom WL-153 with firmware before 1.39, and Sweex LB000021 with firmware 3.15 allows remote attackers to execute arbitrary commands via shell metacharacters. |
| CVE-2011-4501 | High | 2011-11-22 | Not applicable | No public exploit | The UPnP IGD implementation in Edimax EdiLinux on the Edimax BR-6104K with firmware before 3.25, Edimax 6114Wg, Canyon-Tech CN-WF512 with firmware 1.83, Canyon-Tech CN-WF514 with firmware 2.08, Sitecom WL-153 with firmware before 1.39, and Sweex LB000021 with firmware 3.15 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an "external forwarding" vulnerability. |
| CVE-2011-4500 | High | 2011-11-22 | Not applicable | No public exploit | The UPnP IGD implementation on the Cisco Linksys WRT54GX with firmware 2.00.05, when UPnP is enabled, configures the SOAP server to listen on the WAN port, which allows remote attackers to administer the firewall via SOAP requests. |
| CVE-2011-4499 | High | 2011-11-22 | Not applicable | No public exploit | The UPnP IGD implementation in the Broadcom UPnP stack on the Cisco Linksys WRT54G with firmware before 4.30.5, WRT54GS v1 through v3 with firmware before 4.71.1, and WRT54GS v4 with firmware before 1.06.1 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an "external forwarding" vulnerability. |
| CVE-2011-4498 | Medium | 2011-11-21 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in the web console in Zenprise Device Manager 6.x through 6.1.8 allows remote attackers to hijack the authentication of administrators for requests that wipe mobile devices. |
| CVE-2011-4497 | Low | 2011-11-21 | Not applicable | No public exploit | QIS_wizard.htm on the ASUS RT-N56U router with firmware before 1.0.1.4o allows remote attackers to obtain the administrator password via a flag=detect request. |
| CVE-2011-4496 | High | 2011-11-21 | Not applicable | Working exploit published | Buffer overflow in Aviosoft DTV Player 1.0.1.2 allows remote attackers to execute arbitrary code via a crafted .plf (aka playlist) file. |
| CVE-2011-4040 | High | 2011-11-21 | Not applicable | Working exploit published | Buffer overflow in MiniSmtp 3.0.11818 in NJStar Communicator allows remote attackers to execute arbitrary code via a crafted packet. |
| CVE-2011-4465 | Medium | 2011-11-19 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in IBM Lotus Mobile Connect (LMC) 6.1.4 allows remote attackers to inject arbitrary web script or HTML via vectors related to a hidden redirect URL. |
| CVE-2011-4404 | Medium | 2011-11-19 | Not applicable | Working exploit published | The default configuration of the HTTP server in Jetty in vSphere Update Manager in VMware vCenter Update Manager 4.0 before Update 4 and 4.1 before Update 2 allows remote attackers to conduct directory traversal attacks and read arbitrary files via unspecified vectors, a related issue to CVE-2009-1523. |
| CVE-2011-4311 | Medium | 2011-11-19 | Not applicable | No public exploit | ResourceSpace before 4.2.2833 does not properly validate access keys, which allows remote attackers to bypass intended resource restrictions via unspecified vectors. |
| CVE-2011-4159 | Medium | 2011-11-19 | Not applicable | No public exploit | Unspecified vulnerability in System Administration Manager (SAM) in EMS before A.04.20.11.04_01 on HP HP-UX B.11.11, B.11.23, and B.11.31 allows local users to gain privileges via unknown vectors. |
| CVE-2011-3849 | Medium | 2011-11-19 | Not applicable | No public exploit | Unspecified vulnerability in dxserver before 6279 in CA Directory 8.1 and CA Directory r12 before SP7 CR1 allows remote attackers to cause a denial of service (daemon crash) via a crafted SNMP packet. |
| CVE-2011-4122 | Medium | 2011-11-17 | Not applicable | Working exploit published | Directory traversal vulnerability in openpam_configure.c in OpenPAM before r478 on FreeBSD 8.1 allows local users to load arbitrary DSOs and gain privileges via a .. (dot dot) in the service_name argument to the pam_start function, as demonstrated by a .. in the -c option to kcheckpass. |
| CVE-2011-4107 | Medium | 2011-11-17 | Not applicable | Working exploit published | The simplexml_load_string function in the XML import plug-in (libraries/import/xml.php) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before 3.3.10.5 allows remote authenticated users to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack. |