CRLF injection vulnerability in /+CSCOE+/logon.html on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 8.0 through 8.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting …

CVE-2011-3295NONECVSS 0.0EG 0.0

2012-05-02

The NETIO and IPV4_IO processes in Cisco IOS XR 3.8 through 4.1, as used in Cisco Carrier Routing System and other products, allow remote attackers to cause a denial of service (CPU consumption) via crafted network traffic, aka Bug ID CSCt…

CVE-2011-3363MEDIUMCVSS 6.5EG 6.5

2012-05-24

The setup_cifs_sb function in fs/cifs/connect.c in the Linux kernel before 2.6.39 does not properly handle DFS referrals, which allows remote CIFS servers to cause a denial of service (system crash) by placing a referral at the root of a s…

CVE-2011-3365NONECVSS 0.0EG 0.0

2011-11-29

The KDE SSL Wrapper (KSSL) API in KDE SC 4.6.0 through 4.7.1, and possibly earlier versions, does not use a certain font when rendering certificate fields in a security dialog, which allows remote attackers to spoof the common name (CN) of…

CVE-2011-3366NONECVSS 0.0EG 0.0

2011-11-29

Rekonq 0.7.0 and earlier does not use a certain font when rendering certificate fields in a security dialog, which allows remote attackers to spoof the common name (CN) of a certificate via rich text.

CVE-2011-3367NONECVSS 0.0EG 0.0

2011-11-29

Arora, possibly 0.11 and other versions, does not use a certain font when rendering certificate fields in a security dialog, which allows remote attackers to spoof the common name (CN) of a certificate via rich text.

CVE-2011-3368NONECVSS 0.0EG 0.0

2011-10-05

The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a revers…

CVE-2011-3387NONECVSS 0.0EG 0.0

2011-09-02

The class file parser in IBM Java 1.4.2 SR13 FP9 allows remote authenticated users to cause a denial of service (memory consumption or an infinite loop) via a crafted attribute length field in a class file, related to validation of a lengt…

CVE-2011-3389NONECVSS 0.0EG 0.0

2011-09-06

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which…

CVE-2011-3410NONECVSS 0.0EG 0.0

2011-12-14

Array index error in Microsoft Publisher 2003 SP3, and 2007 SP2 and SP3, allows remote attackers to execute arbitrary code via a crafted Publisher file that leverages incorrect handling of values in memory, aka "Publisher Out-of-bounds Arr…

CVE-2011-3415NONECVSS 0.0EG 0.0

2011-12-30

Open redirect vulnerability in the Forms Authentication feature in the ASP.NET subsystem in Microsoft .NET Framework 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing att…

CVE-2011-3422NONECVSS 0.0EG 0.0

2011-09-12

The Keychain implementation in Apple Mac OS X 10.6.8 and earlier does not properly handle an untrusted attribute of a Certification Authority certificate, which makes it easier for man-in-the-middle attackers to spoof arbitrary SSL servers…

CVE-2011-3477MEDIUMCVSS 5.5EG 5.5

2018-02-19

GEAR Software CD DVD Filter driver (aka GEARAspiWDM.sys), as used in Symantec Backup Exec System Recovery 8.5 and BESR 2010, Symantec System Recovery 2011, Norton 360, and Norton Ghost, allows local users to cause a denial of service (syst…

CVE-2011-3484NONECVSS 0.0EG 0.0

2011-09-20

The unxorFrame function in epan/dissectors/packet-opensafety.c in the OpenSafety dissector in Wireshark 1.6.x before 1.6.2 does not properly validate a certain frame size, which allows remote attackers to cause a denial of service (loop an…

CVE-2011-3496NONECVSS 0.0EG 0.0

2011-09-16

service.exe in Measuresoft ScadaPro 4.0.0 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) BF, (2) OF, or (3) EF command.

CVE-2011-3597NONECVSS 0.0EG 0.0

2012-01-13

Eval injection vulnerability in the Digest module before 1.17 for Perl allows context-dependent attackers to execute arbitrary commands via the new constructor.

CVE-2011-3603NONECVSS 0.0EG 0.0

2014-04-27

The router advertisement daemon (radvd) before 1.8.2 does not properly handle errors in the privsep_init function, which causes the radvd daemon to run as root and has an unspecified impact.

CVE-2011-3605NONECVSS 0.0EG 0.0

2014-02-17

The process_rs function in the router advertisement daemon (radvd) before 1.8.2, when UnicastOnly is enabled, allows remote attackers to cause a denial of service (temporary service hang) via a large number of ND_ROUTER_SOLICIT requests.

CVE-2011-3611HIGHCVSS 7.2EG 7.2

2020-01-22

A File Inclusion vulnerability exists in act parameter to admin.php in UseBB before 1.0.12.

CVE-2011-3619NONECVSS 0.0EG 0.0

2013-06-08

The apparmor_setprocattr function in security/apparmor/lsm.c in the Linux kernel before 3.0 does not properly handle invalid parameters, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly …

CVE-2011-3639NONECVSS 0.0EG 0.0

2011-11-30

The mod_proxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for con…

CVE-2011-3646NONECVSS 0.0EG 0.0

2011-11-17

phpmyadmin.css.php in phpMyAdmin 3.4.x before 3.4.6 allows remote attackers to obtain sensitive information via an array-typed js_frame parameter to phpmyadmin.css.php, which reveals the installation path in an error message.

CVE-2011-3647NONECVSS 0.0EG 0.0

2011-11-09

The JSSubScriptLoader in Mozilla Firefox before 3.6.24 and Thunderbird before 3.1.6 does not properly handle XPCNativeWrappers during calls to the loadSubScript method in an add-on, which makes it easier for remote attackers to gain privil…

CVE-2011-3844NONECVSS 0.0EG 0.0

2012-03-08

Apple Safari 5.0.5 does not properly implement the setInterval function, which allows remote attackers to spoof the address bar via a crafted web page.

CVE-2011-3872NONECVSS 0.0EG 0.0

2011-10-27

Puppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6, and Puppet Enterprise (PE) Users 1.0, 1.1, and 1.2 before 1.2.4, when signing an agent certificate, adds the Puppet master's certdnsnames values to the X.509 Subject Alternative Name field…

CVE-2011-3875NONECVSS 0.0EG 0.0

2011-10-25

Google Chrome before 15.0.874.102 does not properly handle drag and drop operations on URL strings, which allows user-assisted remote attackers to spoof the URL bar via unspecified vectors.

CVE-2011-3880NONECVSS 0.0EG 0.0

2011-10-25

Google Chrome before 15.0.874.102 does not prevent use of an unspecified special character as a delimiter in HTTP headers, which has unknown impact and remote attack vectors.

CVE-2011-3884NONECVSS 0.0EG 0.0

2011-10-25

Google Chrome before 15.0.874.102 does not properly address timing issues during DOM traversal, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document.

CVE-2011-3886NONECVSS 0.0EG 0.0

2011-10-25

Google V8, as used in Google Chrome before 15.0.874.102, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers out-of-bounds write operations.

CVE-2011-3907NONECVSS 0.0EG 0.0

2011-12-13

The view-source feature in Google Chrome before 16.0.912.63 allows remote attackers to spoof the URL bar via unspecified vectors.

CVE-2011-3936NONECVSS 0.0EG 0.0

2012-08-20

The dv_extract_audio function in libavcodec in FFmpeg 0.7.x before 0.7.12 and 0.8.x before 0.8.11 and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.5, and 0.8.x before 0.8.1 allows remote attackers to cause a denial of …

CVE-2011-3952NONECVSS 0.0EG 0.0

2012-08-20

The decode_init function in kmvc.c in libavcodec in FFmpeg before 0.10 and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.6, and 0.8.x before 0.8.1 allows remote attackers to cause a denial of service (application crash)…

CVE-2011-3964NONECVSS 0.0EG 0.0

2012-02-09

Google Chrome before 17.0.963.46 does not properly implement the drag-and-drop feature, which makes it easier for remote attackers to spoof the URL bar via unspecified vectors.

CVE-2011-4006NONECVSS 0.0EG 0.0

2012-05-02

The ESMTP inspection feature on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 8.2 through 8.5 allows remote attackers to cause a denial of service (CPU consumption) via an unspecified closing sequence, aka Bug …

CVE-2011-4007NONECVSS 0.0EG 0.0

2012-05-02

Cisco IOS 15.0 and 15.1 and IOS XE 3.x do not properly handle the "set mpls experimental imposition" command, which allows remote attackers to cause a denial of service (device crash) via network traffic that triggers (1) fragmentation or …

CVE-2011-4015NONECVSS 0.0EG 0.0

2012-05-02

Cisco IOS 15.2S allows remote attackers to cause a denial of service (interface queue wedge) via malformed UDP traffic on port 465, aka Bug ID CSCts48300.

CVE-2011-4016NONECVSS 0.0EG 0.0

2012-05-02

The PPP implementation in Cisco IOS 12.2 and 15.0 through 15.2, when Point-to-Point Termination and Aggregation (PTA) and L2TP are used, allows remote attackers to cause a denial of service (device crash) via crafted network traffic, aka B…

CVE-2011-4063NONECVSS 0.0EG 0.0

2011-10-21

chan_sip.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.7.1 and 10.x before 10.0.0-rc1 does not properly initialize variables during request parsing, which allows remote authenticated users to cause a denial of servic…

CVE-2011-4092NONECVSS 0.0EG 0.0

2014-02-10

obby (aka libobby) does not verify SSL server certificates, which allows remote attackers to spoof servers via an arbitrary certificate.

CVE-2011-4106NONECVSS 0.0EG 0.0

2013-10-26

TimThumb (timthumb.php) before 2.0 does not validate the entire source with the domain white list, which allows remote attackers to upload and execute arbitrary code via a URL containing a white-listed domain in the src parameter, then acc…

CVE-2011-4120CRITICALCVSS 9.8EG 9.8

2019-11-26

Yubico PAM Module before 2.10 performed user authentication when 'use_first_pass' PAM configuration option was not used and the module was configured as 'sufficient' in the PAM configuration. A remote attacker could use this flaw to circum…

CVE-2011-4124CRITICALCVSS 9.8EG 9.8

2021-10-27

Input validation issues were found in Calibre at devices/linux_mount_helper.c which can lead to argument injection and elevation of privileges.

CVE-2011-4132NONECVSS 0.0EG 0.0

2012-01-27

The cleanup_journal_tail function in the Journaling Block Device (JBD) functionality in the Linux kernel 2.6 allows local users to cause a denial of service (assertion error and kernel oops) via an ext3 or ext4 image with an "invalid log f…

CVE-2011-4151NONECVSS 0.0EG 0.0

2011-10-20

The krb5_db2_lockout_audit function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.8 through 1.8.4, when the db2 (aka Berkeley DB) back end is used, allows remote attackers to cause a denial of service (assertion failu…

CVE-2011-4153NONECVSS 0.0EG 0.0

2012-01-18

PHP 5.3.8 does not always check the return value of the zend_strndup function, which might allow remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted input to an application that perfor…

CVE-2011-4181HIGHCVSS 7.5EG 7.5

2018-06-11

A vulnerability in open build service allows remote attackers to gain access to source files even though source access is disabled. Affected releases are SUSE open build service up to and including version 2.1.15 (for 2.1) and before versi…

CVE-2011-4182HIGHCVSS 7.3EG 8.1

2018-06-12

Missing escaping of ESSID values in sysconfig of SUSE Linux Enterprise allows attackers controlling an access point to cause execute arbitrary code. Affected releases are sysconfig prior to 0.83.7-2.1.

CVE-2011-4231NONECVSS 0.0EG 0.0

2012-05-03

Cisco IOS 15.1 and 15.2 and IOS XE 3.x, when configured as an IPsec hub with X.509 certificates in use, allows remote authenticated users to cause a denial of service (segmentation fault and device crash) via unspecified vectors, aka Bug I…

CVE-2011-4249NONECVSS 0.0EG 0.0

2011-11-24

Array index error in the RV30 codec in RealNetworks RealPlayer before 15.0.0 allows remote attackers to execute arbitrary code via unspecified vectors.

CVE-2011-4302NONECVSS 0.0EG 0.0

2012-07-11

mnet/xmlrpc/client.php in MNET in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 does not properly process the return value of the openssl_verify function, which allows remote attackers to bypass validation via a cr…

CWE-20— Improper Input Validation

CVEs classified under CWE-20page 36 of 229

Map vulnerabilities like CWE-20 to your infrastructure