The news module in CMSMS before 1.9.4.3 allows remote attackers to corrupt new articles.

CVE-2011-4311NONECVSS 0.0EG 0.0

2011-11-19

ResourceSpace before 4.2.2833 does not properly validate access keys, which allows remote attackers to bypass intended resource restrictions via unspecified vectors.

CVE-2011-4317NONECVSS 0.0EG 0.0

2011-11-30

The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch…

CVE-2011-4318NONECVSS 0.0EG 0.0

2013-03-07

Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the proxy destination, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) of the X.509 certificate, w…

CVE-2011-4405NONECVSS 0.0EG 0.0

2011-11-29

The cupshelpers scripts in system-config-printer in Ubuntu 11.04 and 11.10, as used by the automatic printer driver download service, uses an "insecure connection" for queries to the OpenPrinting database, which allows remote attackers to …

CVE-2011-4407NONECVSS 0.0EG 0.0

2014-05-14

ppa.py in Software Properties before 0.81.13.3 does not validate the server certificate when downloading PPA GPG key fingerprints, which allows man-in-the-middle (MITM) attackers to spoof GPG keys for a package repository.

CVE-2011-4409NONECVSS 0.0EG 0.0

2012-06-16

The Ubuntu One Client for Ubuntu 10.04 LTS, 11.04, 11.10, and 12.04 LTS does not properly validate SSL certificates, which allows remote attackers to spoof a server and modify or read sensitive information via a man-in-the-middle (MITM) at…

CVE-2011-4415NONECVSS 0.0EG 0.0

2011-11-08

The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local us…

CVE-2011-4530NONECVSS 0.0EG 0.0

2012-01-08

Siemens Automation License Manager (ALM) 4.0 through 5.1+SP1+Upd1 does not properly copy fields obtained from clients, which allows remote attackers to cause a denial of service (exception and daemon crash) via long fields, as demonstrated…

CVE-2011-4531NONECVSS 0.0EG 0.0

2012-01-08

Siemens Automation License Manager (ALM) 4.0 through 5.1+SP1+Upd1 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via crafted content in a (1) get_target_ocx_param or (2) send_target_ocx_par…

CVE-2011-4539NONECVSS 0.0EG 0.0

2011-12-08

dhcpd in ISC DHCP 4.x before 4.2.3-P1 and 4.1-ESV before 4.1-ESV-R4 does not properly handle regular expressions in dhcpd.conf, which allows remote attackers to cause a denial of service (daemon crash) via a crafted request packet.

CVE-2011-4553NONECVSS 0.0EG 0.0

2011-12-06

Multiple open redirect vulnerabilities in One Click Orgs before 1.2.3 allow (1) remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the return_to parameter, and allow (2) remote authenticated users to…

CVE-2011-4554NONECVSS 0.0EG 0.0

2011-12-06

One Click Orgs before 1.2.3 allows remote authenticated users to trigger crafted SMTP traffic via (1) " (double quote) and newline characters in an org name or (2) " (double quote) characters in an e-mail address, related to a "2nd Order S…

CVE-2011-4575NONECVSS 0.0EG 0.0

2013-02-05

Cross-site scripting (XSS) vulnerability in the JMX console in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 allows remote attackers to …

CVE-2011-4601NONECVSS 0.0EG 0.0

2011-12-25

family_feedbag.c in the oscar protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted…

CVE-2011-4602NONECVSS 0.0EG 0.0

2011-12-17

The XMPP protocol plugin in libpurple in Pidgin before 2.10.1 does not properly handle missing fields in (1) voice-chat and (2) video-chat stanzas, which allows remote attackers to cause a denial of service (application crash) via a crafte…

CVE-2011-4603NONECVSS 0.0EG 0.0

2011-12-17

The silc_channel_message function in ops.c in the SILC protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (applica…

CVE-2011-4612NONECVSS 0.0EG 0.0

2012-11-20

icecast before 2.3.3 allows remote attackers to inject control characters such as newlines into the error loc (error.log) via a crafted URL.

CVE-2011-4685NONECVSS 0.0EG 0.0

2011-12-07

Dragonfly in Opera before 11.60 allows remote attackers to cause a denial of service (application crash) via unspecified content on a web page, as demonstrated by forbes.com.

CVE-2011-4720NONECVSS 0.0EG 0.0

2014-12-28

Hillstone HS TFTP Server 1.3.2 allows remote attackers to cause a denial of service (daemon crash) via a long filename in a (1) RRQ or (2) WRQ operation.

CVE-2011-4727NONECVSS 0.0EG 0.0

2011-12-16

The Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 does not properly validate string data that is intended for storage in an XML document, which allows remote attackers to cause a denial of service (parsing …

CVE-2011-4755NONECVSS 0.0EG 0.0

2011-12-16

Parallels Plesk Small Business Panel 10.2.0 does not properly validate string data that is intended for storage in an XML document, which allows remote attackers to cause a denial of service (parsing error) or possibly have unspecified oth…

CVE-2011-4783NONECVSS 0.0EG 0.0

2011-12-27

The IDAPython plugin before 1.5.2.3 in IDA Pro allows user-assisted remote attackers to execute arbitrary code via a crafted IDB file, related to improper handling of certain swig_runtime_data files in the current working directory.

CVE-2011-4784NONECVSS 0.0EG 0.0

2011-12-27

The NVIDIA Stereoscopic 3D driver before 7.17.12.7565 does not properly handle commands sent to a named pipe, which allows local users to gain privileges via a crafted application.

CVE-2011-4815NONECVSS 0.0EG 0.0

2011-12-30

Ruby (aka CRuby) before 1.8.7-p357 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an…

CVE-2011-4818NONECVSS 0.0EG 0.0

2012-03-13

Open redirect vulnerability in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5 allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via the uisessionid parame…

CVE-2011-4871NONECVSS 0.0EG 0.0

2012-04-18

Open Automation Software OPC Systems.NET before 5.0 allows remote attackers to cause a denial of service via a malformed .NET RPC packet on TCP port 58723.

CVE-2011-4877NONECVSS 0.0EG 0.0

2012-02-03

HmiLoad in the runtime loader in Siemens WinCC flexible 2004, 2005, 2007, and 2008; WinCC V11 (aka TIA portal); the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime, w…

CVE-2011-4879NONECVSS 0.0EG 0.0

2012-02-03

miniweb.exe in the HMI web server in Siemens WinCC flexible 2004, 2005, 2007, and 2008 before SP3; WinCC V11 (aka TIA portal) before SP2 Update 1; the TP, OP, MP, Comfort Panels, and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Adva…

CVE-2011-4883NONECVSS 0.0EG 0.0

2012-04-13

The web server in Certec atvise webMI2ADS (aka webMI) before 2.0.2 does not properly validate values in HTTP requests, which allows remote attackers to cause a denial of service (resource consumption) via a crafted request.

CVE-2011-4885NONECVSS 0.0EG 9.0

2011-12-30

PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted paramete…

CVE-2011-4890NONECVSS 0.0EG 0.0

2012-02-21

The server in IBM solidDB 6.5 before FP9 and 7.0 before FP1 allows remote authenticated users to cause a denial of service (daemon crash) via a SELECT statement with a ROWNUM condition involving a subquery.

CVE-2011-4902MEDIUMCVSS 6.5EG 6.5

2019-11-06

TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to delete arbitrary files on the webserver.

CVE-2011-4904MEDIUMCVSS 6.5EG 6.5

2019-11-06

TYPO3 before 4.4.9 and 4.5.x before 4.5.4 does not apply proper access control on ExtDirect calls which allows remote attackers to retrieve ExtDirect endpoint services.

CVE-2011-4911NONECVSS 0.0EG 0.0

2012-10-07

Joomla! before 1.5.12 does not perform a JEXEC check in unspecified files, which allows remote attackers to obtain the installation path via unspecified vectors.

CVE-2011-4913NONECVSS 0.0EG 0.0

2012-06-21

The rose_parse_ccitt function in net/rose/rose_subr.c in the Linux kernel before 2.6.39 does not validate the FAC_CCITT_DEST_NSAP and FAC_CCITT_SRC_NSAP fields, which allows remote attackers to (1) cause a denial of service (integer underf…

CVE-2011-4914NONECVSS 0.0EG 0.0

2012-06-21

The ROSE protocol implementation in the Linux kernel before 2.6.39 does not verify that certain data-length values are consistent with the amount of data sent, which might allow remote attackers to obtain sensitive information from kernel …

CVE-2011-4957NONECVSS 0.0EG 0.0

2012-06-27

The make_clickable function in wp-includes/formatting.php in WordPress before 3.1.1 does not properly check URLs before passing them to the PCRE library, which allows remote attackers to cause a denial of service (crash) via a comment with…

CVE-2011-4967HIGHCVSS 7.5EG 7.5

2019-11-19

tog-Pegasus has a package hash collision DoS vulnerability

CVE-2011-4968MEDIUMCVSS 4.8EG 4.8

2019-11-19

nginx http proxy module does not verify peer identity of https origin server which could facilitate man-in-the-middle attack (MITM)

CVE-2011-5035NONECVSS 0.0EG 0.0

2011-12-30

Oracle Glassfish 2.1.1, 3.0.1, and 3.1.1, as used in Communications Server 2.0, Sun Java System Application Server 8.1 and 8.2, and possibly other products, computes hash values for form parameters without restricting the ability to trigge…

CVE-2011-5037NONECVSS 0.0EG 0.0

2011-12-30

Google V8 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters, as …

CVE-2011-5043NONECVSS 0.0EG 0.0

2011-12-30

TomatoSoft Free Mp3 Player 1.0 allows remote attackers to cause a denial of service (application crash) via a long string in an MP3 file, possibly a buffer overflow.

CVE-2011-5046NONECVSS 0.0EG 0.0

2011-12-30

The Graphics Device Interface (GDI) in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not prop…

CVE-2011-5055NONECVSS 0.0EG 0.0

2012-01-08

MaraDNS 1.3.07.12 and 1.4.08 computes hash values for DNS data without properly restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many cr…

CVE-2011-5079NONECVSS 0.0EG 0.0

2012-02-14

Open redirect vulnerability in the Modern FAQ (irfaq) extension 1.1.2 and other versions before 1.1.4 for TYPO3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL, probably in the "retur…

CVE-2011-5086NONECVSS 0.0EG 0.0

2012-04-18

https50.ocx in IP*Works! SSL in the server in Unitronics UniOPC before 2.0.0 does not properly implement an unspecified function, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary …

CVE-2011-5136NONECVSS 0.0EG 0.0

2012-08-30

showImg.php in EPractize Labs Subscription Manager, possibly 1.0, allows remote attackers to overwrite arbitrary files via the db parameter.

CVE-2011-5236NONECVSS 0.0EG 0.0

2012-11-06

Moneris eSelectPlus 2.03 PHP API does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL serve…

CVE-2011-5237NONECVSS 0.0EG 0.0

2012-11-06

PayPal WPS ToolKit does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbi…

CWE-20— Improper Input Validation

CVEs classified under CWE-20page 37 of 229

Map vulnerabilities like CWE-20 to your infrastructure