CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In July 2011

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2011-1865 119 4 Exec Code Overflow 2011-07-01 2017-08-17
10.0
None Remote Low Not required Complete Complete Complete
Multiple stack-based buffer overflows in the inet service in HP OpenView Storage Data Protector 6.00 through 6.20 allow remote attackers to execute arbitrary code via a request containing crafted parameters.
2 CVE-2010-4814 89 2 Exec Code Sql 2011-07-08 2017-08-29
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in index1.php in Best Soft Inc. (BSI) Advance Hotel Booking System 1.0 allows remote attackers to execute arbitrary SQL commands via the page parameter.
3 CVE-2010-4809 89 2 Exec Code Sql 2011-07-08 2017-08-29
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in index.php in DBSite 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.
4 CVE-2010-4808 89 2 Exec Code Sql 2011-07-08 2017-08-29
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in index.php in Webmatic allows remote attackers to execute arbitrary SQL commands via the p parameter.
5 CVE-2011-2963 287 1 DoS +Info 2011-07-29 2011-08-01
10.0
None Remote Low Not required Complete Complete Complete
TCPUploadServer.exe in Progea Movicon 11.2 before Build 1084 does not require authentication for critical functions, which allows remote attackers to obtain sensitive information, delete files, execute arbitrary programs, or cause a denial of service (crash) via a crafted packet to TCP port 10651.
6 CVE-2011-2757 22 1 Dir. Trav. 2011-07-17 2011-07-19
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0.0.12 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the FILENAME parameter. NOTE: this might overlap the US-CERT VU#543310 issue.
7 CVE-2011-2641 399 1 DoS 2011-07-01 2011-07-05
5.0
None Remote Low Not required None None Partial
Opera 11.11 allows remote attackers to cause a denial of service (application crash) by setting the FACE attribute of a FONT element within an IFRAME element after changing the SRC attribute of this IFRAME element to an about:blank value.
8 CVE-2011-2522 352 1 CSRF 2011-07-29 2018-10-30
6.8
None Remote Medium Not required Partial Partial Partial
Multiple cross-site request forgery (CSRF) vulnerabilities in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.10 allow remote attackers to hijack the authentication of administrators for requests that (1) shut down daemons, (2) start daemons, (3) add shares, (4) remove shares, (5) add printers, (6) remove printers, (7) add user accounts, or (8) remove user accounts, as demonstrated by certain start, stop, and restart parameters to the status program.
9 CVE-2011-2506 94 1 2011-07-14 2018-10-09
7.5
None Remote Low Not required Partial Partial Partial
setup/lib/ConfigGenerator.class.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly restrict the presence of comment closing delimiters, which allows remote attackers to conduct static code injection attacks by leveraging the ability to modify the SESSION superglobal array.
10 CVE-2011-2505 94 1 2011-07-14 2018-10-09
6.4
None Remote Low Not required None Partial Partial
libraries/auth/swekey/swekey.auth.lib.php in the Swekey authentication feature in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 assigns values to arbitrary parameters referenced in the query string, which allows remote attackers to modify the SESSION superglobal array via a crafted request, related to a "remote variable manipulation vulnerability."
11 CVE-2011-1866 119 1 Exec Code Overflow 2011-07-01 2018-10-09
10.0
None Remote Low Not required Complete Complete Complete
Buffer overflow in omniinet.exe in the inet service in HP OpenView Storage Data Protector 6.00 through 6.20 allows remote attackers to execute arbitrary code via a crafted request, related to the EXEC_CMD functionality.
12 CVE-2010-4810 94 1 Exec Code File Inclusion 2011-07-08 2017-08-29
7.5
None Remote Low Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in AR Web Content Manager (AWCM) 2.1 final allow remote attackers to execute arbitrary PHP code via a URL in the theme_file parameter to (1) includes/window_top.php and (2) header.php, and the (3) lang_file parameter to control/common.php.
13 CVE-2010-3271 352 1 CSRF 2011-07-18 2018-10-10
6.8
None Remote Medium Not required Partial Partial Partial
Multiple cross-site request forgery (CSRF) vulnerabilities in the Integrated Solutions Console (aka administrative console) in IBM WebSphere Application Server (WAS) 7.0.0.13 and earlier allow remote attackers to hijack the authentication of administrators for requests that disable certain security options via an Edit action to console/adminSecurityDetail.do followed by a save action to console/syncworkspace.do.
14 CVE-2011-2964 94 Exec Code 2011-07-29 2017-08-29
6.8
None Remote Medium Not required Partial Partial Partial
foomaticrip.c in foomatic-rip in foomatic-filters in Foomatic 4.0.6 allows remote attackers to execute arbitrary code via a crafted *FoomaticRIPCommandLine field in a .ppd file, a different vulnerability than CVE-2011-2697.
15 CVE-2011-2962 119 DoS Exec Code Overflow 2011-07-29 2017-08-29
9.3
None Remote Medium Not required Complete Complete Complete
Multiple stack-based buffer overflows in Invensys Wonderware Information Server 3.1, 4.0, and 4.0 SP1 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via two unspecified ActiveX controls.
16 CVE-2011-2961 119 DoS Exec Code Overflow 2011-07-29 2011-08-01
10.0
None Remote Low Not required Complete Complete Complete
Heap-based buffer overflow in AngelServer.exe 6.0.11.3 in Sunway pNetPower allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted UDP packet.
17 CVE-2011-2960 119 DoS Exec Code Overflow 2011-07-29 2011-08-01
10.0
None Remote Low Not required Complete Complete Complete
Heap-based buffer overflow in httpsvr.exe 6.0.5.3 in Sunway ForceControl 6.1 SP1, SP2, and SP3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted URL.
18 CVE-2011-2959 119 DoS Exec Code Overflow 2011-07-29 2011-08-01
10.0
None Remote Low Not required Complete Complete Complete
Stack-based buffer overflow in the Open Database Connectivity (ODBC) service (Odbcixv9se.exe) in 7-Technologies Interactive Graphical SCADA System (IGSS) 9 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted packet to TCP port 22202.
19 CVE-2011-2958 79 XSS 2011-07-28 2017-08-29
4.3
None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Ecava IntegraXor before 3.60 (Build 4080) allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
20 CVE-2011-2957 Exec Code Mem. Corr. 2011-07-28 2011-08-12
6.9
None Local Medium Not required Complete Complete Complete
Unspecified vulnerability in Rockwell Automation FactoryTalk Diagnostics Viewer before V2.30.00 (CPR9 SR3) allows local users to execute arbitrary code via a crafted FactoryTalk Diagnostics Viewer (.ftd) configuration file, which triggers memory corruption.
21 CVE-2011-2956 287 DoS 2011-07-28 2011-07-29
7.8
None Remote Low Not required None None Complete
AzeoTech DAQFactory before 5.85 (Build 1842) does not perform authentication for certain signals, which allows remote attackers to cause a denial of service (system reboot or shutdown) via a signal.
22 CVE-2011-2893 399 DoS 2011-07-27 2017-08-29
4.3
None Remote Medium Not required None None Partial
The DataPilot feature in IBM Lotus Symphony 3 before FP3 allows user-assisted remote attackers to cause a denial of service (application crash) via a large .xls spreadsheet with an invalid Value reference.
23 CVE-2011-2892 20 2011-07-27 2011-07-29
4.3
None Remote Medium Not required None Partial None
Joomla! 1.6.x before 1.6.2 does not prevent page rendering inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.
24 CVE-2011-2891 200 +Info 2011-07-27 2017-08-29
5.0
None Remote Low Not required Partial None None
Joomla! 1.6.x before 1.6.2 allows remote attackers to obtain sensitive information via an empty Itemid array parameter to index.php, which reveals the installation path in an error message, a different vulnerability than CVE-2011-2488.
25 CVE-2011-2890 200 +Info 2011-07-27 2017-08-29
5.0
None Remote Low Not required Partial None None
The MediaViewMedia class in administrator/components/com_media/views/media/view.html.php in Joomla! 1.5.23 and earlier allows remote attackers to obtain sensitive information via vectors involving the base variable, leading to disclosure of the installation path, a different vulnerability than CVE-2011-2488.
26 CVE-2011-2889 200 +Info 2011-07-27 2017-08-29
5.0
None Remote Low Not required Partial None None
templates/system/error.php in Joomla! before 1.5.23 might allow remote attackers to obtain sensitive information via unspecified vectors that trigger an undefined value of a certain error field, leading to disclosure of the installation path. NOTE: this might overlap CVE-2011-2488.
27 CVE-2011-2888 399 DoS 2011-07-27 2017-08-29
4.3
None Remote Medium Not required None None Partial
IBM Lotus Symphony 3 before FP3 allows remote attackers to cause a denial of service (application hang) via complex graphics in a presentation.
28 CVE-2011-2887 399 DoS 2011-07-27 2017-08-29
4.3
None Remote Medium Not required None None Partial
IBM Lotus Symphony 3 before FP3 on Linux allows remote attackers to cause a denial of service (application crash) via a certain sample document.
29 CVE-2011-2886 399 DoS 2011-07-27 2017-08-29
4.3
None Remote Medium Not required None None Partial
IBM Lotus Symphony 3 before FP3 allows remote attackers to cause a denial of service (application crash) via a .docx document with empty bullet styles for parent bullets.
30 CVE-2011-2885 399 DoS 2011-07-27 2017-08-29
4.3
None Remote Medium Not required None None Partial
IBM Lotus Symphony 3 before FP3 allows remote attackers to cause a denial of service (application crash) via the sample .doc document that incorporates a user-defined toolbar.
31 CVE-2011-2884 2011-07-27 2017-08-29
10.0
None Remote Low Not required Complete Complete Complete
Multiple unspecified vulnerabilities in IBM Lotus Symphony 3 before FP3 have unknown impact and attack vectors, related to "critical security vulnerability issues."
32 CVE-2011-2883 20 Exec Code 2011-07-21 2011-07-22
9.3
None Remote Medium Not required Complete Complete Complete
The NSEPA.NsepaCtrl.1 ActiveX control in nsepa.ocx in Citrix Access Gateway Enterprise Edition 8.1 before 8.1-67.7, 9.0 before 9.0-70.5, and 9.1 before 9.1-96.4 attempts to validate signed DLLs by checking the certificate subject, not the signature, which allows man-in-the-middle attackers to execute arbitrary code via HTTP header data referencing a DLL that was signed with a crafted certificate.
33 CVE-2011-2882 119 Exec Code Overflow 2011-07-21 2011-09-22
9.3
None Remote Medium Not required Complete Complete Complete
Stack-based buffer overflow in the NSEPA.NsepaCtrl.1 ActiveX control in nsepa.ocx in Citrix Access Gateway Enterprise Edition 8.1 before 8.1-67.7, 9.0 before 9.0-70.5, and 9.1 before 9.1-96.4 allows remote attackers to execute arbitrary code via crafted HTTP header data.
34 CVE-2011-2780 22 Dir. Trav. 2011-07-19 2018-10-09
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in includes/lib/gz.php in Chyrp 2.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, a different vulnerability than CVE-2011-2744.
35 CVE-2011-2779 264 2011-07-19 2017-08-29
3.6
None Local Low Not required None Partial Partial
Windows Event Log SmartConnector in HP ArcSight Connector Appliance before 6.1 uses world-writable permissions for exported report files, which allows local users to change or delete log data by modifying a file, a different vulnerability than CVE-2011-0770.
36 CVE-2011-2761 399 DoS 2011-07-18 2017-09-19
4.3
None Remote Medium Not required None None Partial
Google Chrome 14.0.794.0 does not properly handle a reload of a page generated in response to a POST, which allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted web site, related to GetWidget methods.
37 CVE-2011-2760 264 Bypass 2011-07-17 2017-08-29
5.0
None Remote Low Not required None Partial None
Brocade BigIron RX switches allow remote attackers to bypass ACL rules by using 179 as the source port of a packet.
38 CVE-2011-2759 200 +Info 2011-07-17 2017-08-29
5.0
None Remote Low Not required Partial None None
The login page of IDSWebApp in the Web Administration Tool in IBM Tivoli Directory Server (TDS) 6.2 before 6.2.0.3-TIV-ITDS-IF0004 does not have an off autocomplete attribute for authentication fields, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.
39 CVE-2011-2758 287 +Info 2011-07-17 2011-07-19
5.0
None Remote Low Not required Partial None None
IDSWebApp in the Web Administration Tool in IBM Tivoli Directory Server (TDS) 6.2 before 6.2.0.3-TIV-ITDS-IF0004 does not require authentication for access to LDAP Server log files, which allows remote attackers to obtain sensitive information via a crafted URL.
40 CVE-2011-2756 287 2011-07-17 2011-07-19
5.0
None Remote Low Not required Partial None None
FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0 before Build 8012 does not require authentication, which allows remote attackers to read files from a specific directory via unspecified vectors.
41 CVE-2011-2755 22 Dir. Trav. 2011-07-17 2011-07-19
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0 before Build 8012 allows remote attackers to read arbitrary files via unspecified vectors.
42 CVE-2011-2754 79 XSS 2011-07-17 2011-07-19
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the PageBuilder2 (aka Page Builder) theme in IBM WebSphere Portal 7.x before 7.0.0.1 CF006, as used in IBM Web Content Manager (WCM) and other products, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
43 CVE-2011-2753 352 CSRF 2011-07-17 2017-08-29
6.8
None Remote Medium Not required Partial Partial Partial
Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to hijack the authentication of unspecified victims via vectors involving (1) the empty trash implementation and (2) the Index Order (aka options_order) page, a different issue than CVE-2010-4555.
44 CVE-2011-2752 94 2011-07-17 2017-08-29
5.8
None Remote Medium Not required None Partial Partial
CRLF injection vulnerability in SquirrelMail 1.4.21 and earlier allows remote attackers to modify or add preference values via a \n (newline) character, a different vulnerability than CVE-2010-4555.
45 CVE-2011-2751 89 Exec Code Sql 2011-07-17 2011-07-19
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Parodia before 6.809 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
46 CVE-2011-2750 399 2011-07-17 2018-10-09
5.0
None Remote Low Not required None None Partial
NFRAgent.exe in Novell File Reporter 1.0.4.2 and earlier allows remote attackers to delete arbitrary files via a full pathname in an SRS OPERATION 4 CMD 5 request to /FSF/CMD.
47 CVE-2011-2747 94 Exec Code 2011-07-28 2017-08-29
9.3
None Remote Medium Not required Complete Complete Complete
Google Picasa before 3.6 Build 105.67 does not properly handle invalid properties in JPEG images, which allows remote attackers to execute arbitrary code via a crafted image file.
48 CVE-2011-2745 264 Exec Code 2011-07-27 2011-09-22
6.5
None Remote Low ??? Partial Partial Partial
upload_handler.php in the swfupload extension in Chyrp 2.0 and earlier relies on client-side JavaScript code to restrict the file extensions of uploaded files, which allows remote authenticated users to upload a .php file, and consequently execute arbitrary PHP code, via a write_post action to the default URI under admin/.
49 CVE-2011-2744 22 Exec Code Dir. Trav. 2011-07-19 2018-10-09
6.8
None Remote Medium Not required Partial Partial Partial
Directory traversal vulnerability in Chyrp 2.1 and earlier allows remote attackers to include and execute arbitrary local files via a ..%2F (encoded dot dot slash) in the action parameter to the default URI.
50 CVE-2011-2743 79 XSS 2011-07-19 2018-10-09
4.3
None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Chyrp 2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the action parameter to (1) the default URI or (2) includes/javascript.php, or the (3) title or (4) body parameter to admin/help.php.
Total number of vulnerabilities : 307   Page : 1 (This Page)2 3 4 5 6 7
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.