Filtered by vendor Subscriptions
Total 322985 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2011-3629 1 Joomla 1 Joomla\! 2024-11-21 7.5 High
Joomla! core 1.7.1 allows information disclosure due to weak encryption
CVE-2011-3624 1 Ruby-lang 1 Ruby 2024-11-21 5.3 Medium
Various methods in WEBrick::HTTPRequest in Ruby 1.9.2 and 1.8.7 and earlier do not validate the X-Forwarded-For, X-Forwarded-Host and X-Forwarded-Server headers in requests, which might allow remote attackers to inject arbitrary text into log files or bypass intended address parsing via a crafted header.
CVE-2011-3622 1 Phorum 1 Phorum 2024-11-21 6.1 Medium
A Cross-Site Scripting (XSS) vulnerability exists in the admin login screen in Phorum before 5.2.18.
CVE-2011-3621 1 Fluxbb 1 Fluxbb 2024-11-21 9.8 Critical
A reverse proxy issue exists in FluxBB before 1.4.7 when FORUM_BEHIND_REVERSE_PROXY is enabled.
CVE-2011-3618 2 Atop Project, Debian 2 Atop, Debian Linux 2024-11-21 7.8 High
atop: symlink attack possible due to insecure tempfile handling
CVE-2011-3617 2 Debian, Tahoe-lafs 2 Debian Linux, Tahoe-lafs 2024-11-21 6.5 Medium
Tahoe-LAFS v1.3.0 through v1.8.2 could allow unauthorized users to delete immutable files in some cases.
CVE-2011-3614 1 Vanillaforums 1 Vanilla 2024-11-21 9.8 Critical
An Access Control vulnerability exists in the Facebook, Twitter, and Embedded plugins in Vanilla Forums before 2.0.17.9.
CVE-2011-3613 1 Vanillaforums 1 Vanilla 2024-11-21 7.5 High
An issue exists in Vanilla Forums before 2.0.17.9 due to the way cookies are handled.
CVE-2011-3612 1 Usebb 1 Usebb 2024-11-21 8.8 High
Cross-Site Request Forgery (CSRF) vulnerability exists in panel.php in UseBB before 1.0.12.
CVE-2011-3611 1 Usebb 1 Usebb 2024-11-21 7.2 High
A File Inclusion vulnerability exists in act parameter to admin.php in UseBB before 1.0.12.
CVE-2011-3610 1 S9y 1 Serendipity Event Freetag 2024-11-21 6.1 Medium
A Cross-site Scripting (XSS) vulnerability exists in the Serendipity freetag plugin before 3.30 in the tagcloud parameter to plugins/serendipity_event_freetag/tagcloud.swf.
CVE-2011-3609 1 Redhat 1 Jboss Application Server 2024-11-21 6.5 Medium
A CSRF issue was found in JBoss Application Server 7 before 7.1.0. JBoss did not properly restrict access to the management console information (for example via the "Access-Control-Allow-Origin" HTTP access control flag). This can lead to unauthorized information leak if a user with admin privileges visits a specially-crafted web page provided by a remote attacker.
CVE-2011-3606 1 Redhat 1 Jboss Application Server 2024-11-21 5.4 Medium
A DOM based cross-site scripting flaw was found in the JBoss Application Server 7 before 7.1.0 Beta 1 administration console. A remote attacker could provide a specially-crafted web page and trick the valid JBoss AS user, with the administrator privilege, to visit it, which would lead into the DOM environment modification and arbitrary HTML or web script execution.
CVE-2011-3600 1 Apache 1 Ofbiz 2024-11-21 7.5 High
The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it can also be used to probe for open network ports, and figure out from returned error messages whether a file exists or not. This affects OFBiz 16.11.01 to 16.11.04.
CVE-2011-3596 2 Debian, Polipo Project 2 Debian Linux, Polipo 2024-11-21 7.5 High
Polipo before 1.0.4.1 suffers from a DoD vulnerability via specially-crafted HTTP POST / PUT request.
CVE-2011-3595 1 Joomla 1 Joomla\! 2024-11-21 5.4 Medium
Multiple Cross-site Scripting (XSS) vulnerabilities exist in Joomla! through 1.7.0 in index.php in the search word, extension, asset, and author parameters.
CVE-2011-3585 2 Redhat, Samba 2 Enterprise Linux, Samba 2024-11-21 4.7 Medium
Multiple race conditions in the (1) mount.cifs and (2) umount.cifs programs in Samba 3.6 allow local users to cause a denial of service (mounting outage) via a SIGKILL signal during a time window when the /etc/mtab~ file exists.
CVE-2011-3584 1 Guidestar 1 Wec Discussion Forum 2024-11-21 9.8 Critical
The TYPO3 Core wec_discussion extension before 2.1.1 is vulnerable to SQL Injection due to improper sanitation of user-supplied input.
CVE-2011-3583 1 Typo3 1 Typo3 2024-11-21 9.8 Critical
It was found that Typo3 Core versions 4.5.0 - 4.5.5 uses prepared statements that, if the parameter values are not properly replaced, could lead to a SQL Injection vulnerability. This issue can only be exploited if two or more parameters are bound to the query and at least two come from user input.
CVE-2011-3582 1 Anelectron 1 Advanced Electron Forums 2024-11-21 8.8 High
A Cross-site Request Forgery (CSRF) vulnerability exists in Advanced Electron Forums (AEF) through 1.0.9 due to inadequate confirmation for sensitive transactions in the administrator functions.