Vulnerabilities
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2011-04-18 | CVE-2011-0286 | Cross-Site Scripting vulnerability in RIM products Cross-site scripting (XSS) vulnerability in webdesktop/app in the BlackBerry Web Desktop Manager component in Research In Motion (RIM) BlackBerry Enterprise Server (BES) software before 5.0.2 MR5 and 5.0.3 before MR1, and BlackBerry Enterprise Server Express software 5.0.1 and 5.0.2, allows remote attackers to inject arbitrary web script or HTML via the displayErrorMessage parameter in a ManageDevices action. | 4.3 |
| 2011-04-18 | CVE-2010-4229 | Path Traversal vulnerability in Novell Zenworks Configuration Management 10.3/10.3.1/11 Directory traversal vulnerability in an unspecified servlet in the Inventory component in ZENworks Asset Management (ZAM) in Novell ZENworks Configuration Management 10.3 before 10.3.2, and 11, allows remote attackers to overwrite files, and subsequently execute arbitrary code, via directory traversal sequences in a filename field in an upload request. | 10.0 |
| 2011-04-18 | CVE-2011-1179 | Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Redhat Spice-Xpi 2.2/2.3/2.4 The SPICE Firefox plug-in (spice-xpi) 2.4, 2.3, 2.2, and possibly other versions allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to (1) plugin/nsScriptablePeer.cpp and (2) plugin/plugin.cpp, which trigger multiple uses of an uninitialized pointer. | 5.1 |
| 2011-04-18 | CVE-2011-0988 | Permissions, Privileges, and Access Controls vulnerability in multiple products pure-ftpd 1.0.22, as used in SUSE Linux Enterprise Server 10 SP3 and SP4, and Enterprise Desktop 10 SP3 and SP4, when running OES Netware extensions, creates a world-writeable directory, which allows local users to overwrite arbitrary files and gain privileges via unspecified vectors. | 4.4 |
| 2011-04-18 | CVE-2011-0012 | Link Following vulnerability in Redhat Spice-Xpi 2.2/2.3/2.4 The SPICE Firefox plug-in (spice-xpi) 2.4, 2.3, 2.2, and possibly other versions allows local users to overwrite arbitrary files via a symlink attack on the usbrdrctl log file, which has a predictable name. | 3.3 |
| 2011-04-18 | CVE-2010-1171 | Permissions, Privileges, and Access Controls vulnerability in Redhat Satellite 5.3/5.4 Red Hat Network (RHN) Satellite 5.3 and 5.4 exposes a dangerous, obsolete XML-RPC API, which allows remote authenticated users to access arbitrary files and cause a denial of service (failed yum operations) via vectors related to configuration and package group (comps.xml) files for channels. | 5.5 |
| 2011-04-18 | CVE-2009-0788 | Information Exposure vulnerability in Redhat Network Satellite Server 5.3/5.4 Red Hat Network (RHN) Satellite Server 5.3 and 5.4 does not properly rewrite unspecified URLs, which allows remote attackers to (1) obtain unspecified sensitive host information or (2) use the server as an inadvertent proxy to connect to arbitrary services and IP addresses via unspecified vectors. | 6.4 |
| 2011-04-15 | CVE-2011-1713 | Information Exposure vulnerability in Microsoft Internet Explorer 8 Microsoft msxml.dll, as used in Internet Explorer 8 on Windows 7, allows remote attackers to obtain potentially sensitive information about heap memory addresses via an XML document containing a call to the XSLT generate-id XPath function. | 4.3 |
| 2011-04-15 | CVE-2011-1712 | Information Exposure vulnerability in Mozilla Firefox and Seamonkey The txXPathNodeUtils::getXSLTId function in txMozillaXPathTreeWalker.cpp and txStandaloneXPathTreeWalker.cpp in Mozilla Firefox before 3.5.19, 3.6.x before 3.6.17, and 4.x before 4.0.1, and SeaMonkey before 2.0.14, allows remote attackers to obtain potentially sensitive information about heap memory addresses via an XML document containing a call to the XSLT generate-id XPath function. | 4.3 |
| 2011-04-15 | CVE-2011-1302 | Out-Of-Bounds Write vulnerability in Google Chrome Heap-based buffer overflow in the GPU process in Google Chrome before 10.0.648.205 allows remote attackers to execute arbitrary code via unknown vectors. | 9.3 |