Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (25746 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2011-4094 1 Jara Project 1 Jara 2024-11-21 9.8 Critical
Jara 1.6 has a SQL injection vulnerability.
CVE-2011-3923 2 Apache, Redhat 2 Struts, Jboss Enterprise Web Server 2024-11-21 9.8 Critical
Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.
CVE-2011-3642 1 Flowplayer 1 Flowplayer Flash 2024-11-21 9.6 Critical
Cross-site scripting (XSS) vulnerability in Flowplayer Flash 3.2.7 through 3.2.16, as used in the News system (news) extension for TYPO3 and Mahara, allows remote attackers to inject arbitrary web script or HTML via the plugin configuration directive in a reference to an external domain plugin.
CVE-2011-3621 1 Fluxbb 1 Fluxbb 2024-11-21 9.8 Critical
A reverse proxy issue exists in FluxBB before 1.4.7 when FORUM_BEHIND_REVERSE_PROXY is enabled.
CVE-2011-3614 1 Vanillaforums 1 Vanilla 2024-11-21 9.8 Critical
An Access Control vulnerability exists in the Facebook, Twitter, and Embedded plugins in Vanilla Forums before 2.0.17.9.
CVE-2011-3584 1 Guidestar 1 Wec Discussion Forum 2024-11-21 9.8 Critical
The TYPO3 Core wec_discussion extension before 2.1.1 is vulnerable to SQL Injection due to improper sanitation of user-supplied input.
CVE-2011-3583 1 Typo3 1 Typo3 2024-11-21 9.8 Critical
It was found that Typo3 Core versions 4.5.0 - 4.5.5 uses prepared statements that, if the parameter values are not properly replaced, could lead to a SQL Injection vulnerability. This issue can only be exploited if two or more parameters are bound to the query and at least two come from user input.
CVE-2011-3350 1 Marmaro 1 Masqmail 2024-11-21 9.8 Critical
masqmail 0.2.21 through 0.2.30 improperly calls seteuid() in src/log.c and src/masqmail.c that results in improper privilege dropping.
CVE-2011-3203 1 Jcow 1 Jcow Cms 2024-11-21 9.8 Critical
A Code Execution vulnerability exists the attachment parameter to index.php in Jcow CMS 4.x to 4.2 and 5.2 to 5.2.
CVE-2011-2936 1 Elgg 1 Elgg 2024-11-21 9.8 Critical
Elgg through 1.7.10 has a SQL injection vulnerability
CVE-2011-2921 1 Ktsuss Project 1 Ktsuss 2024-11-21 9.8 Critical
ktsuss versions 1.4 and prior has the uid set to root and does not drop privileges prior to executing user specified commands, which can result in command execution with root privileges.
CVE-2011-2897 3 Debian, Gnome, Redhat 3 Debian Linux, Gdk-pixbuf, Enterprise Linux 2024-11-21 9.8 Critical
gdk-pixbuf through 2.31.1 has GIF loader buffer overflow when initializing decompression tables due to an input validation flaw
CVE-2011-2717 2 Linux, Redhat 2 Dhcp6c, Enterprise Linux 2024-11-21 9.8 Critical
The DHCPv6 client (dhcp6c) as used in the dhcpv6 project through 2011-07-25 allows remote DHCP servers to execute arbitrary commands via shell metacharacters in a hostname obtained from a DHCP message.
CVE-2011-2715 1 Drupal 2 Data, Drupal 2024-11-21 9.8 Critical
An SQL Injection vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table names or column names.
CVE-2011-2523 2 Debian, Vsftpd Project 2 Debian Linux, Vsftpd 2024-11-21 9.8 Critical
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
CVE-2011-2337 1 Google 1 Blink 2024-11-21 9.8 Critical
A wrong type is used for a return value from strlen in WebKit in Google Chrome before Blink M12 on 64-bit platforms.
CVE-2011-2195 1 Websvn 1 Websvn 2024-11-21 9.8 Critical
A flaw was found in WebSVN 2.3.2. Without prior authentication, if the 'allowDownload' option is enabled in config.php, an attacker can invoke the dl.php script and pass a well formed 'path' argument to execute arbitrary commands against the underlying operating system.
CVE-2011-1939 3 Debian, Php, Zend 3 Debian Linux, Php, Zend Framework 2024-11-21 9.8 Critical
SQL injection vulnerability in Zend Framework 1.10.x before 1.10.9 and 1.11.x before 1.11.6 when using non-ASCII-compatible encodings in conjunction PDO_MySql in PHP before 5.3.6.
CVE-2011-1933 1 Jifty\ 1 \ 2024-11-21 9.8 Critical
SQL injection vulnerability in Jifty::DBI before 0.68.
CVE-2011-1930 2 Debian, Klibc Project 2 Debian Linux, Klibc 2024-11-21 9.8 Critical
In klibc 1.5.20 and 1.5.21, the DHCP options written by ipconfig to /tmp/net-$DEVICE.conf are not properly escaped. This may allow a remote attacker to send a specially crafted DHCP reply which could execute arbitrary code with the privileges of any process which sources DHCP options.