yahoo-inc/cve-impacts huggingface dataset:
CVE-2011-2526: Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service (infinite loop or JVM crash) by leveraging an untrusted web application.
Key phrases: denial of service (infinite loop or JVM crash), bypass intended file access restrictions, bypass intended file access restrictions or cause a
CVE-2011-2527: The change_process_uid function in os-posix.c in Qemu 0.14.0 and earlier does not properly drop group privileges when the -runas option is used, which allows local guest users to access restricted files on the host.
Key phrases: access restricted files on the host
CVE-2011-2528: Unspecified vulnerability in (1) Zope 2.12.x before 2.12.19 and 2.13.x before 2.13.8, as used in Plone 4.x and other products, and (2) PloneHotfix20110720 for Plone 3.x allows attackers to gain privileges via unspecified vectors, related to a "highly serious vulnerability." NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-0720.
Key phrases: gain privileges, gain privileges via unspecified vectors, highly serious, unspecified vulnerability
CVE-2011-2529: chan_sip.c in the SIP channel driver in Asterisk Open Source 1.6.x before 1.6.2.18.1 and 1.8.x before 1.8.4.3 does not properly handle '\\0' characters in SIP packets, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted packet.
Key phrases: denial of service (memory corruption), cause a denial of service (memory corruption, unspecified other impact, unspecified impact
CVE-2011-2530: Buffer overflow in RSEds.dll in RSHWare.exe in the EDS Hardware Installation Tool 1.0.5.1 and earlier in Rockwell Automation RSLinx Classic before 2.58 allows user-assisted remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a malformed .eds file.
Key phrases: execute arbitrary code, denial of service (application crash), cause a denial of service (application crash, buffer overflow
CVE-2011-2531: Prosody 0.8.x before 0.8.1, when MySQL is used, assigns an incorrect data type to the value column in certain tables, which might allow remote attackers to cause a denial of service (data truncation) by sending a large amount of data.
Key phrases: denial of service (data truncation), cause a denial of service (data truncation, incorrect data type, large amount of data
CVE-2011-2532: The json.decode function in util/json.lua in Prosody 0.8.x before 0.8.1 might allow remote attackers to cause a denial of service (infinite loop) via invalid JSON data, as demonstrated by truncated data.
Key phrases: denial of service (infinite loop), cause a denial of service (infinite loop, invalid json data, truncated data
CVE-2011-2533: The configure script in D-Bus (aka DBus) 1.2.x before 1.2.28 allows local users to overwrite arbitrary files via a symlink attack on an unspecified file in /tmp/.
Key phrases: overwrite arbitrary files, overwrite arbitrary files via a symlink attack on, unspecified
CVE-2011-2534: Buffer overflow in the clusterip_proc_write function in net/ipv4/netfilter/ipt_CLUSTERIP.c in the Linux kernel before 2.6.39 might allow local users to cause a denial of service or have unspecified other impact via a crafted write operation, related to string data that lacks a terminating '\\0' character.
Key phrases: cause a denial of service or have unspecified, buffer overflow, unspecified other impact, unspecified impact
CVE-2011-2535: chan_iax2.c in the IAX2 channel driver in Asterisk Open Source 1.4.x before 1.4.41.1, 1.6.2.x before 1.6.2.18.1, and 1.8.x before 1.8.4.3, and Asterisk Business Edition C.3 before C.3.7.3, accesses a memory address contained in an option control frame, which allows remote attackers to cause a denial of service (daemon crash) or possibly have unspecified other impact via a crafted frame.
Key phrases: denial of service (daemon crash), cause a denial of service (daemon crash, unspecified other impact, unspecified impact
CVE-2011-2536: chan_sip.c in the SIP channel driver in Asterisk Open Source 1.4.x before 1.4.41.2, 1.6.2.x before 1.6.2.18.2, and 1.8.x before 1.8.4.4, and Asterisk Business Edition C.3.x before C.3.7.3, disregards the alwaysauthreject option and generates different responses for invalid SIP requests depending on whether the user account exists, which allows remote attackers to enumerate account names via a series of requests.
Key phrases: enumerate account names via a series of requests
CVE-2011-2538: Cisco Video Communications Server (VCS) before X7.0.3 contains a command injection vulnerability which allows remote, authenticated attackers to execute arbitrary commands.
Key phrases: execute arbitrary commands, command injection
CVE-2011-2543: Buffer overflow in the cuil component in Cisco Telepresence System Integrator C Series 4.x before TC4.2.0 allows remote authenticated users to cause a denial of service (endpoint reboot or process crash) or possibly execute arbitrary code via a long location parameter to the getxml program, aka Bug ID CSCtq46496.
Key phrases: execute arbitrary code, denial of service (endpoint reboot or process crash), cause a denial of service (endpoint reboot, buffer overflow
CVE-2011-2544: Cross-site scripting (XSS) vulnerability in the web interface in Cisco TelePresence System MXP Series F9.1 and earlier allows remote authenticated users to inject arbitrary web script or HTML via a crafted Call ID, as demonstrated by resultant cross-site request forgery (CSRF) attacks that change passwords or cause a denial of service, aka Bug ID CSCtq46488.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via a, cross-site scripting (xss), denial of service, cross site request forgery
CVE-2011-2545: Cross-site scripting (XSS) vulnerability in the SIP implementation on the Cisco SPA8000 and SPA8800 before 6.1.11, SPA2102 and SPA3102 before 5.2.13, and SPA 500 series IP phones before 7.4.9 allows remote attackers to inject arbitrary web script or HTML via the FROM field of an INVITE message, aka Bug IDs CSCtr27277, CSCtr27256, CSCtr27274, and CSCtr14715.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2011-2546: SQL injection vulnerability in the web-based management interface on Cisco SA 500 series security appliances with software before 2.1.19 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCtq65669.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via unspecified vectors, sql injection
CVE-2011-2547: The web-based management interface on Cisco SA 500 series security appliances with software before 2.1.19 allows remote authenticated users to execute arbitrary commands via crafted parameters to web forms, aka Bug ID CSCtq65681.
Key phrases: execute arbitrary commands, execute arbitrary commands via crafted parameters to web
CVE-2011-2549: Unspecified vulnerability in Cisco IOS XR 4.1.x before 4.1.1 on Cisco Aggregation Services Routers (ASR) 9000 series devices allows remote attackers to cause a denial of service (line-card reload) via an IPv4 packet, aka Bug ID CSCtr26695.
Key phrases: denial of service (line-card reload), cause a denial of service (line-, unspecified, unspecified vulnerability
CVE-2011-2555: Cisco TelePresence Recording Server 1.7.2.x before 1.7.2.1 has a default password for the root administrator account, which makes it easier for remote attackers to modify the configuration via an SSH session, aka Bug ID CSCtr76182.
Key phrases: default password
CVE-2011-2560: The Packet Capture Service in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 4.x does not properly handle idle TCP connections, which allows remote attackers to cause a denial of service (memory consumption and restart) by making many connections, aka Bug ID CSCtf97162.
Key phrases: denial of service (memory consumption and restart), cause a denial of service (memory consumption
CVE-2011-2561: The SIP process in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 7.x before 7.1(5b)su4 and 8.x before 8.0(1) does not properly handle SDP data within a SIP call in certain situations related to use of the g729ar8 codec for a Media Termination Point (MTP), which allows remote attackers to cause a denial of service (service outage) via a crafted call, aka Bug ID CSCtc61990.
Key phrases: denial of service (service outage), cause a denial of service (service outage
CVE-2011-2562: Unspecified vulnerability in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before 6.1(5)su2, 7.x before 7.1(5b)su3, 8.x before 8.0(3a)su1, and 8.5 before 8.5(1) allows remote attackers to cause a denial of service (service outage) via a SIP INVITE message, aka Bug ID CSCth43256.
Key phrases: denial of service (service outage), cause a denial of service (service outage, unspecified, unspecified vulnerability
CVE-2011-2563: Unspecified vulnerability in the Service Advertisement Framework (SAF) in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 8.x before 8.5(1) and Cisco Intercompany Media Engine 8.x before 8.5(1) allows remote attackers to cause a denial of service (device reload) via crafted SAF packets, aka Bug ID CSCth26669.
Key phrases: denial of service (device reload), cause a denial of service (device reload, unspecified, unspecified vulnerability
CVE-2011-2564: Unspecified vulnerability in the Service Advertisement Framework (SAF) in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 8.x before 8.5(1) and Cisco Intercompany Media Engine 8.x before 8.5(1) allows remote attackers to cause a denial of service (device reload) via crafted SAF packets, aka Bug ID CSCth19417.
Key phrases: denial of service (device reload), cause a denial of service (device reload, unspecified, unspecified vulnerability
CVE-2011-2569: Cisco Nexus OS (aka NX-OS) 4.2 and 5.0 and Cisco Unified Computing System with software 1.4 and 2.0 do not properly restrict command-line options, which allows local users to gain privileges via unspecified vectors, aka Bug IDs CSCtf40008, CSCtg18363, CSCtr44645, CSCts10195, and CSCts10188.
Key phrases: gain privileges, gain privileges via unspecified vectors, bug ids
CVE-2011-2577: Unspecified vulnerability in Cisco TelePresence C Series Endpoints, E/EX Personal Video units, and MXP Series Codecs, when using software versions before TC 4.0.0 or F9.1, allows remote attackers to cause a denial of service (crash) via a crafted SIP packet to port 5060 or 5061, aka Bug ID CSCtq46500.
Key phrases: denial of service (crash), cause a denial of service (crash), unspecified, unspecified vulnerability
CVE-2011-2578: Memory leak in Cisco IOS 15.1 and 15.2 allows remote attackers to cause a denial of service (memory consumption) via malformed SIP packets on a NAT interface, aka Bug ID CSCts12366.
Key phrases: denial of service (memory consumption), cause a denial of service (memory consumption, memory leak
CVE-2011-2581: The ACL implementation in Cisco NX-OS 5.0(2) and 5.0(3) before 5.0(3)N2(1) on Nexus 5000 series switches, and NX-OS before 5.0(3)U1(2a) on Nexus 3000 series switches, does not properly handle comments in conjunction with deny statements, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by sending packets, aka Bug IDs CSCto09813 and CSCtr61490.
Key phrases: bypass intended access restrictions, bypass intended access restrictions in opportunistic circumstances by
CVE-2011-2583: Cisco Unified Contact Center Express (aka CCX) 8.0 and 8.5 allows remote attackers to cause a denial of service via network traffic, as demonstrated by an SEC-BE-STABLE test case, aka Bug ID CSCth33834.
Key phrases: cause a denial of service via network traffic
CVE-2011-2584: Cisco Show and Share 5(2), 5.2(1), and 5.2(2) before 5.2(2.1) allows remote attackers to access the (1) Encoders and Pull Configurations, (2) Push Configurations, (3) Video Encoding Formats, and (4) Transcoding administration pages, and cause a denial of service (live event outage) or obtain potentially sensitive information, via unspecified vectors, aka Bug ID CSCto73758.
Key phrases: denial of service (live event outage), obtain potentially sensitive information, access the (1) Encoders and Pull, pull configurations, unspecified vectors
CVE-2011-2585: Cisco Show and Share 5(2), 5.2(1), and 5.2(2) before 5.2(2.1) allows remote authenticated users to upload and execute arbitrary code by leveraging video upload privileges, aka Bug ID CSCto69857.
Key phrases: execute arbitrary code, upload and execute arbitrary code by leveraging video, video upload privileges
CVE-2011-2586: The HTTP client in Cisco IOS 12.4 and 15.0 allows user-assisted remote attackers to cause a denial of service (device crash) via a malformed HTTP response to a request for service installation, aka Bug ID CSCts12249.
Key phrases: denial of service (device crash), cause a denial of service (device crash, malformed http response
CVE-2011-2587: Heap-based buffer overflow in the DemuxAudioSipr function in real.c in the RealMedia demuxer in VideoLAN VLC media player 1.1.x before 1.1.11 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted Real Media file.
Key phrases: execute arbitrary code, denial of service (application crash), cause a denial of service (application crash, heap-based buffer overflow, heap based buffer overflow
CVE-2011-2588: Heap-based buffer overflow in the AVI_ChunkRead_strf function in libavi.c in the AVI demuxer in VideoLAN VLC media player before 1.1.11 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted AVI media file.
Key phrases: execute arbitrary code, denial of service (application crash), cause a denial of service (application crash, heap-based buffer overflow, heap based buffer overflow
CVE-2011-2589: Heap-based buffer overflow in the SendLogAction method in the UUPlayer ActiveX control 6.0.0.1 in UUSee 2010 6.11.0609.2 might allow remote attackers to execute arbitrary code via a long argument.
Key phrases: execute arbitrary code, execute arbitrary code via a long argument, heap-based buffer overflow, heap based buffer overflow
CVE-2011-2590: The Play method in the UUPlayer ActiveX control 6.0.0.1 in UUSee 2010 6.11.0609.2 allows remote attackers to execute arbitrary programs via a UNC share pathname in the MPlayerPath parameter.
Key phrases: execute arbitrary programs, execute arbitrary programs via a UNC share pathname
CVE-2011-2591: Multiple buffer overflows in the Provideo ActiveX controls allow remote attackers to execute arbitrary code via crafted input fields, as demonstrated by (1) a long strIp argument to the voice method in 2way.dll in the alarm 1.0.3.1 ActiveX control, (2) a network response to AXPlayer.ocx in the GMAXPlayer 2.0.8.2 ActiveX control, the (3) UserName or (4) Password parameter to AXPlayer.ocx in the GMAXPlayer 2.0.8.2 ActiveX control, (5) a long Id parameter to the GetString method in PAxPlayer.ocx in the PAxPlayer 3.0.0.9 ActiveX control, or (6) a long strAdr parameter to the ConnectIPCam method in PAxPlayer.ocx in the PAxPlayer 3.0.0.9 ActiveX control.
Key phrases: execute arbitrary code, execute arbitrary code via crafted input fields, buffer overflows
CVE-2011-2592: Heap-based buffer overflow in the StartEpa method in the nsepacom ActiveX control (nsepa.exe) in Citrix Access Gateway Enterprise Edition Plug-in for Windows 9.x before 9.3-57.5 and 10.0 before 10.0-69.4 allows remote attackers to execute arbitrary code via a long CSEC HTTP response header.
Key phrases: execute arbitrary code, execute arbitrary code via a long CSEC HTTP, heap-based buffer overflow, heap based buffer overflow
CVE-2011-2593: Integer overflow in the StartEpa method in the nsepacom ActiveX control (nsepa.exe) in Citrix Access Gateway Enterprise Edition Plug-in for Windows 9.x before 9.3-57.5 and 10.0 before 10.0-69.4 allows remote attackers to execute arbitrary code via a crafted Content-Length HTTP header, which triggers a heap-based buffer overflow.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted Content-, integer overflow, heap-based buffer overflow, heap based buffer overflow
CVE-2011-2594: Heap-based buffer overflow in KMPlayer 3.0.0.1441, and possibly other versions, allows remote attackers to execute arbitrary code via a playlist (.KPL) file with a long Title field.
Key phrases: execute arbitrary code, execute arbitrary code via a playlist (.KPL, heap-based buffer overflow, heap based buffer overflow
CVE-2011-2595: Multiple stack-based buffer overflows in ACDSee FotoSlate 4.0 Build 146 allow remote attackers to execute arbitrary code via a long id parameter in a (1) String or (2) Int tag in a FotoSlate Project (aka PLP) file.
Key phrases: execute arbitrary code, execute arbitrary code via a long id, stack-based buffer overflows, stack based buffer overflow
CVE-2011-2597: The Lucent/Ascend file parser in Wireshark 1.2.x before 1.2.18, 1.4.x through 1.4.7, and 1.6.0 allows remote attackers to cause a denial of service (infinite loop) via malformed packets.
Key phrases: denial of service (infinite loop), cause a denial of service (infinite loop, malformed packets
CVE-2011-2598: The WebGL implementation in Mozilla Firefox 4.x allows remote attackers to obtain screenshots of the windows of arbitrary desktop applications via vectors involving an SVG filter, an IFRAME element, and uninitialized data in graphics memory.
Key phrases: obtain screenshots of the windows of arbitrary desktop applications, uninitialized data in graphics memory
CVE-2011-2599: Google Chrome 11 does not block use of a cross-domain image as a WebGL texture, which allows remote attackers to obtain approximate copies of arbitrary images via a timing attack involving a crafted WebGL fragment shader.
Key phrases: obtain approximate copies of arbitrary images via a timing attack involving, cross-domain image
CVE-2011-2600: The GPU support functionality in Windows XP does not properly restrict rendering time, which allows remote attackers to cause a denial of service (system crash) via vectors involving WebGL and (1) shader programs or (2) complex 3D geometry, as demonstrated by using Mozilla Firefox or Google Chrome to visit the lots-of-polys-example.html test page in the Khronos WebGL SDK.
Key phrases: denial of service (system crash), cause a denial of service (system crash
CVE-2011-2601: The GPU support functionality in Mac OS X does not properly restrict rendering time, which allows remote attackers to cause a denial of service (desktop hang) via vectors involving WebGL and (1) shader programs or (2) complex 3D geometry, as demonstrated by using Mozilla Firefox or Google Chrome to visit the lots-of-polys-example.html test page in the Khronos WebGL SDK.
Key phrases: denial of service (desktop hang), cause a denial of service (desktop hang, rendering time
CVE-2011-2602: The NVIDIA Geforce 310 driver 6.14.12.7061 on Windows XP SP3 allows remote attackers to cause a denial of service (system crash) via a crafted web page that is visited with Google Chrome or Mozilla Firefox, as demonstrated by the lots-of-polys-example.html test page in the Khronos WebGL SDK.
Key phrases: denial of service (system crash), cause a denial of service (system crash
CVE-2011-2603: The NVIDIA 9400M driver 6.2.6 on Mac OS X 10.6.7 allows remote attackers to cause a denial of service (desktop hang) via a crafted web page that is visited with Google Chrome or Mozilla Firefox, as demonstrated by the lots-of-polys-example.html test page in the Khronos WebGL SDK.
Key phrases: denial of service (desktop hang), cause a denial of service (desktop hang
CVE-2011-2604: The Intel G41 driver 6.14.10.5355 on Windows XP SP3 allows remote attackers to cause a denial of service (system crash) via a crafted web page that is visited with Google Chrome or Mozilla Firefox, as demonstrated by the lots-of-polys-example.html test page in the Khronos WebGL SDK.
Key phrases: denial of service (system crash), cause a denial of service (system crash
CVE-2011-2605: CRLF injection vulnerability in the nsCookieService::SetCookieStringInternal function in netwerk/cookie/nsCookieService.cpp in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, and Thunderbird before 3.1.11, allows remote attackers to bypass intended access restrictions via a string containing a \\n (newline) character, which is not properly handled in a JavaScript "document.cookie =" expression, a different vulnerability than CVE-2011-2374.
Key phrases: bypass intended access restrictions, bypass intended access restrictions via a string containing, crlf injection
CVE-2011-2606: Cross-site scripting (XSS) vulnerability in the Web UI in IBM Rational Team Concert (RTC) 3.0 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Work Item 165511.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via an, cross-site scripting (xss), unspecified
CVE-2011-2607: Cross-site scripting (XSS) vulnerability in IBM Rational Team Concert (RTC) 3.0 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Work Item 165513.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via an, cross-site scripting (xss), unspecified
CVE-2011-2608: ovbbccb.exe 6.20.50.0 and other versions in HP OpenView Performance Agent 4.70 and 5.0; and Operations Agent 11.0, 8.60.005, 8.60.006, 8.60.007, 8.60.008, 8.60.501, and 8.53; allows remote attackers to delete arbitrary files via a full pathname in the File field in a Register command.
Key phrases: delete arbitrary files, delete arbitrary files via a full pathname in
CVE-2011-2609: Opera before 11.50 does not properly restrict data: URIs, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site.
Key phrases: data: uris, cross-site scripting (xss)
CVE-2011-2610: Unspecified vulnerability in Opera before 11.50 has unknown impact and attack vectors, related to a "moderately severe issue."
Key phrases: unspecified, unknown impact, unspecified vulnerability
CVE-2011-2611: Unspecified vulnerability in the printing functionality in Opera before 11.50 allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted web page.
Key phrases: denial of service (application crash), cause a denial of service (application crash, unspecified, unspecified vulnerability
CVE-2011-2612: Unspecified vulnerability in Opera before 11.50 allows remote attackers to cause a denial of service (application crash) via unknown content on a web page, as demonstrated by progorod.ru.
Key phrases: denial of service (application crash), cause a denial of service (application crash, unspecified, unspecified vulnerability
CVE-2011-2613: The Array.prototype.join method in Opera before 11.50 allows remote attackers to cause a denial of service (application crash) via a non-array object that contains initial holes.
Key phrases: denial of service (application crash), cause a denial of service (application crash, initial holes
CVE-2011-2614: The SVG implementation in Opera before 11.50 allows remote attackers to cause a denial of service (application crash) via vectors involving a path on which many characters are drawn.
Key phrases: denial of service (application crash), cause a denial of service (application crash
CVE-2011-2615: Unspecified vulnerability in Opera before 11.50 allows remote attackers to cause a denial of service (application hang) via unknown content on a web page, as demonstrated by domiteca.com.
Key phrases: denial of service (application hang), cause a denial of service (application hang, unspecified, unspecified vulnerability
CVE-2011-2616: Unspecified vulnerability in Opera before 11.50 allows remote attackers to cause a denial of service (memory consumption) via unknown content on a web page, as demonstrated by test262.ecmascript.org.
Key phrases: denial of service (memory consumption), cause a denial of service (memory consumption, unspecified, unspecified vulnerability
CVE-2011-2617: Unspecified vulnerability in Opera before 11.50 allows remote attackers to cause a denial of service (application crash) via vectors related to selecting a text node, and closed pop-up windows, removed pop-up windows, and IFRAME elements.
Key phrases: denial of service (application crash), cause a denial of service (application crash, unspecified, unspecified vulnerability
CVE-2011-2618: Opera before 11.50 allows remote attackers to cause a denial of service (application crash) via web script that moves a (1) AUDIO element or (2) VIDEO element between windows.
Key phrases: denial of service (application crash), cause a denial of service (application crash, web script
CVE-2011-2619: Opera before 11.50 allows remote attackers to cause a denial of service (application crash) via a gradient with many stops, related to the implementation of CANVAS elements, SVG, and Cascading Style Sheets (CSS).
Key phrases: denial of service (application crash), cause a denial of service (application crash
CVE-2011-2620: Unspecified vulnerability in Opera before 11.50 allows remote attackers to cause a denial of service (application crash) via vectors involving SVG animation.
Key phrases: denial of service (application crash), cause a denial of service (application crash, unspecified, unspecified vulnerability
CVE-2011-2621: Unspecified vulnerability in Opera before 11.50 allows remote attackers to cause a denial of service (application crash) via vectors related to form layout.
Key phrases: denial of service (application crash), cause a denial of service (application crash, unspecified, unspecified vulnerability
CVE-2011-2622: Unspecified vulnerability in the Web Workers implementation in Opera before 11.50 allows remote attackers to cause a denial of service (application crash) via unknown vectors.
Key phrases: denial of service (application crash), cause a denial of service (application crash, unspecified, unknown vectors, unspecified vulnerability
CVE-2011-2623: Unspecified vulnerability in the SVG BiDi implementation in Opera before 11.50 allows remote attackers to cause a denial of service (application crash or hang) via unknown vectors.
Key phrases: denial of service (application crash or hang), cause a denial of service (application crash, unspecified, unknown vectors, unspecified vulnerability
CVE-2011-2624: Opera before 11.50 allows user-assisted remote attackers to cause a denial of service (application hang) via a large table, which is not properly handled during a print preview.
Key phrases: denial of service (application hang), cause a denial of service (application hang, large table
CVE-2011-2625: Opera before 11.50 allows remote attackers to cause a denial of service (application crash) via a SELECT element that contains many OPTION elements.
Key phrases: denial of service (application crash), cause a denial of service (application crash, select element
CVE-2011-2626: Opera before 11.50 allows remote attackers to cause a denial of service (application crash) by using "injected script" to set the SRC attribute of an IFRAME element.
Key phrases: denial of service (application crash), cause a denial of service (application crash, injected script
CVE-2011-2627: Unspecified vulnerability in the DOM implementation in Opera before 11.50 allows remote attackers to cause a denial of service (application crash) via unknown content on a web page, as demonstrated by live.com.
Key phrases: denial of service (application crash), cause a denial of service (application crash, unspecified, unspecified vulnerability
CVE-2011-2628: Opera before 11.11 does not properly implement FRAMESET elements, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to page unload.
Key phrases: execute arbitrary code, denial of service (memory corruption), execute arbitrary code or cause a denial of
CVE-2011-2629: Unspecified vulnerability in Opera before 11.11 allows remote attackers to cause a denial of service (application crash) via unknown content on a web page, as demonstrated by www.falk.de.
Key phrases: denial of service (application crash), cause a denial of service (application crash, unspecified, unspecified vulnerability
CVE-2011-2630: Opera before 11.11 allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted web page that is not properly handled during a reload occurring after the opening of a popup of the Easy Sticky Note extension.
Key phrases: denial of service (application crash), cause a denial of service (application crash
CVE-2011-2631: The Cascading Style Sheets (CSS) implementation in Opera before 11.11 does not properly handle the column-count property, which allows remote attackers to cause a denial of service (infinite repaint loop and application hang) via a web page, as demonstrated by an unspecified Wikipedia page.
Key phrases: denial of service (infinite repaint loop and application hang), cause a denial of service (infinite repaint, unspecified
CVE-2011-2632: Opera before 11.11 does not properly handle destruction of a Silverlight instance, which allows remote attackers to cause a denial of service (application crash) via a web page, as demonstrated by vod.onet.pl.
Key phrases: denial of service (application crash), cause a denial of service (application crash, silverlight instance
CVE-2011-2633: Unspecified vulnerability in Opera before 11.11 allows remote attackers to cause a denial of service (application crash) via vectors involving a Certificate Revocation List (CRL) file, as demonstrated by the multicert-ca-02.crl file.
Key phrases: denial of service (application crash), cause a denial of service (application crash, unspecified, unspecified vulnerability
CVE-2011-2634: Opera before 11.10 allows remote attackers to hijack (1) searches and (2) customizations via unspecified third party applications.
Key phrases: hijack (1) searches and (2, unspecified
CVE-2011-2635: The Cascading Style Sheets (CSS) implementation in Opera before 11.10 allows remote attackers to cause a denial of service (application crash) via vectors involving use of the :hover pseudo-class, in conjunction with transforms, for a floated element.
Key phrases: denial of service (application crash), cause a denial of service (application crash
CVE-2011-2636: Unspecified vulnerability in Opera before 11.10 allows remote attackers to cause a denial of service (application crash) via unknown content on a web page, as demonstrated by a certain Tomato Firmware page.
Key phrases: denial of service (application crash), cause a denial of service (application crash, unspecified, unspecified vulnerability
CVE-2011-2637: Unspecified vulnerability in Opera before 11.10 allows remote attackers to cause a denial of service (application crash) via unknown content on a web page, as demonstrated by futura-sciences.com, seoptimise.com, and mitosyfraudes.org.
Key phrases: denial of service (application crash), cause a denial of service (application crash, unspecified, unspecified vulnerability
CVE-2011-2638: Unspecified vulnerability in Opera before 11.10 allows remote attackers to cause a denial of service (application crash) via unknown content on a web page, as demonstrated by games on zylom.com.
Key phrases: denial of service (application crash), cause a denial of service (application crash, unspecified, unspecified vulnerability
CVE-2011-2639: Opera before 11.10 does not properly handle hidden animated GIF images, which allows remote attackers to cause a denial of service (CPU consumption) via an image file that triggers continual repaints.
Key phrases: denial of service (CPU consumption), cause a denial of service (CPU consumption, hidden animated gif images, cpu consumption, continual repaints
CVE-2011-2640: Opera before 11.10 allows remote attackers to cause a denial of service (application crash) via an HTML document that has an empty parameter value for an embedded Java applet.
Key phrases: denial of service (application crash), cause a denial of service (application crash, empty parameter value
CVE-2011-2641: Opera 11.11 allows remote attackers to cause a denial of service (application crash) by setting the FACE attribute of a FONT element within an IFRAME element after changing the SRC attribute of this IFRAME element to an about:blank value.
Key phrases: denial of service (application crash), cause a denial of service (application crash
CVE-2011-2642: Multiple cross-site scripting (XSS) vulnerabilities in the table Print view implementation in tbl_printview.php in phpMyAdmin before 3.3.10.3 and 3.4.x before 3.4.3.2 allow remote authenticated users to inject arbitrary web script or HTML via a crafted table name.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via a, cross-site scripting (xss)
CVE-2011-2643: Directory traversal vulnerability in sql.php in phpMyAdmin 3.4.x before 3.4.3.2, when configuration storage is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in a MIME-type transformation parameter.
Key phrases: include and execute arbitrary local files via directory, directory traversal, directory traversal sequences
CVE-2011-2644: Cross-site scripting (XSS) vulnerability in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to an RPM info display.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting (xss), unspecified vectors
CVE-2011-2645: Unspecified vulnerability in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows remote attackers to execute arbitrary code via a crafted filename for a custom RPM.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted filename for, unspecified, unspecified vulnerability
CVE-2011-2646: Unspecified vulnerability in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows remote attackers to execute arbitrary code via a crafted filename in the list of testdrive modified files.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted filename in, unspecified, unspecified vulnerability
CVE-2011-2647: Unspecified vulnerability in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows remote attackers to execute arbitrary code via a crafted archive name in the list of testdrive modified files.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted archive name, unspecified, unspecified vulnerability
CVE-2011-2648: Unspecified vulnerability in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows remote attackers to execute arbitrary code via a filter in a modified file.
Key phrases: execute arbitrary code, execute arbitrary code via a filter in a, unspecified, unspecified vulnerability
CVE-2011-2649: Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows attackers to execute arbitrary commands via shell metacharacters in an unspecified FileUtils function call.
Key phrases: execute arbitrary commands, execute arbitrary commands via shell metacharacters in an, unspecified
CVE-2011-2650: Cross-site scripting (XSS) vulnerability in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows remote attackers to inject arbitrary web script or HTML via a crafted pattern name that is included in an RPM info display.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via a, cross-site scripting (xss)
CVE-2011-2651: Unspecified vulnerability in the file browser in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows remote attackers to execute arbitrary code via a crafted filename.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted filename, unspecified, unspecified vulnerability
CVE-2011-2652: Cross-site scripting (XSS) vulnerability in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows remote attackers to inject arbitrary web script or HTML via a crafted archive file list that is used in an overlay file.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via a, cross-site scripting (xss)
CVE-2011-2653: Directory traversal vulnerability in the rtrlet component in Novell ZENworks Asset Management (ZAM) 7.5 allows remote attackers to execute arbitrary code by uploading an executable file.
Key phrases: execute arbitrary code, execute arbitrary code by uploading an executable file, directory traversal
CVE-2011-2654: The RPC implementation in the server in Novell Cloud Manager 1.1.2 before Patch 3 does not properly initialize objects, which allows remote attackers to execute arbitrary code by making RPC calls that leverage incorrect privileges associated with a partially initialized session.
Key phrases: execute arbitrary code, execute arbitrary code by making RPC calls that, incorrect privileges, partially initialized session
CVE-2011-2655: Unspecified vulnerability in ZfHSrvr.exe in Novell ZENworks Handheld Management (ZHM) 7 allows remote attackers to execute arbitrary code via unknown vectors, a different vulnerability than CVE-2011-2656.
Key phrases: execute arbitrary code, execute arbitrary code via unknown vectors, unspecified, unspecified vulnerability
CVE-2011-2656: Unspecified vulnerability in ZfHSrvr.exe in Novell ZENworks Handheld Management (ZHM) 7 allows remote attackers to execute arbitrary code via unknown vectors, a different vulnerability than CVE-2011-2655.
Key phrases: execute arbitrary code, execute arbitrary code via unknown vectors, unspecified, unspecified vulnerability
CVE-2011-2657: Directory traversal vulnerability in the LaunchProcess function in the LaunchHelp.HelpLauncher.1 ActiveX control in LaunchHelp.dll in AdminStudio in Novell ZENworks Configuration Management (ZCM) 10.2, 10.3, and 11 SP1 allows remote attackers to execute arbitrary commands via a pathname in the first argument.
Key phrases: execute arbitrary commands, execute arbitrary commands via a pathname in the, directory traversal
CVE-2011-2658: The ISList.ISAvi ActiveX control in AdminStudio in Novell ZENworks Configuration Management (ZCM) 10.2, 10.3, and 11 SP1 provides access to the mscomct2.ocx file, which allows remote attackers to execute arbitrary code by leveraging unspecified mscomct2 flaws.
Key phrases: execute arbitrary code, execute arbitrary code by leveraging unspecified mscomct2 flaws
CVE-2011-2660: The modify_resolvconf_suse script in the vpnc package before 0.5.1-55.10.1 in SUSE Linux Enterprise Desktop 11 SP1 might allow remote attackers to execute arbitrary commands via a crafted DNS domain name.
Key phrases: execute arbitrary commands, execute arbitrary commands via a crafted DNS domain
CVE-2011-2661: Multiple cross-site scripting (XSS) vulnerabilities in WebAccess in Novell GroupWise 8.0 before HP3 allow remote attackers to inject arbitrary web script or HTML via the (1) Directory.Item.name or (2) Directory.Item.displayName parameter.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2011-2662: Integer signedness error in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before HP3 allows remote attackers to execute arbitrary code via a negative BYWEEKNO property in a weekly RRULE variable in a VCALENDAR attachment in an e-mail message.
Key phrases: execute arbitrary code, execute arbitrary code via a negative BYWEEKNO property, integer signedness error
CVE-2011-2663: Array index error in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before HP3 allows remote attackers to execute arbitrary code via a crafted yearly RRULE variable in a VCALENDAR attachment in an e-mail message.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted yearly RRULE, array index error
CVE-2011-2664: Unspecified vulnerability in Check Point Multi-Domain Management / Provider-1 NGX R65, R70, R71, and R75, and SmartCenter during installation on non-Windows machines, allows local users on the MDS system to overwrite arbitrary files via unknown vectors.
Key phrases: overwrite arbitrary files, overwrite arbitrary files via unknown vectors, unspecified, unspecified vulnerability
CVE-2011-2665: reqresp_parser.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.4.3 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a SIP packet with a Contact header that lacks a < (less than) character.
Key phrases: denial of service (NULL pointer dereference and daemon crash), cause a denial of service (NULL pointer, null pointer dereference
CVE-2011-2666: The default configuration of the SIP channel driver in Asterisk Open Source 1.4.x through 1.4.41.2 and 1.6.2.x through 1.6.2.18.2 does not enable the alwaysauthreject option, which allows remote attackers to enumerate account names by making a series of invalid SIP requests and observing the differences in the responses for different usernames, a different vulnerability than CVE-2011-2536.
Key phrases: enumerate account names by making a series of, invalid sip requests
CVE-2011-2667: Icihttp.exe in CA Gateway Security for HTTP, as used in CA Gateway Security 8.1 before 8.1.0.69 and CA Total Defense r12, does not properly parse URLs, which allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption and daemon crash) via a malformed request.
Key phrases: execute arbitrary code, denial of service (heap memory corruption and daemon crash), execute arbitrary code or cause a denial of, malformed request
CVE-2011-2668: Mozilla Firefox through 1.5.0.3 has a vulnerability in processing the content-length header
CVE-2011-2669: Mozilla Firefox prior to 3.6 has a DoS vulnerability due to an issue in the validation of certificates.
Key phrases: dos
CVE-2011-2670: Mozilla Firefox before 3.6 is vulnerable to XSS via the rendering of Cascading Style Sheets
Key phrases: xss
CVE-2011-2671: Unspecified vulnerability in Megalith 12th edition through 27th edition allows remote attackers to gain administrative privileges via unknown vectors.
Key phrases: gain administrative privileges, gain administrative privileges via unknown vectors, unspecified, unspecified vulnerability
CVE-2011-2672: Cross-site scripting (XSS) vulnerability in SemanticScuttle before 0.98 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting (xss), unspecified vectors
CVE-2011-2673: Cross-site scripting (XSS) vulnerability in BaserCMS before 1.6.13.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting (xss), unspecified vectors
CVE-2011-2674: BaserCMS before 1.6.12 does not properly restrict additions to the membership of the operators group, which allows remote authenticated users to gain privileges via unspecified vectors.
Key phrases: gain privileges, gain privileges via unspecified vectors
CVE-2011-2675: Cross-site scripting (XSS) vulnerability in Enkai-kun before 110916 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting (xss), unspecified vectors
CVE-2011-2676: The A-Form and A-Form bamboo before 1.3.6 and 2.x before 2.0.3, and A-Form PC and PC/Mobile before 3.1, plug-ins for Movable Type do not require administrative authentication, which allows remote authenticated users to modify data via unspecified vectors.
Key phrases: modify data via unspecified vectors
CVE-2011-2677: Cybozu Office before 8.0.0 allows remote authenticated users to bypass intended access restrictions and access sensitive information (time card and attendance) via unspecified vectors related to manipulation of a URL.
Key phrases: bypass intended access restrictions, bypass intended access restrictions and access sensitive information, unspecified vectors
CVE-2011-2678: The Cisco VPN Client 5.0.7.0240 and 5.0.7.0290 on 64-bit Windows platforms uses weak permissions (NT AUTHORITY\\INTERACTIVE:F) for cvpnd.exe, which allows local users to gain privileges by replacing this executable file with an arbitrary program, aka Bug ID CSCtn50645. NOTE: this vulnerability exists because of a CVE-2007-4415 regression.
Key phrases: gain privileges, gain privileges by replacing this executable file with, regression
CVE-2011-2679: Cross-site scripting (XSS) vulnerability in IBM Rational DOORS Web Access 1.4.x before 1.4.0.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting (xss), unspecified vectors
CVE-2011-2680: Unspecified vulnerability in IBM Rational DOORS Web Access 1.4.x before 1.4.0.4 has unknown impact and remote attack vectors related to the "server error response."
Key phrases: unspecified, unknown impact, remote attack vectors, unspecified vulnerability
CVE-2011-2681: IBM Rational DOORS Web Access 1.4.x before 1.4.0.4 does not properly handle exceptions, which has unspecified impact and remote attack vectors.
Key phrases: unspecified impact
CVE-2011-2682: The Login component in IBM Rational DOORS Web Access 1.4.x before 1.4.0.4 allows remote authenticated users to cause a denial of service (license consumption) by trying to login to DOORS Web Access with a new user account that has never been used for a DOORS login.
Key phrases: denial of service (license consumption), cause a denial of service (license consumption
CVE-2011-2683: reseed seeds random numbers from an insecure HTTP request to random.org during installation, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a man-in-the-middle attack.
Key phrases: insecure http request, man-in-the-middle, man in the middle
CVE-2011-2684: foo2zjs before 20110722dfsg-3ubuntu1 as packaged in Ubuntu, 20110722dfsg-1 as packaged in Debian unstable, and 20090908dfsg-5.1+squeeze0 as packaged in Debian squeeze create temporary files insecurely, which allows local users to write over arbitrary files via a symlink attack on /tmp/foo2zjs.
Key phrases: write over arbitrary files via a symlink attack
CVE-2011-2685: Stack-based buffer overflow in the Lotus Word Pro import filter in LibreOffice before 3.3.3 allows remote attackers to execute arbitrary code via a crafted .lwp file.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted .lwp file, stack-based buffer overflow, stack based buffer overflow
CVE-2011-2686: Ruby before 1.8.7-p352 does not reset the random seed upon forking, which makes it easier for context-dependent attackers to predict the values of random numbers by leveraging knowledge of the number sequence obtained in a different child process, a related issue to CVE-2003-0900.  NOTE: this issue exists because of a regression during Ruby 1.8.6 development.
Key phrases: regression
CVE-2011-2687: Drupal 7.x before 7.3 allows remote attackers to bypass intended node_access restrictions via vectors related to a listing that shows nodes but lacks a JOIN clause for the node table.
Key phrases: bypass intended node_access restrictions, bypass intended node_access restrictions via vectors related to
CVE-2011-2688: SQL injection vulnerability in mysql/mysql-auth.pl in the mod_authnz_external module 3.2.5 and earlier for the Apache HTTP Server allows remote attackers to execute arbitrary SQL commands via the user field.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the user field, sql injection, arbitrary sql commands