[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1419.

[Assistant] Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1419?

[Assistant]
[announce] 20110302 [SECURITY] Tomcat 7 ignores @ServletSecurity annotations

[users] 20110302 Re: @DenyAll does nothing

[users] 20110302 Re: @DenyAll does nothing

[users] 20110309 [SECURITY] Tomcat 7 ignores @ServletSecurity annotations


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1419?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1420 mean in the context of cybersecurity?

[Assistant] CVE-2011-1420


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1420.

[Assistant] EMC Data Protection Advisor Collector 5.7 and 5.7.1 on Solaris SPARC platforms uses weak permissions for unspecified files, which allows local users to gain privileges via unknown vectors.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1420?

[Assistant] 20110325 ESA-2011-010: EMC Data Protection Advisor Collector arbitrary code execution with elevated privileges vulnerability


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1420?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1421 mean in the context of cybersecurity?

[Assistant] CVE-2011-1421


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1421.

[Assistant] EMC NetWorker 7.5.x before 7.5.4.3 and 7.6.x before 7.6.1.5, when the client push feature is enabled, uses weak permissions for an unspecified file, which allows local users to gain privileges via unknown vectors.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1421?

[Assistant] 20110418 ESA-2011-013: EMC NetWorker arbitrary code execution with elevated privileges vulnerability


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1421?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1422 mean in the context of cybersecurity?

[Assistant] CVE-2011-1422


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1422.

[Assistant] Cross-site scripting (XSS) vulnerability in an unspecified Shockwave Flash file in EMC RSA Adaptive Authentication On-Premise (AAOP) 2.x, 5.7.x, and 6.x allows remote attackers to inject arbitrary web script or HTML via unknown vectors.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1422?

[Assistant] 20110418 ESA-2011-014: RSA, The Security Division of EMC, announces the release of Adaptive Authentication (On-Premise) Flash File Security Patch


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1422?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1423 mean in the context of cybersecurity?

[Assistant] CVE-2011-1423


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1423.

[Assistant] Cross-site scripting (XSS) vulnerability in RSA Data Loss Prevention (DLP) Enterprise Manager 8.x before 8.5 SP1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1423?

[Assistant] 20110429 ESA-2011-015: RSA, The Security Division of EMC, announces a fix for a security vulnerability in RSA Data Loss Prevention


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1423?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1424 mean in the context of cybersecurity?

[Assistant] CVE-2011-1424


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1424.

[Assistant] The default configuration of ExShortcut\Web.config in EMC SourceOne Email Management before 6.6 SP1, when the Mobile Services component is used, does not properly set the localOnly attribute of the trace element, which allows remote authenticated users to obtain sensitive information via ASP.NET Application Tracing.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1424?

[Assistant] 20110513 ESA-2011-016: EMC SourceOne ASP.NET application tracing information disclosure vulnerability


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1424?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1425 mean in the context of cybersecurity?

[Assistant] CVE-2011-1425


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1425.

[Assistant] xslt.c in XML Security Library (aka xmlsec) before 1.2.17, as used in WebKit and other products, when XSLT is enabled, allows remote attackers to create or overwrite arbitrary files via vectors involving the libxslt output extension and a ds:Transform element during signature verification.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1425?

[Assistant] [xmlsec] 20110331 New xmlsec 1.2.17 release


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1425?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1426 mean in the context of cybersecurity?

[Assistant] CVE-2011-1426


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1426.

[Assistant] The OpenURLInDefaultBrowser method in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.2, and RealPlayer SP 1.0 through 1.1.5, launches a default handler for the filename specified in the first argument, which allows remote attackers to execute arbitrary code via a .rnx filename corresponding to a crafted RNX file.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1426?

[Assistant] 20110412 ZDI-11-122: RealNetworks RealPlayer OpenURLInDefaultBrowser Remote Code Execution Vulnerability


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1426?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1427 mean in the context of cybersecurity?

[Assistant] CVE-2011-1427


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1427.

[Assistant] Multiple cross-site scripting (XSS) vulnerabilities in Kodak InSite 5.5.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Language parameter to Pages/login.aspx, (2) HeaderWarning parameter to Troubleshooting/DiagnosticReport.asp, or (3) User-Agent header to troubleshooting/speedtest.asp.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1427?

[Assistant]
20110307 Kodak InSite Login Page Cross-Site Scripting

20110307 InSite Troubleshooting Cross-Site Scripting


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1427?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1428 mean in the context of cybersecurity?

[Assistant] CVE-2011-1428


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1428.

[Assistant] Wee Enhanced Environment for Chat (aka WeeChat) 0.3.4 and earlier does not properly verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof an SSL chat server via an arbitrary certificate, related to incorrect use of the GnuTLS API.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1428?

[Assistant] 20110227 weechat does not properly use gnutls and allow an attacker to bypass certificate verification


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1428?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1429 mean in the context of cybersecurity?

[Assistant] CVE-2011-1429


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1429.

[Assistant] Mutt does not verify that the smtps server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof an SSL SMTP server via an arbitrary certificate, a different vulnerability than CVE-2009-3766.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1429?

[Assistant] 20110308 Mutt: failure to check server certificate in SMTP TLS connection


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1429?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1430 mean in the context of cybersecurity?

[Assistant] CVE-2011-1430


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1430.

[Assistant] The STARTTLS implementation in the server in Ipswitch IMail 11.03 and earlier does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1430?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1430?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1431 mean in the context of cybersecurity?

[Assistant] CVE-2011-1431


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1431.

[Assistant] The STARTTLS implementation in qmail-smtpd.c in qmail-smtpd in the netqmail-1.06-tls patch for netqmail 1.06 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1431?

[Assistant] 20110307 Plaintext injection in STARTTLS (multiple implementations)


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1431?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1432 mean in the context of cybersecurity?

[Assistant] CVE-2011-1432


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1432.

[Assistant] The STARTTLS implementation in SCO SCOoffice Server does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1432?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1432?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1433 mean in the context of cybersecurity?

[Assistant] CVE-2011-1433


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1433.

[Assistant] The (1) AgentInterface and (2) CustomerInterface components in Open Ticket Request System (OTRS) before 3.0.6 place cleartext credentials into the session data in the database, which makes it easier for context-dependent attackers to obtain sensitive information by reading the _UserLogin and _UserPW fields.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1433?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1433?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1434 mean in the context of cybersecurity?

[Assistant] CVE-2011-1434


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1434.

[Assistant] Google Chrome before 11.0.696.57 does not ensure thread safety during handling of MIME data, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1434?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1434?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1435 mean in the context of cybersecurity?

[Assistant] CVE-2011-1435


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1435.

[Assistant] Google Chrome before 11.0.696.57 does not properly implement the tabs permission for extensions, which allows remote attackers to read local files via a crafted extension.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1435?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1435?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1436 mean in the context of cybersecurity?

[Assistant] CVE-2011-1436


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1436.

[Assistant] Google Chrome before 11.0.696.57 on Linux does not properly interact with the X Window System, which allows remote attackers to cause a denial of service (application crash) via unspecified vectors.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1436?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1436?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1437 mean in the context of cybersecurity?

[Assistant] CVE-2011-1437


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1437.

[Assistant] Multiple integer overflows in Google Chrome before 11.0.696.57 allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to float rendering.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1437?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1437?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1438 mean in the context of cybersecurity?

[Assistant] CVE-2011-1438


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1438.

[Assistant] Google Chrome before 11.0.696.57 allows remote attackers to bypass the Same Origin Policy via vectors involving blobs.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1438?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1438?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1439 mean in the context of cybersecurity?

[Assistant] CVE-2011-1439


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1439.

[Assistant] Google Chrome before 11.0.696.57 on Linux does not properly isolate renderer processes, which has unspecified impact and remote attack vectors.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1439?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1439?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1440 mean in the context of cybersecurity?

[Assistant] CVE-2011-1440


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1440.

[Assistant] Use-after-free vulnerability in Google Chrome before 11.0.696.57 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the ruby element and Cascading Style Sheets (CSS) token sequences.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1440?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1440?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1441 mean in the context of cybersecurity?

[Assistant] CVE-2011-1441


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1441.

[Assistant] Google Chrome before 11.0.696.57 does not properly perform a cast of an unspecified variable during handling of floating select lists, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted HTML document.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1441?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1441?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1442 mean in the context of cybersecurity?

[Assistant] CVE-2011-1442


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1442.

[Assistant] Google Chrome before 11.0.696.57 does not properly handle mutation events, which allows remote attackers to cause a denial of service (node tree corruption) or possibly have unspecified other impact via unknown vectors.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1442?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1442?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1443 mean in the context of cybersecurity?

[Assistant] CVE-2011-1443


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1443.

[Assistant] Google Chrome before 11.0.696.57 does not properly implement layering, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to "stale pointers."


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1443?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1443?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1444 mean in the context of cybersecurity?

[Assistant] CVE-2011-1444


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1444.

[Assistant] Race condition in the sandbox launcher implementation in Google Chrome before 11.0.696.57 on Linux allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1444?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1444?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1445 mean in the context of cybersecurity?

[Assistant] CVE-2011-1445


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1445.

[Assistant] Google Chrome before 11.0.696.57 does not properly handle SVG documents, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1445?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1445?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1446 mean in the context of cybersecurity?

[Assistant] CVE-2011-1446


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1446.

[Assistant] Google Chrome before 11.0.696.57 allows remote attackers to spoof the URL bar via vectors involving (1) a navigation error or (2) an interrupted load.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1446?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1446?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1447 mean in the context of cybersecurity?

[Assistant] CVE-2011-1447


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1447.

[Assistant] Google Chrome before 11.0.696.57 does not properly handle drop-down lists, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1447?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1447?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1448 mean in the context of cybersecurity?

[Assistant] CVE-2011-1448


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1448.

[Assistant] Google Chrome before 11.0.696.57 does not properly perform height calculations, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1448?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1448?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1449 mean in the context of cybersecurity?

[Assistant] CVE-2011-1449


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1449.

[Assistant] Use-after-free vulnerability in the WebSockets implementation in Google Chrome before 11.0.696.57 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1449?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1449?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1450 mean in the context of cybersecurity?

[Assistant] CVE-2011-1450


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1450.

[Assistant] Google Chrome before 11.0.696.57 does not properly present file dialogs, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to "dangling pointers."


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1450?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1450?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1451 mean in the context of cybersecurity?

[Assistant] CVE-2011-1451


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1451.

[Assistant] Google Chrome before 11.0.696.57 does not properly handle DOM id maps, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to "dangling pointers."


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1451?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1451?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1452 mean in the context of cybersecurity?

[Assistant] CVE-2011-1452


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1452.

[Assistant] Google Chrome before 11.0.696.57 allows user-assisted remote attackers to spoof the URL bar via vectors involving a redirect and a manual reload.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1452?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1452?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1453 mean in the context of cybersecurity?

[Assistant] CVE-2011-1453


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1453.

[Assistant] WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2011-07-20-1.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1453?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1453?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1454 mean in the context of cybersecurity?

[Assistant] CVE-2011-1454


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1454.

[Assistant] Use-after-free vulnerability in the DOM id handling functionality in Google Chrome before 11.0.696.57 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted HTML document.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1454?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1454?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1455 mean in the context of cybersecurity?

[Assistant] CVE-2011-1455


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1455.

[Assistant] Google Chrome before 11.0.696.57 does not properly handle PDF documents with multipart encoding, which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted document.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1455?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1455?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1456 mean in the context of cybersecurity?

[Assistant] CVE-2011-1456


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1456.

[Assistant] Google Chrome before 11.0.696.57 does not properly handle PDF forms, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to "stale pointers."


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1456?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1456?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1457 mean in the context of cybersecurity?

[Assistant] CVE-2011-1457


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1457.

[Assistant] WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2011-07-20-1.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1457?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1457?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1459 mean in the context of cybersecurity?

[Assistant] CVE-2011-1459


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1459.

[Assistant] The WebKit::WebPluginContainerImpl::handleEvent function in Google Chrome before Blink M11 allows an attacker to cause a denial of service (crash) via the htmlpluginelement.cpp plugin.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1459?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1459?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1460 mean in the context of cybersecurity?

[Assistant] CVE-2011-1460


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1460.

[Assistant] WebKit in Google Chrome before Blink M11 contains a bad cast to RenderBlock when anonymous blocks are renderblocks.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1460?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1460?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1462 mean in the context of cybersecurity?

[Assistant] CVE-2011-1462


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1462.

[Assistant] WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2011-07-20-1.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1462?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1462?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1464 mean in the context of cybersecurity?

[Assistant] CVE-2011-1464


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1464.

[Assistant] Buffer overflow in the strval function in PHP before 5.3.6, when the precision configuration option has a large value, might allow context-dependent attackers to cause a denial of service (application crash) via a small numerical value in the argument.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1464?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1464?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1465 mean in the context of cybersecurity?

[Assistant] CVE-2011-1465


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1465.

[Assistant] The SPDY implementation in net/http/http_network_transaction.cc in Google Chrome before 11.0.696.14 drains the bodies from SPDY responses, which might allow remote SPDY servers to cause a denial of service (application exit) by canceling a stream.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1465?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1465?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1466 mean in the context of cybersecurity?

[Assistant] CVE-2011-1466


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1466.

[Assistant] Integer overflow in the SdnToJulian function in the Calendar extension in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (application crash) via a large integer in the first argument to the cal_from_jd function.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1466?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1466?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1467 mean in the context of cybersecurity?

[Assistant] CVE-2011-1467


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1467.

[Assistant] Unspecified vulnerability in the NumberFormatter::setSymbol (aka numfmt_set_symbol) function in the Intl extension in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (application crash) via an invalid argument, a related issue to CVE-2010-4409.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1467?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1467?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1468 mean in the context of cybersecurity?

[Assistant] CVE-2011-1468


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1468.

[Assistant] Multiple memory leaks in the OpenSSL extension in PHP before 5.3.6 might allow remote attackers to cause a denial of service (memory consumption) via (1) plaintext data to the openssl_encrypt function or (2) ciphertext data to the openssl_decrypt function.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1468?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1468?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1469 mean in the context of cybersecurity?

[Assistant] CVE-2011-1469


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1469.

[Assistant] Unspecified vulnerability in the Streams component in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (application crash) by accessing an ftp:// URL during use of an HTTP proxy with the FTP wrapper.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1469?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1469?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1470 mean in the context of cybersecurity?

[Assistant] CVE-2011-1470


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1470.

[Assistant] The Zip extension in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (application crash) via a ziparchive stream that is not properly handled by the stream_get_contents function.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1470?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1470?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1471 mean in the context of cybersecurity?

[Assistant] CVE-2011-1471


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1471.

[Assistant] Integer signedness error in zip_stream.c in the Zip extension in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (CPU consumption) via a malformed archive file that triggers errors in zip_fread function calls.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1471?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1471?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1472 mean in the context of cybersecurity?

[Assistant] CVE-2011-1472


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1472.

[Assistant] The Nokia E75 phone with firmware before 211.12.01 allows physically proximate attackers to bypass the Device Lock code by entering an unspecified button sequence at boot time.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1472?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1472?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1473 mean in the context of cybersecurity?

[Assistant] CVE-2011-1473


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1473.

[Assistant] OpenSSL before 0.9.8l, and 0.9.8m through 1.x, does not properly restrict client-initiated renegotiation within the SSL and TLS protocols, which might make it easier for remote attackers to cause a denial of service (CPU consumption) by performing many renegotiations within a single connection, a different vulnerability than CVE-2011-5094.  NOTE: it can also be argued that it is the responsibility of server deployments, not a security library, to prevent or limit renegotiation when it is inappropriate within a specific environment


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1473?

[Assistant]
[tls] 20110315 Re: SSL Renegotiation DOS

[tls] 20110318 Re: SSL Renegotiation DOS

20140214 ESA-2014-009: RSA BSAFE SSL-J Multiple Vulnerabilities

[oss-security] 20110708 SSL renegotiation DoS CVE-2011-1473

[tls] 20110318 Re: SSL Renegotiation DOS

[tls] 20110315 Re: SSL Renegotiation DOS

[rocketmq-dev] 20190527 [GitHub] [rocketmq] bix29 opened a new issue #1233: TLS Client-initiated renegotiation attack (CVE-2011-1473)

[rocketmq-dev] 20190801 [GitHub] [rocketmq] duhenglucky commented on issue #1233: TLS Client-initiated renegotiation attack (CVE-2011-1473)

[rocketmq-dev] 20191024 [GitHub] [rocketmq] Journey-x commented on issue #1233: TLS Client-initiated renegotiation attack (CVE-2011-1473)

[rocketmq-dev] 20200305 [GitHub] [rocketmq] ShadowySpirits commented on issue #1233: TLS Client-initiated renegotiation attack (CVE-2011-1473)

[rocketmq-dev] 20200305 [GitHub] [rocketmq] coveralls commented on issue #1820: [ISSUE #1233] Fix CVE-2011-1473

[rocketmq-dev] 20200305 [GitHub] [rocketmq] ShadowySpirits opened a new pull request #1820: [ISSUE #1233] Fix CVE-2011-1473

[rocketmq-dev] 20210311 [GitHub] [rocketmq] vongosling closed issue #1233: TLS Client-initiated renegotiation attack (CVE-2011-1473)

[rocketmq-commits] 20210311 [rocketmq] branch develop updated: [ISSUE #1233] Fix CVE-2011-1473

[rocketmq-dev] 20210311 [GitHub] [rocketmq] vongosling merged pull request #1820: [ISSUE #1233] Fix CVE-2011-1473

[rocketmq-dev] 20210311 [GitHub] [rocketmq] mouzz commented on pull request #1820: [ISSUE #1233] Fix CVE-2011-1473

[rocketmq-dev] 20210327 [GitHub] [rocketmq] liufeiguo commented on pull request #1820: [ISSUE #1233] Fix CVE-2011-1473

[rocketmq-dev] 20210420 [GitHub] [rocketmq] mouzz commented on pull request #1820: [ISSUE #1233] Fix CVE-2011-1473

[rocketmq-dev] 20210420 [GitHub] [rocketmq] mouzz removed a comment on pull request #1820: [ISSUE #1233] Fix CVE-2011-1473


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1473?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1474 mean in the context of cybersecurity?

[Assistant] CVE-2011-1474


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1474.

[Assistant] A locally locally exploitable DOS vulnerability was found in pax-linux versions 2.6.32.33-test79.patch, 2.6.38-test3.patch, and 2.6.37.4-test14.patch. A bad bounds check in arch_get_unmapped_area_topdown triggered by programs doing an mmap after a MAP_GROWSDOWN mmap will create an infinite loop condition without releasing the VM semaphore eventually leading to a system crash.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1474?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1474?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1475 mean in the context of cybersecurity?

[Assistant] CVE-2011-1475


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1475.

[Assistant] The HTTP BIO connector in Apache Tomcat 7.0.x before 7.0.12 does not properly handle HTTP pipelining, which allows remote attackers to read responses intended for other clients in opportunistic circumstances by examining the application data in HTTP packets, related to "a mix-up of responses for requests from different users."


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1475?

[Assistant]
20110406 [SECURITY] CVE-2011-1475 Apache Tomcat information disclosure

20110406 [SECURITY] CVE-2011-1475 Apache Tomcat information disclosure


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1475?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1476 mean in the context of cybersecurity?

[Assistant] CVE-2011-1476


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1476.

[Assistant] Integer underflow in the Open Sound System (OSS) subsystem in the Linux kernel before 2.6.39 on unspecified non-x86 platforms allows local users to cause a denial of service (memory corruption) by leveraging write access to /dev/sequencer.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1476?

[Assistant] [oss-security] 20110325 Re: CVE request: kernel: two OSS fixes


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1476?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1477 mean in the context of cybersecurity?

[Assistant] CVE-2011-1477


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1477.

[Assistant] Multiple array index errors in sound/oss/opl3.c in the Linux kernel before 2.6.39 allow local users to cause a denial of service (heap memory corruption) or possibly gain privileges by leveraging write access to /dev/sequencer.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1477?

[Assistant] [oss-security] 20110325 Re: CVE request: kernel: two OSS fixes


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1477?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1478 mean in the context of cybersecurity?

[Assistant] CVE-2011-1478


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1478.

[Assistant] The napi_reuse_skb function in net/core/dev.c in the Generic Receive Offload (GRO) implementation in the Linux kernel before 2.6.38 does not reset the values of certain structure members, which might allow remote attackers to cause a denial of service (NULL pointer dereference) via a malformed VLAN frame.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1478?

[Assistant]
20111013 VMSA-2011-0012 VMware ESXi and ESX updates to third party libraries and ESX Service Console

[oss-security] 20110328 CVE-2011-1478 kernel: gro: reset dev and skb_iff on skb reuse


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1478?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1479 mean in the context of cybersecurity?

[Assistant] CVE-2011-1479


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1479.

[Assistant] Double free vulnerability in the inotify subsystem in the Linux kernel before 2.6.39 allows local users to cause a denial of service (system crash) via vectors involving failed attempts to create files.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2010-4250.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1479?

[Assistant] [oss-security] 20110411 Re: CVE request: kernel: inotify memory leak


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1479?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1480 mean in the context of cybersecurity?

[Assistant] CVE-2011-1480


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1480.

[Assistant] SQL injection vulnerability in admin.php in the administration backend in Francisco Burzi PHP-Nuke 8.0 and earlier allows remote attackers to execute arbitrary SQL commands via the chng_uid parameter.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1480?

[Assistant]
[oss-security] 20110323 CVE Request: PHP-Nuke 8.x <= "chng_uid" Blind SQL Injection Vulnerability

[oss-security] 20110330 Re: CVE Request: PHP-Nuke 8.x <= "chng_uid" Blind SQL Injection Vulnerability


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1480?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1481 mean in the context of cybersecurity?

[Assistant] CVE-2011-1481


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1481.

[Assistant] Multiple cross-site scripting (XSS) vulnerabilities in Francisco Burzi PHP-Nuke 8.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) sender_name or (2) sender_email parameter in a Feedback action to modules.php.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1481?

[Assistant]
[oss-security] 20110323 CVE Request: PHP-Nuke 8.x <= Cross Site Scripting Vulnerability

[oss-security] 20110330 Re: CVE Request: PHP-Nuke 8.x <= Cross Site Scripting Vulnerability


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1481?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1482 mean in the context of cybersecurity?

[Assistant] CVE-2011-1482


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1482.

[Assistant] Multiple cross-site request forgery (CSRF) vulnerabilities in mainfile.php in Francisco Burzi PHP-Nuke 8.0 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add user accounts or (2) grant the administrative privilege to a user account, related to a Referer check that uses a substring comparison.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1482?

[Assistant]
[oss-security] 20110330 Re: CVE Request: PHP-Nuke 8.x <= Cross Site Request Forgery (CSRF) / Anti-CSRF Bypass Vulnerability

[oss-security] 20110323 CVE Request: PHP-Nuke 8.x <= Cross Site Request Forgery (CSRF) / Anti-CSRF Bypass Vulnerability


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1482?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1483 mean in the context of cybersecurity?

[Assistant] CVE-2011-1483


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1483.

[Assistant] wsf/common/DOMUtils.java in JBossWS Native in Red Hat JBoss Enterprise Application Platform 4.2.0.CP09, 4.3, and 5.1.1; JBoss Enterprise Portal Platform 4.3.CP06 and 5.1.1; JBoss Enterprise SOA Platform 4.2.CP05, 4.3.CP05, and 5.1.0; JBoss Communications Platform 1.2.11 and 5.1.1; JBoss Enterprise BRMS Platform 5.1.0; and JBoss Enterprise Web Platform 5.1.1 does not properly handle recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted request containing an XML document with a DOCTYPE declaration and a large number of nested entity references, a similar issue to CVE-2003-1564.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1483?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1483?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1484 mean in the context of cybersecurity?

[Assistant] CVE-2011-1484


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1484.

[Assistant] jboss-seam.jar in the JBoss Seam 2 framework 2.2.x and earlier, as distributed in Red Hat JBoss Enterprise SOA Platform 4.3.0.CP04 and 5.1.0 and JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3.0.CP09 and 5.1.0, does not properly restrict use of Expression Language (EL) statements in FacesMessages during page exception handling, which allows remote attackers to execute arbitrary Java code via a crafted URL to an application.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1484?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1484?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1485 mean in the context of cybersecurity?

[Assistant] CVE-2011-1485


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1485.

[Assistant] Race condition in the pkexec utility and polkitd daemon in PolicyKit (aka polkit) 0.96 allows local users to gain privileges by executing a setuid program from pkexec, related to the use of the effective user ID instead of the real user ID.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1485?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1485?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1486 mean in the context of cybersecurity?

[Assistant] CVE-2011-1486


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1486.

[Assistant] libvirtd in libvirt before 0.9.0 does not use thread-safe error reporting, which allows remote attackers to cause a denial of service (crash) by causing multiple threads to report errors at the same time.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1486?

[Assistant] [libvirt] 20110323 [PATCH] Make error reporting in libvirtd thread safe


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1486?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1487 mean in the context of cybersecurity?

[Assistant] CVE-2011-1487


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1487.

[Assistant] The (1) lc, (2) lcfirst, (3) uc, and (4) ucfirst functions in Perl 5.10.x, 5.11.x, and 5.12.x through 5.12.3, and 5.13.x through 5.13.11, do not apply the taint attribute to the return value upon processing tainted input, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1487?

[Assistant]
[oss-security] 20110404 Re: CVE Request -- perl -- lc(), uc() routines are laundering tainted data

[oss-security] 20110401 CVE Request -- perl -- lc(), uc() routines are laundering tainted data


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1487?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1488 mean in the context of cybersecurity?

[Assistant] CVE-2011-1488


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1488.

[Assistant] A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages are logged when $RepeatedMsgReduction was enabled. A local attacker could use this flaw to cause a denial of the rsyslogd daemon service by crashing the service via a sequence of repeated log messages sent within short periods of time.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1488?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1488?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1489 mean in the context of cybersecurity?

[Assistant] CVE-2011-1489


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1489.

[Assistant] A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages were logged when multiple rulesets were used and some output batches contained messages belonging to more than one ruleset. A local attacker could cause denial of the rsyslogd daemon service via a log message belonging to more than one ruleset.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1489?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1489?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1490 mean in the context of cybersecurity?

[Assistant] CVE-2011-1490


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1490.

[Assistant] A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages are logged when multiple rulesets were used and some output batches contained messages belonging to more than one ruleset. A local attacker could cause denial of the rsyslogd daemon service via a log message belonging to more than one ruleset


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1490?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1490?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1491 mean in the context of cybersecurity?

[Assistant] CVE-2011-1491


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1491.

[Assistant] The login form in Roundcube Webmail before 0.5.1 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account and then compose an e-mail message, related to a "login CSRF" issue.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1491?

[Assistant]
[oss-security] 20110324 CVE request: roundcube < 0.5.1 CSRF

[oss-security] 20110324 Re: CVE request: roundcube < 0.5.1 CSRF

[oss-security] 20110404 Re: CVE request: roundcube < 0.5.1 CSRF


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1491?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1492 mean in the context of cybersecurity?

[Assistant] CVE-2011-1492


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1492.

[Assistant] steps/utils/modcss.inc in Roundcube Webmail before 0.5.1 does not properly verify that a request is an expected request for an external Cascading Style Sheets (CSS) stylesheet, which allows remote authenticated users to trigger arbitrary outbound TCP connections from the server, and possibly obtain sensitive information, via a crafted request.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1492?

[Assistant]
[oss-security] 20110324 CVE request: roundcube < 0.5.1 CSRF

[oss-security] 20110324 Re: CVE request: roundcube < 0.5.1 CSRF

[oss-security] 20110404 Re: CVE request: roundcube < 0.5.1 CSRF


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1492?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1493 mean in the context of cybersecurity?

[Assistant] CVE-2011-1493


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1493.

[Assistant] Array index error in the rose_parse_national function in net/rose/rose_subr.c in the Linux kernel before 2.6.39 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by composing FAC_NATIONAL_DIGIS data that specifies a large number of digipeaters, and then sending this data to a ROSE socket.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1493?

[Assistant] [oss-security] 20110405 Re: CVE request: kernel: multiple issues in ROSE


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1493?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1494 mean in the context of cybersecurity?

[Assistant] CVE-2011-1494


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1494.

[Assistant] Integer overflow in the _ctl_do_mpt_command function in drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel 2.6.38 and earlier might allow local users to gain privileges or cause a denial of service (memory corruption) via an ioctl call specifying a crafted value that triggers a heap-based buffer overflow.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1494?

[Assistant]
[linux-kernel] 20110405 [PATCH] drivers/scsi/mpt2sas: prevent heap overflows and unchecked reads

[oss-security] 20110405 CVE request: kernel: two issues in mpt2sas

20111013 VMSA-2011-0012 VMware ESXi and ESX updates to third party libraries and ESX Service Console

[oss-security] 20110406 Re: CVE request: kernel: two issues in mpt2sas


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1494?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1495 mean in the context of cybersecurity?

[Assistant] CVE-2011-1495


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1495.

[Assistant] drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel 2.6.38 and earlier does not validate (1) length and (2) offset values before performing memory copy operations, which might allow local users to gain privileges, cause a denial of service (memory corruption), or obtain sensitive information from kernel memory via a crafted ioctl call, related to the _ctl_do_mpt_command and _ctl_diag_read_buffer functions.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1495?

[Assistant]
[linux-kernel] 20110405 [PATCH] drivers/scsi/mpt2sas: prevent heap overflows and unchecked reads

[oss-security] 20110405 CVE request: kernel: two issues in mpt2sas

20111013 VMSA-2011-0012 VMware ESXi and ESX updates to third party libraries and ESX Service Console

[oss-security] 20110406 Re: CVE request: kernel: two issues in mpt2sas


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1495?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1496 mean in the context of cybersecurity?

[Assistant] CVE-2011-1496


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1496.

[Assistant] tmux 1.3 and 1.4 does not properly drop group privileges, which allows local users to gain utmp group privileges via a filename to the -S command-line option.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1496?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1496?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1497 mean in the context of cybersecurity?

[Assistant] CVE-2011-1497


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1497.

[Assistant] A cross-site scripting vulnerability flaw was found in the auto_link function in Rails before version 3.0.6.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1497?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1497?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1498 mean in the context of cybersecurity?

[Assistant] CVE-2011-1498


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1498.

[Assistant] Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization header to the origin server, which allows remote web servers to obtain sensitive information by logging this header.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1498?

[Assistant]
[httpclient-users] 20110224 Proxy-Authorization header received on server side

[oss-security] 20110408 Re: Apache HttpClient CVE request  [VU#153049]

[httpclient-users] 20110224 Re: Proxy-Authorization header received on server side

[httpclient-users] 20110224 RE: Proxy-Authorization header received on server side

[oss-security] 20110407 Apache HttpClient CVE request  [VU#153049]

[httpclient-users] 20110224 Re: Proxy-Authorization header received on server side

[httpclient-users] 20110224 RE: Proxy-Authorization header received on server side


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1498?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1499 mean in the context of cybersecurity?

[Assistant] CVE-2011-1499


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1499.

[Assistant] acl.c in Tinyproxy before 1.8.3, when an Allow configuration setting specifies a CIDR block, permits TCP connections from all IP addresses, which makes it easier for remote attackers to hide the origin of web traffic by leveraging the open HTTP proxy server.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1499?

[Assistant]
[oss-security] 20110408 Re: CVE request: tinyproxy runs as an open proxy when attempting to restrict allowable IP ranges

[oss-security] 20110407 CVE request: tinyproxy runs as an open proxy when attempting to restrict allowable IP ranges


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1499?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1500 mean in the context of cybersecurity?

[Assistant] CVE-2011-1500


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1500.

[Assistant] PreferencesPithosDialog.py in Pithos 0.3.7 does not properly restrict permissions for the .config/pithos.ini file in a user's home directory, which allows local users to obtain Pandora credentials by reading this file.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1500?

[Assistant]
[oss-security] 20110408 Re: CVE request for pithos information disclosure

[oss-security] 20110408 CVE request for pithos information disclosure


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1500?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1501 mean in the context of cybersecurity?

[Assistant] CVE-2011-1501


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1501.

[Assistant] N\A


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1501?

[Assistant] N\A


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1501?

[Assistant] REJECTED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1502 mean in the context of cybersecurity?

[Assistant] CVE-2011-1502


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1502.

[Assistant] Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote authenticated users to read arbitrary files via an entity declaration in conjunction with an entity reference, related to an XML External Entity (aka XXE) issue.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1502?

[Assistant]
[oss-security] 20110408 Re: CVE requests : Liferay 6.0.6

[oss-security] 20110411 Re: CVE requests : Liferay 6.0.6

[oss-security] 20110329 CVE requests : Liferay 6.0.6


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1502?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1503 mean in the context of cybersecurity?

[Assistant] CVE-2011-1503


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1503.

[Assistant] The XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat or Oracle GlassFish is used, allows remote authenticated users to read arbitrary (1) XSL and (2) XML files via a file:/// URL.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1503?

[Assistant]
[oss-security] 20110408 Re: CVE requests : Liferay 6.0.6

[oss-security] 20110411 Re: CVE requests : Liferay 6.0.6

[oss-security] 20110329 CVE requests : Liferay 6.0.6


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1503?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1504 mean in the context of cybersecurity?

[Assistant] CVE-2011-1504


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1504.

[Assistant] Cross-site scripting (XSS) vulnerability in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA allows remote authenticated users to inject arbitrary web script or HTML via a blog title.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1504?

[Assistant]
[oss-security] 20110408 Re: CVE requests : Liferay 6.0.6

[oss-security] 20110411 Re: CVE requests : Liferay 6.0.6

[oss-security] 20110329 CVE requests : Liferay 6.0.6


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1504?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1505 mean in the context of cybersecurity?

[Assistant] CVE-2011-1505


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1505.

[Assistant] Unspecified vulnerability in IBM Lotus Quickr 8.1 before 8.1.0.27 services for Lotus Domino has unknown impact and attack vectors, aka SPR ESEO8DQME2.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1505?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1505?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1506 mean in the context of cybersecurity?

[Assistant] CVE-2011-1506


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1506.

[Assistant] The STARTTLS implementation in Kerio Connect 7.1.4 build 2985 and MailServer 6.x does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.  NOTE: some of these details are obtained from third party information.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1506?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1506?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1507 mean in the context of cybersecurity?

[Assistant] CVE-2011-1507


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1507.

[Assistant] Asterisk Open Source 1.4.x before 1.4.40.1, 1.6.1.x before 1.6.1.25, 1.6.2.x before 1.6.2.17.3, and 1.8.x before 1.8.3.3 and Asterisk Business Edition C.x.x before C.3.6.4 do not restrict the number of unauthenticated sessions to certain interfaces, which allows remote attackers to cause a denial of service (file descriptor exhaustion and disk space exhaustion) via a series of TCP connections.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1507?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1507?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1508 mean in the context of cybersecurity?

[Assistant] CVE-2011-1508


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1508.

[Assistant] Microsoft Publisher 2003 SP3, and 2007 SP2 and SP3, does not properly manage memory allocations for function pointers, which allows user-assisted remote attackers to execute arbitrary code via a crafted Publisher file, aka "Publisher Function Pointer Overwrite Vulnerability."


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1508?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1508?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1509 mean in the context of cybersecurity?

[Assistant] CVE-2011-1509


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1509.

[Assistant] The encryptPassword function in Login.js in ManageEngine ServiceDesk Plus (SDP) 8012 and earlier uses a Caesar cipher for encryption of passwords in cookies, which makes it easier for remote attackers to obtain sensitive information by sniffing the network.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1509?

[Assistant] 20110914 CORE-2011-0506 - Multiples Vulnerabilities in ManageEngine ServiceDesk Plus


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1509?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1510 mean in the context of cybersecurity?

[Assistant] CVE-2011-1510


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1510.

[Assistant] Cross-site scripting (XSS) vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus (SDP) before 8012 allows remote attackers to inject arbitrary web script or HTML via the searchText parameter.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1510?

[Assistant] 20110914 CORE-2011-0506 - Multiples Vulnerabilities in ManageEngine ServiceDesk Plus


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1510?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1511 mean in the context of cybersecurity?

[Assistant] CVE-2011-1511


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1511.

[Assistant] Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Sun Products Suite 2.1.1 and 3.0.1 allows remote attackers to execute arbitrary code via unknown vectors related to Administration.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1511?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1511?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1512 mean in the context of cybersecurity?

[Assistant] CVE-2011-1512


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1512.

[Assistant] Heap-based buffer overflow in xlssr.dll in Autonomy KeyView, as used in IBM Lotus Notes before 8.5.2 FP3, allows remote attackers to execute arbitrary code via a malformed BIFF record in a .xls Excel spreadsheet attachment, aka SPR PRAD8E3HKR.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1512?

[Assistant] 20110524 CORE-2010-0908: Lotus Notes XLS viewer malformed BIFF record heap overflow


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1512?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1513 mean in the context of cybersecurity?

[Assistant] CVE-2011-1513


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1513.

[Assistant] Static code injection vulnerability in install_.php in e107 CMS 0.7.24 and probably earlier versions, when the installation script is not removed, allows remote attackers to inject arbitrary PHP code into e107_config.php via a crafted MySQL server name.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1513?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1513?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1514 mean in the context of cybersecurity?

[Assistant] CVE-2011-1514


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1514.

[Assistant] The inet service in HP OpenView Storage Data Protector 6.00 through 6.20 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a request containing crafted parameters.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1514?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1514?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1515 mean in the context of cybersecurity?

[Assistant] CVE-2011-1515


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1515.

[Assistant] The inet service in HP OpenView Storage Data Protector 6.00 through 6.20 allows remote attackers to cause a denial of service (daemon exit) via a request containing crafted parameters.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1515?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1515?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1516 mean in the context of cybersecurity?

[Assistant] CVE-2011-1516


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1516.

[Assistant] The kSBXProfileNoNetwork and kSBXProfileNoInternet sandbox profiles in Apple Mac OS X 10.5.x through 10.7.x do not propagate restrictions to all created processes, which allows remote attackers to access network resources via a crafted application, as demonstrated by use of osascript to send Apple events to the launchd daemon, a related issue to CVE-2008-7303.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1516?

[Assistant] 20111110 CORE-2011-0919: Apple OS X Sandbox Predefined Profiles Bypass


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1516?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1517 mean in the context of cybersecurity?

[Assistant] CVE-2011-1517


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1517.

[Assistant] SAP NetWeaver 7.0 allows Remote Code Execution and Denial of Service caused by an error in the DiagTraceHex() function. By sending a specially-crafted packet, an attacker could exploit this vulnerability to cause the application to crash.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1517?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1517?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1518 mean in the context of cybersecurity?

[Assistant] CVE-2011-1518


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1518.

[Assistant] Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) 2.4.x before 2.4.10 and 3.x before 3.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1518?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1518?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1519 mean in the context of cybersecurity?

[Assistant] CVE-2011-1519


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1519.

[Assistant] The remote console in the Server Controller in IBM Lotus Domino 7.x and 8.x verifies credentials against a file located at a UNC share pathname specified by the client, which allows remote attackers to bypass authentication, and consequently execute arbitrary code, by placing this pathname in the COOKIEFILE field.  NOTE: this might overlap CVE-2011-0920.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1519?

[Assistant] 20110322 ZDI-11-110: (0day) IBM Lotus Domino Server Controller Authentication Bypass Remote Code Execution Vulnerability


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1519?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1520 mean in the context of cybersecurity?

[Assistant] CVE-2011-1520


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1520.

[Assistant] The default configuration of the server console in IBM Lotus Domino does not require a password (aka Server_Console_Password), which allows physically proximate attackers to perform administrative changes or obtain sensitive information via a (1) Load, (2) Tell, or (3) Set Configuration command.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2011-1520?

[Assistant] 20110322 ZDI-11-110: (0day) IBM Lotus Domino Server Controller Authentication Bypass Remote Code Execution Vulnerability


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2011-1520?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2011-1521 mean in the context of cybersecurity?

[Assistant] CVE-2011-1521