CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In May 2012

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
351 CVE-2011-4012 2012-05-02 2012-10-30
9.3
 None Remote Medium Not required Complete Complete Complete
Cisco IOS 12.0, 15.0, and 15.1, when a Policy Feature Card 3C (PFC3C) is used, does not create a fragment entry during processing of an ICMPv6 ACL, which has unspecified impact and remote attack vectors, aka Bug ID CSCtj90091.
352 CVE-2011-4007 20 DoS 2012-05-02 2012-10-30
5.4
 None Remote High Not required None None Complete
Cisco IOS 15.0 and 15.1 and IOS XE 3.x do not properly handle the "set mpls experimental imposition" command, which allows remote attackers to cause a denial of service (device crash) via network traffic that triggers (1) fragmentation or (2) reassembly, aka Bug ID CSCtr56576.
353 CVE-2011-4006 20 DoS 2012-05-02 2012-10-30
7.8
 None Remote Low Not required None None Complete
The ESMTP inspection feature on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 8.2 through 8.5 allows remote attackers to cause a denial of service (CPU consumption) via an unspecified closing sequence, aka Bug ID CSCtt32565.
354 CVE-2011-3637 476 DoS 2012-05-17 2020-07-27
4.9
 None Local Low Not required None None Complete
The m_stop function in fs/proc/task_mmu.c in the Linux kernel before 2.6.39 allows local users to cause a denial of service (OOPS) via vectors that trigger an m_start error.
355 CVE-2011-3620 287 2012-05-03 2012-08-14
7.5
 None Remote Low Not required Partial Partial Partial
Apache Qpid 0.12 does not properly verify credentials during the joining of a cluster, which allows remote attackers to obtain access to the messaging functionality and job functionality of a cluster by leveraging knowledge of a cluster-username.
356 CVE-2011-3363 20 DoS 2012-05-24 2020-07-27
6.1
 None Local Network Low Not required None None Complete
The setup_cifs_sb function in fs/cifs/connect.c in the Linux kernel before 2.6.39 does not properly handle DFS referrals, which allows remote CIFS servers to cause a denial of service (system crash) by placing a referral at the root of a share.
357 CVE-2011-3359 119 DoS Overflow 2012-05-24 2020-07-27
7.8
 None Remote Low Not required None None Complete
The dma_rx function in drivers/net/wireless/b43/dma.c in the Linux kernel before 2.6.39 does not properly allocate receive buffers, which allows remote attackers to cause a denial of service (system crash) via a crafted frame.
358 CVE-2011-3353 120 DoS Overflow 2012-05-24 2020-07-29
4.9
 None Local Low Not required None None Complete
Buffer overflow in the fuse_notify_inval_entry function in fs/fuse/dev.c in the Linux kernel before 3.1 allows local users to cause a denial of service (BUG_ON and system crash) by leveraging the ability to mount a FUSE filesystem.
359 CVE-2011-3317 79 XSS 2012-05-02 2012-06-09
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in the Solution Engine in Cisco Secure Access Control Server (ACS) 5.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCtr78192.
360 CVE-2011-3309 200 +Info 2012-05-02 2012-10-30
4.3
 None Remote Medium Not required Partial None None
Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 8.2 through 8.4 process IKE requests despite a vpnclient mode configuration, which allows remote attackers to obtain potentially sensitive information by reading IKE responder traffic, aka Bug ID CSCtt07749.
361 CVE-2011-3295 20 DoS 2012-05-02 2012-10-30
7.8
 None Remote Low Not required None None Complete
The NETIO and IPV4_IO processes in Cisco IOS XR 3.8 through 4.1, as used in Cisco Carrier Routing System and other products, allow remote attackers to cause a denial of service (CPU consumption) via crafted network traffic, aka Bug ID CSCti59888.
362 CVE-2011-3293 352 XSS CSRF 2012-05-02 2012-06-09
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple cross-site request forgery (CSRF) vulnerabilities in the Solution Engine in Cisco Secure Access Control Server (ACS) 5.2 allow remote attackers to hijack the authentication of administrators for requests that insert cross-site scripting (XSS) sequences, aka Bug ID CSCtr78143.
363 CVE-2011-3289 264 Bypass 2012-05-02 2012-10-30
3.6
 None Local Low Not required Partial Partial None
Cisco IOS 12.4 and 15.0 through 15.2 allows physically proximate attackers to bypass the No Service Password-Recovery feature and read the start-up configuration via unspecified vectors, aka Bug ID CSCtr97640.
364 CVE-2011-3285 94 Http R.Spl. 2012-05-02 2017-12-07
5.0
 None Remote Low Not required None Partial None
CRLF injection vulnerability in /+CSCOE+/logon.html on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 8.0 through 8.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors, aka Bug ID CSCth63101.
365 CVE-2011-3283 20 DoS 2012-05-02 2017-12-07
5.0
 None Remote Low Not required None None Partial
Cisco Carrier Routing System 3.9.1 allows remote attackers to cause a denial of service (Metro subsystem crash) via a fragmented GRE packet, aka Bug ID CSCts14887.
366 CVE-2011-3191 119 DoS Overflow Mem. Corr. 2012-05-24 2020-07-31
8.3
 None Local Network Low Not required Complete Complete Complete
Integer signedness error in the CIFSFindNext function in fs/cifs/cifssmb.c in the Linux kernel before 3.1 allows remote CIFS servers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a large length value in a response to a read request for a directory.
367 CVE-2011-3188 DoS 2012-05-24 2020-07-29
6.4
 None Remote Low Not required None Partial Partial
The (1) IPv4 and (2) IPv6 implementations in the Linux kernel before 3.1 use a modified MD4 algorithm to generate sequence numbers and Fragment Identification values, which makes it easier for remote attackers to cause a denial of service (disrupted networking) or hijack network sessions by predicting these values and sending crafted packets.
368 CVE-2011-3115 119 DoS Overflow 2012-05-24 2017-09-19
7.5
 None Remote Low Not required Partial Partial Partial
Google V8, as used in Google Chrome before 19.0.1084.52, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger "type corruption."
369 CVE-2011-3114 119 DoS Overflow 2012-05-24 2017-09-19
7.5
 None Remote Low Not required Partial Partial Partial
Multiple buffer overflows in the PDF functionality in Google Chrome before 19.0.1084.52 allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger unknown function calls.
370 CVE-2011-3113 DoS 2012-05-24 2017-09-19
7.5
 None Remote Low Not required Partial Partial Partial
The PDF functionality in Google Chrome before 19.0.1084.52 does not properly perform a cast of an unspecified variable during handling of color spaces, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted document.
371 CVE-2011-3112 399 DoS 2012-05-24 2017-09-19
5.0
 None Remote Low Not required None None Partial
Use-after-free vulnerability in the PDF functionality in Google Chrome before 19.0.1084.52 allows remote attackers to cause a denial of service or possibly have unspecified other impact via an invalid encrypted document.
372 CVE-2011-3111 119 DoS Overflow 2012-05-24 2017-09-19
5.0
 None Remote Low Not required None None Partial
Google V8, as used in Google Chrome before 19.0.1084.52, allows remote attackers to cause a denial of service (invalid read operation) via unspecified vectors.
373 CVE-2011-3110 119 DoS Overflow 2012-05-24 2017-09-19
7.5
 None Remote Low Not required Partial Partial Partial
The PDF functionality in Google Chrome before 19.0.1084.52 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger out-of-bounds write operations.
374 CVE-2011-3109 DoS 2012-05-24 2012-11-20
7.5
 None Remote Low Not required Partial Partial Partial
Google Chrome before 19.0.1084.52 on Linux does not properly perform a cast of an unspecified variable, which allows remote attackers to cause a denial of service or possibly have unknown other impact by leveraging an error in the GTK implementation of the UI.
375 CVE-2011-3108 399 Exec Code 2012-05-24 2017-09-19
10.0
 None Remote Low Not required Complete Complete Complete
Use-after-free vulnerability in Google Chrome before 19.0.1084.52 allows remote attackers to execute arbitrary code via vectors related to the browser cache.
376 CVE-2011-3107 DoS 2012-05-24 2017-09-19
7.5
 None Remote Low Not required Partial Partial Partial
Google Chrome before 19.0.1084.52 does not properly implement JavaScript bindings for plug-ins, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via unknown vectors.
377 CVE-2011-3106 119 DoS Exec Code Overflow Mem. Corr. 2012-05-24 2017-09-19
10.0
 None Remote Low Not required Complete Complete Complete
The WebSockets implementation in Google Chrome before 19.0.1084.52 does not properly handle use of SSL, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
378 CVE-2011-3105 399 DoS 2012-05-24 2017-09-19
7.5
 None Remote Low Not required Partial Partial Partial
Use-after-free vulnerability in the Cascading Style Sheets (CSS) implementation in Google Chrome before 19.0.1084.52 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the :first-letter pseudo-element.
379 CVE-2011-3104 119 DoS Overflow 2012-05-24 2017-09-19
5.0
 None Remote Low Not required None None Partial
Skia, as used in Google Chrome before 19.0.1084.52, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
380 CVE-2011-3103 399 DoS 2012-05-24 2017-09-19
7.5
 None Remote Low Not required Partial Partial Partial
Google V8, as used in Google Chrome before 19.0.1084.52, does not properly perform garbage collection, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted JavaScript code.
381 CVE-2011-3102 189 DoS 2012-05-16 2017-12-29
6.8
 None Remote Medium Not required Partial Partial Partial
Off-by-one error in libxml2, as used in Google Chrome before 19.0.1084.46 and other products, allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via unknown vectors.
382 CVE-2011-3101 2012-05-16 2017-12-29
10.0
 None Remote Low Not required Complete Complete Complete
Google Chrome before 19.0.1084.46 on Linux does not properly mitigate an unspecified flaw in an NVIDIA driver, which has unknown impact and attack vectors. NOTE: see CVE-2012-3105 for the related MFSA 2012-34 issue in Mozilla products.
383 CVE-2011-3100 DoS 2012-05-16 2017-12-29
5.0
 None Remote Low Not required None None Partial
Google Chrome before 19.0.1084.46 does not properly draw dash paths, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
384 CVE-2011-3099 399 DoS 2012-05-16 2017-12-05
10.0
 None Remote Low Not required Complete Complete Complete
Use-after-free vulnerability in the PDF functionality in Google Chrome before 19.0.1084.46 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving a malformed name for the font encoding.
385 CVE-2011-3098 264 +Priv 2012-05-16 2018-10-30
7.2
 None Local Low Not required Complete Complete Complete
Google Chrome before 19.0.1084.46 on Windows uses an incorrect search path for the Windows Media Player plug-in, which might allow local users to gain privileges via a Trojan horse plug-in in an unspecified directory.
386 CVE-2011-3097 20 DoS 2012-05-16 2017-12-05
10.0
 None Remote Low Not required Complete Complete Complete
The PDF functionality in Google Chrome before 19.0.1084.46 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging an out-of-bounds write error in the implementation of sampled functions.
387 CVE-2011-3096 399 DoS 2012-05-16 2017-12-29
7.5
 None Remote Low Not required Partial Partial Partial
Use-after-free vulnerability in Google Chrome before 19.0.1084.46 on Linux allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging an error in the GTK implementation of the omnibox.
388 CVE-2011-3095 20 DoS 2012-05-16 2017-12-29
10.0
 None Remote Low Not required Complete Complete Complete
The OGG container in Google Chrome before 19.0.1084.46 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger an out-of-bounds write.
389 CVE-2011-3094 20 DoS 2012-05-16 2017-12-29
5.0
 None Remote Low Not required None None Partial
Google Chrome before 19.0.1084.46 does not properly handle Tibetan text, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
390 CVE-2011-3093 20 DoS 2012-05-16 2017-12-29
5.0
 None Remote Low Not required None None Partial
Google Chrome before 19.0.1084.46 does not properly handle glyphs, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
391 CVE-2011-3092 20 DoS 2012-05-16 2017-12-29
10.0
 None Remote Low Not required Complete Complete Complete
The regex implementation in Google V8, as used in Google Chrome before 19.0.1084.46, allows remote attackers to cause a denial of service (invalid write operation) or possibly have unspecified other impact via unknown vectors.
392 CVE-2011-3091 399 DoS 2012-05-16 2017-12-29
10.0
 None Remote Low Not required Complete Complete Complete
Use-after-free vulnerability in the IndexedDB implementation in Google Chrome before 19.0.1084.46 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
393 CVE-2011-3090 362 DoS 2012-05-16 2017-12-29
7.6
 None Remote High Not required Complete Complete Complete
Race condition in Google Chrome before 19.0.1084.46 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to worker processes.
394 CVE-2011-3089 399 DoS 2012-05-16 2017-12-29
10.0
 None Remote Low Not required Complete Complete Complete
Use-after-free vulnerability in Google Chrome before 19.0.1084.46 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving tables.
395 CVE-2011-3088 119 DoS Overflow 2012-05-16 2017-12-29
5.0
 None Remote Low Not required None None Partial
Google Chrome before 19.0.1084.46 does not properly draw hairlines, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
396 CVE-2011-3087 2012-05-16 2017-12-29
10.0
 None Remote Low Not required Complete Complete Complete
Google Chrome before 19.0.1084.46 does not properly perform window navigation, which has unspecified impact and remote attack vectors.
397 CVE-2011-3086 399 DoS 2012-05-16 2017-12-29
10.0
 None Remote Low Not required Complete Complete Complete
Use-after-free vulnerability in Google Chrome before 19.0.1084.46 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving a STYLE element.
398 CVE-2011-3085 119 DoS Overflow 2012-05-16 2017-12-29
5.0
 None Remote Low Not required None None Partial
The Autofill feature in Google Chrome before 19.0.1084.46 does not properly restrict field values, which allows remote attackers to cause a denial of service (UI corruption) and possibly conduct spoofing attacks via vectors involving long values.
399 CVE-2011-3084 264 Bypass 2012-05-16 2017-12-29
7.5
 None Remote Low Not required Partial Partial Partial
Google Chrome before 19.0.1084.46 does not use a dedicated process for the loading of links found on an internal page, which might allow attackers to bypass intended sandbox restrictions via a crafted page.
400 CVE-2011-3083 119 DoS Overflow 2012-05-16 2017-12-29
5.0
 None Remote Low Not required None None Partial
browser/profiles/profile_impl_io_data.cc in Google Chrome before 19.0.1084.46 does not properly handle a malformed ftp URL in the SRC attribute of a VIDEO element, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted web page.
Total number of vulnerabilities : 426   Page : 1 2 3 4 5 6 7 8 (This Page)9
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.