# CVEs published 2011-01-18

19 CVEs were published on January 18, 2011: 0 critical, 0 high. Days are UTC.

- [CVE-2006-7243](https://cve.now/CVE-2006-7243.md): PHP before 5.3.4 accepts the \\0 character in a pathname, which might allow context-dependent attackers to bypass intended access restriction (no CVSS)
- [CVE-2010-4697](https://cve.now/CVE-2010-4697.md): Use-after-free vulnerability in the Zend engine in PHP before 5.2.15 and 5.3.x before 5.3.4 might allow context-dependent attackers to cause (no CVSS)
- [CVE-2010-4698](https://cve.now/CVE-2010-4698.md): Stack-based buffer overflow in the GD extension in PHP before 5.2.15 and 5.3.x before 5.3.4 allows context-dependent attackers to cause a de (no CVSS)
- [CVE-2010-4699](https://cve.now/CVE-2010-4699.md): The iconv\_mime\_decode\_headers function in the Iconv extension in PHP before 5.3.4 does not properly handle encodings that are unrecognized b (no CVSS)
- [CVE-2010-4700](https://cve.now/CVE-2010-4700.md): The set\_magic\_quotes\_runtime function in PHP 5.3.2 and 5.3.3, when the MySQLi extension is used, does not properly interact with use of the (no CVSS)
- [CVE-2009-5051](https://cve.now/CVE-2009-5051.md): Hastymail2 before RC 8 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers t (no CVSS)
- [CVE-2010-4166](https://cve.now/CVE-2010-4166.md): Multiple SQL injection vulnerabilities in Joomla! 1.5.x before 1.5.22 allow remote attackers to execute arbitrary SQL commands via (1) the f (no CVSS)
- [CVE-2010-4263](https://cve.now/CVE-2010-4263.md): The igb\_receive\_skb function in drivers/net/igb/igb\_main.c in the Intel Gigabit Ethernet (aka igb) subsystem in the Linux kernel before 2.6. (no CVSS)
- [CVE-2010-4530](https://cve.now/CVE-2010-4530.md): Signedness error in ccid\_serial.c in libccid in the USB Chip/Smart Card Interface Devices (CCID) driver, as used in pcscd in PCSC-Lite 1.5.3 (no CVSS)
- [CVE-2010-4531](https://cve.now/CVE-2010-4531.md): Stack-based buffer overflow in the ATRDecodeAtr function in the Answer-to-Reset (ATR) Handler (atrhandler.c) for pcscd in PCSC-Lite 1.5.3, a (no CVSS)
- [CVE-2010-4646](https://cve.now/CVE-2010-4646.md): Cross-site scripting (XSS) vulnerability in Hastymail2 before 1.01 allows remote attackers to inject arbitrary web script or HTML via a craf (no CVSS)
- [CVE-2010-4696](https://cve.now/CVE-2010-4696.md): Multiple SQL injection vulnerabilities in Joomla! 1.5.x before 1.5.22 allow remote attackers to execute arbitrary SQL commands via the (1) f (no CVSS)
- [CVE-2011-0010](https://cve.now/CVE-2011-0010.md): check.c in sudo 1.7.x before 1.7.4p5, when a Runas group is configured, does not require a password for command execution that involves a gi (no CVSS)
- [CVE-2011-0272](https://cve.now/CVE-2011-0272.md): Unspecified vulnerability in HP LoadRunner 9.52 allows remote attackers to execute arbitrary code via network traffic to TCP port 5001 or 50 (no CVSS)
- [CVE-2011-0408](https://cve.now/CVE-2011-0408.md): pngrtran.c in libpng 1.5.x before 1.5.1 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitra (no CVSS)
- [CVE-2011-0486](https://cve.now/CVE-2011-0486.md): Cross-site scripting (XSS) vulnerability in cognos.cgi in IBM Cognos 8 Business Intelligence (BI) 8.4.1 before FP1 allows remote attackers t (no CVSS)
- [CVE-2011-0487](https://cve.now/CVE-2011-0487.md): ICQ 7 does not verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a crafted file tha (no CVSS)
- [CVE-2011-0488](https://cve.now/CVE-2011-0488.md): Stack-based buffer overflow in NTWebServer.exe in the test web service in InduSoft NTWebServer, as distributed in Advantech Studio 6.1 and I (no CVSS)
- [CVE-2011-0489](https://cve.now/CVE-2011-0489.md): The server components in Objectivity/DB 10.0 do not require authentication for administrative commands, which allows remote attackers to mod (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2011-01-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.