# CVEs published 2011-01-25

17 CVEs were published on January 25, 2011: 0 critical, 0 high. Days are UTC.

- [CVE-2010-4256](https://cve.now/CVE-2010-4256.md): The pipe\_fcntl function in fs/pipe.c in the Linux kernel before 2.6.37 does not properly determine whether a file is a named pipe, which all (no CVSS)
- [CVE-2011-0009](https://cve.now/CVE-2011-0009.md): Best Practical Solutions RT 3.x before 3.8.9rc2 and 4.x before 4.0.0rc4 uses the MD5 algorithm for password hashes, which makes it easier fo (no CVSS)
- [CVE-2011-0021](https://cve.now/CVE-2011-0021.md): Multiple heap-based buffer overflows in cdg.c in the CDG decoder in VideoLAN VLC Media Player before 1.1.6 allow remote attackers to cause a (no CVSS)
- [CVE-2011-0641](https://cve.now/CVE-2011-0641.md): Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/admin.php in the StatPressCN plugin 1.9.0 for WordPress allow remote attacke (no CVSS)
- [CVE-2011-0642](https://cve.now/CVE-2011-0642.md): Cross-site request forgery (CSRF) vulnerability in news/admin.php in N-13 News 3.4, 3.7, and 4.0 allows remote attackers to hijack the authe (no CVSS)
- [CVE-2011-0643](https://cve.now/CVE-2011-0643.md): Cross-site request forgery (CSRF) vulnerability in admin/conf\_users\_edit.php in PHP Link Directory (phpLD) 4.1.0 allows remote attackers to (no CVSS)
- [CVE-2011-0644](https://cve.now/CVE-2011-0644.md): SQL injection vulnerability in include/admin/model\_field.class.php in PHPCMS 2008 V2 allows remote attackers to execute arbitrary SQL comman (no CVSS)
- [CVE-2011-0645](https://cve.now/CVE-2011-0645.md): SQL injection vulnerability in data.php in PHPCMS 2008 V2 allows remote attackers to execute arbitrary SQL commands via the where\_time param (no CVSS)
- [CVE-2011-0646](https://cve.now/CVE-2011-0646.md): SQL injection vulnerability in viewfaqs.php in PHP LOW BIDS allows remote attackers to execute arbitrary SQL commands via the cat parameter. (no CVSS)
- [CVE-2010-4255](https://cve.now/CVE-2010-4255.md): The fixup\_page\_fault function in arch/x86/traps.c in Xen 4.0.1 and earlier on 64-bit platforms, when paravirtualization is enabled, does not (no CVSS)
- [CVE-2010-4341](https://cve.now/CVE-2010-4341.md): The pam\_parse\_in\_data\_v2 function in src/responder/pam/pamsrv\_cmd.c in the PAM responder in SSSD 1.5.0, 1.4.x, and 1.3 allows local users to (no CVSS)
- [CVE-2010-4353](https://cve.now/CVE-2010-4353.md): Unrestricted file upload vulnerability in modules/gallery/models/item.php in Menalto Gallery before 3.0 and beta allows remote authenticated (no CVSS)
- [CVE-2011-0273](https://cve.now/CVE-2011-0273.md): Buffer overflow in crs.exe in HP OpenView Storage Data Protector Cell Manager 6.11 allows remote attackers to execute arbitrary code via uns (no CVSS)
- [CVE-2011-0637](https://cve.now/CVE-2011-0637.md): The FC SCSI protocol driver in IBM AIX 6.1 does not verify that a timer is unused before deallocating this timer, which might allow attacker (no CVSS)
- [CVE-2011-0638](https://cve.now/CVE-2011-0638.md): Microsoft Windows does not properly warn the user before enabling additional Human Interface Device (HID) functionality over USB, which allo (no CVSS)
- [CVE-2011-0639](https://cve.now/CVE-2011-0639.md): Apple Mac OS X does not properly warn the user before enabling additional Human Interface Device (HID) functionality over USB, which allows (no CVSS)
- [CVE-2011-0640](https://cve.now/CVE-2011-0640.md): The default configuration of udev on Linux does not warn the user before enabling additional Human Interface Device (HID) functionality over (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2011-01-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.