# CVEs published 2011-03-14

7 CVEs were published on March 14, 2011: 0 critical, 0 high. Days are UTC.

- [CVE-2011-0280](https://cve.now/CVE-2011-0280.md): Multiple cross-site scripting (XSS) vulnerabilities in HP Power Manager (HPPM) 4.3.2 and earlier allow remote attackers to inject arbitrary (no CVSS)
- [CVE-2011-0432](https://cve.now/CVE-2011-0432.md): Multiple SQL injection vulnerabilities in the get\_userinfo method in the MySQLAuthHandler class in DAVServer/mysqlauth.py in PyWebDAV before (no CVSS, pywebdav)
- [CVE-2011-0700](https://cve.now/CVE-2011-0700.md): Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.0.5 allow remote authenticated users to inject arbitrary web scrip (no CVSS)
- [CVE-2011-0701](https://cve.now/CVE-2011-0701.md): wp-admin/async-upload.php in the media uploader in WordPress before 3.0.5 allows remote authenticated users to read (1) draft posts or (2) p (no CVSS)
- [CVE-2011-1088](https://cve.now/CVE-2011-1088.md): Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restric (no CVSS, org.apache.tomcat:tomcat)
- [CVE-2011-1091](https://cve.now/CVE-2011-1091.md): libymsg.c in the Yahoo! protocol plugin in libpurple in Pidgin 2.6.0 through 2.7.10 allows (1) remote authenticated users to cause a denial (no CVSS)
- [CVE-2011-1419](https://cve.now/CVE-2011-1419.md): Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote (no CVSS, org.apache.tomcat:tomcat)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2011-03-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.