# CVEs published 2011-04-27

26 CVEs were published on April 27, 2011: 0 critical, 0 high. Days are UTC.

- [CVE-2010-2787](https://cve.now/CVE-2010-2787.md): api.php in MediaWiki before 1.15.5 does not prevent use of public caching headers for private data, which allows remote attackers to bypass (no CVSS)
- [CVE-2010-2788](https://cve.now/CVE-2010-2788.md): Cross-site scripting (XSS) vulnerability in profileinfo.php in MediaWiki before 1.15.5, when wgEnableProfileInfo is enabled, allows remote a (no CVSS)
- [CVE-2010-2789](https://cve.now/CVE-2010-2789.md): PHP remote file inclusion vulnerability in MediaWikiParserTest.php in MediaWiki 1.16 beta, when register\_globals is enabled, allows remote a (no CVSS)
- [CVE-2010-3260](https://cve.now/CVE-2010-3260.md): oxf/xml/xerces/XercesSAXParserFactoryImpl.java in the xforms-server component in the XForms service in Orbeon Forms before 3.9 does not prop (no CVSS)
- [CVE-2010-4790](https://cve.now/CVE-2010-4790.md): Directory traversal vulnerability in FilterFTP 2.0.3, 2.0.5, and probably earlier versions, allows remote FTP servers to write arbitrary fil (no CVSS)
- [CVE-2010-4791](https://cve.now/CVE-2010-4791.md): SQL injection vulnerability in infusions/mg\_user\_fotoalbum\_panel/mg\_user\_fotoalbum.php in the MG User-Fotoalbum (mg\_user\_fotoalbum\_panel) mo (no CVSS)
- [CVE-2010-4792](https://cve.now/CVE-2010-4792.md): Cross-site scripting (XSS) vulnerability in title.php in OPEN IT OverLook 5.0 allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2010-4793](https://cve.now/CVE-2010-4793.md): SQL injection vulnerability in detail.asp in Site2Nite Auto e-Manager allows remote attackers to execute arbitrary SQL commands via the ID p (no CVSS)
- [CVE-2010-4794](https://cve.now/CVE-2010-4794.md): Multiple cross-site scripting (XSS) vulnerabilities in the JoomlaSeller JS Calendar (com\_jscalendar) component 1.5.1 and 1.5.4 for Joomla! a (no CVSS)
- [CVE-2010-4795](https://cve.now/CVE-2010-4795.md): SQL injection vulnerability in the JS Calendar (com\_jscalendar) component 1.5.1 and 1.5.4 for Joomla! allows remote attackers to execute arb (no CVSS)
- [CVE-2010-4796](https://cve.now/CVE-2010-4796.md): Multiple SQL injection vulnerabilities in PHPYun 1.1.6 allow remote attackers to execute arbitrary SQL commands via the (1) provinceid param (no CVSS)
- [CVE-2010-4797](https://cve.now/CVE-2010-4797.md): Multiple SQL injection vulnerabilities in the log-in form in Truworth Flex Timesheet allow remote attackers to execute arbitrary SQL command (no CVSS)
- [CVE-2010-4798](https://cve.now/CVE-2010-4798.md): Directory traversal vulnerability in index.php in OrangeHRM 2.6.0.1 allows remote attackers to include and execute arbitrary local files via (no CVSS)
- [CVE-2010-4799](https://cve.now/CVE-2010-4799.md): Multiple SQL injection vulnerabilities in Chipmunk Pwngame 1.0, when magic\_quotes\_gpc is disabled, allow remote attackers to execute arbitra (no CVSS)
- [CVE-2010-4800](https://cve.now/CVE-2010-4800.md): SQL injection vulnerability in doadd.php in BaconMap 1.0 allows remote attackers to execute arbitrary SQL commands via the type parameter. (no CVSS)
- [CVE-2010-4801](https://cve.now/CVE-2010-4801.md): Directory traversal vulnerability in admin/updatelist.php in BaconMap 1.0 allows remote attackers to include and execute arbitrary local fil (no CVSS)
- [CVE-2011-1507](https://cve.now/CVE-2011-1507.md): Asterisk Open Source 1.4.x before 1.4.40.1, 1.6.1.x before 1.6.1.25, 1.6.2.x before 1.6.2.17.3, and 1.8.x before 1.8.3.3 and Asterisk Busine (no CVSS)
- [CVE-2011-1578](https://cve.now/CVE-2011-1578.md): Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.3, when Internet Explorer 6 or earlier is used, allows remote attackers to (no CVSS)
- [CVE-2011-1579](https://cve.now/CVE-2011-1579.md): The checkCss function in includes/Sanitizer.php in the wikitext parser in MediaWiki before 1.16.3 does not properly validate Cascading Style (no CVSS)
- [CVE-2011-1580](https://cve.now/CVE-2011-1580.md): The transwiki import functionality in MediaWiki before 1.16.3 does not properly check privileges, which allows remote authenticated users to (no CVSS)
- [CVE-2011-1586](https://cve.now/CVE-2011-1586.md): Directory traversal vulnerability in the KGetMetalink::File::isValidNameAttr function in ui/metalinkcreator/metalinker.cpp in KGet in KDE SC (no CVSS)
- [CVE-2011-1587](https://cve.now/CVE-2011-1587.md): Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.4, when Internet Explorer 6 or earlier is used, allows remote attackers to (no CVSS)
- [CVE-2011-1599](https://cve.now/CVE-2011-1599.md): manager.c in the Manager Interface in Asterisk Open Source 1.4.x before 1.4.40.1, 1.6.1.x before 1.6.1.25, 1.6.2.x before 1.6.2.17.3, and 1. (no CVSS)
- [CVE-2011-1718](https://cve.now/CVE-2011-1718.md): The Web Agents component in CA SiteMinder R6 before SP6 CR2 and R12 before SP3 CR2 does not properly handle multi-line headers, which allows (no CVSS)
- [CVE-2011-1719](https://cve.now/CVE-2011-1719.md): Multiple stack-based buffer overflows in the Web Viewer ActiveX controls in CA Output Management Web Viewer 11.0 and 11.5 allow remote attac (no CVSS)
- [CVE-2011-1725](https://cve.now/CVE-2011-1725.md): Unspecified vulnerability in HP Network Automation 7.2x, 7.5x, 7.6x, 9.0, and 9.10 allows remote attackers to obtain sensitive information v (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2011-04-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.