# CVEs published 2011-05-20

35 CVEs were published on May 20, 2011: 0 critical, 0 high. Days are UTC.

- [CVE-2006-7245](https://cve.now/CVE-2006-7245.md): Monkey's Audio before 4.01b2 allows remote attackers to cause a denial of service (application crash) via an APX file that lacks NULL termin (no CVSS)
- [CVE-2009-5075](https://cve.now/CVE-2009-5075.md): Monkey's Audio before 4.02 allows remote attackers to cause a denial of service (application crash) via a malformed APE file. (no CVSS)
- [CVE-2010-0217](https://cve.now/CVE-2010-0217.md): Zeacom Chat Server before 5.1 uses too short a random string for the JSESSIONID value, which makes it easier for remote attackers to hijack (no CVSS)
- [CVE-2010-3908](https://cve.now/CVE-2010-3908.md): FFmpeg before 0.5.4, as used in MPlayer and other products, allows remote attackers to cause a denial of service (memory corruption and appl (no CVSS)
- [CVE-2011-0722](https://cve.now/CVE-2011-0722.md): FFmpeg before 0.5.4, as used in MPlayer and other products, allows remote attackers to cause a denial of service (heap memory corruption and (no CVSS)
- [CVE-2011-0723](https://cve.now/CVE-2011-0723.md): FFmpeg 0.5.x, as used in MPlayer and other products, allows remote attackers to cause a denial of service (application crash) or possibly ex (no CVSS)
- [CVE-2011-0959](https://cve.now/CVE-2011-0959.md): Multiple cross-site scripting (XSS) vulnerabilities in Cisco Unified Operations Manager (CUOM) before 8.6 allow remote attackers to inject a (no CVSS)
- [CVE-2011-0960](https://cve.now/CVE-2011-0960.md): Multiple SQL injection vulnerabilities in Cisco Unified Operations Manager (CUOM) before 8.6 allow remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2011-0961](https://cve.now/CVE-2011-0961.md): Cross-site scripting (XSS) vulnerability in cwhp/device.center.do in the Help servlet in Cisco CiscoWorks Common Services 3.3 and earlier al (no CVSS)
- [CVE-2011-0962](https://cve.now/CVE-2011-0962.md): Cross-site scripting (XSS) vulnerability in CSCOnm/servlet/com.cisco.nm.help.ServerHelpEngine in the Common Services Device Center in Cisco (no CVSS)
- [CVE-2011-0966](https://cve.now/CVE-2011-0966.md): Directory traversal vulnerability in cwhp/auditLog.do in the Homepage Auditing component in Cisco CiscoWorks Common Services 3.3 and earlier (no CVSS)
- [CVE-2011-1327](https://cve.now/CVE-2011-1327.md): The Keystroke Encryption feature in Trend Micro Internet Security 2009 (aka Virus Buster 2009 and PC-cillin 2009) does not completely encryp (no CVSS)
- [CVE-2011-1582](https://cve.now/CVE-2011-1582.md): Apache Tomcat 7.0.12 and 7.0.13 processes the first request to a servlet without following security constraints that have been configured th (no CVSS, org.apache.tomcat:tomcat)
- [CVE-2011-1784](https://cve.now/CVE-2011-1784.md): The pidfile\_write function in core/pidfile.c in keepalived 1.2.2 and earlier uses 0666 permissions for the (1) keepalived.pid, (2) checkers. (no CVSS)
- [CVE-2011-1838](https://cve.now/CVE-2011-1838.md): Multiple cross-site scripting (XSS) vulnerabilities in TemplateLogin.pm in TWiki before 5.0.2 allow remote attackers to inject arbitrary web (no CVSS)
- [CVE-2011-2020](https://cve.now/CVE-2011-2020.md): Cross-site scripting (XSS) vulnerability in TIBCO iProcess Engine before 11.1.3 and iProcess Workspace before 11.3.1 allows remote attackers (no CVSS)
- [CVE-2011-2021](https://cve.now/CVE-2011-2021.md): Session fixation vulnerability in TIBCO iProcess Engine before 11.1.3 and iProcess Workspace before 11.3.1 allows remote attackers to hijack (no CVSS)
- [CVE-2011-2147](https://cve.now/CVE-2011-2147.md): Openswan 2.2.x does not properly restrict permissions for (1) /var/run/starter.pid, related to starter.c in the IPsec starter, and (2) /var/ (no CVSS)
- [CVE-2011-2148](https://cve.now/CVE-2011-2148.md): Admin/frmSite.aspx in the SmarterTools SmarterStats 6.0 web server allows remote attackers to execute arbitrary commands via vectors involvi (no CVSS)
- [CVE-2011-2149](https://cve.now/CVE-2011-2149.md): Multiple SQL injection vulnerabilities in the SmarterTools SmarterStats 6.0 web server allow remote attackers to execute arbitrary SQL comma (no CVSS)
- [CVE-2011-2150](https://cve.now/CVE-2011-2150.md): The SmarterTools SmarterStats 6.0 web server does not properly validate string data that is intended for storage in an XML document, which a (no CVSS)
- [CVE-2011-2151](https://cve.now/CVE-2011-2151.md): The (1) Admin/frmEmailReportSettings.aspx, (2) Admin/frmGeneralSettings.aspx, (3) Admin/frmSite.aspx, (4) Client/frmUser.aspx, and (5) Login (no CVSS)
- [CVE-2011-2152](https://cve.now/CVE-2011-2152.md): The SmarterTools SmarterStats 6.0 web server generates web pages containing external links in response to GET requests with query strings fo (no CVSS)
- [CVE-2011-2153](https://cve.now/CVE-2011-2153.md): Login.aspx in the SmarterTools SmarterStats 6.0 web server supports URLs containing txtUser and txtPass parameters in the query string, whic (no CVSS)
- [CVE-2011-2154](https://cve.now/CVE-2011-2154.md): login.aspx in the SmarterTools SmarterStats 6.0 web server does not include the HTTPOnly flag in a Set-Cookie header for the loginsettings c (no CVSS)
- [CVE-2011-2155](https://cve.now/CVE-2011-2155.md): Login.aspx in the SmarterTools SmarterStats 6.0 web server generates a ctl00$MPH$txtPassword password form field without disabling the autoc (no CVSS)
- [CVE-2011-2156](https://cve.now/CVE-2011-2156.md): The SmarterTools SmarterStats 6.0 web server allows remote attackers to obtain directory listings via a direct request for the (1) Admin/, ( (no CVSS)
- [CVE-2011-2157](https://cve.now/CVE-2011-2157.md): The (1) Admin/frmEmailReportSettings.aspx and (2) Admin/frmGeneralSettings.aspx components in the SmarterTools SmarterStats 6.0 web server g (no CVSS)
- [CVE-2011-2158](https://cve.now/CVE-2011-2158.md): The SmarterTools SmarterStats 6.0 web server sends incorrect Content-Type headers for certain resources, which might allow remote attackers (no CVSS)
- [CVE-2011-2159](https://cve.now/CVE-2011-2159.md): The SmarterTools SmarterStats 6.0 web server omits the Content-Type header for certain resources, which might allow remote attackers to have (no CVSS)
- [CVE-2011-2160](https://cve.now/CVE-2011-2160.md): The VC-1 decoding functionality in FFmpeg before 0.5.4, as used in MPlayer and other products, does not properly restrict read operations, w (no CVSS)
- [CVE-2011-2161](https://cve.now/CVE-2011-2161.md): The ape\_read\_header function in ape.c in libavformat in FFmpeg before 0.5.4, as used in MPlayer, VideoLAN VLC media player, and other produc (no CVSS)
- [CVE-2011-2162](https://cve.now/CVE-2011-2162.md): Multiple unspecified vulnerabilities in FFmpeg 0.4.x through 0.6.x, as used in MPlayer 1.0 and other products, in Mandriva Linux 2009.0, 201 (no CVSS)
- [CVE-2011-2163](https://cve.now/CVE-2011-2163.md): Unspecified vulnerability in Virtualization Manager 1.2.2 in IBM Systems Director 1.2.2 has unknown impact and attack vectors. (no CVSS)
- [CVE-2011-2164](https://cve.now/CVE-2011-2164.md): Multiple unspecified vulnerabilities in Adobe Photoshop before 12.0.4 have unknown impact and attack vectors. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2011-05-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.