# CVEs published 2011-07-27

27 CVEs were published on July 27, 2011: 0 critical, 0 high. Days are UTC.

- [CVE-2011-2488](https://cve.now/CVE-2011-2488.md): Joomla! before 1.5.23 does not properly check for errors, which allows remote attackers to obtain sensitive information via unspecified vect (no CVSS)
- [CVE-2011-2509](https://cve.now/CVE-2011-2509.md): Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.6.4 allow remote attackers to inject arbitrary web script or HTML vi (no CVSS, joomla/joomla-cms)
- [CVE-2011-2710](https://cve.now/CVE-2011-2710.md): Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.7.0 allow remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2011-2884](https://cve.now/CVE-2011-2884.md): Multiple unspecified vulnerabilities in IBM Lotus Symphony 3 before FP3 have unknown impact and attack vectors, related to "critical securit (no CVSS)
- [CVE-2011-2885](https://cve.now/CVE-2011-2885.md): IBM Lotus Symphony 3 before FP3 allows remote attackers to cause a denial of service (application crash) via the sample .doc document that i (no CVSS)
- [CVE-2011-2886](https://cve.now/CVE-2011-2886.md): IBM Lotus Symphony 3 before FP3 allows remote attackers to cause a denial of service (application crash) via a .docx document with empty bul (no CVSS)
- [CVE-2011-2887](https://cve.now/CVE-2011-2887.md): IBM Lotus Symphony 3 before FP3 on Linux allows remote attackers to cause a denial of service (application crash) via a certain sample docum (no CVSS)
- [CVE-2011-2888](https://cve.now/CVE-2011-2888.md): IBM Lotus Symphony 3 before FP3 allows remote attackers to cause a denial of service (application hang) via complex graphics in a presentati (no CVSS)
- [CVE-2011-2889](https://cve.now/CVE-2011-2889.md): templates/system/error.php in Joomla! before 1.5.23 might allow remote attackers to obtain sensitive information via unspecified vectors tha (no CVSS)
- [CVE-2011-2890](https://cve.now/CVE-2011-2890.md): The MediaViewMedia class in administrator/components/com\_media/views/media/view.html.php in Joomla! 1.5.23 and earlier allows remote attacke (no CVSS)
- [CVE-2011-2891](https://cve.now/CVE-2011-2891.md): Joomla! 1.6.x before 1.6.2 allows remote attackers to obtain sensitive information via an empty Itemid array parameter to index.php, which r (no CVSS)
- [CVE-2011-2892](https://cve.now/CVE-2011-2892.md): Joomla! 1.6.x before 1.6.2 does not prevent page rendering inside a frame in a third-party HTML document, which makes it easier for remote a (no CVSS)
- [CVE-2011-2893](https://cve.now/CVE-2011-2893.md): The DataPilot feature in IBM Lotus Symphony 3 before FP3 allows user-assisted remote attackers to cause a denial of service (application cra (no CVSS)
- [CVE-2009-4139](https://cve.now/CVE-2009-4139.md): Spacewalk-java: spacewalk: red hat network satellite: spacewalk java: privilege escalation via cross-site request forgery (CVSS 6.8, Red Hat Network Satellite Server v · Red Hat Enterprise Lin…)
- [CVE-2011-1829](https://cve.now/CVE-2011-1829.md): APT before 0.8.15.2 does not properly validate inline GPG signatures, which allows man-in-the-middle attackers to install modified packages (no CVSS)
- [CVE-2011-2185](https://cve.now/CVE-2011-2185.md): Fabric before 1.1.0 allows local users to overwrite arbitrary files via a symlink attack on (1) a /tmp/fab.\*.tar file or (2) certain other f (no CVSS, fabric)
- [CVE-2011-2196](https://cve.now/CVE-2011-2196.md): jboss-seam.jar in the JBoss Seam 2 framework 2.2.x and earlier, as distributed in Red Hat JBoss Enterprise SOA Platform 4.3.0.CP05 and 5.1.0 (no CVSS)
- [CVE-2011-2467](https://cve.now/CVE-2011-2467.md): SQL injection vulnerability in lsassd in Lsass in the Likewise Security Authority in Likewise Open 5.4 through 6.1, and Likewise Enterprise (no CVSS)
- [CVE-2011-2489](https://cve.now/CVE-2011-2489.md): Multiple off-by-one errors in opiesu.c in opiesu in OPIE 2.4.1-test1 and earlier might allow local users to gain privileges via a crafted co (no CVSS)
- [CVE-2011-2490](https://cve.now/CVE-2011-2490.md): opielogin.c in opielogin in OPIE 2.4.1-test1 and earlier does not check the return value of the setuid system call, which allows local users (no CVSS)
- [CVE-2011-2587](https://cve.now/CVE-2011-2587.md): Heap-based buffer overflow in the DemuxAudioSipr function in real.c in the RealMedia demuxer in VideoLAN VLC media player 1.1.x before 1.1.1 (no CVSS)
- [CVE-2011-2588](https://cve.now/CVE-2011-2588.md): Heap-based buffer overflow in the AVI\_ChunkRead\_strf function in libavi.c in the AVI demuxer in VideoLAN VLC media player before 1.1.11 allo (no CVSS)
- [CVE-2011-2687](https://cve.now/CVE-2011-2687.md): Drupal 7.x before 7.3 allows remote attackers to bypass intended node\_access restrictions via vectors related to a listing that shows nodes (no CVSS, drupal/core)
- [CVE-2011-2696](https://cve.now/CVE-2011-2696.md): Integer overflow in libsndfile before 1.0.25 allows remote attackers to cause a denial of service (application crash) or possibly execute ar (no CVSS)
- [CVE-2011-2745](https://cve.now/CVE-2011-2745.md): upload\_handler.php in the swfupload extension in Chyrp 2.0 and earlier relies on client-side JavaScript code to restrict the file extensions (no CVSS)
- [CVE-2011-1484](https://cve.now/CVE-2011-1484.md): jboss-seam.jar in the JBoss Seam 2 framework 2.2.x and earlier, as distributed in Red Hat JBoss Enterprise SOA Platform 4.3.0.CP04 and 5.1.0 (no CVSS)
- [CVE-2011-1782](https://cve.now/CVE-2011-1782.md): Heap-based buffer overflow in the read\_channel\_data function in file-psp.c in the Paint Shop Pro (PSP) plugin in GIMP 2.6.11 allows remote a (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2011-07-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.