Search
Total
86024 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2010-0962 | 1 Apple | 3 Airport Express, Airport Extreme, Time Capsule | 2018-10-10 | 5.0 MEDIUM | N/A |
| The FTP proxy server in Apple AirPort Express, AirPort Extreme, and Time Capsule with firmware 7.5 does not restrict the IP address and port specified in a PORT command from a client, which allows remote attackers to leverage intranet FTP servers for arbitrary TCP forwarding via a crafted PORT command. | |||||
| CVE-2010-0988 | 1 Pulsecms | 1 Pulse Cms | 2018-10-10 | 6.0 MEDIUM | N/A |
| Multiple unspecified vulnerabilities in Pulse CMS before 1.2.3 allow (1) remote attackers to write to arbitrary files and execute arbitrary PHP code via vectors related to improper handling of login failures by includes/login.php; and allow remote authenticated users to write to arbitrary files and execute arbitrary PHP code via vectors involving the (2) filename and (3) block parameters to view.php. | |||||
| CVE-2010-0989 | 1 Pulsecms | 1 Pulse Cms | 2018-10-10 | 5.5 MEDIUM | N/A |
| Directory traversal vulnerability in delete.php in Pulse CMS before 1.2.3 allows remote authenticated users to delete arbitrary files via directory traversal sequences in the f parameter. | |||||
| CVE-2010-0990 | 1 Creative | 2 Autoupdate, Autoupdate Engine Activex Control | 2018-10-10 | 10.0 HIGH | N/A |
| Stack-based buffer overflow in Creative Software AutoUpdate Engine ActiveX Control 2.0.12.0, as used in Creative Software AutoUpdate 1.40.01, allows remote attackers to execute arbitrary code via vectors related to the BrowseFolder method. | |||||
| CVE-2010-0991 | 1 Enlightenment | 1 Imlib2 | 2018-10-10 | 6.8 MEDIUM | N/A |
| Multiple heap-based buffer overflows in imlib2 1.4.3 allow context-dependent attackers to execute arbitrary code via a crafted (1) ARGB, (2) XPM, or (3) BMP file, related to the IMAGE_DIMENSIONS_OK macro in lib/image.h. | |||||
| CVE-2010-0992 | 1 Pulsecms | 1 Pulse Cms | 2018-10-10 | 6.8 MEDIUM | N/A |
| Multiple cross-site request forgery (CSRF) vulnerabilities in Pulse CMS Basic 1.2.2 and 1.2.3, and possibly Pulse Pro before 1.3.2, allow remote attackers to hijack the authentication of users for requests that (1) upload image files, (2) delete image files, or (3) create blocks. | |||||
| CVE-2010-0993 | 1 Pulsecms | 1 Pulse Cms | 2018-10-10 | 6.0 MEDIUM | N/A |
| Unrestricted file upload vulnerability in Pulse CMS Basic 1.2.2 and 1.2.3, and possibly Pulse Pro before 1.3.2, allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory. | |||||
| CVE-2010-0994 | 1 Visualizationlibrary | 1 Visualization Library | 2018-10-10 | 6.8 MEDIUM | N/A |
| Multiple buffer overflows in src/vl/vlDAT.cpp in Visualization Library 2009.08.812 allow user-assisted remote attackers to execute arbitrary code via a crafted DAT file, related to the (1) vl::loadDAT and (2) vl::isDAT functions. | |||||
| CVE-2010-0995 | 1 Tonec | 1 Internet Download Manager | 2018-10-10 | 9.3 HIGH | N/A |
| Stack-based buffer overflow in Internet Download Manager (IDM) before 5.19 allows remote attackers to execute arbitrary code via a crafted FTP URI that causes unspecified "test sequences" to be sent from client to server. | |||||
| CVE-2010-0996 | 1 E107 | 1 E107 | 2018-10-10 | 6.0 MEDIUM | N/A |
| Unrestricted file upload vulnerability in e107 before 0.7.20 allows remote authenticated users to execute arbitrary code by uploading a .php.filetypesphp file. NOTE: the vendor disputes the significance of this issue, noting that "an odd set of preferences and a missing file" are required. | |||||
| CVE-2010-0997 | 1 E107 | 1 E107 | 2018-10-10 | 3.5 LOW | N/A |
| Cross-site scripting (XSS) vulnerability in 107_plugins/content/content_manager.php in the Content Management plugin in e107 before 0.7.20, when the personal content manager is enabled, allows user-assisted remote authenticated users to inject arbitrary web script or HTML via the content_heading parameter. | |||||
| CVE-2010-0998 | 1 Freedownloadmanager | 1 Free Download Manager | 2018-10-10 | 10.0 HIGH | N/A |
| Multiple stack-based buffer overflows in Free Download Manager (FDM) before 3.0.852 allow remote attackers to execute arbitrary code via vectors involving (1) the folders feature in Site Explorer, (2) the websites feature in Site Explorer, (3) an FTP URI, or (4) a redirect. | |||||
| CVE-2010-0999 | 1 Freedownloadmanager | 1 Free Download Manager | 2018-10-10 | 7.1 HIGH | N/A |
| Directory traversal vulnerability in Free Download Manager (FDM) before 3.0.852 allows remote attackers to create arbitrary files via directory traversal sequences in the name attribute of a file element in a metalink file. | |||||
| CVE-2010-1000 | 1 Kde | 1 Kde Sc | 2018-10-10 | 5.8 MEDIUM | N/A |
| Directory traversal vulnerability in KGet in KDE SC 4.0.0 through 4.4.3 allows remote attackers to create arbitrary files via directory traversal sequences in the name attribute of a file element in a metalink file. | |||||
| CVE-2010-1003 | 1 Efrontlearning | 1 Efront | 2018-10-10 | 6.8 MEDIUM | N/A |
| Directory traversal vulnerability in www/editor/tiny_mce/langs/language.php in eFront 3.5.x through 3.5.5 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the langname parameter. | |||||
| CVE-2010-1035 | 1 Hp | 1 Insight Virtual Machine Management | 2018-10-10 | 9.0 HIGH | N/A |
| Multiple unspecified vulnerabilities in HP Virtual Machine Manager (VMM) before 6.0 allow remote authenticated users to execute arbitrary code via unknown vectors. | |||||
| CVE-2010-1039 | 3 Hp, Ibm, Sgi | 5 Hp-ux, Nfs\/oncplus, Aix and 2 more | 2018-10-10 | 10.0 HIGH | N/A |
| Format string vulnerability in the _msgout function in rpc.pcnfsd in IBM AIX 6.1, 5.3, and earlier; IBM VIOS 2.1, 1.5, and earlier; NFS/ONCplus B.11.31_09 and earlier on HP HP-UX B.11.11, B.11.23, and B.11.31; and SGI IRIX 6.5 allows remote attackers to execute arbitrary code via an RPC request containing format string specifiers in an invalid directory name. | |||||
| CVE-2010-1054 | 1 Parscms | 1 Parscms | 2018-10-10 | 7.5 HIGH | N/A |
| Multiple SQL injection vulnerabilities in ParsCMS allow remote attackers to execute arbitrary SQL commands via the RP parameter to (1) fa_default.asp and (2) en_default.asp. | |||||
| CVE-2010-1078 | 1 Sphere.xlentprojects | 1 Spherecms | 2018-10-10 | 7.5 HIGH | N/A |
| SQL injection vulnerability in archive.php in XlentProjects SphereCMS 1.1 alpha allows remote attackers to execute arbitrary SQL commands via encoded null bytes ("%00") in the view parameter, which bypasses a protection mechanism. | |||||
| CVE-2010-1083 | 1 Linux | 1 Linux Kernel | 2018-10-10 | 4.7 MEDIUM | N/A |
| The processcompl_compat function in drivers/usb/core/devio.c in Linux kernel 2.6.x through 2.6.32, and possibly other versions, does not clear the transfer buffer before returning to userspace when a USB command fails, which might make it easier for physically proximate attackers to obtain sensitive information (kernel memory). | |||||
| CVE-2010-1084 | 1 Linux | 1 Linux Kernel | 2018-10-10 | 7.1 HIGH | N/A |
| Linux kernel 2.6.18 through 2.6.33, and possibly other versions, allows remote attackers to cause a denial of service (memory corruption) via a large number of Bluetooth sockets, related to the size of sysfs files in (1) net/bluetooth/l2cap.c, (2) net/bluetooth/rfcomm/core.c, (3) net/bluetooth/rfcomm/sock.c, and (4) net/bluetooth/sco.c. | |||||
| CVE-2010-1088 | 1 Linux | 1 Linux Kernel | 2018-10-10 | 5.4 MEDIUM | N/A |
| fs/namei.c in Linux kernel 2.6.18 through 2.6.34 does not always follow NFS automount "symlinks," which allows attackers to have an unknown impact, related to LOOKUP_FOLLOW. | |||||
| CVE-2010-1099 | 1 Apple | 1 Safari | 2018-10-10 | 5.0 MEDIUM | N/A |
| Integer overflow in Apple Safari allows remote attackers to bypass intended port restrictions on outbound TCP connections via a port number outside the range of the unsigned short data type, as demonstrated by a value of 65561 for TCP port 25. | |||||
| CVE-2010-1100 | 1 Arora-browser | 1 Arora | 2018-10-10 | 5.0 MEDIUM | N/A |
| Integer overflow in Arora allows remote attackers to bypass intended port restrictions on outbound TCP connections via a port number outside the range of the unsigned short data type, as demonstrated by a value of 65561 for TCP port 25. | |||||
| CVE-2010-1101 | 1 Icab | 1 Icab | 2018-10-10 | 5.0 MEDIUM | N/A |
| Integer overflow in Alexander Clauss iCab allows remote attackers to bypass intended port restrictions on outbound TCP connections via a port number outside the range of the unsigned short data type, as demonstrated by a value of 65561 for TCP port 25. | |||||
| CVE-2010-1102 | 1 Omnigroup | 1 Omniweb | 2018-10-10 | 5.0 MEDIUM | N/A |
| Integer overflow in OmniWeb allows remote attackers to bypass intended port restrictions on outbound TCP connections via a port number outside the range of the unsigned short data type, as demonstrated by a value of 65561 for TCP port 25. | |||||
| CVE-2010-1103 | 1 Mesadynamics | 1 Stainless | 2018-10-10 | 5.0 MEDIUM | N/A |
| Integer overflow in Stainless allows remote attackers to bypass intended port restrictions on outbound TCP connections via a port number outside the range of the unsigned short data type, as demonstrated by a value of 65561 for TCP port 25. | |||||
| CVE-2010-1123 | 1 Chip Salzenberg | 1 Deliver | 2018-10-10 | 2.1 LOW | N/A |
| Chip Salzenberg Deliver does not properly associate a lockfile with the user who created the file, which allows local users to cause a denial of service (blockage of incoming e-mail) by creating lockfiles for arbitrary mailboxes. | |||||
| CVE-2010-1125 | 1 Mozilla | 2 Firefox, Seamonkey | 2018-10-10 | 5.8 MEDIUM | N/A |
| The JavaScript implementation in Mozilla Firefox 3.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, allows remote attackers to send selected keystrokes to a form field in a hidden frame, instead of the intended form field in a visible frame, via certain calls to the focus method. | |||||
| CVE-2010-1126 | 1 Apple | 1 Webkit | 2018-10-10 | 5.8 MEDIUM | N/A |
| The JavaScript implementation in WebKit allows remote attackers to send selected keystrokes to a form field in a hidden frame, instead of the intended form field in a visible frame, via certain calls to the focus method. | |||||
| CVE-2010-1163 | 1 Todd Miller | 1 Sudo | 2018-10-10 | 6.9 MEDIUM | N/A |
| The command matching functionality in sudo 1.6.8 through 1.7.2p5 does not properly handle when a file in the current working directory has the same name as a pseudo-command in the sudoers file and the PATH contains an entry for ".", which allows local users to execute arbitrary commands via a Trojan horse executable, as demonstrated using sudoedit, a different vulnerability than CVE-2010-0426. | |||||
| CVE-2010-1167 | 1 Fetchmail | 1 Fetchmail | 2018-10-10 | 4.3 MEDIUM | N/A |
| fetchmail 4.6.3 through 6.3.16, when debug mode is enabled, does not properly handle invalid characters in a multi-character locale, which allows remote attackers to cause a denial of service (memory consumption and application crash) via a crafted (1) message header or (2) POP3 UIDL list. | |||||
| CVE-2010-1173 | 1 Linux | 1 Linux Kernel | 2018-10-10 | 7.1 HIGH | N/A |
| The sctp_process_unk_param function in net/sctp/sm_make_chunk.c in the Linux kernel 2.6.33.3 and earlier, when SCTP is enabled, allows remote attackers to cause a denial of service (system crash) via an SCTPChunkInit packet containing multiple invalid parameters that require a large amount of error data. | |||||
| CVE-2010-0843 | 1 Sun | 3 Jdk, Jre, Sdk | 2018-10-10 | 7.5 HIGH | N/A |
| Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related to XNewPtr and improper handling of an integer parameter when allocating heap memory in the com.sun.media.sound libraries, which allows remote attackers to execute arbitrary code. | |||||
| CVE-2010-0845 | 1 Sun | 2 Jdk, Jre | 2018-10-10 | 5.1 MEDIUM | N/A |
| Unspecified vulnerability in the HotSpot Server component in Oracle Java SE and Java for Business 6 Update 18, 5.0, Update, and 23 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. | |||||
| CVE-2010-0526 | 1 Apple | 2 Mac Os X, Mac Os X Server | 2018-10-10 | 4.3 MEDIUM | N/A |
| Heap-based buffer overflow in QuickTimeMPEG.qtx in QuickTime in Apple Mac OS X before 10.6.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted genl atom in a QuickTime movie file with MPEG encoding, which is not properly handled during decompression. | |||||
| CVE-2010-0528 | 2 Apple, Microsoft | 4 Quicktime, Windows 7, Windows Vista and 1 more | 2018-10-10 | 9.3 HIGH | N/A |
| Apple QuickTime before 7.6.6 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted color tables in a movie file, related to malformed MediaVideo data, a sample description atom (STSD), and a crafted length value. | |||||
| CVE-2010-0529 | 2 Apple, Microsoft | 4 Quicktime, Windows 7, Windows Vista and 1 more | 2018-10-10 | 9.3 HIGH | N/A |
| Heap-based buffer overflow in QuickTime.qts in Apple QuickTime before 7.6.6 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PICT image with a BkPixPat opcode (0x12) containing crafted values that are used in a calculation for memory allocation. | |||||
| CVE-2010-0550 | 1 Geopp | 1 Geo\+\+ Gncaster | 2018-10-10 | 4.0 MEDIUM | N/A |
| admin.htm in Geo++ GNCASTER 1.4.0.7 and earlier does not properly enforce HTTP Digest Authentication, which allows remote authenticated users to use HTTP Basic Authentication, bypassing intended server policy. | |||||
| CVE-2010-0551 | 1 Geopp | 1 Geo\+\+ Gncaster | 2018-10-10 | 5.0 MEDIUM | N/A |
| HTTP authentication implementation in Geo++ GNCASTER 1.4.0.7 and earlier allows remote attackers to read authentication headers of other users via a large request with an incorrect authentication attempt, which includes sensitive memory in the response. NOTE: this is referred to as a "memory leak" by some sources, but is better characterized as "memory disclosure." | |||||
| CVE-2010-0552 | 1 Geopp | 1 Geo\+\+ Gncaster | 2018-10-10 | 7.5 HIGH | N/A |
| Geo++ GNCASTER 1.4.0.7 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via multiple requests for a non-existent file using a long URI. | |||||
| CVE-2010-0553 | 1 Geopp | 1 Geo\+\+ Gncaster | 2018-10-10 | 6.5 MEDIUM | N/A |
| Geo++ GNCASTER 1.4.0.7 and earlier allows remote authenticated users to cause a denial of service (application crash) and possibly execute arbitrary code via a long NMEA data sentence. | |||||
| CVE-2010-0554 | 1 Geopp | 1 Geo\+\+ Gncaster | 2018-10-10 | 7.5 HIGH | N/A |
| The HTTP Authentication implementation in Geo++ GNCASTER 1.4.0.7 and earlier uses the same nonce for all authentication, which allows remote attackers to hijack web sessions or bypass authentication via a replay attack. | |||||
| CVE-2010-0556 | 1 Google | 1 Chrome | 2018-10-10 | 4.3 MEDIUM | N/A |
| browser/login/login_prompt.cc in Google Chrome before 4.0.249.89 populates an authentication dialog with credentials that were stored by Password Manager for a different web site, which allows user-assisted remote HTTP servers to obtain sensitive information via a URL that requires authentication, as demonstrated by a URL in the SRC attribute of an IMG element. | |||||
| CVE-2010-0614 | 1 Myshell | 1 Evalsmsi | 2018-10-10 | 7.5 HIGH | N/A |
| SQL injection vulnerability in ajax.php in evalSMSI 2.1.03 allows remote attackers to execute arbitrary SQL commands via the query parameter in the (1) question action, and possibly the (2) sub_par or (3) num_quest actions. | |||||
| CVE-2010-0615 | 1 Myshell | 1 Evalsmsi | 2018-10-10 | 4.3 MEDIUM | N/A |
| Cross-site scripting (XSS) vulnerability in assess.php in evalSMSI 2.1.03 allows remote attackers to inject arbitrary web script or HTML via the reports comment box in a continue_assess action. NOTE: some of these details are obtained from third party information. | |||||
| CVE-2010-0616 | 1 Myshell | 1 Evalsmsi | 2018-10-10 | 7.5 HIGH | N/A |
| evalSMSI 2.1.03 stores passwords in cleartext in the database, which allows attackers with database access to gain privileges. NOTE: remote attack vectors are possible by leveraging a separate SQL injection vulnerability. | |||||
| CVE-2010-0618 | 1 Lexmark | 1 Z2420 | 2018-10-10 | 5.0 MEDIUM | N/A |
| The flood-protection feature in the base, IPDS DLE, Forms DLE, Barcode DLE, Prescribe DLE, and Printcryption DLE components on certain Lexmark laser and inkjet printers and MarkNet devices allows remote attackers to cause a denial of service (TCP outage) by making many passive FTP connections and then aborting these connections. | |||||
| CVE-2010-0619 | 1 Lexmark | 1 X94x | 2018-10-10 | 7.3 HIGH | N/A |
| Stack-based buffer overflow in the base, IPDS DLE, Forms DLE, Barcode DLE, Prescribe DLE, and Printcryption DLE components on certain Lexmark laser printers and multi-function printers allows remote attackers to execute arbitrary code or cause a denial of service (device hang) via a long argument to a PJL INQUIRE command. | |||||
| CVE-2010-0620 | 1 Emc | 1 Homebase Server | 2018-10-10 | 9.3 HIGH | N/A |
| Directory traversal vulnerability in the SSL Service in EMC HomeBase Server 6.2.x before 6.2.3 and 6.3.x before 6.3.2 allows remote attackers to overwrite arbitrary files with any content, and consequently execute arbitrary code, via a .. (dot dot) in an unspecified parameter. | |||||