2010 CVEs (page 2)
Page 2 of 53 — CVEs published in 2010, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2010-3666 | Medium | 5.3 | 2019-11-04 | TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 contains insecure randomness in the uniqid function. |
CVE-2010-3665 | Medium | 5.4 | 2019-11-04 | TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows XSS on the Extension Manager. |
CVE-2010-3664 | Medium | 6.5 | 2019-11-04 | TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Information Disclosure on the backend. |
CVE-2010-3663 | High | 8.8 | 2019-11-04 | TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 contains an insecure default value of the variable fileDenyPattern which co… |
CVE-2010-3662 | High | 8.8 | 2019-11-04 | TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows SQL Injection on the backend. |
CVE-2010-3661 | Medium | 6.1 | 2019-11-01 | TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Open Redirection on the backend. |
CVE-2010-3660 | Medium | 5.4 | 2019-11-01 | TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows XSS on the backend. |
CVE-2010-2783 | Critical | 9.1 | 2019-10-31 | IcedTea6 before 1.7.4 allow unsigned apps to read and write arbitrary files, related to Extended JNLP Services. |
CVE-2010-2548 | Critical | 9.1 | 2019-10-31 | IcedTea6 before 1.7.4 does not properly check property access, which allows unsigned apps to read and write arbitrary files. |
CVE-2010-2490 | Medium | 6.5 | 2019-10-31 | Mumble: murmur-server has DoS due to malformed client query |
CVE-2010-1673 | Medium | 6.1 | 2019-10-30 | A cross-site scripting (XSS) vulnerability in ikiwiki before 3.20101112 allows remote attackers to inject arbitrary web script or HTML via a comment. |
CVE-2010-0749 | Medium | 5.3 | 2019-10-30 | Transmission before 1.92 allows attackers to prevent download of a file by corrupted data during the endgame. |
CVE-2010-0748 | Critical | 9.8 | 2019-10-30 | Transmission before 1.92 allows an attacker to cause a denial of service (crash) or possibly have other unspecified impact via a large number of tr arguments i… |
CVE-2010-0747 | High | 7.8 | 2019-10-30 | drbd8 allows local users to bypass intended restrictions for certain actions via netlink packets, similar to CVE-2009-3725. |
CVE-2010-0737 | High | 8.0 | 2019-10-30 | A missing permission check was found in The CLI in JBoss Operations Network before 2.3.1 does not properly check permissions, which allows JBoss ON users to pe… |
CVE-2010-0398 | Medium | 6.5 | 2019-10-30 | The init script in autokey before 0.61.3-2 allows local attackers to write to arbitrary files via a symlink attack. |
CVE-2010-0207 | Medium | 5.5 | 2019-10-30 | In xpdf, the xref table contains an infinite loop which allows remote attackers to cause a denial of service (application crash) in xpdf-based PDF viewers. |
CVE-2010-0206 | Medium | 5.5 | 2019-10-30 | xpdf allows remote attackers to cause a denial of service (NULL pointer dereference and crash) in the way it processes JBIG2 PDF stream objects. |
CVE-2010-2064 | High | 7.1 | 2019-10-29 | rpcbind 0.2.0 allows local users to write to arbitrary files or gain privileges via a symlink attack on (1) /tmp/portmap.xdr and (2) /tmp/rpcbind.xdr. |
CVE-2010-2061 | High | 7.8 | 2019-10-29 | rpcbind 0.2.0 does not properly validate (1) /tmp/portmap.xdr and (2) /tmp/rpcbind.xdr, which can be created by an attacker before the daemon is started. |
CVE-2010-1678 | High | 7.5 | 2019-10-29 | Mapserver 5.2, 5.4 and 5.6 before 5.6.5-2 improperly validates symbol index values during Mapfile parsing. |
CVE-2010-4237 | Medium | 5.9 | 2019-10-29 | Mercurial before 1.6.4 fails to verify the Common Name field of SSL certificates which allows remote attackers who acquire a certificate signed by a Certificat… |
CVE-2010-3375 | Critical | 9.8 | 2019-10-29 | qtparted has insecure library loading which may allow arbitrary code execution |
CVE-2010-3373 | Medium | 5.5 | 2019-10-29 | paxtest handles temporary files insecurely |
CVE-2010-4245 | Medium | 6.1 | 2019-10-28 | pootle 2.0.5 has XSS via 'match_names' parameter |
CVE-2010-4241 | High | 8.8 | 2019-10-28 | Tiki Wiki CMS Groupware 5.2 has CSRF |
CVE-2010-4240 | Medium | 6.1 | 2019-10-28 | Tiki Wiki CMS Groupware 5.2 has XSS |
CVE-2010-4239 | Critical | 9.8 | 2019-10-28 | Tiki Wiki CMS Groupware 5.2 has Local File Inclusion |
CVE-2010-3293 | Medium | 5.5 | 2019-10-28 | mailscanner can allow local users to prevent virus signatures from being updated |
CVE-2010-5340 | Medium | 6.1 | 2019-10-11 | IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/ with the parameter password is non-persistent in 10.2.0. |
CVE-2010-5339 | Medium | 6.1 | 2019-10-11 | IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter _dlg[captcha][uid] is non-persistent in 10.1.3 and 10.2.0. |
CVE-2010-5338 | Medium | 6.1 | 2019-10-11 | IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter _dlg[captcha][action] is non-persistent in 10.1.3 and 10.2… |
CVE-2010-5337 | Medium | 6.1 | 2019-10-11 | IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter _dlg[captcha][controller] is non-persistent in 10.1.3 and 1… |
CVE-2010-5336 | Medium | 6.1 | 2019-10-11 | IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: admin/login.html with the parameter username is persistent in 10.2.0. |
CVE-2010-5335 | High | 7.5 | 2019-10-11 | IceWarp Webclient before 10.2.1 has a directory traversal vulnerability. This can result in loss of confidential data of IceWarp Mailserver and the operating s… |
CVE-2010-5334 | High | 7.5 | 2019-10-11 | IceWarp Webclient before 10.2.1 has a directory traversal vulnerability. This can result in loss of confidential data of IceWarp Mailserver and the operating s… |
CVE-2010-5333 | Critical | 9.8 | 2019-09-13 | The web server in Integard Pro and Home before 2.0.0.9037 and 2.2.x before 2.2.0.9037 has a buffer overflow via a long password in an administration login POST… |
CVE-2010-5332 | Medium | 5.6 | 2019-07-27 | In the Linux kernel before 2.6.37, an out of bounds array access happened in drivers/net/mlx4/port.c. When searching for a free entry in either mlx4_register_v… |
CVE-2010-5331 | High | 7.8 | 2019-07-27 | In the Linux kernel before 2.6.34, a range check issue in drivers/gpu/drm/radeon/atombios.c could cause an off by one (buffer overflow) problem. NOTE: At least… |
CVE-2010-5330 | Critical | 9.8 | 2019-06-11 | On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demo… |
CVE-2010-5305 | Critical | 9.8 | 2019-03-26 | The potential exists for exposure of the product's password used to restrict unauthorized access to Rockwell PLC5/SLC5/0x/RSLogix 1785-Lx and 1747-L5x controll… |
CVE-2010-0109 | Medium | 6.5 | 2018-02-19 | DBManager in Symantec Altiris Deployment Solution 6.9.x before DS 6.9 SP4 allows remote attackers to cause a denial of service via a crafted request. |
CVE-2010-2232 | High | 7.5 | 2017-10-23 | In Apache Derby 10.1.2.1, 10.2.2.0, 10.3.1.4, and 10.4.1.3, Export processing may allow an attacker to overwrite an existing file. |
CVE-2010-3659 | Medium | 5.4 | 2017-10-20 | Multiple cross-site scripting (XSS) vulnerabilities in TYPO3 CMS 4.1.x before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4, and 4.4.x before 4.4.1 allow rem… |
CVE-2010-3050 | Medium | 6.5 | 2017-09-25 | Cisco IOS before 12.2(33)SXI allows remote authenticated users to cause a denial of service (device reboot). |
CVE-2010-3049 | Medium | 5.5 | 2017-09-25 | Cisco IOS before 12.2(33)SXI allows local users to cause a denial of service (device reboot). |
CVE-2010-3845 | Critical | 9.8 | 2017-08-08 | libapache-authenhook-perl 2.00-04 stores usernames and passwords in plaintext in the vhost error log. |
CVE-2010-2245 | High | 7.4 | 2017-08-08 | XML External Entity (XXE) vulnerability in Apache Wink 1.1.1 and earlier allows remote attackers to read arbitrary files or cause a denial of service via a cra… |
CVE-2010-1776 | Medium | 4.8 | 2017-04-24 | Find My iPhone on iOS 2.0 through 3.1.3 for iPhone 3G and later and iOS 2.1 through 3.1.3 for iPod touch (2nd generation) and later, when Find My iPhone is dis… |
CVE-2010-5329 | Medium | 5.5 | 2017-04-24 | The video_usercopy function in drivers/media/video/v4l2-ioctl.c in the Linux kernel before 2.6.39 relies on the count value of a v4l2_ext_controls data structu… |
CVE-2010-5321 | Medium | 4.3 | 2017-04-24 | Memory leak in drivers/media/video/videobuf-core.c in the videobuf subsystem in the Linux kernel 2.6.x through 4.x allows local users to cause a denial of serv… |
CVE-2010-1821 | High | 7.8 | 2017-04-13 | Apple Mac OS X 10.6 through 10.6.3 and Mac OS X Server 10.6 through 10.6.3 allows local users to obtain system privileges. |
CVE-2010-1816 | High | 7.8 | 2017-04-13 | Buffer overflow in ImageIO in Apple Mac OS X 10.6 through 10.6.3 and Mac OS X Server 10.6 through 10.6.3 allows remote attackers to execute arbitrary code or c… |
CVE-2010-4314 | High | 8.8 | 2017-03-11 | Remote attackers can use the iPrint web-browser ActiveX plugin in Novell iPrint Client before 5.42 for Windows XP/Vista/Win7 to execute code by overflowing the… |
CVE-2010-5328 | Medium | 5.5 | 2017-02-06 | include/linux/init_task.h in the Linux kernel before 2.6.35 does not prevent signals with a process group ID of zero from reaching the swapper process, which a… |
CVE-2010-5327 | High | 8.8 | 2017-01-13 | Liferay Portal through 6.2.10 allows remote authenticated users to execute arbitrary shell commands via a crafted Velocity template. |
CVE-2010-5326 | Critical | 10.0 | 2016-05-13 | The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to… |
CVE-2010-5325 | Critical | 9.8 | 2016-04-15 | Heap-based buffer overflow in the unhtmlify function in foomatic-rip in foomatic-filters before 4.0.6 allows remote attackers to cause a denial of service (mem… |
CVE-2010-5310 | | 2015-08-04 | The Acquisition Workstation for the GE Healthcare Revolution XQ/i has a password of adw3.1 for the sdc user, which has unspecified impact and attack vectors… | |
CVE-2010-5309 | | 2015-08-04 | GE Healthcare CADStream Server has a default password of confirma for the admin user, which has unspecified impact and attack vectors. | |
CVE-2010-5308 | | 2015-08-04 | GE Healthcare Optima MR360 does not require authentication for the HIPAA emergency login procedure, which allows physically proximate users to gain access via… | |
CVE-2010-5307 | | 2015-08-04 | The HIPAA configuration interface in GE Healthcare Optima MR360 has a password of (1) operator for the root account, (2) adw2.0 for the admin account, and (3)… | |
CVE-2010-5306 | | 2015-08-04 | GE Healthcare Optima CT680, CT540, CT640, and CT520 has a default password of #bigguy for the root user, which has unspecified impact and attack vectors. | |
CVE-2010-5324 | | 2015-06-07 | Directory traversal vulnerability in UploadServlet in the Remote Management component in Novell ZENworks Configuration Management (ZCM) 10 before 10.3 allows r… | |
CVE-2010-5323 | | 2015-06-07 | Directory traversal vulnerability in UploadServlet in the Remote Management component in Novell ZENworks Configuration Management (ZCM) 10 before 10.3 allows r… | |
CVE-2010-5322 | | 2015-03-11 | Cross-site scripting (XSS) vulnerability in ZeusCart 4.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter in… | |
CVE-2010-5320 | | 2015-01-03 | Multiple cross-site request forgery (CSRF) vulnerabilities in MemHT Portal 4.0.1 allow remote attackers to hijack the authentication of administrators for requ… | |
CVE-2010-5319 | | 2015-01-03 | Multiple cross-site request forgery (CSRF) vulnerabilities in Kandidat CMS 1.4.2 allow remote attackers to hijack the authentication of administrators for requ… | |
CVE-2010-5318 | | 2015-01-03 | The password-reset feature in as/index.php in SweetRice CMS before 0.6.7.1 allows remote attackers to modify the administrator's password by specifying the adm… | |
CVE-2010-5317 | | 2015-01-03 | Multiple SQL injection vulnerabilities in index.php in SweetRice CMS before 0.6.7.1 allow remote attackers to execute arbitrary SQL commands via (1) the file_n… | |
CVE-2010-5316 | | 2015-01-03 | Cross-site scripting (XSS) vulnerability in as/index.php in SweetRice CMS before 0.6.7.1 allows remote attackers to inject arbitrary web script or HTML via a t… | |
CVE-2010-5315 | | 2015-01-03 | Multiple cross-site request forgery (CSRF) vulnerabilities in BEdita before 3.1 allow remote attackers to hijack the authentication of administrators for reque… | |
CVE-2010-5314 | | 2015-01-03 | Cross-site scripting (XSS) vulnerability in controllers/home_controller.php in BEdita before 3.1 allows remote attackers to inject arbitrary web script or HTML… | |
CVE-2010-5075 | | 2014-12-28 | Integer overflow in aswFW.sys 5.0.594.0 in Avast! Internet Security 5.0 Korean Trial allows local users to cause a denial of service (memory corruption and pan… | |
CVE-2010-2062 | | 2014-12-26 | Integer underflow in the real_get_rdt_chunk function in real.c, as used in modules/access/rtsp/real.c in VideoLAN VLC media player before 1.0.1 and stream/real… | |
CVE-2010-1445 | | 2014-12-26 | Heap-based buffer overflow in VideoLAN VLC media player before 1.0.6 allows remote attackers to cause a denial of service (application crash) or possibly execu… | |
CVE-2010-1444 | | 2014-12-26 | The ZIP archive decompressor in VideoLAN VLC media player before 1.0.6 allows remote attackers to cause a denial of service (invalid memory access and applicat… | |
CVE-2010-1443 | | 2014-12-26 | The parse_track_node function in modules/demux/playlist/xspf.c in the XSPF playlist parser in VideoLAN VLC media player before 1.0.6 allows remote attackers to… | |
CVE-2010-1442 | | 2014-12-26 | VideoLAN VLC media player before 1.0.6 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly execute a… | |
CVE-2010-1441 | | 2014-12-26 | Multiple heap-based buffer overflows in VideoLAN VLC media player before 1.0.6 allow remote attackers to cause a denial of service (application crash) or possi… | |
CVE-2010-5313 | | 2014-11-30 | Race condition in arch/x86/kvm/x86.c in the Linux kernel before 2.6.38 allows L2 guest OS users to cause a denial of service (L1 guest OS crash) via a crafted… | |
CVE-2010-5312 | Medium | 6.1 | 2014-11-24 | Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web… |
CVE-2010-5077 | | 2014-10-27 | server/sv_main.c in Quake3 Arena, as used in ioquake3 before r1762, OpenArena, Tremulous, and other products, allows remote attackers to cause a denial of serv… | |
CVE-2010-4820 | | 2014-10-27 | Untrusted search path vulnerability in Ghostscript 8.62 allows local users to execute arbitrary PostScript code via a Trojan horse Postscript library file in E… | |
CVE-2010-5110 | | 2014-08-29 | DCTStream.cc in Poppler before 0.13.3 allows remote attackers to cause a denial of service (crash) via a crafted PDF file. | |
CVE-2010-5303 | | 2014-08-21 | Cross-site scripting (XSS) vulnerability in the displayError function in timthumb.php in TimThumb before 1.15 (r85), as used in multiple products, allows remot… | |
CVE-2010-5302 | | 2014-08-21 | Cross-site scripting (XSS) vulnerability in timthumb.php in TimThumb before 1.15 as of 20100908 (r88), as used in multiple products, allows remote attackers to… | |
CVE-2010-5111 | | 2014-06-16 | Multiple buffer overflows in readline.c in Echoping 6.0.2 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a… | |
CVE-2010-5301 | | 2014-06-13 | Stack-based buffer overflow in Kolibri 2.0 allows remote attackers to execute arbitrary code via a long URI in a HEAD request. | |
CVE-2010-5300 | | 2014-06-11 | Stack-based buffer overflow in Jzip 1.3 through 2.0.0.132900 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code v… | |
CVE-2010-5299 | | 2014-05-23 | Stack-based buffer overflow in MicroP 0.1.1.1600 allows remote attackers to execute arbitrary code via a crafted .mppl file. NOTE: it has been reported that t… | |
CVE-2010-4832 | | 2014-05-14 | Android OS before 2.2 does not display the correct SSL certificate in certain cases, which might allow remote attackers to spoof trusted web sites via a web pa… | |
CVE-2010-5109 | | 2014-05-05 | Off-by-one error in the DecompressRTF function in ytnef.c in Yerase's TNEF Stream Reader allows remote attackers to cause a denial of service (crash) via a cra… | |
CVE-2010-5105 | | 2014-04-27 | The undo save quit routine in the kernel in Blender 2.5, 2.63a, and earlier allows local users to overwrite arbitrary files via a symlink attack on the quit.bl… | |
CVE-2010-2236 | | 2014-04-15 | The monitoring probe display in spacewalk-java before 2.1.148-1 and Red Hat Network (RHN) Satellite 4.0.0 through 4.2.0 and 5.1.0 through 5.3.0, and Proxy 5.3… | |
CVE-2010-5298 | | 2014-04-14 | Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, allows remote attackers to inje… | |
CVE-2010-4777 | | 2014-02-10 | The Perl_reg_numbered_buff_fetch function in Perl 5.10.0, 5.12.0, 5.14.0, and other versions, when running with debugging enabled, allows context-dependent att… | |
CVE-2010-4226 | High | 7.2 | 2014-02-06 | cpio, as used in build 2007.05.10, 2010.07.28, and possibly other versions, allows remote attackers to overwrite arbitrary files via a symlink within an RPM pa… |
CVE-2010-5297 | | 2014-01-21 | WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site administrators can add users" option once changed, which might all… | |
CVE-2010-5296 | | 2014-01-21 | wp-includes/capabilities.php in WordPress before 3.0.2, when a Multisite configuration is used, does not require the Super Admin role for the delete_users capa… |