CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In October 2010

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2010-4121 287 2010-10-28 2010-10-29
7.5
 None Remote Low Not required Partial Partial Partial
** DISPUTED ** The TCP-to-ODBC gateway in IBM Tivoli Provisioning Manager for OS Deployment 7.1.1.3 does not require authentication for SQL statements, which allows remote attackers to modify, create, or read database records via a session on TCP port 2020. NOTE: the vendor disputes this issue, stating that the "default Microsoft Access database is not password protected because it is intended to be used for evaluation purposes only."
2 CVE-2010-4120 79 XSS 2010-10-28 2017-08-17
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in the TAM console in IBM Tivoli Access Manager for e-business 6.1.0 before 6.1.0-TIV-TAM-FP0006 allow remote attackers to inject arbitrary web script or HTML via (1) the parm1 parameter to ivt/ivtserver, or the method parameter to (2) acl, (3) domain, (4) group, (5) gso, (6) gsogroup, (7) os, (8) pop, (9) rule, (10) user, or (11) webseal in ibm/wpm/.
3 CVE-2010-4099 20 1 Exec Code 2010-10-27 2017-08-17
6.8
 None Remote Medium Not required Partial Partial Partial
ess.pm in NitroSecurity NitroView ESM 8.4.0a, when ESSPMDebug is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in the Request parameter to ess.
4 CVE-2010-4098 DoS 2010-10-27 2017-08-17
5.0
 None Remote Low Not required None None Partial
monotone before 0.48.1, when configured to allow remote commands, allows remote attackers to cause a denial of service (crash) via an empty argument to the mtn command.
5 CVE-2010-4097 79 XSS 2010-10-27 2018-10-10
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Aardvark Topsites PHP 5.2.0 and 5.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) mail, (2) title, (3) u, and (4) url parameters. NOTE: the q parameter is already covered by CVE-2009-2302.
6 CVE-2010-4096 94 Exec Code 2010-10-27 2011-01-04
4.6
 None Local Low Not required Partial Partial Partial
share/ma/keys_for_user in Monkeysphere 0.31 and 0.32 allows local users to execute arbitrary code via unknown manipulations related to the "monkeysphere-authentication keys-for-user" command.
7 CVE-2010-4095 22 Dir. Trav. 2010-10-26 2018-10-10
9.3
 None Remote Medium Not required Complete Complete Complete
Directory traversal vulnerability in the FTP client in Serengeti Systems Incorporated Robo-FTP 3.7.3, and probably other versions before 3.7.5, allows remote FTP servers to write arbitrary files via a .. (dot dot) in a filename in a server response.
8 CVE-2010-4094 255 Exec Code 2010-10-26 2011-01-11
5.0
 None Remote Low Not required None Partial None
The Tomcat server in IBM Rational Quality Manager and Rational Test Lab Manager has a default password for the ADMIN account, which makes it easier for remote attackers to execute arbitrary code by leveraging access to the manager role. NOTE: this might overlap CVE-2009-3548.
9 CVE-2010-4090 119 DoS Exec Code Overflow Mem. Corr. 2010-10-29 2017-09-19
9.3
 None Remote Medium Not required Complete Complete Complete
Adobe Shockwave Player before 11.5.9.615 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
10 CVE-2010-4089 119 DoS Exec Code Overflow Mem. Corr. 2010-10-29 2018-10-10
9.3
 None Remote Medium Not required Complete Complete Complete
IML32.dll in Adobe Shockwave Player before 11.5.9.615 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a .dir file containing "duplicated LCSM entries in mmap record," a different vulnerability than CVE-2010-4087.
11 CVE-2010-4088 119 DoS Exec Code Overflow Mem. Corr. 2010-10-29 2018-10-10
9.3
 None Remote Medium Not required Complete Complete Complete
dirapi.dll in Adobe Shockwave Player before 11.5.9.615 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a .dir file with "duplicated references to the same KEY* chunk," a different vulnerability than CVE-2010-2581, CVE-2010-4084, CVE-2010-4085, and CVE-2010-4086.
12 CVE-2010-4087 119 DoS Exec Code Overflow Mem. Corr. 2010-10-29 2018-10-10
9.3
 None Remote Medium Not required Complete Complete Complete
IML32.dll in Adobe Shockwave Player before 11.5.9.615 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a .dir file with a crafted mmap record containing an invalid length of a VSWV entry, a different vulnerability than CVE-2010-4089.
13 CVE-2010-4086 119 DoS Exec Code Overflow Mem. Corr. 2010-10-29 2018-10-10
9.3
 None Remote Medium Not required Complete Complete Complete
dirapi.dll in Adobe Shockwave Player before 11.5.9.615 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Director (.dir) media file with an invalid element size, a different vulnerability than CVE-2010-2581, CVE-2010-2880, CVE-2010-4084, CVE-2010-4085, and CVE-2010-4088.
14 CVE-2010-4085 119 DoS Exec Code Overflow Mem. Corr. 2010-10-29 2017-09-19
9.3
 None Remote Medium Not required Complete Complete Complete
dirapi.dll in Adobe Shockwave Player before 11.5.9.615 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-2581, CVE-2010-4084, CVE-2010-4086, and CVE-2010-4088.
15 CVE-2010-4084 119 DoS Exec Code Overflow Mem. Corr. 2010-10-29 2017-09-19
9.3
 None Remote Medium Not required Complete Complete Complete
dirapi.dll in Adobe Shockwave Player before 11.5.9.615 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-2581, CVE-2010-4085, CVE-2010-4086, and CVE-2010-4088.
16 CVE-2010-4070 189 DoS Exec Code Overflow Mem. Corr. 2010-10-25 2010-10-27
10.0
 None Remote Low Not required Complete Complete Complete
Integer overflow in librpc.dll in portmap.exe (aka the ISM Portmapper service) in ISM before 2.20.TC1.117 in IBM Informix Dynamic Server (IDS) 7.x before 7.31.xD11, 9.x before 9.40.xC10, 10.00 before 10.00.xC8, and 11.10 before 11.10.xC2 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted parameter size, aka idsdb00146931, idsdb00146930, idsdb00146929, and idsdb00138308.
17 CVE-2010-4069 119 Exec Code Overflow 2010-10-25 2010-10-27
8.5
 None Remote Medium ??? Complete Complete Complete
Stack-based buffer overflow in IBM Informix Dynamic Server (IDS) 7.x through 7.31, 9.x through 9.40, 10.00 before 10.00.xC10, 11.10 before 11.10.xC3, and 11.50 before 11.50.xC3 allows remote authenticated users to execute arbitrary code via long DBINFO keyword arguments in a SQL statement, aka idsdb00165017, idsdb00165019, idsdb00165021, idsdb00165022, and idsdb00165023.
18 CVE-2010-4068 20 2010-10-25 2010-10-27
4.9
 None Remote Medium ??? Partial Partial None
Unspecified vulnerability in the Extension Manager in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 allows remote authenticated administrators to read and possibly modify arbitrary files via a crafted parameter, a different vulnerability than CVE-2010-3714.
19 CVE-2010-4057 189 1 DoS 2010-10-23 2017-08-17
5.0
 None Remote Low Not required None None Partial
solid.exe in IBM solidDB 6.5.0.3 and earlier does not properly perform a recursive call to a certain function upon receiving packet data containing many integer fields with two different values, which allows remote attackers to cause a denial of service (invalid memory access and daemon crash) via a TCP session on port 1315.
20 CVE-2010-4056 1 DoS 2010-10-23 2017-08-17
5.0
 None Remote Low Not required None None Partial
solid.exe in IBM solidDB 6.5.0.3 and earlier does not properly perform a recursive call to a certain function upon receiving packet data containing a single integer field, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a TCP session on port 1315.
21 CVE-2010-4055 399 1 DoS 2010-10-23 2017-08-17
5.0
 None Remote Low Not required None None Partial
Stack consumption vulnerability in solid.exe in IBM solidDB 6.5.0.3 and earlier allows remote attackers to cause a denial of service (memory consumption and daemon crash) by connecting to TCP port 1315 and sending a packet with many integer fields, which trigger many recursive calls of a certain function.
22 CVE-2010-4054 119 DoS Overflow 2010-10-23 2015-01-09
4.3
 None Remote Medium Not required None None Partial
The gs_type2_interpret function in Ghostscript allows remote attackers to cause a denial of service (incorrect pointer dereference and application crash) via crafted font data in a compressed data stream, aka bug 691043.
23 CVE-2010-4053 119 Exec Code Overflow 2010-10-23 2017-08-17
9.0
 None Remote Low ??? Complete Complete Complete
Stack-based buffer overflow in an unspecified logging function in oninit.exe in IBM Informix Dynamic Server (IDS) 11.10 before 11.10.xC2W2 and 11.50 before 11.50.xC1 allows remote authenticated users to execute arbitrary code via a crafted EXPLAIN directive, aka idsdb00154125 and idsdb00154243.
24 CVE-2010-4050 119 DoS Overflow Mem. Corr. 2010-10-21 2017-09-19
4.3
 None Remote Medium Not required None None Partial
Opera before 10.63 allows remote attackers to cause a denial of service (memory corruption) by referencing an SVG document in an IMG element.
25 CVE-2010-4049 20 DoS 2010-10-21 2017-09-19
4.3
 None Remote Medium Not required None None Partial
Opera before 10.63 allows remote attackers to cause a denial of service (application crash) via a Flash movie with a transparent Window Mode (aka wmode) property, which is not properly handled during navigation away from the containing HTML document.
26 CVE-2010-4048 20 DoS 2010-10-21 2017-09-19
4.3
 None Remote Medium Not required None None Partial
Opera before 10.63 allows user-assisted remote web servers to cause a denial of service (application crash) by sending a redirect during the saving of a file.
27 CVE-2010-4047 79 XSS 2010-10-21 2017-09-19
4.3
 None Remote Medium Not required None Partial None
Opera before 10.63 does not properly select the security context of JavaScript code associated with an error page, which allows user-assisted remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site.
28 CVE-2010-4046 200 +Info 2010-10-21 2017-09-19
4.3
 None Remote Medium Not required Partial None None
Opera before 10.63 does not properly verify the origin of video content, which allows remote attackers to obtain sensitive information by using a video stream as HTML5 canvas content.
29 CVE-2010-4045 264 Exec Code XSS 2010-10-21 2017-09-19
9.3
 None Remote Medium Not required Complete Complete Complete
Opera before 10.63 does not properly restrict web script in unspecified circumstances involving reloads and redirects, which allows remote attackers to spoof the Address Bar, conduct cross-site scripting (XSS) attacks, and possibly execute arbitrary code by leveraging the ability of a script to interact with a web page from (1) a different domain or (2) a different security context.
30 CVE-2010-4044 20 2010-10-21 2017-09-19
4.3
 None Remote Medium Not required None Partial None
Opera before 10.63 does not ensure that the portion of a URL shown in the Address Bar contains the beginning of the URL, which allows remote attackers to spoof URLs by changing a window's size.
31 CVE-2010-4043 264 +Info 2010-10-21 2017-09-19
4.3
 None Remote Medium Not required Partial None None
Opera before 10.63 does not prevent interpretation of a cross-origin document as a CSS stylesheet when the document lacks a CSS token sequence, which allows remote attackers to obtain sensitive information via a crafted document.
32 CVE-2010-4042 20 DoS 2010-10-21 2020-07-31
7.5
 None Remote Low Not required Partial Partial Partial
Google Chrome before 7.0.517.41 does not properly handle element maps, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to "stale elements."
33 CVE-2010-4041 Bypass 2010-10-21 2020-07-31
7.5
 None Remote Low Not required Partial Partial Partial
The sandbox implementation in Google Chrome before 7.0.517.41 on Linux does not properly constrain worker processes, which might allow remote attackers to bypass intended access restrictions via unspecified vectors.
34 CVE-2010-4040 20 DoS Mem. Corr. 2010-10-21 2020-07-31
6.8
 None Remote Medium Not required Partial Partial Partial
Google Chrome before 7.0.517.41 does not properly handle animated GIF images, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted image.
35 CVE-2010-4039 2010-10-21 2020-07-31
7.5
 None Remote Low Not required Partial Partial Partial
Google Chrome before 7.0.517.41 on Linux does not properly set the PATH environment variable, which has unspecified impact and attack vectors.
36 CVE-2010-4038 404 DoS 2010-10-21 2020-07-31
5.0
 None Remote Low Not required None None Partial
The Web Sockets implementation in Google Chrome before 7.0.517.41 does not properly handle a shutdown action, which allows remote attackers to cause a denial of service (application crash) via unspecified vectors.
37 CVE-2010-4037 Bypass 2010-10-21 2017-09-19
4.3
 None Remote Medium Not required None Partial None
Unspecified vulnerability in Google Chrome before 7.0.517.41 allows remote attackers to bypass the pop-up blocker via unknown vectors.
38 CVE-2010-4036 20 2010-10-21 2017-09-19
6.8
 None Remote Medium Not required Partial Partial Partial
Google Chrome before 7.0.517.41 does not properly handle the unloading of a page, which allows remote attackers to spoof URLs via unspecified vectors.
39 CVE-2010-4035 20 DoS 2010-10-21 2017-09-19
9.3
 None Remote Medium Not required Complete Complete Complete
Google Chrome before 7.0.517.41 does not properly perform autofill operations for forms, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted HTML document.
40 CVE-2010-4034 20 DoS 2010-10-21 2017-09-19
9.3
 None Remote Medium Not required Complete Complete Complete
Google Chrome before 7.0.517.41 does not properly handle forms, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted HTML document.
41 CVE-2010-4033 2010-10-21 2017-09-19
5.0
 None Remote Low Not required None Partial None
Google Chrome before 7.0.517.41 does not properly implement the autofill and autocomplete functionality, which allows remote attackers to conduct "profile spamming" attacks via unspecified vectors.
42 CVE-2010-4029 DoS +Info 2010-10-28 2011-01-04
7.5
 None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in HP Storage Essentials before 6.3.0, when LDAP authentication is enabled, allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via unknown vectors.
43 CVE-2010-4028 DoS +Info 2010-10-28 2010-11-11
7.5
 None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in LoadRunner Web Tours 9.10 in HP LoadRunner 9.1 and earlier allows remote attackers to cause a denial of service, and possibly obtain sensitive information or modify data, via unknown vectors.
44 CVE-2010-4027 2010-10-28 2010-11-11
5.6
 None Local High Not required None Complete Complete
Unspecified vulnerability in the camera application in HP Palm webOS 1.4.1 allows local users to overwrite arbitrary files via unknown vectors.
45 CVE-2010-4026 +Priv 2010-10-28 2010-11-11
6.2
 None Local High Not required Complete Complete Complete
Unspecified vulnerability in the service API in HP Palm webOS 1.4.1 allows local users to gain privileges by leveraging the ability to perform certain service calls.
46 CVE-2010-4025 Exec Code 2010-10-28 2010-11-11
9.3
 None Remote Medium Not required Complete Complete Complete
Unspecified vulnerability in Doc Viewer in HP Palm webOS 1.4.1 allows remote attackers to execute arbitrary code via a crafted document, as demonstrated by a Word document.
47 CVE-2010-4024 352 CSRF 2010-10-28 2010-11-11
6.8
 None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in HP Insight Control Power Management before 6.2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
48 CVE-2010-4023 79 XSS 2010-10-28 2010-11-11
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in HP Insight Control Power Management before 6.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
49 CVE-2010-4007 310 2010-10-20 2010-10-21
5.0
 None Remote Low Not required None Partial None
Oracle Mojarra uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack, a related issue to CVE-2010-2057.
50 CVE-2010-3994 79 XSS 2010-10-28 2010-11-06
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in HP Version Control Repository Manager (VCRM) before 6.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Total number of vulnerabilities : 435   Page : 1 (This Page)2 3 4 5 6 7 8 9
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.