Security Vulnerabilities Published In April 2010

2010 : January February March April May June July August September October November December

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	# of Exploits	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2000-1245	264		Bypass	2010-04-05	2010-04-05	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Multiple unspecified vulnerabilities in NWFTPD.nlm before 5.01o in the FTP server in Novell NetWare 5.1 SP3 allow remote attackers to bypass intended restrictions on anonymous access via unknown vectors.
2	CVE-2000-1246	119		DoS Overflow	2010-04-05	2010-04-05	3.5	None	Remote	Medium	???	None	None	Partial
NWFTPD.nlm before 5.01o in the FTP server in Novell NetWare 5.1 SP3 allows remote authenticated users to cause a denial of service (abend) by sending an RNTO command after a failed RNFR command.
3	CVE-2001-1587	119		DoS Overflow	2010-04-05	2010-04-05	5.0	None	Remote	Low	Not required	None	None	Partial
NWFTPD.nlm before 5.01w in the FTP server in Novell NetWare allows remote attackers to cause a denial of service (abend) via an anonymous STOU command.
4	CVE-2002-2432			DoS	2010-04-05	2010-04-05	5.0	None	Remote	Low	Not required	None	None	Partial
Unspecified vulnerability in NWFTPD.nlm before 5.03b in the FTP server in Novell NetWare allows remote attackers to cause a denial of service (abend) via a crafted username.
5	CVE-2002-2433	20		DoS	2010-04-05	2010-06-08	4.0	None	Remote	Low	???	None	None	Partial
NWFTPD.nlm before 5.03b in the FTP server in Novell NetWare allows remote authenticated users to cause a denial of service (abend) via a crafted ABOR command.
6	CVE-2002-2434			DoS	2010-04-05	2010-06-08	5.0	None	Remote	Low	Not required	None	None	Partial
NWFTPD.nlm before 5.02i in the FTP server in Novell NetWare does not properly listen for data connections, which allows remote attackers to cause a denial of service (abend) via multiple FTP sessions.
7	CVE-2003-1591			DoS	2010-04-05	2010-06-08	4.3	None	Remote	Medium	Not required	None	None	Partial
NWFTPD.nlm in the FTP server in Novell NetWare 6.0 before SP4 and 6.5 before SP1 allows user-assisted remote attackers to cause a denial of service (console hang) via a large number of FTP sessions, which are not properly handled during an NLM unload.
8	CVE-2003-1592	119		DoS Overflow	2010-04-05	2010-04-06	5.0	None	Remote	Low	Not required	None	None	Partial
Multiple buffer overflows in NWFTPD.nlm in the FTP server in Novell NetWare 6.0 before SP4 and 6.5 before SP1 allow remote attackers to cause a denial of service (abend) via a long (1) username or (2) password.
9	CVE-2003-1593	264		Bypass	2010-04-05	2010-04-06	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
NWFTPD.nlm in the FTP server in Novell NetWare 6.0 before SP4 and 6.5 before SP1 does not enforce domain-name login restrictions, which allows remote attackers to bypass intended access control via an FTP connection.
10	CVE-2003-1594	264		Bypass	2010-04-05	2010-04-06	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
NWFTPD.nlm before 5.04.05 in the FTP server in Novell NetWare 6.5 does not properly enforce FTPREST.TXT settings, which allows remote attackers to bypass intended access restrictions via an FTP session.
11	CVE-2003-1595	264			2010-04-05	2010-04-06	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
NWFTPD.nlm before 5.04.05 in the FTP server in Novell NetWare 6.5 does not properly perform "intruder detection," which has unspecified impact and attack vectors.
12	CVE-2003-1596	264		Bypass	2010-04-05	2010-06-08	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
NWFTPD.nlm before 5.03.12 in the FTP server in Novell NetWare does not properly restrict filesystem use by anonymous users with NFS Gateway home directories, which allows remote attackers to bypass intended access restrictions via an FTP session.
13	CVE-2004-2767	264		DoS	2010-04-05	2010-04-06	4.3	None	Remote	Medium	Not required	None	None	Partial
NWFTPD.nlm before 5.04.25 in the FTP server in Novell NetWare does not promptly close DS sessions, which allows remote attackers to cause a denial of service (connection slot exhaustion) by establishing many FTP sessions that persist for the lifetime of a DS session.
14	CVE-2005-4887				2010-04-05	2010-04-06	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
NWFTPD.nlm before 5.06.05 in the FTP server in Novell NetWare 6.5 SP5 allows attackers to have an unspecified impact via vectors related to passwords.
15	CVE-2005-4888			DoS	2010-04-05	2010-04-06	5.0	None	Remote	Low	Not required	None	None	Partial
NWFTPD.nlm before 5.06.04 in the FTP server in Novell NetWare allows remote attackers to cause a denial of service (excessive stale connections) by establishing many FTP sessions, which persist in the Not-Logged-In state after each session is completed.
16	CVE-2007-6734	264			2010-04-05	2010-04-06	4.0	None	Remote	Low	???	Partial	None	None
NWFTPD.nlm before 5.08.07 in the FTP server in Novell NetWare 6.5 SP7 does not properly implement the FTPREST.TXT NOREMOTE restriction, which allows remote authenticated users to access directories outside of the home server via unspecified vectors.
17	CVE-2007-6735	264		Bypass	2010-04-05	2010-04-06	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
NWFTPD.nlm before 5.08.06 in the FTP server in Novell NetWare does not properly handle partial matches for container names in the FTPREST.TXT file, which allows remote attackers to bypass intended access restrictions via an FTP session.
18	CVE-2008-3279	264		+Priv	2010-04-05	2017-09-29	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
Untrusted search path vulnerability in libbrlttybba.so in brltty 3.7.2 allows local users to gain privileges via a crafted library, related to an incorrect RPATH setting.
19	CVE-2008-7254	22	2	Dir. Trav.	2010-04-07	2010-04-08	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Directory traversal vulnerability in includes/template-loader.php in Irmin CMS (formerly Pepsi CMS) 0.5 and 0.6 BETA2, when register_globals is enabled, allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the _Root_Path parameter. NOTE: some of these details are obtained from third party information.
20	CVE-2008-7255	255			2010-04-20	2010-06-03	4.6	None	Local	Low	Not required	Partial	Partial	Partial
login_screen.tcl in aMSN (aka Alvaro's Messenger) before 0.97.1 saves a password after logout, which allows physically proximate attackers to hijack a session by visiting an unattended workstation.
21	CVE-2009-1564	119		Exec Code Overflow	2010-04-12	2010-04-22	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Heap-based buffer overflow in vmnc.dll in the VMnc media codec in VMware Movie Decoder before 6.5.4 Build 246459 on Windows, and the movie decoder in VMware Workstation 6.5.x before 6.5.4 build 246459, VMware Player 2.5.x before 2.5.4 build 246459, and VMware Server 2.x on Windows, allows remote attackers to execute arbitrary code via an AVI file with crafted video chunks that use HexTile encoding.
22	CVE-2009-1565	119		Exec Code Overflow	2010-04-12	2010-04-22	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
vmnc.dll in the VMnc media codec in VMware Movie Decoder before 6.5.4 Build 246459 on Windows, and the movie decoder in VMware Workstation 6.5.x before 6.5.4 build 246459, VMware Player 2.5.x before 2.5.4 build 246459, and VMware Server 2.x on Windows, allows remote attackers to execute arbitrary code via an AVI file with crafted HexTile-encoded video chunks that trigger heap-based buffer overflows, related to "integer truncation errors."
23	CVE-2009-2277	79		XSS	2010-04-01	2017-09-19	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross-site scripting (XSS) vulnerability in WebAccess in VMware VirtualCenter 2.0.2 and 2.5 and VMware ESX 3.0.3 and 3.5 allows remote attackers to inject arbitrary web script or HTML via vectors related to "context data."
24	CVE-2009-2822	264		Bypass	2010-04-05	2017-08-17	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
AirPort Utility before 5.5.1 for Apple AirPort Base Station does not properly distribute MAC address ACLs to network extenders, which allows remote attackers to bypass intended access restrictions via an 802.11 authentication frame.
25	CVE-2009-2936	287		Exec Code CSRF	2010-04-05	2018-10-10	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
DISPUTED The Command Line Interface (aka Server CLI or administration interface) in the master process in the reverse proxy server in Varnish before 2.1.0 does not require authentication for commands received through a TCP port, which allows remote attackers to (1) execute arbitrary code via a vcl.inline directive that provides a VCL configuration file containing inline C code; (2) change the ownership of the master process via param.set, stop, and start directives; (3) read the initial line of an arbitrary file via a vcl.load directive; or (4) conduct cross-site request forgery (CSRF) attacks that leverage a victim's location on a trusted network and improper input validation of directives. NOTE: the vendor disputes this report, saying that it is "fundamentally misguided and pointless."
26	CVE-2009-3732	134		Exec Code	2010-04-12	2022-06-15	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Format string vulnerability in vmware-vmrc.exe build 158248 in VMware Remote Console (aka VMrc) allows remote attackers to execute arbitrary code via unspecified vectors.
27	CVE-2009-4509	94		Exec Code Bypass	2010-04-13	2018-10-10	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
The administrative web console on the TANDBERG Video Communication Server (VCS) before X4.3 uses predictable session cookies in (1) tandberg/web/lib/secure.php and (2) tandberg/web/user/lib/secure.php, which makes it easier for remote attackers to bypass authentication, and execute arbitrary code by loading a custom software update, via a crafted "Cookie: tandberg_login=" HTTP header.
28	CVE-2009-4510	310			2010-04-13	2018-08-13	8.5	None	Remote	Medium	???	Complete	Complete	Complete
The SSH service on the TANDBERG Video Communication Server (VCS) before X5.1 uses a fixed DSA key, which makes it easier for remote attackers to conduct man-in-the-middle attacks and spoof arbitrary servers via crafted SSH packets.
29	CVE-2009-4511	200		Dir. Trav. +Info	2010-04-13	2018-10-10	4.0	None	Remote	Low	???	Partial	None	None
Multiple directory traversal vulnerabilities in the web administration interface on the TANDBERG Video Communication Server (VCS) before X5.1 allow remote authenticated users to read arbitrary files via a .. (dot dot) in the page parameter to (1) helppage.php or (2) user/helppage.php.
30	CVE-2009-4737	119		Exec Code Overflow	2010-04-06	2017-08-17	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Stack-based buffer overflow in JustSystems Corporation Ichitaro 13, 2004 through 2009, Viewer 2009 19.0.1.0 and earlier, and other versions allows context-dependent attackers to execute arbitrary code via a crafted Rich Text File (RTF), related to "pvpara ffooter."
31	CVE-2009-4764	94	1	Exec Code	2010-04-05	2017-09-19	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Adobe Reader 8.x and 9.x on Windows is able to execute EXE files that are embedded in a PDF document, which makes it easier for remote attackers to trick users into executing arbitrary code via a crafted document.
32	CVE-2009-4765	264	1		2010-04-13	2010-04-14	5.0	None	Remote	Low	Not required	Partial	None	None
CNR Hikaye Portal 2.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for db/hikaye.mdb.
33	CVE-2009-4766	264	1		2010-04-13	2010-04-14	5.0	None	Remote	Low	Not required	Partial	None	None
YP Portal MS-Pro Surumu (aka MS-Pro Portal Scripti) 1.0 and 1.2 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for galeri/database/db.mdb.
34	CVE-2009-4767	79	1	XSS	2010-04-20	2017-08-17	4.3	None	Remote	Medium	Not required	None	Partial	None
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Plohni Shoutbox 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) input_name and (2) input_text parameters. NOTE: some of these details are obtained from third party information.
35	CVE-2009-4768	94		Exec Code	2010-04-20	2017-08-17	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Unspecified vulnerability in the JASS script interpreter in Warcraft III: The Frozen Throne 1.24b and earlier allows user-assisted remote attackers to execute arbitrary code via a crafted custom map. NOTE: some of these details are obtained from third party information.
36	CVE-2009-4769	134	2	Exec Code	2010-04-20	2010-06-07	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Multiple format string vulnerabilities in the tolog function in httpdx 1.4, 1.4.5, 1.4.6, 1.4.6b, and 1.5 allow (1) remote attackers to execute arbitrary code via format string specifiers in a GET request to the HTTP server component when logging is enabled, and allow (2) remote authenticated users to execute arbitrary code via format string specifiers in a PWD command to the FTP server component.
37	CVE-2009-4770	255	1		2010-04-20	2010-06-07	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The FTP server component in httpdx 1.4, 1.4.5, 1.4.6, 1.4.6b, and 1.5 has a default password of pass123 for the moderator account, which makes it easier for remote attackers to obtain privileged access.
38	CVE-2009-4771	20			2010-04-20	2017-08-17	5.0	None	Remote	Low	Not required	None	Partial	None
The PayPal Website Payments Standard functionality in the Ubercart module 5.x before 5.x-1.9 and 6.x before 6.x-2.1 for Drupal does not properly validate orders, which allows remote attackers to trigger unspecified "duplicate actions" via unknown vectors.
39	CVE-2009-4772			+Info	2010-04-20	2017-08-17	4.3	None	Remote	Medium	Not required	Partial	None	None
Unspecified vulnerability in the PayPal Website Payments Standard functionality in the Ubercart module 5.x before 5.x-1.9 and 6.x before 6.x-2.1 for Drupal, when a custom checkout completion message is enabled, allows attackers to obtain sensitive information via unknown vectors.
40	CVE-2009-4773	352		CSRF	2010-04-20	2017-08-17	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Cross-site request forgery (CSRF) vulnerability in the order-management functionality in the Ubercart module 5.x before 5.x-1.9 and 6.x before 6.x-2.1 for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
41	CVE-2009-4774			DoS	2010-04-21	2010-04-21	4.0	None	Local	High	Not required	None	None	Complete
Unspecified vulnerability in Sun Solaris 10 and OpenSolaris snv_49 through snv_117, when 64bit mode is used on the Intel x86 platform and a Linux (lx) branded zone is configured, allows local users to cause a denial of service (panic) via unspecified vectors, a different vulnerability than CVE-2007-6225.
42	CVE-2009-4775	134	1	DoS	2010-04-21	2017-09-19	4.3	None	Remote	Medium	Not required	None	None	Partial
Format string vulnerability in Ipswitch WS_FTP Professional 12 before 12.2 allows remote attackers to cause a denial of service (crash) via format string specifiers in the status code portion of an HTTP response.
43	CVE-2009-4776	119		Overflow	2010-04-21	2010-06-07	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Buffer overflow in Hitachi Cosminexus V4 through V8, Processing Kit for XML, and Developer's Kit for Java, as used in products such as uCosminexus, Electronic Form Workflow, Groupmax, and IBM XL C/C++ Enterprise Edition 7 and 8, allows remote attackers to have an unknown impact via vectors related to the use of GIF image processing APIs by a Java application, and a different issue from CVE-2007-3794.
44	CVE-2009-4777			DoS	2010-04-21	2017-08-17	4.3	None	Remote	Medium	Not required	None	None	Partial
Unspecified vulnerability in multiple versions of Hitachi JP1/Automatic Job Management System 2 - View, JP1/Integrated Management - View, and JP1/Cm2/SNMP System Observer, allows remote attackers to cause a denial of service ("abnormal" termination) via vectors related to the display of an "invalid GIF file."
45	CVE-2009-4778			DoS Exec Code Mem. Corr.	2010-04-21	2010-04-22	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Multiple unspecified vulnerabilities in the PDF distiller in the Attachment Service component in Research In Motion (RIM) BlackBerry Enterprise Server (BES) software 4.1.3 through 4.1.7 and 5.0.0, and BlackBerry Professional Software 4.1.4, allow user-assisted remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted .pdf file attachment, a different vulnerability than CVE-2008-3246, CVE-2009-0176, CVE-2009-0219, CVE-2009-2643, and CVE-2009-2646.
46	CVE-2009-4779	94	1	Exec Code File Inclusion	2010-04-21	2017-08-17	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Multiple PHP remote file inclusion vulnerabilities in NukeHall 0.3 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the spaw_root parameter to (1) blocks.php, (2) messages.php, and (3) stories.php in admin/modules/.
47	CVE-2009-4780	79		XSS	2010-04-21	2010-04-24	4.3	None	Remote	Medium	Not required	None	Partial	None
Multiple cross-site scripting (XSS) vulnerabilities in index.php in phpMyFAQ before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via (1) the lang parameter in a sitemap action, (2) the search parameter in a search action, (3) the tagging_id parameter in a search action, (4) the highlight parameter in an artikel action, (5) the artlang parameter in an artikel action, (6) the letter parameter in a sitemap action, (7) the lang parameter in a show action, (8) the cat parameter in a show action, (9) the newslang parameter in a news action, (10) the artlang parameter in a send2friend action, (11) the cat parameter in a send2friend action, (12) the id parameter in a send2friend action, (13) the srclang parameter in a translate action, (14) the id parameter in a translate action, (15) the cat parameter in a translate action, (16) the cat parameter in an add action, or (17) the question parameter in an add action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
48	CVE-2009-4781	255	1		2010-04-21	2010-04-22	7.2	None	Local	Low	Not required	Complete	Complete	Complete
TUKEVA Password Reminder before 1.0.0.4 uses a hard-coded password for rem.accdb, which allows local users to discover credentials via a DBI connection.
49	CVE-2009-4782	79	1	XSS	2010-04-21	2018-10-10	4.3	None	Remote	Medium	Not required	None	Partial	None
Multiple cross-site scripting (XSS) vulnerabilities in Theeta CMS, possibly 0.01, allow remote attackers to inject arbitrary web script or HTML via the (1) start, (2) forum, and (3) cat parameters to community/thread.php; (4) start and (5) cat parameters to community/forum.php; and (6) start parameter to blog/index.php.
50	CVE-2009-4783	89	1	Exec Code Sql	2010-04-21	2018-10-10	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Multiple SQL injection vulnerabilities in Theeta CMS, possibly 0.01, allow remote attackers to execute arbitrary SQL commands via the start parameter to (1) forum.php and (2) thread.php in community/, and (3) blog/index.php.

Total number of vulnerabilities : 501 Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11