CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In August 2010

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2008-7258 20 DoS 2010-08-20 2010-08-24
2.1
 None Local Low Not required None None Partial
** DISPUTED ** The standardise function in Anibal Monsalve Salazar sSMTP 2.61 and 2.62 allows local users to cause a denial of service (application exit) via an e-mail message containing a long line that begins with a . (dot) character. NOTE: CVE disputes this issue because it is solely a usability problem for senders of messages with certain long lines, and has no security impact.
2 CVE-2009-2696 79 XSS 2010-08-05 2016-10-27
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat on Red Hat Enterprise Linux 5, Desktop Workstation 5, and Linux Desktop 5 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML." NOTE: this is due to a missing fix for CVE-2009-0781.
3 CVE-2009-3737 94 Exec Code 2010-08-17 2011-07-26
9.3
 None Remote Medium Not required Complete Complete Complete
The Oracle Siebel Option Pack for IE ActiveX control does not properly initialize memory that is used by the NewBusObj method, which allows remote attackers to execute arbitrary code via a crafted HTML document.
4 CVE-2009-3743 189 DoS Exec Code Overflow Mem. Corr. 2010-08-26 2018-10-10
9.3
 None Remote Medium Not required Complete Complete Complete
Off-by-one error in the Ins_MINDEX function in the TrueType bytecode interpreter in Ghostscript before 8.71 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a malformed TrueType font in a document that trigger an integer overflow and a heap-based buffer overflow.
5 CVE-2009-4269 310 2010-08-16 2011-01-26
2.1
 None Local Low Not required Partial None None
The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.
6 CVE-2009-4896 22 Dir. Trav. 2010-08-02 2010-08-03
6.5
 None Remote Low ??? Partial Partial Partial
Multiple directory traversal vulnerabilities in the mlmmj-php-admin web interface for Mailing List Managing Made Joyful (mlmmj) 1.2.15 through 1.2.17 allow remote authenticated users to overwrite, create, or delete arbitrary files, or determine the existence of arbitrary directories, via a .. (dot dot) in a list name in a (1) edit or (2) save action.
7 CVE-2009-4975 79 XSS 2010-08-02 2017-08-17
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in webview.cpp in QtDemoBrowser allows remote attackers to inject arbitrary web script or HTML via a URL associated with a nonexistent domain name, related to a "universal XSS" issue, a similar vulnerability to CVE-2010-2536.
8 CVE-2009-4976 79 XSS 2010-08-02 2017-08-17
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in webkitpart.cpp in kwebkitpart allows remote attackers to inject arbitrary web script or HTML via a URL associated with a nonexistent domain name, related to a "universal XSS" issue, a similar vulnerability to CVE-2010-2536.
9 CVE-2009-4977 94 1 Exec Code File Inclusion 2010-08-25 2017-09-19
6.5
 None Remote Low ??? Partial Partial Partial
PHP remote file inclusion vulnerability in index.php in MyBackup 1.4.0 allows remote authenticated users to execute arbitrary PHP code via a URL in the main_content parameter.
10 CVE-2009-4978 22 1 Dir. Trav. 2010-08-25 2017-09-19
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in down.php in MyBackup 1.4.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter.
11 CVE-2009-4979 89 Exec Code Sql 2010-08-25 2010-08-25
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in search.php in Photokorn Gallery 1.81 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) where[], (2) sort, (3) order, and (4) Match parameters.
12 CVE-2009-4980 79 XSS 2010-08-25 2010-08-25
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Photokorn Gallery 1.81 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) where[] parameter to search.php and (2) qc parameter to admin.php.
13 CVE-2009-4981 352 CSRF 2010-08-25 2010-08-25
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple cross-site request forgery (CSRF) vulnerabilities in Photokorn Gallery 1.81 allow remote attackers to hijack the authentication of administrators.
14 CVE-2009-4982 89 1 Exec Code Sql 2010-08-25 2017-09-19
6.8
 None Remote Medium Not required Partial Partial Partial
SQL injection vulnerability in the select function in Irokez CMS 0.7.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the PATH_INFO to the default URI.
15 CVE-2009-4983 79 1 XSS 2010-08-25 2010-08-25
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Silurus Classifieds 1.0 allow remote attackers to inject arbitrary web script or HTML via the ID parameter to (1) category.php and (2) wcategory.php, and the (3) keywords parameter to search.php.
16 CVE-2009-4984 79 1 XSS 2010-08-25 2017-09-19
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Accessories Me PHP Affiliate Script 1.4 allow remote attackers to inject arbitrary web script or HTML via the (1) Keywords parameter to search.php and (2) SearchIndex parameter to browse.php.
17 CVE-2009-4985 89 1 Exec Code Sql 2010-08-25 2017-09-19
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in browse.php in Accessories Me PHP Affiliate Script 1.4 allows remote attackers to execute arbitrary SQL commands via the Go parameter.
18 CVE-2009-4986 22 1 Dir. Trav. 2010-08-25 2017-09-19
6.8
 None Remote Medium Not required Partial Partial Partial
Directory traversal vulnerability in index.php in In-Portal 4.3.1, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the env parameter.
19 CVE-2009-4987 287 1 Bypass 2010-08-25 2017-09-19
7.5
 None Remote Low Not required Partial Partial Partial
admin/header.php in Scripteen Free Image Hosting Script 2.3 allows remote attackers to bypass authentication and gain administrative access by setting the cookgid cookie value to 1, a different vector than CVE-2008-3211.
20 CVE-2009-4988 119 1 Exec Code Overflow 2010-08-25 2018-10-10
10.0
 None Remote Low Not required Complete Complete Complete
Stack-based buffer overflow in NT_Naming_Service.exe in SAP Business One 2005 A 6.80.123 and 6.80.320 allows remote attackers to execute arbitrary code via a long GIOP request to TCP port 30000.
21 CVE-2009-4989 79 1 XSS 2010-08-25 2010-08-25
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in index.php in AJ Auction Pro OOPD 3.0 allows remote attackers to inject arbitrary web script or HTML via the txtkeyword parameter in a search action.
22 CVE-2009-4990 79 XSS 2010-08-25 2010-08-25
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the Webform report module 5.x and 6.x for Drupal allows remote attackers to inject arbitrary web script or HTML via a submission.
23 CVE-2009-4991 79 1 XSS 2010-08-25 2010-08-25
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in users/resume_register.php in Omnistar Recruiting allows remote attackers to inject arbitrary web script or HTML via the job2 parameter.
24 CVE-2009-4992 89 1 Exec Code Sql 2010-08-25 2017-09-19
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in paidbanner.php in LM Starmail Paidmail 2.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.
25 CVE-2009-4993 94 1 Exec Code File Inclusion 2010-08-25 2017-09-19
7.5
 None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in home.php in LM Starmail Paidmail 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.
26 CVE-2009-4994 79 XSS 2010-08-25 2010-08-26
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in frmKBSearch.aspx in SmarterTools SmarterTrack before 4.0.3504 allows remote attackers to inject arbitrary web script or HTML via the search parameter.
27 CVE-2009-4995 79 XSS 2010-08-25 2010-08-26
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in frmTickets.aspx in SmarterTools SmarterTrack before 4.0.3504 allows remote attackers to inject arbitrary web script or HTML via the email address field. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
28 CVE-2010-0019 94 DoS Exec Code Mem. Corr. 2010-08-11 2018-10-12
9.3
 None Remote Medium Not required Complete Complete Complete
Microsoft Silverlight 3 before 3.0.50611.0 on Windows, and before 3.0.41130.0 on Mac OS X, does not properly handle pointers, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and framework outage) via a crafted web site, aka "Microsoft Silverlight Memory Corruption Vulnerability."
29 CVE-2010-0116 189 Exec Code Overflow 2010-08-30 2017-09-19
9.3
 None Remote Medium Not required Complete Complete Complete
Integer overflow in RealNetworks RealPlayer 11.0 through 11.1 and RealPlayer SP 1.0 through 1.1.4 on Windows might allow remote attackers to execute arbitrary code via a crafted QCP file that triggers a heap-based buffer overflow.
30 CVE-2010-0117 Exec Code 2010-08-30 2017-09-19
9.3
 None Remote Medium Not required Complete Complete Complete
RealNetworks RealPlayer 11.0 through 11.1 and RealPlayer SP 1.0 through 1.1.4 on Windows do not properly handle dimensions during YUV420 transformations, which might allow remote attackers to execute arbitrary code via crafted MP4 content.
31 CVE-2010-0120 119 Exec Code Overflow 2010-08-30 2017-09-19
9.3
 None Remote Medium Not required Complete Complete Complete
Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1 and RealPlayer SP 1.0 through 1.1.4 on Windows allows remote attackers to execute arbitrary code via large size values in QCP audio content.
32 CVE-2010-0126 119 Exec Code Overflow 2010-08-17 2013-02-07
9.3
 None Remote Medium Not required Complete Complete Complete
Heap-based buffer overflow in an unspecified library in Autonomy KeyView 10.4 and 10.9, as used in multiple IBM, Symantec, and other products, allows remote attackers to execute arbitrary code via a crafted compound file, as demonstrated using a Quattro Pro file, which is not properly handled by the Quattro speed reader (qpssr.dll).
33 CVE-2010-0131 119 Exec Code Overflow 2010-08-17 2013-02-07
9.3
 None Remote Medium Not required Complete Complete Complete
Stack-based buffer overflow in the SpreadSheet Lotus 123 reader (wkssr.dll), as used in Autonomy KeyView 10.4 and 10.9, Symantec Mail Security, and possibly other products, allows remote attackers to execute arbitrary code via unspecified vectors related to floating point conversion in unknown record types.
34 CVE-2010-0133 119 Exec Code Overflow 2010-08-17 2013-02-07
9.3
 None Remote Medium Not required Complete Complete Complete
Multiple stack-based buffer overflows in the SpreadSheet Lotus 123 reader (wkssr.dll) in Autonomy KeyView 10.4 and 10.9, as used in multiple IBM, Symantec, and other products, allow remote attackers to execute arbitrary code via unspecified vectors related to "certain records."
35 CVE-2010-0134 189 Exec Code Overflow 2010-08-17 2013-02-07
9.3
 None Remote Medium Not required Complete Complete Complete
Integer signedness error in rtfsr.dll in Autonomy KeyView 10.4 and 10.9, as used in multiple IBM, Symantec, and other products, allows remote attackers to execute arbitrary code via a crafted \ls keyword in a list override table entry in an RTF file, which triggers a buffer overflow.
36 CVE-2010-0135 119 Exec Code Overflow 2010-08-17 2013-02-07
9.3
 None Remote Medium Not required Complete Complete Complete
Heap-based buffer overflow in the WordPerfect 5.x reader (wosr.dll), as used in Autonomy KeyView 10.4 and 10.9 and possibly other products, allows remote attackers to execute arbitrary code via unspecified vectors related to "data blocks."
37 CVE-2010-0209 94 DoS Exec Code Mem. Corr. 2010-08-11 2018-10-30
9.3
 None Remote Medium Not required Complete Complete Complete
Adobe Flash Player before 9.0.280 and 10.x before 10.1.82.76, and Adobe AIR before 2.0.3, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-2213, CVE-2010-2214, and CVE-2010-2216.
38 CVE-2010-0428 20 DoS +Priv 2010-08-24 2010-08-25
6.6
 None Local Medium ??? Complete Complete Complete
libspice, as used in QEMU-KVM in the Hypervisor (aka rhev-hypervisor) in Red Hat Enterprise Virtualization (RHEV) 2.2 and qspice 0.3.0, does not properly validate guest QXL driver pointers, which allows guest OS users to cause a denial of service (invalid pointer dereference and guest OS crash) or possibly gain privileges via unspecified vectors.
39 CVE-2010-0429 264 DoS +Priv 2010-08-24 2010-08-25
6.6
 None Local Medium ??? Complete Complete Complete
libspice, as used in QEMU-KVM in the Hypervisor (aka rhev-hypervisor) in Red Hat Enterprise Virtualization (RHEV) 2.2 and qspice 0.3.0, does not properly restrict the addresses upon which memory-management actions are performed, which allows guest OS users to cause a denial of service (guest OS crash) or possibly gain privileges via unspecified vectors.
40 CVE-2010-0431 20 DoS +Priv 2010-08-24 2010-08-25
6.6
 None Local Medium ??? Complete Complete Complete
QEMU-KVM, as used in the Hypervisor (aka rhev-hypervisor) in Red Hat Enterprise Virtualization (RHEV) 2.2 and KVM 83, does not properly validate guest QXL driver pointers, which allows guest OS users to cause a denial of service (invalid pointer dereference and guest OS crash) or possibly gain privileges via unspecified vectors.
41 CVE-2010-0435 DoS 2010-08-24 2011-01-19
4.6
 None Local Low ??? None None Complete
The Hypervisor (aka rhev-hypervisor) in Red Hat Enterprise Virtualization (RHEV) 2.2, and KVM 83, when the Intel VT-x extension is enabled, allows guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) via vectors related to instruction emulation.
42 CVE-2010-0834 287 Exec Code 2010-08-10 2010-08-10
9.3
 None Remote Medium Not required Complete Complete Complete
The base-files package before 5.0.0ubuntu7.1 on Ubuntu 9.10 and before 5.0.0ubuntu20.10.04.2 on Ubuntu 10.04 LTS, as shipped on Dell Latitude 2110 netbooks, does not require authentication for package installation, which allows remote archive servers and man-in-the-middle attackers to execute arbitrary code via a crafted package.
43 CVE-2010-1172 264 DoS Bypass 2010-08-20 2017-08-17
3.6
 None Local Low Not required None Partial Partial
DBus-GLib 0.73 disregards the access flag of exported GObject properties, which allows local users to bypass intended access restrictions and possibly cause a denial of service by modifying properties, as demonstrated by properties of the (1) DeviceKit-Power, (2) NetworkManager, and (3) ModemManager services.
44 CVE-2010-1258 200 Exec Code +Info 2010-08-11 2021-07-23
4.3
 None Remote Medium Not required Partial None None
Microsoft Internet Explorer 6, 7, and 8 does not properly determine the origin of script code, which allows remote attackers to execute script in an unintended domain or security zone, and obtain sensitive information, via unspecified vectors, aka "Event Handler Cross-Domain Vulnerability."
45 CVE-2010-1386 264 2010-08-19 2011-08-23
10.0
 None Remote Low Not required Complete Complete Complete
page/Geolocation.cpp in WebCore in WebKit before r56188 and before 1.2.5 does not properly restrict access to the lastPosition function, which has unspecified impact and remote attack vectors, aka rdar problem 7746357.
46 CVE-2010-1516 189 Exec Code Overflow 2010-08-17 2018-10-10
9.3
 None Remote Medium Not required Complete Complete Complete
Multiple integer overflows in SWFTools 0.9.1 allow remote attackers to execute arbitrary code via (1) a crafted PNG file, related to the getPNG function in lib/png.c; or (2) a crafted JPEG file, related to the jpeg_load function in lib/jpeg.c.
47 CVE-2010-1517 20 2010-08-02 2010-08-03
10.0
 None Remote Low Not required Complete Complete Complete
The GIGABYTE Dldrv2 ActiveX control 1.4.206.11 allows remote attackers to (1) download arbitrary programs onto a client system, and execute these programs, via vectors involving the dl method; and (2) download arbitrary programs onto a client system via vectors involving the SetDLInfo method in conjunction with the Bdl method.
48 CVE-2010-1518 20 DoS Exec Code Mem. Corr. 2010-08-02 2010-08-03
10.0
 None Remote Low Not required Complete Complete Complete
Array index error in the SetDLInfo method in the GIGABYTE Dldrv2 ActiveX control 1.4.206.11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via the item argument.
49 CVE-2010-1519 189 Exec Code Overflow 2010-08-16 2018-10-10
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple integer overflows in glpng.c in glpng 1.45 allow context-dependent attackers to execute arbitrary code via a crafted PNG image, related to (1) the pngLoadRawF function and (2) the pngLoadF function, leading to heap-based buffer overflows.
50 CVE-2010-1524 119 Exec Code Overflow Mem. Corr. 2010-08-17 2013-02-07
9.3
 None Remote Medium Not required Complete Complete Complete
The SpreadSheet Lotus 123 reader (wkssr.dll) in Autonomy KeyView 10.4 and 10.9, as used in multiple IBM, Symantec, and other products, allows remote attackers to execute arbitrary code via unspecified vectors related to allocation of an array of pointers and "string indexing," which triggers memory corruption.
Total number of vulnerabilities : 381   Page : 1 (This Page)2 3 4 5 6 7 8
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.