CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In December 2010 (CVSS score >= 5)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2010-4641 89 Exec Code Sql 2010-12-30 2017-08-17
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in XWiki Enterprise before 2.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
2 CVE-2010-4639 89 2 Exec Code Sql 2010-12-30 2017-08-17
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in index.php in MySource Matrix allows remote attackers to execute arbitrary SQL commands via the id parameter.
3 CVE-2010-4638 89 1 Exec Code Sql 2010-12-30 2010-12-31
6.8
None Remote Medium Not required Partial Partial Partial
SQL injection vulnerability in the submitSurvey function in controller.php in JQuarks4s (com_jquarks4s) component 1.0.0 for Joomla!, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the q parameter in a submitSurvey action to index.php.
4 CVE-2010-4636 89 1 Exec Code Sql 2010-12-30 2017-08-17
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in detail.asp in Site2Nite Business e-Listings allows remote attackers to execute arbitrary SQL commands via the ID parameter.
5 CVE-2010-4635 89 2 Exec Code Sql 2010-12-30 2017-08-17
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in detail.asp in Site2Nite Vacation Rental (VRBO) Listings allows remote attackers to execute arbitrary SQL commands via the ID parameter.
6 CVE-2010-4634 22 2 Dir. Trav. 2010-12-30 2010-12-31
5.0
None Remote Low Not required Partial None None
** DISPUTED ** Directory traversal vulnerability in osTicket 1.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter to module.php, a different vector than CVE-2005-1439. NOTE: this issue has been disputed by a reliable third party.
7 CVE-2010-4633 89 2 Exec Code Sql 2010-12-30 2017-08-17
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in cart.php in digiSHOP 2.0.2 allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vulnerability than CVE-2005-4614.1.
8 CVE-2010-4632 89 2 Exec Code Sql 2010-12-30 2010-12-31
7.5
None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in ASPilot Pilot Cart 7.3 allow remote attackers to execute arbitrary SQL commands via the (1) article parameter to kb.asp, (2) specific parameter to cart.asp, (3) countrycode parameter to contact.asp, and the (4) srch parameter to search.asp. NOTE: the article parameter to pilot.asp is already covered by CVE-2008-2688.
9 CVE-2010-4629 264 DoS 2010-12-30 2017-08-17
5.0
None Remote Low Not required None None Partial
MyBB (aka MyBulletinBoard) before 1.4.12 does not properly restrict uid values for group join requests, which allows remote attackers to cause a denial of service (resource consumption) by using guest access to submit join request forms for moderated groups, related to usercp.php and managegroup.php.
10 CVE-2010-4628 DoS 2010-12-30 2017-08-17
5.0
None Remote Low Not required None None Partial
member.php in MyBB (aka MyBulletinBoard) before 1.4.12 makes a certain superfluous call to the SQL COUNT function, which allows remote attackers to cause a denial of service (resource consumption) by making requests to member.php that trigger scans of the entire users table.
11 CVE-2010-4627 352 CSRF 2010-12-30 2017-08-17
6.8
None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in usercp2.php in MyBB (aka MyBulletinBoard) before 1.4.12 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
12 CVE-2010-4626 310 2010-12-30 2017-08-17
5.1
None Remote High Not required Partial Partial Partial
The my_rand function in functions.php in MyBB (aka MyBulletinBoard) before 1.4.12 does not properly use the PHP mt_rand function, which makes it easier for remote attackers to obtain access to an arbitrary account by requesting a reset of the account's password, and then conducting a brute-force attack.
13 CVE-2010-4625 200 +Info 2010-12-30 2017-08-17
5.0
None Remote Low Not required Partial None None
MyBB (aka MyBulletinBoard) before 1.4.12 does not properly handle a configuration with a visible forum that contains hidden threads, which allows remote attackers to obtain sensitive information by reading the Latest Threads block of the Portal Page.
14 CVE-2010-4622 22 Dir. Trav. 2010-12-30 2017-08-17
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in WebSEAL in IBM Tivoli Access Manager for e-business 6.1.1 before 6.1.1-TIV-AWS-FP0001 on AIX allows remote attackers to read arbitrary files via a %uff0e%uff0e (encoded dot dot) in a URI.
15 CVE-2010-4619 89 1 Exec Code Sql 2010-12-29 2017-08-17
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in profil.php in Mafya Oyun Scrpti (aka Mafia Game Script) allows remote attackers to execute arbitrary SQL commands via the id parameter.
16 CVE-2010-4617 22 2 Dir. Trav. 2010-12-29 2017-08-17
6.8
None Remote Medium Not required Partial Partial Partial
Directory traversal vulnerability in the JotLoader (com_jotloader) component 2.2.1 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the section parameter to index.php.
17 CVE-2010-4615 89 1 Exec Code Sql 2010-12-29 2017-08-17
7.5
None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Oto Galeri Sistemi 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) arac parameter to carsdetail.asp and the (2) marka parameter to twohandscars.asp.
18 CVE-2010-4614 89 1 Exec Code Sql 2010-12-29 2010-12-30
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in item.php in Ero Auktion 2010 allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vector than CVE-2010-0723.
19 CVE-2010-4613 22 1 Dir. Trav. 2010-12-29 2010-12-30
7.5
None Remote Low Not required Partial Partial Partial
Multiple directory traversal vulnerabilities in Hycus CMS 1.0.3 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the site parameter to (1) index.php and (2) admin.php.
20 CVE-2010-4612 89 1 Exec Code Sql 2010-12-29 2018-10-10
6.8
None Remote Medium Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in index.php in Hycus CMS 1.0.3, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) user_name and (2) usr_email parameters to user/1/hregister.html, (3) usr_email parameter to user/1/hlogin.html, (4) useremail parameter to user/1/forgotpass.html, and the (5) q parameter to search/1.html. NOTE: some of these details are obtained from third party information.
21 CVE-2010-4611 200 1 +Info 2010-12-29 2017-08-17
5.0
None Remote Low Not required Partial None None
Html-edit CMS 3.1.8 allows remote attackers to obtain sensitive information via a direct request to (1) pages.php and (2) menu.php in includes/core_files and (3) extensions/login/frontend/pages/antihacker.php, which reveals the installation path in an error message.
22 CVE-2010-4609 89 1 Exec Code Sql 2010-12-29 2011-01-04
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in index.php in Html-edit CMS 3.1.8 allows remote attackers to execute arbitrary SQL commands via the nuser parameter in a registrate action.
23 CVE-2010-4608 200 1 +Info 2010-12-29 2010-12-30
5.0
None Remote Low Not required Partial None None
Habari 0.6.5 allows remote attackers to obtain sensitive information via a direct request to (1) header.php and (2) comments_items.php in system/admin/, which reveals the installation path in an error message.
24 CVE-2010-4606 94 Exec Code 2010-12-29 2011-01-04
10.0
None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in the Space Management client in the Hierarchical Storage Management (HSM) component in IBM Tivoli Storage Manager (TSM) 5.4.x before 5.4.3.4, 5.5.x before 5.5.3, 6.1.x before 6.1.4, and 6.2.x before 6.2.2 on Unix and Linux allows remote attackers to execute arbitrary commands via unknown vectors, related to a "script execution vulnerability."
25 CVE-2010-4605 2010-12-29 2011-01-04
6.6
None Local Low Not required None Complete Complete
Unspecified vulnerability in the backup-archive client in IBM Tivoli Storage Manager (TSM) 5.3.x before 5.3.6.10, 5.4.x before 5.4.3.4, 5.5.x before 5.5.3, 6.1.x before 6.1.4, and 6.2.x before 6.2.2 on Unix and Linux allows local users to overwrite arbitrary files via unknown vectors.
26 CVE-2010-4604 119 1 Overflow +Priv 2010-12-29 2018-10-10
6.9
None Local Medium Not required Complete Complete Complete
Stack-based buffer overflow in the GeneratePassword function in dsmtca (aka the Trusted Communications Agent or TCA) in the backup-archive client in IBM Tivoli Storage Manager (TSM) 5.3.x before 5.3.6.10, 5.4.x before 5.4.3.4, 5.5.x before 5.5.2.10, and 6.1.x before 6.1.3.1 on Unix and Linux allows local users to gain privileges by specifying a long LANG environment variable, and then sending a request over a pipe.
27 CVE-2010-4603 DoS 2010-12-29 2017-08-17
6.5
None Remote Low ??? Partial Partial Partial
IBM Rational ClearQuest 7.0.x before 7.0.1.11, 7.1.1.x before 7.1.1.4, and 7.1.2.x before 7.1.2.1 does not prevent modification of back-reference fields, which allows remote authenticated users to interfere with intended record relationships, and possibly cause a denial of service (loop) or have unspecified other impact, by (1) adding or (2) removing a back reference.
28 CVE-2010-4601 2010-12-29 2011-01-04
10.0
None Remote Low Not required Complete Complete Complete
Multiple unspecified vulnerabilities in IBM Rational ClearQuest 7.0.x before 7.0.1.11, 7.1.1.x before 7.1.1.4, and 7.1.2.x before 7.1.2.1 allow attackers to have an unknown impact via vectors related to third-party .ocx files.
29 CVE-2010-4600 200 +Info 2010-12-29 2011-01-04
5.0
None Remote Low Not required Partial None None
Dojo Toolkit, as used in the Web client in IBM Rational ClearQuest 7.1.1.x before 7.1.1.4 and 7.1.2.x before 7.1.2.1, allows remote attackers to read cookies by navigating to a Dojo file, related to an "open direct" issue.
30 CVE-2010-4599 +Priv 2010-12-23 2011-01-11
6.9
None Local Medium Not required Complete Complete Complete
Untrusted search path vulnerability in Ecava IntegraXor 3.6.4000.0 allows local users to gain privileges via a Trojan horse dwmapi.dll file in the current working directory. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
31 CVE-2010-4598 22 1 Dir. Trav. 2010-12-23 2011-01-14
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in Ecava IntegraXor 3.6.4000.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the file_name parameter in an open request.
32 CVE-2010-4597 119 1 Exec Code Overflow 2010-12-23 2011-01-11
10.0
None Remote Low Not required Complete Complete Complete
Stack-based buffer overflow in the save method in the IntegraXor.Project ActiveX control in igcomm.dll in Ecava IntegraXor Human-Machine Interface (HMI) before 3.5.3900.10 allows remote attackers to execute arbitrary code via a long string in the second argument.
33 CVE-2010-4595 264 Bypass 2010-12-22 2010-12-27
5.0
None Remote Low Not required None Partial None
The Connection Manager in IBM Lotus Mobile Connect before 6.1.4 disables the http.device.stanza blacklisting functionality for HTTP Access Services (HTTP-AS), which allows remote attackers to bypass intended access restrictions via an HTTP request that contains a disallowed User-Agent header.
34 CVE-2010-4588 94 Exec Code 2010-12-23 2011-01-19
9.3
None Remote Medium Not required Complete Complete Complete
The WBEMSingleView.ocx ActiveX control 1.50.1131.0 in Microsoft WMI Administrative Tools 1.1 and earlier allows remote attackers to execute arbitrary code via a crafted argument to the ReleaseContext method, a different vector than CVE-2010-3973, possibly an untrusted pointer dereference.
35 CVE-2010-4587 2010-12-22 2011-01-12
9.3
None Remote Medium Not required Complete Complete Complete
Opera before 11.00 on Windows does not properly implement the Insecure Third Party Module warning message, which might make it easier for user-assisted remote attackers to have an unspecified impact via a crafted module.
36 CVE-2010-4586 16 2010-12-22 2011-01-22
10.0
None Remote Low Not required Complete Complete Complete
The default configuration of Opera before 11.00 enables WebSockets functionality, which has unspecified impact and remote attack vectors, possibly a related issue to CVE-2010-4508.
37 CVE-2010-4585 DoS 2010-12-22 2011-01-22
5.0
None Remote Low Not required None None Partial
Unspecified vulnerability in the auto-update functionality in Opera before 11.00 allows remote attackers to cause a denial of service (application crash) by triggering an Opera Unite update.
38 CVE-2010-4582 264 Bypass 2010-12-22 2011-01-22
5.0
None Remote Low Not required None Partial None
Opera before 11.00 does not properly handle security policies during updates to extensions, which might allow remote attackers to bypass intended access restrictions via unspecified vectors.
39 CVE-2010-4581 2010-12-22 2011-01-22
10.0
None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in Opera before 11.00 has unknown impact and attack vectors, related to "a high severity issue."
40 CVE-2010-4580 200 +Info 2010-12-22 2011-01-22
5.0
None Remote Low Not required Partial None None
Opera before 11.00 does not clear WAP WML form fields after manual navigation to a new web site, which allows remote attackers to obtain sensitive information via an input field that has the same name as an input field on a previously visited web site.
41 CVE-2010-4579 2010-12-22 2011-01-22
5.0
None Remote Low Not required None Partial None
Opera before 11.00 does not properly constrain dialogs to appear on top of rendered documents, which makes it easier for remote attackers to trick users into interacting with a crafted web site that spoofs the (1) security information dialog or (2) download dialog.
42 CVE-2010-4578 DoS 2010-12-22 2020-07-28
7.5
None Remote Low Not required Partial Partial Partial
Google Chrome before 8.0.552.224 and Chrome OS before 8.0.552.343 do not properly perform cursor handling, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to "stale pointers."
43 CVE-2010-4577 125 DoS 2010-12-22 2020-07-31
5.0
None Remote Low Not required None None Partial
The CSSParser::parseFontFaceSrc function in WebCore/css/CSSParser.cpp in WebKit, as used in Google Chrome before 8.0.552.224, Chrome OS before 8.0.552.343, webkitgtk before 1.2.6, and other products does not properly parse Cascading Style Sheets (CSS) token sequences, which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted local font, related to "Type Confusion."
44 CVE-2010-4576 476 DoS 2010-12-22 2020-07-29
5.0
None Remote Low Not required None None Partial
browser/worker_host/message_port_dispatcher.cc in Google Chrome before 8.0.552.224 and Chrome OS before 8.0.552.343 does not properly handle certain postMessage calls, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted JavaScript code that creates a web worker.
45 CVE-2010-4574 502 DoS Bypass 2010-12-22 2020-07-31
7.5
None Remote Low Not required Partial Partial Partial
The Pickle::Pickle function in base/pickle.cc in Google Chrome before 8.0.552.224 and Chrome OS before 8.0.552.343 on 64-bit Linux platforms does not properly perform pointer arithmetic, which allows remote attackers to bypass message deserialization validation, and cause a denial of service or possibly have unspecified other impact, via invalid pickle data.
46 CVE-2010-4573 287 2010-12-22 2018-10-10
9.3
None Remote Medium Not required Complete Complete Complete
The Update Installer in VMware ESXi 4.1, when a modified sfcb.cfg is present, does not properly configure the SFCB authentication mode, which allows remote attackers to obtain access via an arbitrary username and password.
47 CVE-2010-4558 94 Exec Code 2010-12-17 2010-12-20
7.5
None Remote Low Not required Partial Partial Partial
phpMyFAQ 2.6.11 and 2.6.12, as distributed between December 4th and December 15th 2010, contains an externally introduced modification (Trojan Horse) in the getTopTen method in inc/Faq.php, which allows remote attackers to execute arbitrary PHP code.
48 CVE-2010-4557 119 1 DoS Exec Code Overflow 2010-12-17 2013-08-19
10.0
None Remote Low Not required Complete Complete Complete
Buffer overflow in the lm_tcp service in Invensys Wonderware InBatch 8.1 and 9.0, as used in Invensys Foxboro I/A Series Batch 8.1 and possibly other products, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted request to port 9001.
49 CVE-2010-4556 119 Exec Code Overflow 2010-12-17 2017-08-17
9.3
None Remote Medium Not required Complete Complete Complete
Stack-based buffer overflow in the SapThemeRepository ActiveX control (sapwdpcd.dll) in SAP NetWeaver Business Client allows remote attackers to execute arbitrary code via the (1) Load and (2) LoadTheme methods.
50 CVE-2010-4553 20 DoS 2010-12-16 2010-12-17
5.0
None Remote Low Not required None None Partial
An unspecified Domino API in IBM Lotus Notes Traveler before 8.5.1.1 does not properly handle MIME types, which allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors.
Total number of vulnerabilities : 249   Page : 1 (This Page)2 3 4 5
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.