CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In January 2010 (CVSS score >= 7)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2010-0459 89 2 Exec Code Sql 2010-01-28 2017-08-17
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Mochigames (com_mochigames) component 0.51 and possibly other versions for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.
2 CVE-2010-0458 89 2 Exec Code Sql 2010-01-28 2017-08-17
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in NetArt Media Blog System 1.5 allow remote attackers to execute arbitrary SQL commands via the (1) cat parameter to index.php and the (2) note parameter to blog.php.
3 CVE-2010-0457 89 2 Exec Code Sql 2010-01-28 2017-08-17
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in home.php in magic-portal 2.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
4 CVE-2010-0456 89 1 Exec Code Sql 2010-01-28 2017-08-17
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the indianpulse Game Server (com_gameserver) component 1.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the grp parameter in a gameserver action to index.php.
5 CVE-2010-0454 89 1 Exec Code Sql 2010-01-28 2018-10-10
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in cgi/cgilua.exe/sys/start.htm in Publique! 2.3 allows remote attackers to execute arbitrary SQL commands via the sid parameter.
6 CVE-2010-0392 119 Exec Code Overflow 2010-01-26 2018-10-10
9.3
 None Remote Medium Not required Complete Complete Complete
Stack-based buffer overflow in vpnconf.exe in TheGreenBow IPSec VPN Client 4.51.001, 4.65.003, and possibly other versions, allows user-assisted remote attackers to execute arbitrary code via a long OpenScriptAfterUp parameter in a policy (.tgb) file, related to "phase 2."
7 CVE-2010-0391 119 Exec Code Overflow 2010-01-26 2011-01-12
7.5
 None Remote Low Not required Partial Partial Partial
Multiple stack-based buffer overflows in Embarcadero Technologies InterBase SMP 2009 9.0.3.437 allow remote attackers to execute arbitrary code via unknown vectors involving crafted packets. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
8 CVE-2010-0388 134 DoS 2010-01-25 2017-08-17
7.5
 None Remote Low Not required Partial Partial Partial
Format string vulnerability in the WebDAV implementation in webservd in Sun Java System Web Server 7.0 Update 6 allows remote attackers to cause a denial of service (daemon crash) and possibly have unspecified other impact via format string specifiers in the encoding attribute of the XML declaration in a PROPFIND request.
9 CVE-2010-0387 119 DoS Overflow 2010-01-25 2017-08-17
7.5
 None Remote Low Not required Partial Partial Partial
Multiple heap-based buffer overflows in (1) webservd and (2) the admin server in Sun Java System Web Server 7.0 Update 7 allow remote attackers to cause a denial of service (daemon crash) and possibly have unspecified other impact via a long string in an "Authorization: Digest" HTTP header.
10 CVE-2010-0382 2010-01-22 2017-09-19
7.6
 None Remote High Not required Complete Complete Complete
ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P5, 9.5 before 9.5.2-P2, 9.6 before 9.6.1-P3, and 9.7.0 beta handles out-of-bailiwick data accompanying a secure response without re-fetching from the original source, which allows remote attackers to have an unspecified impact via a crafted response, aka Bug 20819. NOTE: this vulnerability exists because of a regression during the fix for CVE-2009-4022.
11 CVE-2010-0381 89 Exec Code Sql 2010-01-22 2010-01-25
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in modules/arcade/index.php in PHP MySpace Gold Edition 8.0 and 8.10 allows remote attackers to execute arbitrary SQL commands via the gid parameter in a show_stats action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
12 CVE-2010-0379 Exec Code 2010-01-21 2017-09-19
9.3
 None Remote Medium Not required Complete Complete Complete
Multiple unspecified vulnerabilities in the Macromedia Flash ActiveX control in Adobe Flash Player 6, as distributed in Microsoft Windows XP SP2 and SP3, might allow remote attackers to execute arbitrary code via unspecified vectors that are not related to the use-after-free "Movie Unloading Vulnerability" (CVE-2010-0378). NOTE: due to lack of details, it is not clear whether this overlaps any other CVE item.
13 CVE-2010-0378 Exec Code Mem. Corr. 2010-01-21 2017-09-19
9.3
 None Remote Medium Not required Complete Complete Complete
Use-after-free vulnerability in Adobe Flash Player 6.0.79, as distributed in Microsoft Windows XP SP2 and SP3, allows remote attackers to execute arbitrary code by unloading a Flash object that is currently being accessed by a script, leading to memory corruption, aka a "Movie Unloading Vulnerability."
14 CVE-2010-0377 89 1 Exec Code Sql 2010-01-21 2010-01-22
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in modules/arcade/index.php in PHP MySpace Gold Edition 8.0 and 8.10 allows remote attackers to execute arbitrary SQL commands via the gid parameter in a play_game action. NOTE: some of these details are obtained from third party information.
15 CVE-2010-0375 89 1 Exec Code Sql 2010-01-21 2017-08-17
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in product_list.php in JCE-Tech PHP Calendars, downloaded 2010-01-11, allows remote attackers to execute arbitrary SQL commands via the cat parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
16 CVE-2010-0373 89 2 Exec Code Sql 2010-01-21 2017-08-17
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the libros (com_libros) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action to index.php.
17 CVE-2010-0372 89 2 Exec Code Sql 2010-01-21 2017-08-17
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Articlemanager (com_articlemanager) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the artid parameter in a display action to index.php.
18 CVE-2010-0367 94 1 Exec Code File Inclusion 2010-01-21 2017-08-17
7.5
 None Remote Low Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in BitScripts Bits Video Script 2.05 Gold Beta, and possibly 2.04, allow remote attackers to execute arbitrary PHP code via a URL in the rowptem[template] parameter to (1) showcasesearch.php and (2) showcase2search.php.
19 CVE-2010-0364 119 1 Exec Code Overflow 2010-01-21 2017-09-19
9.3
 None Remote Medium Not required Complete Complete Complete
Stack-based buffer overflow in VideoLAN VLC Media Player 0.8.6 allows user-assisted remote attackers to execute arbitrary code via an ogg file with a crafted Advanced SubStation Alpha Subtitle (.ass) file, probably involving the Dialogue field.
20 CVE-2010-0361 119 DoS Overflow 2010-01-20 2011-04-28
10.0
 None Remote Low Not required Complete Complete Complete
Stack-based buffer overflow in the WebDAV implementation in webservd in Sun Java System Web Server (aka SJWS) 7.0 Update 7 allows remote attackers to cause a denial of service (daemon crash) and possibly have unspecified other impact via a long URI in an HTTP OPTIONS request.
21 CVE-2010-0360 20 Overflow 2010-01-20 2011-04-28
10.0
 None Remote Low Not required Complete Complete Complete
Sun Java System Web Server (aka SJWS) 7.0 Update 7 allows remote attackers to overwrite memory locations in the heap, and discover the contents of memory locations, via a malformed HTTP TRACE request that includes a long URI and many empty headers, related to an "overflow." NOTE: this might overlap CVE-2010-0272 and CVE-2010-0273.
22 CVE-2010-0359 119 DoS Exec Code Overflow 2010-01-20 2010-01-21
10.0
 None Remote Low Not required Complete Complete Complete
Buffer overflow in the SSLv2 support in Zeus Web Server before 4.3r5 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a long string in an invalid Client Hello message.
23 CVE-2010-0358 119 DoS Overflow 2010-01-20 2011-04-28
10.0
 None Remote Low Not required Complete Complete Complete
Heap-based buffer overflow in the server in IBM Lotus Domino 7 and 8.5 FP1 allows remote attackers to cause a denial of service (daemon exit) and possibly have unspecified other impact via a long string in a crafted LDAP message to a TCP port, a different vulnerability than CVE-2009-3087.
24 CVE-2010-0356 119 Exec Code Overflow 2010-01-18 2017-08-17
9.3
 None Remote Medium Not required Complete Complete Complete
Stack-based buffer overflow in the MOVIEPLAYER.MoviePlayerCtrl.1 ActiveX control in MoviePlayer.ocx 6.8.0.0 in Viscom Software Movie Player Pro SDK ActiveX 6.8 allows remote attackers to execute arbitrary code via a long strFontName parameter to the DrawText method.
25 CVE-2010-0350 22 Dir. Trav. 2010-01-15 2011-05-02
7.5
 None Remote Low Not required Partial Partial Partial
Directory traversal vulnerability in the Photo Book (goof_fotoboek) extension 1.7.14 and earlier for TYPO3 has unknown impact and remote attack vectors.
26 CVE-2010-0344 89 Exec Code Sql 2010-01-15 2011-04-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the zak_store_management extension 1.0.0 and earlier TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
27 CVE-2010-0343 89 Exec Code Sql 2010-01-15 2011-04-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Clan Users List (pb_clanlist) extension 0.0.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
28 CVE-2010-0342 89 Exec Code Sql 2010-01-15 2011-04-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Reports for Job (job_reports) extension 0.1.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
29 CVE-2010-0341 89 Exec Code Sql 2010-01-15 2011-04-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the BB Simple Jobs (bb_simplejobs) extension 0.1.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
30 CVE-2010-0340 89 Exec Code Sql 2010-01-15 2011-04-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the MJS Event Pro (mjseventpro) extension 0.2.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
31 CVE-2010-0339 89 Exec Code Sql 2010-01-15 2011-04-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the User Links (vm19_userlinks) extension 0.1.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
32 CVE-2010-0338 89 Exec Code Sql 2010-01-15 2011-02-01
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the TT_Products editor (ttpedit) extension 0.0.2 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
33 CVE-2010-0337 89 Exec Code Sql 2010-01-15 2011-04-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the tt_news Mail alert (dl3_tt_news_alerts) extension 0.2.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
34 CVE-2010-0334 89 Exec Code Sql 2010-01-15 2011-07-25
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Vote rank for news (vote_for_tt_news) extension 1.0.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
35 CVE-2010-0333 89 Exec Code Sql 2010-01-15 2011-07-26
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Helpdesk (mg_help) extension 1.1.6 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
36 CVE-2010-0332 89 Exec Code Sql 2010-01-15 2011-08-08
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the TV21 Talkshow (tv21_talkshow) extension 1.0.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
37 CVE-2010-0330 89 Exec Code Sql 2010-01-15 2010-01-18
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Googlemaps for tt_news (jf_easymaps) extension 1.0.2 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
38 CVE-2010-0329 89 Exec Code Sql 2010-01-15 2011-08-08
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the powermail extension 1.5.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to the "SQL selection field" and "typoscript."
39 CVE-2010-0324 89 Exec Code Sql 2010-01-15 2010-01-18
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Customer Reference List (ref_list) extension 1.0.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
40 CVE-2010-0323 +Info 2010-01-15 2010-01-18
7.8
 None Remote Low Not required Complete None None
Unspecified vulnerability in the Photo Book (goof_fotoboek) extension 1.7.14 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unknown attack vectors.
41 CVE-2010-0322 89 Exec Code Sql 2010-01-15 2010-01-18
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the init function in MK-AnydropdownMenu (mk_anydropdownmenu) extension 0.3.28 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
42 CVE-2010-0317 399 1 DoS 2010-01-15 2018-10-10
7.8
 None Remote Low Not required None None Complete
Novell Netware 6.5 SP8 allows remote attackers to cause a denial of service (NULL pointer dereference, memory consumption, ABEND, and crash) via a large number of malformed or AFP requests that are not properly handled by (1) the CIFS functionality in CIFS.nlm Semantic Agent (Build 163 MP) 3.27 or (2) the AFP functionality in AFPTCP.nlm Build 163 SP 3.27. NOTE: some of these details are obtained from third party information.
43 CVE-2010-0316 189 DoS Exec Code Overflow Mem. Corr. 2010-01-15 2011-08-08
9.3
 None Remote Medium Not required Complete Complete Complete
Integer overflow in Google SketchUp before 7.1 M2 allows remote attackers to cause a denial of service (heap memory corruption) or possibly execute arbitrary code via a crafted SKP file.
44 CVE-2010-0280 189 DoS Exec Code Mem. Corr. 2010-01-15 2018-10-10
9.3
 None Remote Medium Not required Complete Complete Complete
Array index error in Jan Eric Kyprianidis lib3ds 1.x, as used in Google SketchUp 7.x before 7.1 M2, allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted structures in a 3DS file, probably related to mesh.c.
45 CVE-2010-0276 2010-01-09 2017-08-17
10.0
 None Remote Low Not required Complete Complete Complete
IBM Lotus iNotes (aka Domino Web Access or DWA) before 229.241 for Domino 8.0.2 FP3 does not properly handle navigation of the "Try Lotus iNotes anyway" link from the page that reports use of an unsupported browser, which has unspecified impact and attack vectors, aka SPR LSHR7TBMQU.
46 CVE-2010-0275 2010-01-09 2017-08-17
10.0
 None Remote Low Not required Complete Complete Complete
Ultra-light Mode in IBM Lotus iNotes (aka Domino Web Access or DWA) before 229.241 for Domino 8.0.2 FP3 does not properly handle script commands in the status-alerts URL, which has unspecified impact and attack vectors, aka SPR LSHR7TBM58.
47 CVE-2010-0274 2010-01-09 2017-08-17
10.0
 None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in the Edit Contact scene in Ultra-light Mode in IBM Lotus iNotes (aka Domino Web Access or DWA) before 229.241 for Domino 8.0.2 FP3 has unknown impact and attack vectors, aka SPR LSHR7TBLY5.
48 CVE-2010-0273 Exec Code 2010-01-08 2010-01-11
7.5
 None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in Sun Java System Web Server 7.0 Update 6 on Linux allows remote attackers to execute arbitrary code by sending a process memory address and crafted data to TCP port 80, as demonstrated by the vd_sjws2 module in VulnDisco. NOTE: as of 20100106, this disclosure has no actionable information. However, because the VulnDisco author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
49 CVE-2010-0272 119 Overflow 2010-01-08 2017-08-17
7.5
 None Remote Low Not required Partial Partial Partial
Heap-based buffer overflow in Sun Java System Web Server 7.0 Update 6 on Linux allows remote attackers to discover process memory locations via crafted data to TCP port 80, as demonstrated by the vd_sjws2 module in VulnDisco. NOTE: as of 20100106, this disclosure has no actionable information. However, because the VulnDisco author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
50 CVE-2010-0249 399 1 Exec Code Mem. Corr. 2010-01-15 2018-10-30
9.3
 None Remote Medium Not required Complete Complete Complete
Use-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2003 SP2; Windows Vista Gold, SP1, and SP2; Windows Server 2008 Gold, SP2, and R2; and Windows 7 allows remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object, related to incorrectly initialized memory and improper handling of objects in memory, as exploited in the wild in December 2009 and January 2010 during Operation Aurora, aka "HTML Object Memory Corruption Vulnerability."
Total number of vulnerabilities : 157   Page : 1 (This Page)2 3 4
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.