CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In July 2010 (CVSS score >= 7)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2009-4897 119 DoS Exec Code Overflow Mem. Corr. 2010-07-22 2017-08-17
9.3
None Remote Medium Not required Complete Complete Complete
Buffer overflow in gs/psi/iscan.c in Ghostscript 8.64 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted PDF document containing a long name.
2 CVE-2009-4927 287 1 Bypass 2010-07-12 2017-09-19
7.5
None Remote Low Not required Partial Partial Partial
WB News 2.1.2 allows remote attackers to bypass authentication and gain administrative access via a modified WBNEWS cookie, as demonstrated by setting this cookie to 1.
3 CVE-2009-4928 94 1 Exec Code File Inclusion 2010-07-12 2017-09-19
7.5
None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in config.php in TotalCalendar 2.4 allows remote attackers to execute arbitrary PHP code via a URL in the inc_dir parameter, a different vector than CVE-2006-1922 and CVE-2006-7055.
4 CVE-2009-4929 287 1 2010-07-12 2017-09-19
7.5
None Remote Low Not required Partial Partial Partial
admin/manage_users.php in TotalCalendar 2.4 does not require administrative authentication, which allows remote attackers to change arbitrary passwords via the newPW1 and newPW2 parameters.
5 CVE-2009-4933 89 1 Exec Code Sql 2010-07-12 2017-09-19
7.5
None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in login.php in EZ Webitor allow remote attackers to execute arbitrary SQL commands via the (1) txtUserId (Username) and (2) txtPassword (Password) parameters. NOTE: some of these details are obtained from third party information.
6 CVE-2009-4935 89 1 Exec Code Sql 2010-07-12 2017-09-19
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in ogp_show.php in Online Guestbook Pro allows remote attackers to execute arbitrary SQL commands via the display parameter.
7 CVE-2009-4936 89 1 Exec Code Sql 2010-07-22 2018-10-10
7.5
None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Small Pirate (SPirate) 2.1 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter to the default URI in an rss .xml action, or the id parameter to (2) pag1.php, (3) pag1-guest.php, (4) rss-comment_post.php (aka rss-coment_post.php), or (5) rss-pic-comment.php.
8 CVE-2009-4938 89 1 Exec Code Sql 2010-07-22 2017-09-19
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the JVideo! (com_jvideo) component 0.3.11c Beta and 0.3.x for Joomla! allows remote attackers to execute arbitrary SQL commands via the user_id parameter in a user action to index.php.
9 CVE-2009-4940 89 1 Exec Code Sql 2010-07-22 2017-09-19
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in index.php in Zeus Cart 2.3 and earlier allows remote attackers to execute arbitrary SQL commands via the maincatid parameter in a showmaincatlanding action.
10 CVE-2009-4945 255 2010-07-22 2018-10-10
7.5
None Remote Low Not required Partial Partial Partial
AdPeeps 8.5d1 has a default password of admin for the admin account, which makes it easier for remote attackers to obtain access via requests to index.php.
11 CVE-2009-4947 89 Exec Code Sql 2010-07-22 2018-10-10
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in frmLoginPwdReminderPopup.aspx in Q2 Solutions ConnX 4.0.20080606 allows remote attackers to execute arbitrary SQL commands via the txtEmail parameter.
12 CVE-2009-4949 89 Exec Code Sql 2010-07-22 2010-07-23
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Store Locator extension before 1.2.8 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
13 CVE-2009-4950 89 Exec Code Sql 2010-07-22 2010-07-23
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the A21glossary Advanced Output (a21glossary_advanced_output) extension before 0.1.12 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
14 CVE-2009-4952 22 Dir. Trav. 2010-07-22 2010-07-23
10.0
None Remote Low Not required Complete Complete Complete
Directory traversal vulnerability in the Directory Listing (dir_listing) extension 1.1.0 and earlier for TYPO3 allows remote attackers to have an unspecified impact via unknown vectors.
15 CVE-2009-4954 89 Exec Code Sql 2010-07-22 2010-07-23
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Versatile Calendar Extension [VCE] (sk_calendar) extension before 0.3.4 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
16 CVE-2009-4955 89 Exec Code Sql 2010-07-22 2010-07-23
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the ultraCards (th_ultracards) extension before 0.5.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
17 CVE-2009-4957 22 1 Dir. Trav. 2010-07-22 2017-09-19
7.5
None Remote Low Not required Partial Partial Partial
Directory traversal vulnerability in loadpanel.php in Interspire ActiveKB allows remote attackers to read arbitrary files and possibly have unspecified other impact via directory traversal sequences in the Panel parameter.
18 CVE-2009-4958 89 1 Exec Code Sql 2010-07-28 2017-09-19
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in video.php in EMO Breeder Manager (aka EMO Breader Manager) allows remote attackers to execute arbitrary SQL commands via the idd parameter.
19 CVE-2009-4959 89 Exec Code Sql 2010-07-28 2010-07-28
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the T3M E-Mail Marketing Tool (t3m) extension 0.2.4 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
20 CVE-2009-4962 119 1 Exec Code Overflow 2010-07-28 2017-09-19
9.3
None Remote Medium Not required Complete Complete Complete
Stack-based buffer overflow in Fat Player 0.6b allows remote attackers to execute arbitrary code via a long string in a .wav file. NOTE: some of these details are obtained from third party information.
21 CVE-2009-4964 119 1 Exec Code Overflow 2010-07-28 2017-09-19
9.3
None Remote Medium Not required Complete Complete Complete
Stack-based buffer overflow in KSP 2006 FINAL allows remote attackers to execute arbitrary code via a long string in a .M3U playlist file.
22 CVE-2009-4965 89 Exec Code Sql 2010-07-28 2010-07-28
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the AIRware Lexicon (air_lexicon) extension 0.0.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
23 CVE-2009-4966 89 Exec Code Sql 2010-07-28 2010-07-28
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the AST ZipCodeSearch (ast_addresszipsearch) extension 0.5.4 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
24 CVE-2009-4967 89 Exec Code Sql 2010-07-28 2010-07-28
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Car (car) extension before 0.1.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
25 CVE-2009-4968 89 Exec Code Sql 2010-07-28 2010-07-28
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Event Registration (event_registr) extension 1.0.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
26 CVE-2009-4969 89 Exec Code Sql 2010-07-28 2010-07-28
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Solidbase Bannermanagement (SBbanner) extension 1.0.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
27 CVE-2009-4970 89 Exec Code Sql 2010-07-28 2010-07-28
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the t3m_affiliate extension 0.5.0 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
28 CVE-2009-4971 89 Exec Code Sql 2010-07-28 2010-07-28
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the AJAX Chat (vjchat) extension before 0.3.3 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
29 CVE-2009-4973 89 1 Exec Code Sql 2010-07-28 2017-09-19
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in rss.php in TotalCalendar 2.4 allows remote attackers to execute arbitrary SQL commands via the selectedCal parameter in a SwitchCal action.
30 CVE-2009-4974 22 1 Dir. Trav. 2010-07-28 2017-09-19
7.5
None Remote Low Not required Partial Partial Partial
Directory traversal vulnerability in box_display.php in TotalCalendar 2.4 allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the box parameter.
31 CVE-2010-0083 2010-07-13 2012-10-23
7.6
None Remote High Not required Complete Complete Complete
Unspecified vulnerability in Oracle OpenSolaris 8, 9, and 10 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
32 CVE-2010-0266 94 Exec Code 2010-07-15 2018-10-12
9.3
None Remote Medium Not required Complete Complete Complete
Microsoft Office Outlook 2002 SP3, 2003 SP3, and 2007 SP1 and SP2 does not properly verify e-mail attachments with a PR_ATTACH_METHOD property value of ATTACH_BY_REFERENCE, which allows user-assisted remote attackers to execute arbitrary code via a crafted message, aka "Microsoft Outlook SMB Attachment Vulnerability."
33 CVE-2010-0814 94 Exec Code 2010-07-15 2018-10-12
9.3
None Remote Medium Not required Complete Complete Complete
The Microsoft Access Wizard Controls in ACCWIZ.dll in Microsoft Office Access 2003 SP3 and 2007 SP1 and SP2 do not properly interact with the memory-allocation approach used by Internet Explorer during instantiation, which allows remote attackers to execute arbitrary code via a web site that references multiple ActiveX controls, as demonstrated by the ImexGrid and FieldList controls, aka "Access ActiveX Control Vulnerability."
34 CVE-2010-0833 287 Bypass 2010-07-28 2018-10-10
9.3
None Remote Medium Not required Complete Complete Complete
The pam_lsass library in Likewise Open 5.4 and CIFS 5.4 before build 8046, and 6.0 before build 8234, as used in HP StorageWorks X9000 Network Storage Systems and possibly other products, uses "SetPassword logic" when running as part of a root service, which allows remote attackers to bypass authentication for a Likewise Security Authority (lsassd) account whose password is marked as expired.
35 CVE-2010-0873 2010-07-13 2012-10-23
10.0
None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in the Data Server component in Oracle TimesTen In-Memory Database 7.0.6.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
36 CVE-2010-0898 2010-07-13 2012-10-23
10.0
None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in Oracle Secure Backup 10.3.0.1 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
37 CVE-2010-0899 2010-07-13 2012-10-23
9.0
None Remote Low ??? Complete Complete Complete
Unspecified vulnerability in Oracle Secure Backup 10.3.0.1 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2010-0898, CVE-2010-0907, and CVE-2010-0906.
38 CVE-2010-0903 2010-07-13 2012-10-23
7.8
None Remote Low Not required None None Complete
Unspecified vulnerability in the Net Foundation Layer component in Oracle Database Server 9.2.0.8, 10.1.0.5, 10.2.0.4, 11.1.0.7, and 11.2.0.1, when running on Windows, allows remote attackers to affect availability via unknown vectors.
39 CVE-2010-0906 2010-07-13 2012-10-23
9.0
None Remote Low ??? Complete Complete Complete
Unspecified vulnerability in Oracle Secure Backup 10.3.0.1 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.
40 CVE-2010-0907 2010-07-13 2012-10-23
10.0
None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in Oracle Secure Backup 10.3.0.1 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2010-0898, CVE-2010-0899, CVE-2010-0904, and CVE-2010-0906.
41 CVE-2010-0908 2010-07-13 2012-10-23
7.5
None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 12.1.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
42 CVE-2010-0911 2010-07-13 2012-10-23
7.8
None Remote Low Not required None None Complete
Unspecified vulnerability in the Listener component in Oracle Database Server 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.4, 11.1.0.7, and 11.2.0.1 allows remote attackers to affect availability via unknown vectors.
43 CVE-2010-1208 399 Exec Code 2010-07-30 2017-09-19
9.3
None Remote Medium Not required Complete Complete Complete
Use-after-free vulnerability in the attribute-cloning functionality in the DOM implementation in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, and SeaMonkey before 2.0.6, allows remote attackers to execute arbitrary code via vectors related to deletion of an event attribute node with a nonzero reference count.
44 CVE-2010-1209 399 Exec Code 2010-07-30 2017-09-19
9.3
None Remote Medium Not required Complete Complete Complete
Use-after-free vulnerability in the NodeIterator implementation in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, and SeaMonkey before 2.0.6, allows remote attackers to execute arbitrary code via a crafted NodeFilter that detaches DOM nodes, related to the NodeIterator interface and a javascript callback.
45 CVE-2010-1211 DoS Exec Code Mem. Corr. 2010-07-30 2017-09-19
9.3
None Remote Medium Not required Complete Complete Complete
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1, and SeaMonkey before 2.0.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
46 CVE-2010-1212 119 DoS Exec Code Overflow Mem. Corr. 2010-07-30 2017-09-19
9.3
None Remote Medium Not required Complete Complete Complete
js/src/jstracer.cpp in the browser engine in Mozilla Firefox 3.6.x before 3.6.7 and Thunderbird 3.1.x before 3.1.1 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to (1) propagation of deep aborts in the TraceRecorder::record_JSOP_BINDNAME function, (2) depth handling in the TraceRecorder::record_JSOP_GETELEM function, and (3) tracing of out-of-range arguments in the TraceRecorder::record_JSOP_ARGSUB function.
47 CVE-2010-1214 189 Exec Code Overflow 2010-07-30 2017-09-19
9.3
None Remote Medium Not required Complete Complete Complete
Integer overflow in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, and SeaMonkey before 2.0.6, allows remote attackers to execute arbitrary code via plugin content with many parameter elements.
48 CVE-2010-1327 89 Exec Code Sql 2010-07-06 2017-08-17
7.5
None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in TornadoStore 1.4.3 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the marca parameter to precios.php3 or (2) the where parameter in a delivery_courier action to control/abm_list.php3.
49 CVE-2010-1522 89 Exec Code Sql 2010-07-02 2018-10-10
7.5
None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in the BookLibrary Basic (com_booklibrary) component 1.5.3 before 1.5.3_2010_06_20 for Joomla! allow remote attackers to execute arbitrary SQL commands via the bid[] parameter in a (1) lend_request or (2) save_lend_request action to index.php, the id parameter in a (3) mdownload or (4) downitsf action to index.php, or (5) the searchtext parameter in a search action to index.php.
50 CVE-2010-1574 264 +Info 2010-07-08 2017-08-17
10.0
None Remote Low Not required Complete Complete Complete
IOS 12.2(52)SE and 12.2(52)SE1 on Cisco Industrial Ethernet (IE) 3000 series switches has (1) a community name of public for RO access and (2) a community name of private for RW access, which makes it easier for remote attackers to modify the configuration or obtain potentially sensitive information via SNMP requests, aka Bug ID CSCtf25589.
Total number of vulnerabilities : 162   Page : 1 (This Page)2 3 4
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.