CVEs

346,031 total · page 6044 of 6,921

CVE	Vendor / Product	Risk	CVSS	EPSS	Published	Description
CVE-2010-4182	Microsoft Windows	0.02	—	0.25	Nov 4, 2010	Untrusted search path vulnerability in the Data Access Objects (DAO) library (dao360.dll) in Microsoft Windows XP Professional SP3, Windows Server 2003 R2 Enterprise Edition SP3, Windows Vista Business SP1, and Windows 7 Professional allows local users, and possibly remote…
CVE-2010-4181	Yaws Yaws	0.04	—	0.08	Nov 4, 2010	Directory traversal vulnerability in Yaws 1.89 allows remote attackers to read arbitrary files via ..\ (dot dot backslash) and other sequences.
CVE-2010-3851	Libguestfs Libguestfs	0.00	—	0.00	Nov 4, 2010	libguestfs before 1.5.23, as used in virt-v2v, virt-inspector 1.5.3 and earlier, and possibly other products, when a raw-format disk image is used, allows local guest OS administrators to read files from the host via a crafted (1) qcow2, (2) VMDK, or (3) VDI header, related to…
CVE-2010-3611	Isc DHCP	0.01	—	0.09	Nov 4, 2010	ISC DHCP server 4.0 before 4.0.2, 4.1 before 4.1.2, and 4.2 before 4.2.0-P1 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a DHCPv6 packet containing a Relay-Forward message without an address in the Relay-Forward link-address field.
CVE-2010-4155	—	0.00	—	0.01	Nov 3, 2010	Multiple cross-site scripting (XSS) vulnerabilities in eXV2 CMS 2.10 allow remote attackers to inject arbitrary web script or HTML via the (1) rssfeedURL parameter to manual/caferss/example.php and the sumb parameter to (2) modules/news/archive.php, (3) modules/news/topics.php,…
CVE-2010-4154	Rhino Software, Inc. FTP Voyager	0.00	—	0.02	Nov 3, 2010	Directory traversal vulnerability in Rhino Software, Inc. FTP Voyager 15.2.0.11, and possibly earlier, allows remote FTP servers to write arbitrary files via a "..\" (dot dot backslash) in a filename.
CVE-2010-4153	Crossftp Crossftp Pro	0.00	—	0.01	Nov 3, 2010	Directory traversal vulnerability in CrossFTP Pro 1.65a, and probably earlier, allows remote FTP servers to write arbitrary files via a "..\" (dot dot backslash) in a filename.
CVE-2010-4152	4site 4site CMS	0.03	—	0.01	Nov 3, 2010	SQL injection vulnerability in catalog/index.shtml in 4site CMS 2.6, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the cat parameter. NOTE: the i and th vectors are already covered by CVE-2009-0646.
CVE-2010-4151	Deluxebb Deluxebb	0.03	—	0.01	Nov 3, 2010	SQL injection vulnerability in misc.php in DeluxeBB 1.3, and possibly earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the xthedateformat parameter in a register action, a different vector than CVE-2005-2989,…
CVE-2010-4006	Wsn Links Wsn Links	0.03	—	0.01	Nov 3, 2010	Multiple SQL injection vulnerabilities in search.php in WSN Links 5.0.x before 5.0.81, 5.1.x before 5.1.51, and 6.0.x before 6.0.1 allow remote attackers to execute arbitrary SQL commands via the (1) namecondition or (2) namesearch parameter.
CVE-2010-3977	WordPress cforms	0.03	—	0.04	Nov 3, 2010	Multiple cross-site scripting (XSS) vulnerabilities in wp-content/plugins/cforms/lib_ajax.php in cforms WordPress plugin 11.5 allow remote attackers to inject arbitrary web script or HTML via the (1) rs and (2) rsargs[] parameters.
CVE-2010-3914	Vim Gvim	0.01	—	0.09	Nov 3, 2010	Untrusted search path vulnerability in VIM Development Group GVim before 7.3.034, and possibly other versions before 7.3.46, allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse User32.dll or other DLL…
CVE-2010-2583	SonicWall Aventail.EPInstaller	0.00	—	0.05	Nov 3, 2010	Stack-based buffer overflow in SonicWALL SSL-VPN End-Point Interrogator/Installer ActiveX control (Aventail.EPInstaller) before 10.5.2 and 10.0.5 hotfix 3 allows remote attackers to execute arbitrary code via long (1) CabURL and (2) Location arguments to the…
CVE-2010-4142	Realflex Realwin	0.08	—	0.64	Nov 2, 2010	Multiple stack-based buffer overflows in DATAC RealWin 2.0 Build 6.1.8.10 and earlier allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) SCPC_INITIALIZE, (2) SCPC_INITIALIZE_RF, or (3) SCPC_TXTEVENT packet. NOTE: it was…
CVE-2010-4106	Microfocus Insight Control for Linux	0.00	—	0.02	Nov 2, 2010	Cross-site request forgery (CSRF) vulnerability in HP Insight Control for Linux before 6.2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVE-2010-4105	Microfocus Insight Orchestration	0.00	—	0.02	Nov 2, 2010	Unspecified vulnerability in HP Insight Orchestration before 6.2 allows remote attackers to bypass intended access restrictions, and obtain sensitive information or modify data, via unknown vectors.
CVE-2010-4104	Microfocus Insight Orchestration	0.00	—	0.02	Nov 2, 2010	Unspecified vulnerability in HP Insight Orchestration before 6.2 allows remote attackers to read arbitrary files via unknown vectors.
CVE-2010-4103	Microfocus Insight Managed System Setup Wizard	0.00	—	0.03	Nov 2, 2010	Unspecified vulnerability in HP Insight Managed System Setup Wizard before 6.2 allows remote attackers to read arbitrary files via unknown vectors.
CVE-2010-4102	Microfocus Insight Recovery	0.00	—	0.02	Nov 2, 2010	Unspecified vulnerability in HP Insight Recovery before 6.2 allows remote attackers to read arbitrary files via unknown vectors.
CVE-2010-4101	Microfocus Insight Recovery	0.00	—	0.02	Nov 2, 2010	Cross-site scripting (XSS) vulnerability in HP Insight Recovery before 6.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2010-4100	Microfocus Insight Control Performance Management	0.00	—	0.02	Nov 2, 2010	Unspecified vulnerability in HP Insight Control Performance Management before 6.1 update 2 allows remote attackers to read arbitrary files via unknown vectors.
CVE-2010-4032	Microfocus Insight Control Performance Management	0.00	—	0.01	Nov 2, 2010	Cross-site request forgery (CSRF) vulnerability in HP Insight Control Performance Management before 6.2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVE-2010-4031	Microfocus Insight Control Performance Management	0.00	—	0.02	Nov 2, 2010	Unspecified vulnerability in HP Insight Control Performance Management before 6.2 allows remote authenticated users to gain privileges via unknown vectors.
CVE-2010-4030	Microfocus Insight Control Performance Management	0.00	—	0.02	Nov 2, 2010	Cross-site scripting (XSS) vulnerability in HP Insight Control Performance Management before 6.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2010-4149	Freshwebmaster Fresh FTP	0.00	—	0.02	Nov 2, 2010	Directory traversal vulnerability in FreshWebMaster Fresh FTP 5.36, 5.37, and possibly earlier, allows remote FTP servers to write arbitrary files via a "..\" (dot dot backslash) in a filename. NOTE: some of these details are obtained from third party information.
CVE-2010-4148	Anyconnect Anyconnect	0.00	—	0.02	Nov 2, 2010	Directory traversal vulnerability in AnyConnect 1.2.3.0, and possibly earlier, allows remote FTP servers to write arbitrary files via a "..\" (dot dot backslash) in a filename.
CVE-2010-4147	Pentasoft Corp. Shopping Cart	0.00	—	0.01	Nov 2, 2010	Multiple SQL injection vulnerabilities in Pentasoft Avactis Shopping Cart 1.9.1 build 8356 free edition and earlier allow remote attackers to execute arbitrary SQL commands via the User-Agent header to (1) index.php and (2) product-list.php.
CVE-2010-4146	Attachmate Reflection For The Web	0.00	—	0.01	Nov 2, 2010	Cross-site scripting (XSS) vulnerability in Attachmate Reflection for the Web 2008 R2 (builds 10.1.569 and earlier), 2008 R1, and 9.6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2010-4145	Kisisel Radyo Script Kisisel Radyo Script	0.03	—	0.03	Nov 2, 2010	Kisisel Radyo Script stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for sevvo/eco23.mdb.
CVE-2010-4144	Kisisel Radyo Script Kisisel Radyo Script	0.03	—	0.01	Nov 2, 2010	SQL injection vulnerability in radyo.asp in Kisisel Radyo Script allows remote attackers to execute arbitrary SQL commands via the Id parameter.
CVE-2010-4143	Phpcheckz Phpcheckz	0.03	—	0.01	Nov 2, 2010	SQL injection vulnerability in chart.php in phpCheckZ 1.1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2010-4090	Adobe Inc. Shockwave Player	0.00	—	0.04	Oct 29, 2010	Adobe Shockwave Player before 11.5.9.615 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
CVE-2010-4089	Adobe Inc. Shockwave Player	0.00	—	0.04	Oct 29, 2010	IML32.dll in Adobe Shockwave Player before 11.5.9.615 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a .dir file containing "duplicated LCSM entries in mmap record," a different vulnerability than CVE-2010-4087.
CVE-2010-4088	Adobe Inc. Shockwave Player	0.00	—	0.04	Oct 29, 2010	dirapi.dll in Adobe Shockwave Player before 11.5.9.615 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a .dir file with "duplicated references to the same KEY* chunk," a different vulnerability than CVE-2010-2581, CVE-2010-4084,…
CVE-2010-4087	Adobe Inc. Shockwave Player	0.00	—	0.04	Oct 29, 2010	IML32.dll in Adobe Shockwave Player before 11.5.9.615 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a .dir file with a crafted mmap record containing an invalid length of a VSWV entry, a different vulnerability than CVE-2010-4089.
CVE-2010-4086	Adobe Inc. Shockwave Player	0.00	—	0.04	Oct 29, 2010	dirapi.dll in Adobe Shockwave Player before 11.5.9.615 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Director (.dir) media file with an invalid element size, a different vulnerability than CVE-2010-2581, CVE-2010-2880,…
CVE-2010-4085	Adobe Inc. Shockwave Player	0.00	—	0.04	Oct 29, 2010	dirapi.dll in Adobe Shockwave Player before 11.5.9.615 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-2581, CVE-2010-4084, CVE-2010-4086, and CVE-2010-4088.
CVE-2010-4084	Adobe Inc. Shockwave Player	0.00	—	0.04	Oct 29, 2010	dirapi.dll in Adobe Shockwave Player before 11.5.9.615 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-2581, CVE-2010-4085, CVE-2010-4086, and CVE-2010-4088.
CVE-2010-3700	IBM Websphere Application Server	0.00	—	0.02	Oct 29, 2010	VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server (WAS) 6.1 and 7.0, allows remote attackers to bypass security constraints via a path parameter.
CVE-2010-3655	Adobe Inc. Shockwave Player	0.01	—	0.09	Oct 29, 2010	Stack-based buffer overflow in dirapi.dll in Adobe Shockwave Player before 11.5.9.615 allows attackers to execute arbitrary code via unspecified vectors.
CVE-2010-3654	Adobe Inc. Acrobat	0.09	—	0.70	Oct 29, 2010	Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris and 10.1.95.1 on Android, and authplay.dll (aka AuthPlayLib.bundle or libauthplay.so.0.0.0) in Adobe Reader and Acrobat 9.x through 9.4, allows remote attackers to execute…
CVE-2010-3036	Cisco Systems, Inc. Ciscoworks Common Services	0.00	—	0.06	Oct 29, 2010	Multiple buffer overflows in the authentication functionality in the web-server module in Cisco CiscoWorks Common Services before 4.0 allow remote attackers to execute arbitrary code via a session on TCP port (1) 443 or (2) 1741, aka Bug ID CSCti41352.
CVE-2010-2582	Adobe Inc. Shockwave Player	0.01	—	0.08	Oct 29, 2010	An unspecified function in TextXtra.x32 in Adobe Shockwave Player before 11.5.9.615 does not properly reallocate a buffer when processing a DEMX chunk in a Director file, which allows remote attackers to trigger a heap-based buffer overflow and execute arbitrary code.
CVE-2010-2581	Adobe Inc. Shockwave Player	0.00	—	0.04	Oct 29, 2010	dirapi.dll in Adobe Shockwave Player before 11.5.9.615 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a Director file containing a crafted pamm chunk with an invalid (1) size and (2) number of sub-chunks, a different…
CVE-2010-4121	IBM Tivoli Provisioning Manager OS Deployment	0.00	—	0.03	Oct 28, 2010	The TCP-to-ODBC gateway in IBM Tivoli Provisioning Manager for OS Deployment 7.1.1.3 does not require authentication for SQL statements, which allows remote attackers to modify, create, or read database records via a session on TCP port 2020. NOTE: the vendor disputes this…
CVE-2010-4120	IBM Tivoli Access Manager For E Business	0.03	—	0.03	Oct 28, 2010	Multiple cross-site scripting (XSS) vulnerabilities in the TAM console in IBM Tivoli Access Manager for e-business 6.1.0 before 6.1.0-TIV-TAM-FP0006 allow remote attackers to inject arbitrary web script or HTML via (1) the parm1 parameter to ivt/ivtserver, or the method…
CVE-2010-4029	Microfocus Storage Essentials	0.00	—	0.03	Oct 28, 2010	Unspecified vulnerability in HP Storage Essentials before 6.3.0, when LDAP authentication is enabled, allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via unknown vectors.
CVE-2010-4028	Microfocus Loadrunner	0.00	—	0.02	Oct 28, 2010	Unspecified vulnerability in LoadRunner Web Tours 9.10 in HP LoadRunner 9.1 and earlier allows remote attackers to cause a denial of service, and possibly obtain sensitive information or modify data, via unknown vectors.
CVE-2010-4027	Microfocus Palm webOS	0.00	—	0.01	Oct 28, 2010	Unspecified vulnerability in the camera application in HP Palm webOS 1.4.1 allows local users to overwrite arbitrary files via unknown vectors.
CVE-2010-4026	Microfocus Palm webOS	0.00	—	0.00	Oct 28, 2010	Unspecified vulnerability in the service API in HP Palm webOS 1.4.1 allows local users to gain privileges by leveraging the ability to perform certain service calls.

CVE-2010-4182Nov 4, 2010
Microsoft
Windows
risk 0.02cvss —epss 0.25
Untrusted search path vulnerability in the Data Access Objects (DAO) library (dao360.dll) in Microsoft Windows XP Professional SP3, Windows Server 2003 R2 Enterprise Edition SP3, Windows Vista Business SP1, and Windows 7 Professional allows local users, and possibly remote…
CVE-2010-4181Nov 4, 2010
Yaws
Yaws
risk 0.04cvss —epss 0.08
Directory traversal vulnerability in Yaws 1.89 allows remote attackers to read arbitrary files via ..\ (dot dot backslash) and other sequences.
CVE-2010-3851Nov 4, 2010
Libguestfs
Libguestfs
risk 0.00cvss —epss 0.00
libguestfs before 1.5.23, as used in virt-v2v, virt-inspector 1.5.3 and earlier, and possibly other products, when a raw-format disk image is used, allows local guest OS administrators to read files from the host via a crafted (1) qcow2, (2) VMDK, or (3) VDI header, related to…
CVE-2010-3611Nov 4, 2010
Isc
DHCP
risk 0.01cvss —epss 0.09
ISC DHCP server 4.0 before 4.0.2, 4.1 before 4.1.2, and 4.2 before 4.2.0-P1 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a DHCPv6 packet containing a Relay-Forward message without an address in the Relay-Forward link-address field.
CVE-2010-4155Nov 3, 2010
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in eXV2 CMS 2.10 allow remote attackers to inject arbitrary web script or HTML via the (1) rssfeedURL parameter to manual/caferss/example.php and the sumb parameter to (2) modules/news/archive.php, (3) modules/news/topics.php,…
CVE-2010-4154Nov 3, 2010
Rhino Software, Inc.
FTP Voyager
risk 0.00cvss —epss 0.02
Directory traversal vulnerability in Rhino Software, Inc. FTP Voyager 15.2.0.11, and possibly earlier, allows remote FTP servers to write arbitrary files via a "..\" (dot dot backslash) in a filename.
CVE-2010-4153Nov 3, 2010
Crossftp
Crossftp Pro
risk 0.00cvss —epss 0.01
Directory traversal vulnerability in CrossFTP Pro 1.65a, and probably earlier, allows remote FTP servers to write arbitrary files via a "..\" (dot dot backslash) in a filename.
CVE-2010-4152Nov 3, 2010
4site
4site CMS
risk 0.03cvss —epss 0.01
SQL injection vulnerability in catalog/index.shtml in 4site CMS 2.6, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the cat parameter. NOTE: the i and th vectors are already covered by CVE-2009-0646.
CVE-2010-4151Nov 3, 2010
Deluxebb
Deluxebb
risk 0.03cvss —epss 0.01
SQL injection vulnerability in misc.php in DeluxeBB 1.3, and possibly earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the xthedateformat parameter in a register action, a different vector than CVE-2005-2989,…
CVE-2010-4006Nov 3, 2010
Wsn Links
Wsn Links
risk 0.03cvss —epss 0.01
Multiple SQL injection vulnerabilities in search.php in WSN Links 5.0.x before 5.0.81, 5.1.x before 5.1.51, and 6.0.x before 6.0.1 allow remote attackers to execute arbitrary SQL commands via the (1) namecondition or (2) namesearch parameter.
CVE-2010-3977Nov 3, 2010
WordPress
cforms
risk 0.03cvss —epss 0.04
Multiple cross-site scripting (XSS) vulnerabilities in wp-content/plugins/cforms/lib_ajax.php in cforms WordPress plugin 11.5 allow remote attackers to inject arbitrary web script or HTML via the (1) rs and (2) rsargs[] parameters.
CVE-2010-3914Nov 3, 2010
Vim
Gvim
risk 0.01cvss —epss 0.09
Untrusted search path vulnerability in VIM Development Group GVim before 7.3.034, and possibly other versions before 7.3.46, allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse User32.dll or other DLL…
CVE-2010-2583Nov 3, 2010
SonicWall
Aventail.EPInstaller
risk 0.00cvss —epss 0.05
Stack-based buffer overflow in SonicWALL SSL-VPN End-Point Interrogator/Installer ActiveX control (Aventail.EPInstaller) before 10.5.2 and 10.0.5 hotfix 3 allows remote attackers to execute arbitrary code via long (1) CabURL and (2) Location arguments to the…
CVE-2010-4142Nov 2, 2010
Realflex
Realwin
risk 0.08cvss —epss 0.64
Multiple stack-based buffer overflows in DATAC RealWin 2.0 Build 6.1.8.10 and earlier allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) SCPC_INITIALIZE, (2) SCPC_INITIALIZE_RF, or (3) SCPC_TXTEVENT packet. NOTE: it was…
CVE-2010-4106Nov 2, 2010
Microfocus
Insight Control for Linux
risk 0.00cvss —epss 0.02
Cross-site request forgery (CSRF) vulnerability in HP Insight Control for Linux before 6.2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVE-2010-4105Nov 2, 2010
Microfocus
Insight Orchestration
risk 0.00cvss —epss 0.02
Unspecified vulnerability in HP Insight Orchestration before 6.2 allows remote attackers to bypass intended access restrictions, and obtain sensitive information or modify data, via unknown vectors.
CVE-2010-4104Nov 2, 2010
Microfocus
Insight Orchestration
risk 0.00cvss —epss 0.02
Unspecified vulnerability in HP Insight Orchestration before 6.2 allows remote attackers to read arbitrary files via unknown vectors.
CVE-2010-4103Nov 2, 2010
Microfocus
Insight Managed System Setup Wizard
risk 0.00cvss —epss 0.03
Unspecified vulnerability in HP Insight Managed System Setup Wizard before 6.2 allows remote attackers to read arbitrary files via unknown vectors.
CVE-2010-4102Nov 2, 2010
Microfocus
Insight Recovery
risk 0.00cvss —epss 0.02
Unspecified vulnerability in HP Insight Recovery before 6.2 allows remote attackers to read arbitrary files via unknown vectors.
CVE-2010-4101Nov 2, 2010
Microfocus
Insight Recovery
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in HP Insight Recovery before 6.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2010-4100Nov 2, 2010
Microfocus
Insight Control Performance Management
risk 0.00cvss —epss 0.02
Unspecified vulnerability in HP Insight Control Performance Management before 6.1 update 2 allows remote attackers to read arbitrary files via unknown vectors.
CVE-2010-4032Nov 2, 2010
Microfocus
Insight Control Performance Management
risk 0.00cvss —epss 0.01
Cross-site request forgery (CSRF) vulnerability in HP Insight Control Performance Management before 6.2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVE-2010-4031Nov 2, 2010
Microfocus
Insight Control Performance Management
risk 0.00cvss —epss 0.02
Unspecified vulnerability in HP Insight Control Performance Management before 6.2 allows remote authenticated users to gain privileges via unknown vectors.
CVE-2010-4030Nov 2, 2010
Microfocus
Insight Control Performance Management
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in HP Insight Control Performance Management before 6.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2010-4149Nov 2, 2010
Freshwebmaster
Fresh FTP
risk 0.00cvss —epss 0.02
Directory traversal vulnerability in FreshWebMaster Fresh FTP 5.36, 5.37, and possibly earlier, allows remote FTP servers to write arbitrary files via a "..\" (dot dot backslash) in a filename. NOTE: some of these details are obtained from third party information.
CVE-2010-4148Nov 2, 2010
Anyconnect
Anyconnect
risk 0.00cvss —epss 0.02
Directory traversal vulnerability in AnyConnect 1.2.3.0, and possibly earlier, allows remote FTP servers to write arbitrary files via a "..\" (dot dot backslash) in a filename.
CVE-2010-4147Nov 2, 2010
Pentasoft Corp.
Shopping Cart
risk 0.00cvss —epss 0.01
Multiple SQL injection vulnerabilities in Pentasoft Avactis Shopping Cart 1.9.1 build 8356 free edition and earlier allow remote attackers to execute arbitrary SQL commands via the User-Agent header to (1) index.php and (2) product-list.php.
CVE-2010-4146Nov 2, 2010
Attachmate
Reflection For The Web
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Attachmate Reflection for the Web 2008 R2 (builds 10.1.569 and earlier), 2008 R1, and 9.6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2010-4145Nov 2, 2010
Kisisel Radyo Script
Kisisel Radyo Script
risk 0.03cvss —epss 0.03
Kisisel Radyo Script stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for sevvo/eco23.mdb.
CVE-2010-4144Nov 2, 2010
Kisisel Radyo Script
Kisisel Radyo Script
risk 0.03cvss —epss 0.01
SQL injection vulnerability in radyo.asp in Kisisel Radyo Script allows remote attackers to execute arbitrary SQL commands via the Id parameter.
CVE-2010-4143Nov 2, 2010
Phpcheckz
Phpcheckz
risk 0.03cvss —epss 0.01
SQL injection vulnerability in chart.php in phpCheckZ 1.1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2010-4090Oct 29, 2010
Adobe Inc.
Shockwave Player
risk 0.00cvss —epss 0.04
Adobe Shockwave Player before 11.5.9.615 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
CVE-2010-4089Oct 29, 2010
Adobe Inc.
Shockwave Player
risk 0.00cvss —epss 0.04
IML32.dll in Adobe Shockwave Player before 11.5.9.615 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a .dir file containing "duplicated LCSM entries in mmap record," a different vulnerability than CVE-2010-4087.
CVE-2010-4088Oct 29, 2010
Adobe Inc.
Shockwave Player
risk 0.00cvss —epss 0.04
dirapi.dll in Adobe Shockwave Player before 11.5.9.615 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a .dir file with "duplicated references to the same KEY* chunk," a different vulnerability than CVE-2010-2581, CVE-2010-4084,…
CVE-2010-4087Oct 29, 2010
Adobe Inc.
Shockwave Player
risk 0.00cvss —epss 0.04
IML32.dll in Adobe Shockwave Player before 11.5.9.615 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a .dir file with a crafted mmap record containing an invalid length of a VSWV entry, a different vulnerability than CVE-2010-4089.
CVE-2010-4086Oct 29, 2010
Adobe Inc.
Shockwave Player
risk 0.00cvss —epss 0.04
dirapi.dll in Adobe Shockwave Player before 11.5.9.615 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Director (.dir) media file with an invalid element size, a different vulnerability than CVE-2010-2581, CVE-2010-2880,…
CVE-2010-4085Oct 29, 2010
Adobe Inc.
Shockwave Player
risk 0.00cvss —epss 0.04
dirapi.dll in Adobe Shockwave Player before 11.5.9.615 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-2581, CVE-2010-4084, CVE-2010-4086, and CVE-2010-4088.
CVE-2010-4084Oct 29, 2010
Adobe Inc.
Shockwave Player
risk 0.00cvss —epss 0.04
dirapi.dll in Adobe Shockwave Player before 11.5.9.615 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-2581, CVE-2010-4085, CVE-2010-4086, and CVE-2010-4088.
CVE-2010-3700Oct 29, 2010
IBM
Websphere Application Server
risk 0.00cvss —epss 0.02
VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server (WAS) 6.1 and 7.0, allows remote attackers to bypass security constraints via a path parameter.
CVE-2010-3655Oct 29, 2010
Adobe Inc.
Shockwave Player
risk 0.01cvss —epss 0.09
Stack-based buffer overflow in dirapi.dll in Adobe Shockwave Player before 11.5.9.615 allows attackers to execute arbitrary code via unspecified vectors.
CVE-2010-3654Oct 29, 2010
Adobe Inc.
Acrobat
risk 0.09cvss —epss 0.70
Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris and 10.1.95.1 on Android, and authplay.dll (aka AuthPlayLib.bundle or libauthplay.so.0.0.0) in Adobe Reader and Acrobat 9.x through 9.4, allows remote attackers to execute…
CVE-2010-3036Oct 29, 2010
Cisco Systems, Inc.
Ciscoworks Common Services
risk 0.00cvss —epss 0.06
Multiple buffer overflows in the authentication functionality in the web-server module in Cisco CiscoWorks Common Services before 4.0 allow remote attackers to execute arbitrary code via a session on TCP port (1) 443 or (2) 1741, aka Bug ID CSCti41352.
CVE-2010-2582Oct 29, 2010
Adobe Inc.
Shockwave Player
risk 0.01cvss —epss 0.08
An unspecified function in TextXtra.x32 in Adobe Shockwave Player before 11.5.9.615 does not properly reallocate a buffer when processing a DEMX chunk in a Director file, which allows remote attackers to trigger a heap-based buffer overflow and execute arbitrary code.
CVE-2010-2581Oct 29, 2010
Adobe Inc.
Shockwave Player
risk 0.00cvss —epss 0.04
dirapi.dll in Adobe Shockwave Player before 11.5.9.615 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a Director file containing a crafted pamm chunk with an invalid (1) size and (2) number of sub-chunks, a different…
CVE-2010-4121Oct 28, 2010
IBM
Tivoli Provisioning Manager OS Deployment
risk 0.00cvss —epss 0.03
The TCP-to-ODBC gateway in IBM Tivoli Provisioning Manager for OS Deployment 7.1.1.3 does not require authentication for SQL statements, which allows remote attackers to modify, create, or read database records via a session on TCP port 2020. NOTE: the vendor disputes this…
CVE-2010-4120Oct 28, 2010
IBM
Tivoli Access Manager For E Business
risk 0.03cvss —epss 0.03
Multiple cross-site scripting (XSS) vulnerabilities in the TAM console in IBM Tivoli Access Manager for e-business 6.1.0 before 6.1.0-TIV-TAM-FP0006 allow remote attackers to inject arbitrary web script or HTML via (1) the parm1 parameter to ivt/ivtserver, or the method…
CVE-2010-4029Oct 28, 2010
Microfocus
Storage Essentials
risk 0.00cvss —epss 0.03
Unspecified vulnerability in HP Storage Essentials before 6.3.0, when LDAP authentication is enabled, allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via unknown vectors.
CVE-2010-4028Oct 28, 2010
Microfocus
Loadrunner
risk 0.00cvss —epss 0.02
Unspecified vulnerability in LoadRunner Web Tours 9.10 in HP LoadRunner 9.1 and earlier allows remote attackers to cause a denial of service, and possibly obtain sensitive information or modify data, via unknown vectors.
CVE-2010-4027Oct 28, 2010
Microfocus
Palm webOS
risk 0.00cvss —epss 0.01
Unspecified vulnerability in the camera application in HP Palm webOS 1.4.1 allows local users to overwrite arbitrary files via unknown vectors.
CVE-2010-4026Oct 28, 2010
Microfocus
Palm webOS
risk 0.00cvss —epss 0.00
Unspecified vulnerability in the service API in HP Palm webOS 1.4.1 allows local users to gain privileges by leveraging the ability to perform certain service calls.