CVEs

385,866 total · page 6854 of 7,718

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	KEV	Published	Description
CVE-2010-1326	March Hare Cvs Suite		0.00	—	0.05		Sep 15, 2010	perms.cpp in March Hare Software CVSNT 2.0.58, 2.5.01, 2.5.02, 2.5.03 before build 3736, 2.5.04 before build 2862; CVS Suite 2.5.03, 2008 before build 3736, and 2009 before 3729 allows remote attackers to bypass the permissions check, modify arbitrary modules and directories…
CVE-2010-2799	Dest Unreach Socat		0.00	—	0.03		Sep 14, 2010	Stack-based buffer overflow in the nestlex function in nestlex.c in Socat 1.5.0.0 through 1.7.1.2 and 2.0.0-b1 through 2.0.0-b3, when bidirectional data relay is enabled, allows context-dependent attackers to execute arbitrary code via long command-line arguments.
CVE-2010-3082	Djangoproject Django		0.00	—	0.02		Sep 14, 2010	Cross-site scripting (XSS) vulnerability in Django 1.2.x before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via a csrfmiddlewaretoken (aka csrf_token) cookie.
CVE-2010-2961	Scott James Remnant Mountall		0.03	—	0.00		Sep 14, 2010	mountall.c in mountall before 2.15.2 uses 0666 permissions for the root.rules file, which allows local users to gain privileges by modifying this file.
CVE-2010-2953	Apache Couchdb		0.00	—	0.01		Sep 14, 2010	Untrusted search path vulnerability in a certain Debian GNU/Linux patch for the couchdb script in CouchDB 0.8.0 allows local users to gain privileges via a crafted shared library in the current working directory.
CVE-2010-3323	Splunk Splunk		0.00	—	0.01		Sep 14, 2010	Splunk 4.0.0 through 4.1.4 allows remote attackers to conduct session hijacking attacks and obtain the splunkd session key via vectors related to the SPLUNKD_SESSION_KEY parameter.
CVE-2010-3322	Splunk Splunk	Hig	0.57	8.8	0.01		Sep 14, 2010	The XML parser in Splunk 4.0.0 through 4.1.4 allows remote authenticated users to obtain sensitive information and gain privileges via an XML External Entity (XXE) attack to unknown vectors.
CVE-2010-0155	IBM Proventia Network Mail Security System Virtual Appliance		0.00	—	0.01		Sep 14, 2010	CRLF injection vulnerability in load.php in the Local Management Interface (LMI) on the IBM Proventia Network Mail Security System (PNMSS) appliance with firmware before 2.5 allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting…
CVE-2010-0154	IBM Proventia Network Mail Security System Virtual Appliance		0.00	—	0.01		Sep 14, 2010	Directory traversal vulnerability in sla/index.php in the Local Management Interface (LMI) on the IBM Proventia Network Mail Security System (PNMSS) appliance with firmware before 2.5 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the l…
CVE-2010-0153	IBM Proventia Network Mail Security System Virtual Appliance		0.00	—	0.01		Sep 14, 2010	Multiple cross-site request forgery (CSRF) vulnerabilities in the Local Management Interface (LMI) on the IBM Proventia Network Mail Security System (PNMSS) appliance with firmware before 2.5.0.2 allow remote attackers to hijack the authentication of administrators for requests…
CVE-2010-0152	IBM Proventia Network Mail Security System Virtual Appliance		0.00	—	0.01		Sep 14, 2010	Multiple cross-site scripting (XSS) vulnerabilities in the Local Management Interface (LMI) on the IBM Proventia Network Mail Security System (PNMSS) appliance with firmware before 2.5.0.2 allow remote attackers to inject arbitrary web script or HTML via (1) the date1 parameter…
CVE-2010-3320	IBM Records Manager		0.00	—	0.01		Sep 13, 2010	Open redirect vulnerability in IBM Records Manager (RM) 4.5.x before 4.5.1.1-IER-FP001 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVE-2010-3319	IBM Records Manager		0.00	—	0.01		Sep 13, 2010	IBM Records Manager (RM) 4.5.x before 4.5.1.1-IER-FP001 places a session token in the URI, which might allow remote attackers to obtain sensitive information by reading a Referer log file.
CVE-2010-3318	IBM Records Manager		0.00	—	0.01		Sep 13, 2010	IBM Records Manager (RM) 4.5.x before 4.5.1.1-IER-FP001 transmits passwords in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network.
CVE-2010-3317	IBM Records Manager		0.00	—	0.01		Sep 13, 2010	Cross-site scripting (XSS) vulnerability in IBM Records Manager (RM) 4.5.x before 4.5.1.1-IER-FP001 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2010-3202	Flock Flock		0.03	—	0.01		Sep 13, 2010	Cross-site scripting (XSS) vulnerability in Flock Browser 3.0.0.3989 allows remote attackers to inject arbitrary web script or HTML via a crafted bookmark.
CVE-2010-3008	Microfocus Data Protector Express		0.00	—	0.01		Sep 13, 2010	Unspecified vulnerability in HP Data Protector Express, and Data Protector Express Single Server Edition (SSE), 3.x before build 56936 and 4.x before build 56906 on Windows allows local users to gain privileges or cause a denial of service via unknown vectors, a different…
CVE-2010-2952	Apache trafficserver		0.00	—	0.03		Sep 13, 2010	Apache Traffic Server before 2.0.1, and 2.1.x before 2.1.2-unstable, does not properly choose DNS source ports and transaction IDs, and does not properly use DNS query fields to validate responses, which makes it easier for man-in-the-middle attackers to poison the internal DNS…
CVE-2010-2366	Futomi Access Analyzer Cgi		0.00	—	0.01		Sep 13, 2010	Cross-site scripting (XSS) vulnerability in futomi CGI Cafe Access Analyzer CGI Professional, and Standard 4.0.2 and earlier, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2010-3263	PhpMyAdmin phpMyAdmin		0.00	—	0.02		Sep 10, 2010	Cross-site scripting (XSS) vulnerability in setup/frames/index.inc.php in the setup script in phpMyAdmin 3.x before 3.3.7 allows remote attackers to inject arbitrary web script or HTML via a server name.
CVE-2010-3199	Tortoisesvn Tortoisesvn		0.00	—	0.04		Sep 10, 2010	Untrusted search path vulnerability in TortoiseSVN 1.6.10, Build 19898 and earlier allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same folder as a file that is…
CVE-2010-3006	Microfocus ProLiant G6 Lights-Out 100 Remote Management card		0.00	—	0.02		Sep 10, 2010	Unspecified vulnerability on the HP ProLiant G6 Lights-Out 100 Remote Management card with firmware before 4.06 allows remote attackers to cause a denial of service via unknown vectors.
CVE-2010-2956	Todd Miller Sudo		0.00	—	0.00		Sep 10, 2010	Sudo 1.7.0 through 1.7.4p3, when a Runas group is configured, does not properly handle use of the -u option in conjunction with the -g option, which allows local users to gain privileges via a command line containing a "-u root" sequence.
CVE-2010-2949	Quagga (software) Quagga		0.00	—	0.03		Sep 10, 2010	bgpd in Quagga before 0.99.17 does not properly parse AS paths, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an unknown AS type in an AS path attribute in a BGP UPDATE message.
CVE-2010-2948	Quagga (software) Quagga		0.00	—	0.04		Sep 10, 2010	Stack-based buffer overflow in the bgp_route_refresh_receive function in bgp_packet.c in bgpd in Quagga before 0.99.17 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a malformed Outbound Route Filtering (ORF)…
CVE-2010-1807	Webkitgtk Webkitgtk		0.08	—	0.61		Sep 10, 2010	WebKit in Apple Safari 4.x before 4.1.2 and 5.x before 5.0.2; Android before 2.2; and webkitgtk before 1.2.6; does not properly validate floating-point data, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted…
CVE-2010-1806	Apple Inc. Safari		0.00	—	0.05		Sep 10, 2010	Use-after-free vulnerability in Apple Safari 4.x before 4.1.2 and 5.x before 5.0.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via run-in styling in an element, related to object pointers.
CVE-2010-1805	Apple Inc. Safari		0.00	—	0.00		Sep 10, 2010	Untrusted search path vulnerability in Apple Safari 4.x before 4.1.2 and 5.x before 5.0.2 on Windows allows local users to gain privileges via a Trojan horse explorer.exe (aka Windows Explorer) program in a directory containing a file that had been downloaded by Safari.
CVE-2010-3034	Cisco Systems, Inc. Wireless Lan Controller Software		0.00	—	0.01		Sep 10, 2010	Cisco Wireless LAN Controller (WLC) software, possibly 6.0.x or possibly 4.1 through 6.0.x, allows remote attackers to bypass ACLs in the controller CPU, and consequently send network traffic to unintended segments or devices, via unspecified vectors, a different vulnerability…
CVE-2010-3033	Cisco Systems, Inc. Wireless Lan Controller Software		0.00	—	0.01		Sep 10, 2010	Cisco Wireless LAN Controller (WLC) software, possibly 4.2 through 6.0, allows remote authenticated users to bypass intended access restrictions and modify the configuration, and possibly obtain administrative privileges, via unspecified vectors, a different vulnerability than…
CVE-2010-3003	Microfocus Insight Diagnostics		0.03	—	0.05		Sep 10, 2010	Cross-site scripting (XSS) vulnerability in HP Insight Diagnostics Online Edition before 8.5.0-11 on Linux allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2010-2957	S9y Serendipity		0.00	—	0.01		Sep 10, 2010	Cross-site scripting (XSS) vulnerability in Serendipity before 1.5.4, when "Remember me" logins are enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2010-2843	Cisco Systems, Inc. Wireless Lan Controller Software		0.00	—	0.01		Sep 10, 2010	Cisco Wireless LAN Controller (WLC) software, possibly 4.2 through 6.0, allows remote authenticated users to bypass intended access restrictions and modify the configuration, and possibly obtain administrative privileges, via unspecified vectors, a different vulnerability than…
CVE-2010-2842	Cisco Systems, Inc. Wireless Lan Controller Software		0.00	—	0.01		Sep 10, 2010	Cisco Wireless LAN Controller (WLC) software, possibly 4.2 through 6.0, allows remote authenticated users to bypass intended access restrictions and modify the configuration, and possibly obtain administrative privileges, via unspecified vectors, a different vulnerability than…
CVE-2010-2841	Cisco Systems, Inc. Wireless Lan Controller Software		0.00	—	0.01		Sep 10, 2010	Unspecified vulnerability in Cisco Wireless LAN Controller (WLC) software 4.2 before 4.2.209.0; 4.2M before 4.2.207.54M; 5.0, 5.1, and 6.0 before 6.0.196.0; and 5.2 before 5.2.193.11 allows remote authenticated users to cause a denial of service (device reload) via crafted HTTP…
CVE-2010-0575	Cisco Systems, Inc. Wireless Lan Controller Software		0.00	—	0.01		Sep 10, 2010	Cisco Wireless LAN Controller (WLC) software, possibly 6.0.x or possibly 4.1 through 6.0.x, allows remote attackers to bypass ACLs in the controller CPU, and consequently send network traffic to unintended segments or devices, via unspecified vectors, a different vulnerability…
CVE-2010-0574	Cisco Systems, Inc. Wireless Lan Controller Software		0.00	—	0.01		Sep 10, 2010	Unspecified vulnerability in Cisco Wireless LAN Controller (WLC) software 3.2 before 3.2.215.0; 4.1 and 4.2 before 4.2.205.0; 4.1M and 4.2M before 4.2.207.54M; 5.0, 5.1, and 6.0 before 6.0.188.0; and 5.2 before 5.2.193.11 allows remote attackers to cause a denial of service…
CVE-2010-3018	Rsa Access Manager Server		0.00	—	0.01		Sep 9, 2010	RSA Access Manager Server 5.5.3 before 5.5.3.172, 6.0.4 before 6.0.4.53, and 6.1 before 6.1.2.01 does not properly perform cache updates, which allows remote attackers to obtain sensitive information via unspecified vectors.
CVE-2010-3017	Rsa Access Manager Agent		0.00	—	0.01		Sep 9, 2010	Unspecified vulnerability in RSA Access Manager Agent 4.7.1 before 4.7.1.7, when RSA Adaptive Authentication Integration is enabled, allows remote attackers to bypass authentication and obtain sensitive information via unknown vectors.
CVE-2010-3007	Microfocus Data Protector Express		0.03	—	0.06		Sep 9, 2010	Unspecified vulnerability in HP Data Protector Express, and Data Protector Express Single Server Edition (SSE), 3.x before build 56936 and 4.x before build 56906 allows local users to gain privileges or cause a denial of service via unknown vectors.
CVE-2010-2883	Adobe Inc. Acrobat	Hig	0.69	7.3	0.81	KEV	Sep 9, 2010	Stack-based buffer overflow in CoolType.dll in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PDF document with a long field in a…
CVE-2010-1817	Apple Inc. iOS		0.00	—	0.03		Sep 9, 2010	Buffer overflow in ImageIO in Apple iOS before 4.1 on the iPhone and iPod touch allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted GIF file.
CVE-2010-1815	Webkitgtk Webkitgtk		0.00	—	0.04		Sep 9, 2010	Use-after-free vulnerability in WebKit in Apple iOS before 4.1 on the iPhone and iPod touch, and webkitgtk before 1.2.6, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving scrollbars.
CVE-2010-1814	Webkitgtk Webkitgtk		0.00	—	0.04		Sep 9, 2010	WebKit in Apple iOS before 4.1 on the iPhone and iPod touch, and webkitgtk before 1.2.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors involving form menus.
CVE-2010-1813	Apple Inc. Webkit		0.04	—	0.10		Sep 9, 2010	WebKit in Apple iOS before 4.1 on the iPhone and iPod touch allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors involving HTML object outlines.
CVE-2010-1812	Webkitgtk Webkitgtk		0.00	—	0.04		Sep 9, 2010	Use-after-free vulnerability in WebKit in Apple iOS before 4.1 on the iPhone and iPod touch, and webkitgtk before 1.2.6, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving selections.
CVE-2010-1811	Apple Inc. iOS		0.00	—	0.03		Sep 9, 2010	ImageIO in Apple iOS before 4.1 on the iPhone and iPod touch allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted TIFF file.
CVE-2010-1810	Apple Inc. iOS		0.00	—	0.01		Sep 9, 2010	FaceTime in Apple iOS before 4.1 on the iPhone and iPod touch does not properly handle invalid X.509 certificates, which allows man-in-the-middle attackers to redirect calls via a crafted certificate.
CVE-2010-1809	Apple Inc. iOS		0.00	—	0.02		Sep 9, 2010	The Accessibility component in Apple iOS before 4.1 on the iPhone and iPod touch does not perform the expected VoiceOver announcement associated with the location services icon, which has unspecified impact and attack vectors.
CVE-2010-1781	Apple Inc. iOS		0.00	—	0.04		Sep 9, 2010	Double free vulnerability in WebKit in Apple iOS before 4.1 on the iPhone and iPod touch allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to the rendering of an inline element.

CVE-2010-1326Sep 15, 2010
March Hare
Cvs Suite
risk 0.00cvss —epss 0.05
perms.cpp in March Hare Software CVSNT 2.0.58, 2.5.01, 2.5.02, 2.5.03 before build 3736, 2.5.04 before build 2862; CVS Suite 2.5.03, 2008 before build 3736, and 2009 before 3729 allows remote attackers to bypass the permissions check, modify arbitrary modules and directories…
CVE-2010-2799Sep 14, 2010
Dest Unreach
Socat
risk 0.00cvss —epss 0.03
Stack-based buffer overflow in the nestlex function in nestlex.c in Socat 1.5.0.0 through 1.7.1.2 and 2.0.0-b1 through 2.0.0-b3, when bidirectional data relay is enabled, allows context-dependent attackers to execute arbitrary code via long command-line arguments.
CVE-2010-3082Sep 14, 2010
Djangoproject
Django
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in Django 1.2.x before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via a csrfmiddlewaretoken (aka csrf_token) cookie.
CVE-2010-2961Sep 14, 2010
Scott James Remnant
Mountall
risk 0.03cvss —epss 0.00
mountall.c in mountall before 2.15.2 uses 0666 permissions for the root.rules file, which allows local users to gain privileges by modifying this file.
CVE-2010-2953Sep 14, 2010
Apache
Couchdb
risk 0.00cvss —epss 0.01
Untrusted search path vulnerability in a certain Debian GNU/Linux patch for the couchdb script in CouchDB 0.8.0 allows local users to gain privileges via a crafted shared library in the current working directory.
CVE-2010-3323Sep 14, 2010
Splunk
Splunk
risk 0.00cvss —epss 0.01
Splunk 4.0.0 through 4.1.4 allows remote attackers to conduct session hijacking attacks and obtain the splunkd session key via vectors related to the SPLUNKD_SESSION_KEY parameter.
CVE-2010-3322HigSep 14, 2010
Splunk
Splunk
risk 0.57cvss 8.8epss 0.01
The XML parser in Splunk 4.0.0 through 4.1.4 allows remote authenticated users to obtain sensitive information and gain privileges via an XML External Entity (XXE) attack to unknown vectors.
CVE-2010-0155Sep 14, 2010
IBM
Proventia Network Mail Security System Virtual Appliance
risk 0.00cvss —epss 0.01
CRLF injection vulnerability in load.php in the Local Management Interface (LMI) on the IBM Proventia Network Mail Security System (PNMSS) appliance with firmware before 2.5 allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting…
CVE-2010-0154Sep 14, 2010
IBM
Proventia Network Mail Security System Virtual Appliance
risk 0.00cvss —epss 0.01
Directory traversal vulnerability in sla/index.php in the Local Management Interface (LMI) on the IBM Proventia Network Mail Security System (PNMSS) appliance with firmware before 2.5 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the l…
CVE-2010-0153Sep 14, 2010
IBM
Proventia Network Mail Security System Virtual Appliance
risk 0.00cvss —epss 0.01
Multiple cross-site request forgery (CSRF) vulnerabilities in the Local Management Interface (LMI) on the IBM Proventia Network Mail Security System (PNMSS) appliance with firmware before 2.5.0.2 allow remote attackers to hijack the authentication of administrators for requests…
CVE-2010-0152Sep 14, 2010
IBM
Proventia Network Mail Security System Virtual Appliance
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in the Local Management Interface (LMI) on the IBM Proventia Network Mail Security System (PNMSS) appliance with firmware before 2.5.0.2 allow remote attackers to inject arbitrary web script or HTML via (1) the date1 parameter…
CVE-2010-3320Sep 13, 2010
IBM
Records Manager
risk 0.00cvss —epss 0.01
Open redirect vulnerability in IBM Records Manager (RM) 4.5.x before 4.5.1.1-IER-FP001 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVE-2010-3319Sep 13, 2010
IBM
Records Manager
risk 0.00cvss —epss 0.01
IBM Records Manager (RM) 4.5.x before 4.5.1.1-IER-FP001 places a session token in the URI, which might allow remote attackers to obtain sensitive information by reading a Referer log file.
CVE-2010-3318Sep 13, 2010
IBM
Records Manager
risk 0.00cvss —epss 0.01
IBM Records Manager (RM) 4.5.x before 4.5.1.1-IER-FP001 transmits passwords in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network.
CVE-2010-3317Sep 13, 2010
IBM
Records Manager
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in IBM Records Manager (RM) 4.5.x before 4.5.1.1-IER-FP001 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2010-3202Sep 13, 2010
Flock
Flock
risk 0.03cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Flock Browser 3.0.0.3989 allows remote attackers to inject arbitrary web script or HTML via a crafted bookmark.
CVE-2010-3008Sep 13, 2010
Microfocus
Data Protector Express
risk 0.00cvss —epss 0.01
Unspecified vulnerability in HP Data Protector Express, and Data Protector Express Single Server Edition (SSE), 3.x before build 56936 and 4.x before build 56906 on Windows allows local users to gain privileges or cause a denial of service via unknown vectors, a different…
CVE-2010-2952Sep 13, 2010
Apache
trafficserver
risk 0.00cvss —epss 0.03
Apache Traffic Server before 2.0.1, and 2.1.x before 2.1.2-unstable, does not properly choose DNS source ports and transaction IDs, and does not properly use DNS query fields to validate responses, which makes it easier for man-in-the-middle attackers to poison the internal DNS…
CVE-2010-2366Sep 13, 2010
Futomi
Access Analyzer Cgi
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in futomi CGI Cafe Access Analyzer CGI Professional, and Standard 4.0.2 and earlier, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2010-3263Sep 10, 2010
PhpMyAdmin
phpMyAdmin
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in setup/frames/index.inc.php in the setup script in phpMyAdmin 3.x before 3.3.7 allows remote attackers to inject arbitrary web script or HTML via a server name.
CVE-2010-3199Sep 10, 2010
Tortoisesvn
Tortoisesvn
risk 0.00cvss —epss 0.04
Untrusted search path vulnerability in TortoiseSVN 1.6.10, Build 19898 and earlier allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same folder as a file that is…
CVE-2010-3006Sep 10, 2010
Microfocus
ProLiant G6 Lights-Out 100 Remote Management card
risk 0.00cvss —epss 0.02
Unspecified vulnerability on the HP ProLiant G6 Lights-Out 100 Remote Management card with firmware before 4.06 allows remote attackers to cause a denial of service via unknown vectors.
CVE-2010-2956Sep 10, 2010
Todd Miller
Sudo
risk 0.00cvss —epss 0.00
Sudo 1.7.0 through 1.7.4p3, when a Runas group is configured, does not properly handle use of the -u option in conjunction with the -g option, which allows local users to gain privileges via a command line containing a "-u root" sequence.
CVE-2010-2949Sep 10, 2010
Quagga (software)
Quagga
risk 0.00cvss —epss 0.03
bgpd in Quagga before 0.99.17 does not properly parse AS paths, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an unknown AS type in an AS path attribute in a BGP UPDATE message.
CVE-2010-2948Sep 10, 2010
Quagga (software)
Quagga
risk 0.00cvss —epss 0.04
Stack-based buffer overflow in the bgp_route_refresh_receive function in bgp_packet.c in bgpd in Quagga before 0.99.17 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a malformed Outbound Route Filtering (ORF)…
CVE-2010-1807Sep 10, 2010
Webkitgtk
Webkitgtk
risk 0.08cvss —epss 0.61
WebKit in Apple Safari 4.x before 4.1.2 and 5.x before 5.0.2; Android before 2.2; and webkitgtk before 1.2.6; does not properly validate floating-point data, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted…
CVE-2010-1806Sep 10, 2010
Apple Inc.
Safari
risk 0.00cvss —epss 0.05
Use-after-free vulnerability in Apple Safari 4.x before 4.1.2 and 5.x before 5.0.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via run-in styling in an element, related to object pointers.
CVE-2010-1805Sep 10, 2010
Apple Inc.
Safari
risk 0.00cvss —epss 0.00
Untrusted search path vulnerability in Apple Safari 4.x before 4.1.2 and 5.x before 5.0.2 on Windows allows local users to gain privileges via a Trojan horse explorer.exe (aka Windows Explorer) program in a directory containing a file that had been downloaded by Safari.
CVE-2010-3034Sep 10, 2010
Cisco Systems, Inc.
Wireless Lan Controller Software
risk 0.00cvss —epss 0.01
Cisco Wireless LAN Controller (WLC) software, possibly 6.0.x or possibly 4.1 through 6.0.x, allows remote attackers to bypass ACLs in the controller CPU, and consequently send network traffic to unintended segments or devices, via unspecified vectors, a different vulnerability…
CVE-2010-3033Sep 10, 2010
Cisco Systems, Inc.
Wireless Lan Controller Software
risk 0.00cvss —epss 0.01
Cisco Wireless LAN Controller (WLC) software, possibly 4.2 through 6.0, allows remote authenticated users to bypass intended access restrictions and modify the configuration, and possibly obtain administrative privileges, via unspecified vectors, a different vulnerability than…
CVE-2010-3003Sep 10, 2010
Microfocus
Insight Diagnostics
risk 0.03cvss —epss 0.05
Cross-site scripting (XSS) vulnerability in HP Insight Diagnostics Online Edition before 8.5.0-11 on Linux allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2010-2957Sep 10, 2010
S9y
Serendipity
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Serendipity before 1.5.4, when "Remember me" logins are enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2010-2843Sep 10, 2010
Cisco Systems, Inc.
Wireless Lan Controller Software
risk 0.00cvss —epss 0.01
Cisco Wireless LAN Controller (WLC) software, possibly 4.2 through 6.0, allows remote authenticated users to bypass intended access restrictions and modify the configuration, and possibly obtain administrative privileges, via unspecified vectors, a different vulnerability than…
CVE-2010-2842Sep 10, 2010
Cisco Systems, Inc.
Wireless Lan Controller Software
risk 0.00cvss —epss 0.01
Cisco Wireless LAN Controller (WLC) software, possibly 4.2 through 6.0, allows remote authenticated users to bypass intended access restrictions and modify the configuration, and possibly obtain administrative privileges, via unspecified vectors, a different vulnerability than…
CVE-2010-2841Sep 10, 2010
Cisco Systems, Inc.
Wireless Lan Controller Software
risk 0.00cvss —epss 0.01
Unspecified vulnerability in Cisco Wireless LAN Controller (WLC) software 4.2 before 4.2.209.0; 4.2M before 4.2.207.54M; 5.0, 5.1, and 6.0 before 6.0.196.0; and 5.2 before 5.2.193.11 allows remote authenticated users to cause a denial of service (device reload) via crafted HTTP…
CVE-2010-0575Sep 10, 2010
Cisco Systems, Inc.
Wireless Lan Controller Software
risk 0.00cvss —epss 0.01
Cisco Wireless LAN Controller (WLC) software, possibly 6.0.x or possibly 4.1 through 6.0.x, allows remote attackers to bypass ACLs in the controller CPU, and consequently send network traffic to unintended segments or devices, via unspecified vectors, a different vulnerability…
CVE-2010-0574Sep 10, 2010
Cisco Systems, Inc.
Wireless Lan Controller Software
risk 0.00cvss —epss 0.01
Unspecified vulnerability in Cisco Wireless LAN Controller (WLC) software 3.2 before 3.2.215.0; 4.1 and 4.2 before 4.2.205.0; 4.1M and 4.2M before 4.2.207.54M; 5.0, 5.1, and 6.0 before 6.0.188.0; and 5.2 before 5.2.193.11 allows remote attackers to cause a denial of service…
CVE-2010-3018Sep 9, 2010
Rsa
Access Manager Server
risk 0.00cvss —epss 0.01
RSA Access Manager Server 5.5.3 before 5.5.3.172, 6.0.4 before 6.0.4.53, and 6.1 before 6.1.2.01 does not properly perform cache updates, which allows remote attackers to obtain sensitive information via unspecified vectors.
CVE-2010-3017Sep 9, 2010
Rsa
Access Manager Agent
risk 0.00cvss —epss 0.01
Unspecified vulnerability in RSA Access Manager Agent 4.7.1 before 4.7.1.7, when RSA Adaptive Authentication Integration is enabled, allows remote attackers to bypass authentication and obtain sensitive information via unknown vectors.
CVE-2010-3007Sep 9, 2010
Microfocus
Data Protector Express
risk 0.03cvss —epss 0.06
Unspecified vulnerability in HP Data Protector Express, and Data Protector Express Single Server Edition (SSE), 3.x before build 56936 and 4.x before build 56906 allows local users to gain privileges or cause a denial of service via unknown vectors.
CVE-2010-2883HigKEVSep 9, 2010
Adobe Inc.
Acrobat
risk 0.69cvss 7.3epss 0.81
Stack-based buffer overflow in CoolType.dll in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PDF document with a long field in a…
CVE-2010-1817Sep 9, 2010
Apple Inc.
iOS
risk 0.00cvss —epss 0.03
Buffer overflow in ImageIO in Apple iOS before 4.1 on the iPhone and iPod touch allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted GIF file.
CVE-2010-1815Sep 9, 2010
Webkitgtk
Webkitgtk
risk 0.00cvss —epss 0.04
Use-after-free vulnerability in WebKit in Apple iOS before 4.1 on the iPhone and iPod touch, and webkitgtk before 1.2.6, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving scrollbars.
CVE-2010-1814Sep 9, 2010
Webkitgtk
Webkitgtk
risk 0.00cvss —epss 0.04
WebKit in Apple iOS before 4.1 on the iPhone and iPod touch, and webkitgtk before 1.2.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors involving form menus.
CVE-2010-1813Sep 9, 2010
Apple Inc.
Webkit
risk 0.04cvss —epss 0.10
WebKit in Apple iOS before 4.1 on the iPhone and iPod touch allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors involving HTML object outlines.
CVE-2010-1812Sep 9, 2010
Webkitgtk
Webkitgtk
risk 0.00cvss —epss 0.04
Use-after-free vulnerability in WebKit in Apple iOS before 4.1 on the iPhone and iPod touch, and webkitgtk before 1.2.6, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving selections.
CVE-2010-1811Sep 9, 2010
Apple Inc.
iOS
risk 0.00cvss —epss 0.03
ImageIO in Apple iOS before 4.1 on the iPhone and iPod touch allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted TIFF file.
CVE-2010-1810Sep 9, 2010
Apple Inc.
iOS
risk 0.00cvss —epss 0.01
FaceTime in Apple iOS before 4.1 on the iPhone and iPod touch does not properly handle invalid X.509 certificates, which allows man-in-the-middle attackers to redirect calls via a crafted certificate.
CVE-2010-1809Sep 9, 2010
Apple Inc.
iOS
risk 0.00cvss —epss 0.02
The Accessibility component in Apple iOS before 4.1 on the iPhone and iPod touch does not perform the expected VoiceOver announcement associated with the location services icon, which has unspecified impact and attack vectors.
CVE-2010-1781Sep 9, 2010
Apple Inc.
iOS
risk 0.00cvss —epss 0.04
Double free vulnerability in WebKit in Apple iOS before 4.1 on the iPhone and iPod touch allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to the rendering of an inline element.