CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In 2010(Bypass)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2010-4624 264 Bypass 2010-12-30 2017-08-16
3.5
 None Remote Medium Single system None Partial None
MyBB (aka MyBulletinBoard) before 1.4.12 allows remote authenticated users to bypass intended restrictions on the number of [img] MyCodes by editing a post after it has been created.
2 CVE-2010-4602 264 Bypass 2010-12-29 2017-08-16
4.0
 None Remote Low Single system Partial None None
The Web client in IBM Rational ClearQuest 7.1.1.x before 7.1.1.4 and 7.1.2.x before 7.1.2.1 allows remote authenticated users to bypass "restricted user" limitations, and read arbitrary records, via a modified record number in the URL for a RECORD action, as demonstrated by a modified bookmark.
3 CVE-2010-4595 264 Bypass 2010-12-22 2010-12-27
5.0
 None Remote Low Not required None Partial None
The Connection Manager in IBM Lotus Mobile Connect before 6.1.4 disables the http.device.stanza blacklisting functionality for HTTP Access Services (HTTP-AS), which allows remote attackers to bypass intended access restrictions via an HTTP request that contains a disallowed User-Agent header.
4 CVE-2010-4582 264 Bypass 2010-12-21 2011-01-22
5.0
 None Remote Low Not required None Partial None
Opera before 11.00 does not properly handle security policies during updates to extensions, which might allow remote attackers to bypass intended access restrictions via unspecified vectors.
5 CVE-2010-4574 189 DoS Bypass 2010-12-21 2017-09-18
7.5
 None Remote Low Not required Partial Partial Partial
The Pickle::Pickle function in base/pickle.cc in Google Chrome before 8.0.552.224 and Chrome OS before 8.0.552.343 on 64-bit Linux platforms does not properly perform pointer arithmetic, which allows remote attackers to bypass message deserialization validation, and cause a denial of service or possibly have unspecified other impact, via invalid pickle data.
6 CVE-2010-4549 264 Bypass 2010-12-16 2010-12-17
4.0
 None Remote Low Single system None Partial None
IBM Lotus Notes Traveler before 8.5.1.3 on the Nokia s60 device successfully performs a Replace Data operation for a prohibited application, which allows remote authenticated users to bypass intended access restrictions via this operation.
7 CVE-2010-4547 264 Bypass 2010-12-16 2010-12-17
3.5
 None Remote Medium Single system None Partial None
IBM Lotus Notes Traveler before 8.5.1.3, when a multidomain environment is used, does not properly apply policy documents to mobile users from a different Domino domain than the Traveler server, which allows remote authenticated users to bypass intended access restrictions by using credentials from a different domain.
8 CVE-2010-4546 264 Bypass 2010-12-16 2010-12-17
4.0
 None Remote Low Single system None Partial None
IBM Lotus Notes Traveler before 8.5.1.2 does not reject an attachment download request for an e-mail message with a Prevent Copy attribute, which allows remote authenticated users to bypass intended access restrictions via this request.
9 CVE-2010-4501 264 Bypass 2010-12-08 2010-12-09
6.8
 None Remote Medium Not required Partial Partial Partial
IO::Socket::SSL Perl module 1.35, when verify_mode is not VERIFY_NONE, fails open to VERIFY_NONE instead of throwing an error when a ca_file/ca_path cannot be verified, which allows remote attackers to bypass intended certificate restrictions.
10 CVE-2010-4483 264 Bypass 2010-12-07 2017-09-18
4.3
 None Remote Medium Not required Partial None None
Google Chrome before 8.0.552.215 does not properly restrict read access to videos derived from CANVAS elements, which allows remote attackers to bypass the Same Origin Policy and obtain potentially sensitive video data via a crafted web site.
11 CVE-2010-4482 Bypass 2010-12-07 2017-09-18
5.0
 None Remote Low Not required None Partial None
Unspecified vulnerability in Google Chrome before 8.0.552.215 allows remote attackers to bypass the pop-up blocker via unknown vectors.
12 CVE-2010-4481 287 Bypass +Info 2010-12-17 2011-01-28
5.0
 None Remote Low Not required Partial None None
phpMyAdmin before 3.4.0-beta1 allows remote attackers to bypass authentication and obtain sensitive information via a direct request to phpinfo.php, which calls the phpinfo function.
13 CVE-2010-4478 287 Bypass 2010-12-06 2017-09-18
7.5
 None Remote Low Not required Partial Partial Partial
OpenSSH 5.6 and earlier, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remote attackers to bypass the need for knowledge of the shared secret, and successfully authenticate, by sending crafted values in each round of the protocol, a related issue to CVE-2010-4252.
14 CVE-2010-4398 119 1 Overflow +Priv Bypass 2010-12-06 2018-10-12
7.2
 None Local Low Not required Complete Complete Complete
Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows local users to gain privileges, and bypass the User Account Control (UAC) feature, via a crafted REG_BINARY value for a SystemDefaultEUDCFont registry key, aka "Driver Improper Interaction with Windows Kernel Vulnerability."
15 CVE-2010-4388 20 Bypass 2010-12-14 2011-01-19
4.3
 None Remote Medium Not required None Partial None
The (1) Upsell.htm, (2) Main.html, and (3) Custsupport.html components in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.5, and RealPlayer Enterprise 2.1.2 and 2.1.3 allow remote attackers to inject code into the RealOneActiveXObject process, and consequently bypass intended Local Machine Zone restrictions and load arbitrary ActiveX controls, via unspecified vectors.
16 CVE-2010-4364 79 XSS Bypass 2010-12-01 2017-08-16
4.3
 None Remote Medium Not required None Partial None
DaDaBIK 4.3 beta3, when running in a case-sensitive environment, does not include the htmLawed library, which allows remote attackers to bypass the protection mechanism for CVE-2010-4355 and conduct cross-site scripting (XSS) attacks via the (1) html content and (2) rich_editor fields. NOTE: some of these details are obtained from third party information.
17 CVE-2010-4346 264 Bypass 2010-12-22 2018-10-10
2.1
 None Local Low Not required None Partial None
The install_special_mapping function in mm/mmap.c in the Linux kernel before 2.6.37-rc6 does not make an expected security_file_mmap function call, which allows local users to bypass intended mmap_min_addr restrictions and possibly conduct NULL pointer dereference attacks via a crafted assembly-language application.
18 CVE-2010-4333 287 1 Bypass 2010-12-21 2018-10-10
7.5
 User Remote Low Not required Partial Partial Partial
Pointter PHP Micro-Blogging Social Network 1.8 allows remote attackers to bypass authentication and obtain administrative privileges via arbitrary values of the auser and apass cookies.
19 CVE-2010-4332 287 1 Bypass 2010-12-21 2018-10-10
7.5
 User Remote Low Not required Partial Partial Partial
Pointter PHP Content Management System 1.0 allows remote attackers to bypass authentication and obtain administrative privileges via arbitrary values of the auser and apass cookies.
20 CVE-2010-4281 94 1 Exec Code Bypass 2010-12-02 2018-10-10
7.5
 None Remote Low Not required Partial Partial Partial
Incomplete blacklist vulnerability in the safe_url_extraclean function in ajax.php in Pandora FMS before 3.1.1 allows remote attackers to execute arbitrary PHP code by using a page parameter containing a UNC share pathname, which bypasses the check for the : (colon) character.
21 CVE-2010-4279 287 1 Bypass 2010-12-02 2018-10-10
10.0
 None Remote Low Not required Complete Complete Complete
The default configuration of Pandora FMS 3.1 and earlier specifies an empty string for the loginhash_pwd field, which allows remote attackers to bypass authentication by sending a request to index.php with "admin" in the loginhash_user parameter, in conjunction with the md5 hash of "admin" in the loginhash_data parameter.
22 CVE-2010-4258 264 +Priv Bypass 2010-12-30 2013-09-13
6.2
 Admin Local High Not required Complete Complete Complete
The do_exit function in kernel/exit.c in the Linux kernel before 2.6.36.2 does not properly handle a KERNEL_DS get_fs value, which allows local users to bypass intended access_ok restrictions, overwrite arbitrary kernel memory locations, and gain privileges by leveraging a (1) BUG, (2) NULL pointer dereference, or (3) page fault, as demonstrated by vectors involving the clear_child_tid feature and the splice system call.
23 CVE-2010-4254 20 1 Exec Code Bypass 2010-12-06 2011-02-02
7.5
 None Remote Low Not required Partial Partial Partial
Mono, when Moonlight before 2.3.0.1 or 2.99.x before 2.99.0.10 is used, does not properly validate arguments to generic methods, which allows remote attackers to bypass generic constraints, and possibly execute arbitrary code, via a crafted method call.
24 CVE-2010-4252 287 Bypass 2010-12-06 2017-09-18
7.5
 None Remote Low Not required Partial Partial Partial
OpenSSL before 1.0.0c, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remote attackers to bypass the need for knowledge of the shared secret, and successfully authenticate, by sending crafted values in each round of the protocol.
25 CVE-2010-4232 287 1 Bypass 2010-11-16 2018-10-10
10.0
 None Remote Low Not required Complete Complete Complete
The web-based administration interface on the Camtron CMNC-200 Full HD IP Camera and TecVoz CMNC-200 Megapixel IP Camera with firmware 1.102A-008 allows remote attackers to bypass authentication via a // (slash slash) at the beginning of a URI, as demonstrated by the //system.html URI.
26 CVE-2010-4105 Bypass +Info 2010-11-01 2019-10-09
6.4
 None Remote Low Not required Partial Partial None
Unspecified vulnerability in HP Insight Orchestration before 6.2 allows remote attackers to bypass intended access restrictions, and obtain sensitive information or modify data, via unknown vectors.
27 CVE-2010-4041 264 Bypass 2010-10-21 2017-09-18
6.8
 None Remote Medium Not required Partial Partial Partial
The sandbox implementation in Google Chrome before 7.0.517.41 on Linux does not properly constrain worker processes, which might allow remote attackers to bypass intended access restrictions via unspecified vectors.
28 CVE-2010-4037 Bypass 2010-10-21 2017-09-18
4.3
 None Remote Medium Not required None Partial None
Unspecified vulnerability in Google Chrome before 7.0.517.41 allows remote attackers to bypass the pop-up blocker via unknown vectors.
29 CVE-2010-4012 362 Bypass 2010-12-08 2010-12-09
6.2
 None Local High Not required Complete Complete Complete
Race condition in Apple iOS 4.0 through 4.1 for iPhone 3G and later allows physically proximate attackers to bypass the passcode lock by making a call from the Emergency Call screen, then quickly pressing the Sleep/Wake button.
30 CVE-2010-3988 DoS Bypass 2010-10-28 2010-11-11
5.0
 None Remote Low Not required None None Partial
Unspecified vulnerability in HP Insight Control Virtual Machine Management before 6.2 allows remote attackers to bypass intended access restrictions and cause a denial of service via unknown vectors.
31 CVE-2010-3934 264 1 Bypass 2010-10-14 2010-10-15
6.8
 None Remote Medium Not required Partial Partial Partial
The browser in Research In Motion (RIM) BlackBerry Device Software 5.0.0.593 Platform 5.1.0.147 on the BlackBerry 9700 does not properly restrict cross-domain execution of JavaScript, which allows remote attackers to bypass the Same Origin Policy via vectors related to a window.open call and an IFRAME element. NOTE: some of these details are obtained from third party information.
32 CVE-2010-3920 264 Bypass 2010-12-08 2011-03-10
4.6
 None Local Low Not required Partial Partial Partial
The Seiko Epson printer driver installers for LP-S9000 before 4.1.11 and LP-S7100 before 4.1.7, or as downloaded from the vendor between May 2010 and 20101125, set weak permissions for the "C:\Program Files" folder, which might allow local users to bypass intended access restrictions and create or modify arbitrary files and directories.
33 CVE-2010-3898 264 Bypass 2010-11-12 2018-10-10
5.0
 None Remote Low Not required Partial None None
IBM OmniFind Enterprise Edition 8.x and 9.x does not properly restrict the cookie path of administrator (aka ESAdmin) cookies, which might allow remote attackers to bypass authentication by leveraging access to other pages on the web site.
34 CVE-2010-3887 264 Bypass 2010-10-08 2010-10-11
4.3
 None Remote Medium Not required None Partial None
The Limit Mail feature in the Parental Controls functionality in Mail on Apple Mac OS X does not properly enforce the correspondence whitelist, which allows remote attackers to bypass intended access restrictions and conduct e-mail communication by leveraging knowledge of a child's e-mail address and a parent's e-mail address, related to parental notification of unapproved e-mail addresses.
35 CVE-2010-3870 20 Sql XSS Bypass 2010-11-12 2018-10-30
6.8
 None Remote Medium Not required Partial Partial Partial
The utf8_decode function in PHP before 5.3.4 does not properly handle non-shortest form UTF-8 encoding and ill-formed subsequences in UTF-8 data, which makes it easier for remote attackers to bypass cross-site scripting (XSS) and SQL injection protection mechanisms via a crafted string.
36 CVE-2010-3863 22 Dir. Trav. Bypass 2010-11-05 2018-10-10
5.0
 None Remote Low Not required Partial None None
Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI.
37 CVE-2010-3852 287 Bypass 2010-11-05 2017-08-16
6.4
 None Remote Low Not required Partial Partial None
The default configuration of Luci 0.22.4 and earlier in Red Hat Conga uses "[INSERT SECRET HERE]" as its secret key for cookies, which makes it easier for remote attackers to bypass repoze.who authentication via a forged ticket cookie.
38 CVE-2010-3850 264 Bypass 2010-12-30 2012-03-19
4.9
 None Local Low Not required None Complete None
The ec_dev_ioctl function in net/econet/af_econet.c in the Linux kernel before 2.6.36.2 does not require the CAP_NET_ADMIN capability, which allows local users to bypass intended access restrictions and configure econet addresses via an SIOCSIFADDR ioctl call.
39 CVE-2010-3829 264 Bypass 2010-11-26 2017-08-16
5.8
 None Remote Medium Not required Partial Partial None
WebKit in Apple iOS before 4.2 allows remote attackers to bypass the remote image loading setting in Mail via an HTML LINK element with a DNS prefetching property, as demonstrated by an HTML e-mail message that uses a LINK element for X-Confirm-Reading-To functionality, a related issue to CVE-2010-3813.
40 CVE-2010-3813 264 Bypass 2010-11-22 2017-09-18
5.8
 None Remote Medium Not required Partial Partial None
The WebCore::HTMLLinkElement::process function in WebCore/html/HTMLLinkElement.cpp in WebKit, as used in Apple Safari before 5.0.3 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.3 on Mac OS X 10.4; webkitgtk before 1.2.6; and possibly other products does not verify whether DNS prefetching is enabled when processing an HTML LINK element, which allows remote attackers to bypass intended access restrictions, as demonstrated by an HTML e-mail message that uses a LINK element for X-Confirm-Reading-To functionality.
41 CVE-2010-3783 264 Bypass 2010-11-16 2010-12-10
6.8
 None Remote Low Single system None Complete None
Password Server in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 does not properly perform replication, which allows remote authenticated users to bypass verification of the current password via unspecified vectors.
42 CVE-2010-3779 264 Bypass 2010-10-06 2011-02-12
3.5
 None Remote Medium Single system None Partial None
Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.beta2 grants the admin permission to the owner of each mailbox in a non-public namespace, which might allow remote authenticated users to bypass intended access restrictions by changing the ACL of a mailbox, as demonstrated by a symlinked shared mailbox.
43 CVE-2010-3713 264 Bypass 2010-10-27 2010-10-28
4.3
 None Remote Medium Not required Partial None None
rss.php in UseBB before 1.0.11 does not properly handle forum configurations in which a user has the view permission but not the read permission, which allows remote attackers to bypass intended access restrictions by reading a forum feed in combination with a topic feed.
44 CVE-2010-3707 264 Bypass 2010-10-06 2011-08-26
5.5
 None Remote Low Single system Partial Partial None
plugins/acl/acl-backend-vfile.c in Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.5 interprets an ACL entry as a directive to add to the permissions granted by another ACL entry, instead of a directive to replace the permissions granted by another ACL entry, in certain circumstances involving more specific entries that occur after less specific entries, which allows remote authenticated users to bypass intended access restrictions via a request to read or modify a mailbox.
45 CVE-2010-3706 264 Bypass 2010-10-06 2011-02-12
5.5
 None Remote Low Single system Partial Partial None
plugins/acl/acl-backend-vfile.c in Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.5 interprets an ACL entry as a directive to add to the permissions granted by another ACL entry, instead of a directive to replace the permissions granted by another ACL entry, in certain circumstances involving the private namespace of a user, which allows remote authenticated users to bypass intended access restrictions via a request to read or modify a mailbox.
46 CVE-2010-3704 20 DoS Exec Code Mem. Corr. Bypass 2010-11-05 2012-11-19
6.8
 None Remote Medium Not required Partial Partial Partial
The FoFiType1::parse function in fofi/FoFiType1.cc in the PDF parser in xpdf before 3.02pl5, poppler 0.8.7 and possibly other versions up to 0.15.1, kdegraphics, and possibly other products allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a PDF file with a crafted PostScript Type1 font that contains a negative array index, which bypasses input validation and triggers memory corruption.
47 CVE-2010-3700 264 Bypass 2010-10-29 2018-10-10
5.0
 None Remote Low Not required None Partial None
VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server (WAS) 6.1 and 7.0, allows remote attackers to bypass security constraints via a path parameter.
48 CVE-2010-3687 Bypass 2010-09-29 2010-09-30
5.0
 None Remote Low Not required None Partial None
Unspecified vulnerability in the powermail extension 1.5.3 and earlier for TYPO3 allows remote attackers to bypass validation have an unspecified impact by "[injecting] arbitrary values into validated fields," as demonstrated using the (1) Email and (2) URL fields.
49 CVE-2010-3686 287 Bypass 2010-09-29 2010-09-30
5.0
 None Remote Low Not required None Partial None
The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not ensuring that fields are signed, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider.
50 CVE-2010-3685 287 Bypass 2010-09-29 2010-09-30
5.0
 None Remote Low Not required None Partial None
The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not checking for reuse of openid.response_nonce values, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider.
Total number of vulnerabilities : 234   Page : 1 (This Page)2 3 4 5
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.