CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In 2010(Execute Code)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2010-4641 89 Exec Code Sql 2010-12-30 2017-08-16
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in XWiki Enterprise before 2.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
2 CVE-2010-4639 89 2 Exec Code Sql 2010-12-30 2017-08-16
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in index.php in MySource Matrix allows remote attackers to execute arbitrary SQL commands via the id parameter.
3 CVE-2010-4638 89 1 Exec Code Sql 2010-12-30 2010-12-31
6.8
 None Remote Medium Not required Partial Partial Partial
SQL injection vulnerability in the submitSurvey function in controller.php in JQuarks4s (com_jquarks4s) component 1.0.0 for Joomla!, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the q parameter in a submitSurvey action to index.php.
4 CVE-2010-4636 89 1 Exec Code Sql 2010-12-30 2017-08-16
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in detail.asp in Site2Nite Business e-Listings allows remote attackers to execute arbitrary SQL commands via the ID parameter.
5 CVE-2010-4635 89 2 Exec Code Sql 2010-12-30 2017-08-16
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in detail.asp in Site2Nite Vacation Rental (VRBO) Listings allows remote attackers to execute arbitrary SQL commands via the ID parameter.
6 CVE-2010-4633 89 2 Exec Code Sql 2010-12-30 2017-08-16
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in cart.php in digiSHOP 2.0.2 allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vulnerability than CVE-2005-4614.1.
7 CVE-2010-4632 89 2 Exec Code Sql 2010-12-30 2010-12-31
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in ASPilot Pilot Cart 7.3 allow remote attackers to execute arbitrary SQL commands via the (1) article parameter to kb.asp, (2) specific parameter to cart.asp, (3) countrycode parameter to contact.asp, and the (4) srch parameter to search.asp. NOTE: the article parameter to pilot.asp is already covered by CVE-2008-2688.
8 CVE-2010-4619 89 1 Exec Code Sql 2010-12-29 2017-08-16
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in profil.php in Mafya Oyun Scrpti (aka Mafia Game Script) allows remote attackers to execute arbitrary SQL commands via the id parameter.
9 CVE-2010-4615 89 1 Exec Code Sql 2010-12-29 2017-08-16
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Oto Galeri Sistemi 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) arac parameter to carsdetail.asp and the (2) marka parameter to twohandscars.asp.
10 CVE-2010-4614 89 1 Exec Code Sql 2010-12-29 2010-12-30
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in item.php in Ero Auktion 2010 allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vector than CVE-2010-0723.
11 CVE-2010-4612 89 1 Exec Code Sql 2010-12-29 2017-08-16
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in index.php in Hycus CMS 1.0.3, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) user_name and (2) usr_email parameters to user/1/hregister.html, (3) usr_email parameter to user/1/hlogin.html, (4) useremail parameter to user/1/forgotpass.html, and the (5) q parameter to search/1.html. NOTE: some of these details are obtained from third party information.
12 CVE-2010-4609 89 1 Exec Code Sql 2010-12-29 2011-01-04
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in index.php in Html-edit CMS 3.1.8 allows remote attackers to execute arbitrary SQL commands via the nuser parameter in a registrate action.
13 CVE-2010-4606 94 Exec Code 2010-12-29 2011-01-04
10.0
 None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in the Space Management client in the Hierarchical Storage Management (HSM) component in IBM Tivoli Storage Manager (TSM) 5.4.x before 5.4.3.4, 5.5.x before 5.5.3, 6.1.x before 6.1.4, and 6.2.x before 6.2.2 on Unix and Linux allows remote attackers to execute arbitrary commands via unknown vectors, related to a "script execution vulnerability."
14 CVE-2010-4597 119 1 Exec Code Overflow 2010-12-23 2011-01-11
10.0
 None Remote Low Not required Complete Complete Complete
Stack-based buffer overflow in the save method in the IntegraXor.Project ActiveX control in igcomm.dll in Ecava IntegraXor Human-Machine Interface (HMI) before 3.5.3900.10 allows remote attackers to execute arbitrary code via a long string in the second argument.
15 CVE-2010-4588 94 Exec Code 2010-12-23 2011-01-19
9.3
 None Remote Medium Not required Complete Complete Complete
The WBEMSingleView.ocx ActiveX control 1.50.1131.0 in Microsoft WMI Administrative Tools 1.1 and earlier allows remote attackers to execute arbitrary code via a crafted argument to the ReleaseContext method, a different vector than CVE-2010-3973, possibly an untrusted pointer dereference.
16 CVE-2010-4558 94 Exec Code 2010-12-17 2010-12-20
7.5
 None Remote Low Not required Partial Partial Partial
phpMyFAQ 2.6.11 and 2.6.12, as distributed between December 4th and December 15th 2010, contains an externally introduced modification (Trojan Horse) in the getTopTen method in inc/Faq.php, which allows remote attackers to execute arbitrary PHP code.
17 CVE-2010-4557 119 1 DoS Exec Code Overflow 2010-12-17 2013-08-19
10.0
 None Remote Low Not required Complete Complete Complete
Buffer overflow in the lm_tcp service in Invensys Wonderware InBatch 8.1 and 9.0, as used in Invensys Foxboro I/A Series Batch 8.1 and possibly other products, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted request to port 9001.
18 CVE-2010-4556 119 Exec Code Overflow 2010-12-17 2017-08-16
9.3
 None Remote Medium Not required Complete Complete Complete
Stack-based buffer overflow in the SapThemeRepository ActiveX control (sapwdpcd.dll) in SAP NetWeaver Business Client allows remote attackers to execute arbitrary code via the (1) Load and (2) LoadTheme methods.
19 CVE-2010-4517 89 1 Exec Code Sql 2010-12-09 2010-12-10
6.8
 None Remote Medium Not required Partial Partial Partial
SQL injection vulnerability in the JExtensions JE Auto (com_jeauto) component 1.0 for Joomla!, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the char parameter in an item action to index.php.
20 CVE-2010-4507 352 1 Exec Code CSRF 2010-12-30 2011-01-12
9.3
 Admin Remote Medium Not required Complete Complete Complete
Multiple cross-site request forgery (CSRF) vulnerabilities on the iSpot 2.0.0.0 R1679, and the ClearSpot 2.0.0.0 R1512 and R1786, with firmware 1.9.9.4 allow remote attackers to hijack the authentication of administrators for requests that (1) execute arbitrary commands via the cmd parameter in an act_cmd_result action to webmain.cgi, (2) enable remote management via an enable_remote_access act_network_set action to webmain.cgi, (3) enable the TELNET service via an ENABLE_TELNET act_set_wimax_etc_config action to webmain.cgi, (4) enable TELNET sessions via a certain act_network_set action to webmain.cgi, or (5) read arbitrary files via the FILE_PATH parameter in an act_file_download action to upgrademain.cgi.
21 CVE-2010-4505 89 Exec Code Sql 2010-12-08 2010-12-09
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in login.php in Injader 2.4.4, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) un and (2) pw parameters.
22 CVE-2010-4503 89 1 Exec Code Sql 2010-12-08 2010-12-09
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in indexlight.php in Aigaion 1.3.4 allows remote attackers to execute arbitrary SQL commands via the ID parameter in an export action.
23 CVE-2010-4502 189 1 DoS Exec Code Overflow 2010-12-08 2010-12-09
7.2
 None Local Low Not required Complete Complete Complete
Integer overflow in KmxSbx.sys 6.2.0.22 in CA Internet Security Suite Plus 2010 allows local users to cause a denial of service (pool corruption) and execute arbitrary code via crafted arguments to the 0x88000080 IOCTL, which triggers a buffer overflow.
24 CVE-2010-4500 89 Exec Code Sql 2010-12-08 2010-12-09
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in contact.php in MRCGIGUY (MCG) FreeTicket 1.0.0, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) name, (2) email, (3) subject, and (4) message parameters in a sendmess action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
25 CVE-2010-4495 Exec Code 2010-12-17 2010-12-20
9.0
 None Remote Low Single system Complete Complete Complete
Unspecified vulnerability in the ActiveMatrix Runtime component in TIBCO ActiveMatrix Service Grid 3.0.0, 3.0.1, and 3.1.0; ActiveMatrix Service Bus 3.0.0 and 3.0.1; ActiveMatrix BusinessWorks Service Engine 5.9.0; ActiveMatrix BPM 1.0.1 and 1.0.2; Silver BPM Service 1.0.1; and Silver CAP Service 1.0.0 allows remote authenticated users to execute arbitrary code via vectors related to JMX connections.
26 CVE-2010-4479 DoS Exec Code 2010-12-07 2011-03-23
7.5
 None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in pdf.c in libclamav in ClamAV before 0.96.5 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document, aka "bb #2380," a different vulnerability than CVE-2010-4260.
27 CVE-2010-4404 89 Exec Code Sql 2010-12-06 2010-12-16
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Yannick Gaultier sh404SEF component before 2.1.8.777 for Joomla! allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
28 CVE-2010-4400 89 2 Exec Code Sql 2010-12-06 2010-12-20
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in _rights.php in DynPG CMS 4.2.0 allows remote attackers to execute arbitrary SQL commands via the giveRights_UserId parameter.
29 CVE-2010-4397 189 Exec Code Overflow 2010-12-14 2011-01-19
9.3
 None Remote Medium Not required Complete Complete Complete
Integer overflow in the pnen3260.dll module in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.1, Mac RealPlayer 11.0 through 11.1, and Linux RealPlayer 11.0.2.1744 allows remote attackers to execute arbitrary code via a crafted TIT2 atom in an AAC file.
30 CVE-2010-4395 119 Exec Code Overflow 2010-12-14 2011-01-19
9.3
 None Remote Medium Not required Complete Complete Complete
Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.5, and Linux RealPlayer 11.0.2.1744 allows remote attackers to execute arbitrary code via a crafted conditional component in AAC frame data.
31 CVE-2010-4394 119 Exec Code Overflow 2010-12-14 2011-01-19
9.3
 None Remote Medium Not required Complete Complete Complete
Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1 and RealPlayer SP 1.0 through 1.1.5 allows remote web servers to execute arbitrary code via a long Server header in a response to an HTTP request that occurs during parsing of a RealPix file.
32 CVE-2010-4392 119 Exec Code Overflow 2010-12-14 2011-01-26
9.3
 None Remote Medium Not required Complete Complete Complete
Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.5, RealPlayer Enterprise 2.1.2 and 2.1.3, Linux RealPlayer 11.0.2.1744, and possibly HelixPlayer 1.0.6 and other versions, allows remote attackers to execute arbitrary code via crafted ImageMap data in a RealMedia file, related to certain improper integer calculations.
33 CVE-2010-4391 119 Exec Code Overflow 2010-12-14 2011-01-19
9.3
 None Remote Medium Not required Complete Complete Complete
Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.5, and RealPlayer Enterprise 2.1.2 and 2.1.3 allows remote attackers to execute arbitrary code via a crafted value in an unspecified header field in an RMX file.
34 CVE-2010-4389 119 Exec Code Overflow 2010-12-14 2011-01-19
9.3
 None Remote Medium Not required Complete Complete Complete
Heap-based buffer overflow in the cook codec in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.5, and Linux RealPlayer 11.0.2.1744 allows remote attackers to execute arbitrary code via unspecified data in the initialization buffer.
35 CVE-2010-4387 119 DoS Exec Code Overflow Mem. Corr. 2010-12-14 2011-01-19
9.3
 None Remote Medium Not required Complete Complete Complete
The RealAudio codec in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.4, Mac RealPlayer 11.0 through 12.0.0.1444, and Linux RealPlayer 11.0.2.1744 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted audio stream in a RealMedia file.
36 CVE-2010-4386 119 DoS Exec Code Overflow Mem. Corr. 2010-12-14 2011-01-26
9.3
 None Remote Medium Not required Complete Complete Complete
RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.4, Linux RealPlayer 11.0.2.1744, and possibly HelixPlayer 1.0.6 and other versions, allow remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted RealMedia video file.
37 CVE-2010-4384 20 Exec Code 2010-12-14 2011-01-26
9.3
 None Remote Medium Not required Complete Complete Complete
Array index error in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer Enterprise 2.1.2, Mac RealPlayer 11.0 through 11.1, Linux RealPlayer 11.0.2.1744, and possibly HelixPlayer 1.0.6 and other versions, allows remote attackers to execute arbitrary code via a malformed Media Properties Header (aka MDPR) in a RealMedia file.
38 CVE-2010-4378 119 DoS Exec Code Overflow Mem. Corr. 2010-12-14 2011-01-26
9.3
 None Remote Medium Not required Complete Complete Complete
The drv2.dll (aka RV20 decompression) module in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.5, RealPlayer Enterprise 2.1.2 and 2.1.3, Linux RealPlayer 11.0.2.1744, and possibly HelixPlayer 1.0.6 and other versions, allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted value of an unspecified length field in an RV20 video stream.
39 CVE-2010-4377 119 Exec Code Overflow 2010-12-14 2011-01-19
9.3
 None Remote Medium Not required Complete Complete Complete
Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.5, Mac RealPlayer 11.0 through 12.0.0.1444, and Linux RealPlayer 11.0.2.1744 allows remote attackers to execute arbitrary code by specifying many subbands in cook audio codec information in a Real Audio file.
40 CVE-2010-4376 119 Exec Code Overflow 2010-12-14 2011-01-19
9.3
 None Remote Medium Not required Complete Complete Complete
Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.1, Mac RealPlayer 11.0 through 11.1, and Linux RealPlayer 11.0.2.1744 allows remote attackers to execute arbitrary code via a large Screen Width value in the Screen Descriptor header of a GIF87a file in an RTSP stream.
41 CVE-2010-4375 119 Exec Code Overflow 2010-12-14 2011-01-26
9.3
 None Remote Medium Not required Complete Complete Complete
Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1, Mac RealPlayer 11.0 through 11.1, Linux RealPlayer 11.0.2.1744, and possibly HelixPlayer 1.0.6 and other versions, allows remote attackers to execute arbitrary code via malformed multi-rate data in an audio stream.
42 CVE-2010-4370 189 Exec Code Overflow 2010-12-02 2017-09-18
9.3
 None Remote Medium Not required Complete Complete Complete
Multiple integer overflows in the in_midi plugin in Winamp before 5.6 allow remote attackers to execute arbitrary code via a crafted MIDI file that triggers a buffer overflow.
43 CVE-2010-4368 94 Exec Code 2010-12-02 2010-12-03
7.5
 None Remote Low Not required Partial Partial Partial
awstats.cgi in AWStats before 7.0 on Windows accepts a configdir parameter in the URL, which allows remote attackers to execute arbitrary commands via a crafted configuration file located at a UNC share pathname.
44 CVE-2010-4367 94 Exec Code 2010-12-02 2011-02-23
7.5
 None Remote Low Not required Partial Partial Partial
awstats.cgi in AWStats before 7.0 accepts a configdir parameter in the URL, which allows remote attackers to execute arbitrary commands via a crafted configuration file located on a (1) WebDAV server or (2) NFS server.
45 CVE-2010-4365 89 2 Exec Code Sql 2010-12-01 2010-12-02
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in JE Ajax Event Calendar (com_jeajaxeventcalendar) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the event_id parameter in an alleventlist_more action to index.php.
46 CVE-2010-4363 89 1 Exec Code Sql 2010-12-01 2010-12-02
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in contact.php in MRCGIGUY (MCG) FreeTicket 1.0.0, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) id and (2) email parameters in a showtickets action.
47 CVE-2010-4362 89 1 Exec Code Sql 2010-12-01 2011-04-08
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in MicroNetsoft RV Dealer Website allow remote attackers to execute arbitrary SQL commands via the (1) selStock parameter to search.asp and the (2) orderBy parameter to showAlllistings.asp.
48 CVE-2010-4360 89 Exec Code Sql 2010-12-01 2010-12-02
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in index.php in Jurpopage 0.2.0 allow remote attackers to execute arbitrary SQL commands via the (1) note and (2) pg parameters, different vectors than CVE-2010-4359. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
49 CVE-2010-4359 89 2 Exec Code Sql 2010-12-01 2010-12-02
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in index.php in Jurpopage 0.2.0 allows remote attackers to execute arbitrary SQL commands via the category parameter.
50 CVE-2010-4357 89 1 Exec Code Sql 2010-12-01 2010-12-02
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in comments.php in SiteEngine 7.1 allows remote attackers to execute arbitrary SQL commands via the module parameter.
Total number of vulnerabilities : 1714   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.