CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In 2010

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2010-4642 79 XSS 2010-12-30 2017-08-17
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in XWiki Enterprise before 2.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
2 CVE-2010-4641 89 Exec Code Sql 2010-12-30 2017-08-17
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in XWiki Enterprise before 2.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
3 CVE-2010-4640 79 XSS 2010-12-30 2017-08-17
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in XWiki Watch 1.0 allow remote attackers to inject arbitrary web script or HTML via the rev parameter to (1) bin/viewrev/Main/WebHome and (2) bin/view/Blog, and the (3) register_first_name and (4) register_last_name parameters to bin/register/XWiki/Register. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
4 CVE-2010-4639 89 2 Exec Code Sql 2010-12-30 2017-08-17
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in index.php in MySource Matrix allows remote attackers to execute arbitrary SQL commands via the id parameter.
5 CVE-2010-4638 89 1 Exec Code Sql 2010-12-30 2010-12-31
6.8
 None Remote Medium Not required Partial Partial Partial
SQL injection vulnerability in the submitSurvey function in controller.php in JQuarks4s (com_jquarks4s) component 1.0.0 for Joomla!, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the q parameter in a submitSurvey action to index.php.
6 CVE-2010-4637 79 1 XSS 2010-12-30 2017-08-17
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in feedlist/handler_image.php in the FeedList plugin 2.61.01 for WordPress allows remote attackers to inject arbitrary web script or HTML via the i parameter.
7 CVE-2010-4636 89 1 Exec Code Sql 2010-12-30 2017-08-17
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in detail.asp in Site2Nite Business e-Listings allows remote attackers to execute arbitrary SQL commands via the ID parameter.
8 CVE-2010-4635 89 2 Exec Code Sql 2010-12-30 2017-08-17
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in detail.asp in Site2Nite Vacation Rental (VRBO) Listings allows remote attackers to execute arbitrary SQL commands via the ID parameter.
9 CVE-2010-4634 22 2 Dir. Trav. 2010-12-30 2010-12-31
5.0
 None Remote Low Not required Partial None None
** DISPUTED ** Directory traversal vulnerability in osTicket 1.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter to module.php, a different vector than CVE-2005-1439. NOTE: this issue has been disputed by a reliable third party.
10 CVE-2010-4633 89 2 Exec Code Sql 2010-12-30 2017-08-17
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in cart.php in digiSHOP 2.0.2 allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vulnerability than CVE-2005-4614.1.
11 CVE-2010-4632 89 2 Exec Code Sql 2010-12-30 2010-12-31
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in ASPilot Pilot Cart 7.3 allow remote attackers to execute arbitrary SQL commands via the (1) article parameter to kb.asp, (2) specific parameter to cart.asp, (3) countrycode parameter to contact.asp, and the (4) srch parameter to search.asp. NOTE: the article parameter to pilot.asp is already covered by CVE-2008-2688.
12 CVE-2010-4631 79 2 XSS 2010-12-30 2017-08-17
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in ASPilot Pilot Cart 7.3 allow remote attackers to inject arbitrary web script or HTML via the (1) countrycode parameter to contact.asp, USERNAME parameter to (2) gateway.asp and (3) cart.asp, and the specific parameter to (4) quote.asp and (5) buyitnow.
13 CVE-2010-4630 79 1 XSS 2010-12-30 2017-08-17
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in pages/admin/surveys/create.php in the WP Survey And Quiz Tool plugin 1.2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter.
14 CVE-2010-4629 264 DoS 2010-12-30 2017-08-17
5.0
 None Remote Low Not required None None Partial
MyBB (aka MyBulletinBoard) before 1.4.12 does not properly restrict uid values for group join requests, which allows remote attackers to cause a denial of service (resource consumption) by using guest access to submit join request forms for moderated groups, related to usercp.php and managegroup.php.
15 CVE-2010-4628 DoS 2010-12-30 2017-08-17
5.0
 None Remote Low Not required None None Partial
member.php in MyBB (aka MyBulletinBoard) before 1.4.12 makes a certain superfluous call to the SQL COUNT function, which allows remote attackers to cause a denial of service (resource consumption) by making requests to member.php that trigger scans of the entire users table.
16 CVE-2010-4627 352 CSRF 2010-12-30 2017-08-17
6.8
 None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in usercp2.php in MyBB (aka MyBulletinBoard) before 1.4.12 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
17 CVE-2010-4626 310 2010-12-30 2017-08-17
5.1
 None Remote High Not required Partial Partial Partial
The my_rand function in functions.php in MyBB (aka MyBulletinBoard) before 1.4.12 does not properly use the PHP mt_rand function, which makes it easier for remote attackers to obtain access to an arbitrary account by requesting a reset of the account's password, and then conducting a brute-force attack.
18 CVE-2010-4625 200 +Info 2010-12-30 2017-08-17
5.0
 None Remote Low Not required Partial None None
MyBB (aka MyBulletinBoard) before 1.4.12 does not properly handle a configuration with a visible forum that contains hidden threads, which allows remote attackers to obtain sensitive information by reading the Latest Threads block of the Portal Page.
19 CVE-2010-4624 264 Bypass 2010-12-30 2017-08-17
3.5
 None Remote Medium ??? None Partial None
MyBB (aka MyBulletinBoard) before 1.4.12 allows remote authenticated users to bypass intended restrictions on the number of [img] MyCodes by editing a post after it has been created.
20 CVE-2010-4623 399 DoS 2010-12-30 2017-08-17
4.0
 None Remote Low ??? None None Partial
WebSEAL in IBM Tivoli Access Manager for e-business 6.1.1 before 6.1.1-TIV-AWS-FP0001 allows remote authenticated users to cause a denial of service (worker thread consumption) via shift-reload actions.
21 CVE-2010-4622 22 Dir. Trav. 2010-12-30 2017-08-17
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in WebSEAL in IBM Tivoli Access Manager for e-business 6.1.1 before 6.1.1-TIV-AWS-FP0001 on AIX allows remote attackers to read arbitrary files via a %uff0e%uff0e (encoded dot dot) in a URI.
22 CVE-2010-4619 89 1 Exec Code Sql 2010-12-29 2017-08-17
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in profil.php in Mafya Oyun Scrpti (aka Mafia Game Script) allows remote attackers to execute arbitrary SQL commands via the id parameter.
23 CVE-2010-4618 79 XSS 2010-12-29 2010-12-30
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the Algis Info aiContactSafe component before 2.0.14 for Joomla! allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
24 CVE-2010-4617 22 2 Dir. Trav. 2010-12-29 2017-08-17
6.8
 None Remote Medium Not required Partial Partial Partial
Directory traversal vulnerability in the JotLoader (com_jotloader) component 2.2.1 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the section parameter to index.php.
25 CVE-2010-4616 79 XSS 2010-12-29 2018-10-10
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in modules/content/admin/content.php in ImpressCMS 1.2.3 Final, and possibly other versions before 1.2.4, allows remote attackers to inject arbitrary web script or HTML via the quicksearch_ContentContent parameter.
26 CVE-2010-4615 89 1 Exec Code Sql 2010-12-29 2017-08-17
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Oto Galeri Sistemi 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) arac parameter to carsdetail.asp and the (2) marka parameter to twohandscars.asp.
27 CVE-2010-4614 89 1 Exec Code Sql 2010-12-29 2010-12-30
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in item.php in Ero Auktion 2010 allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vector than CVE-2010-0723.
28 CVE-2010-4613 22 1 Dir. Trav. 2010-12-29 2010-12-30
7.5
 None Remote Low Not required Partial Partial Partial
Multiple directory traversal vulnerabilities in Hycus CMS 1.0.3 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the site parameter to (1) index.php and (2) admin.php.
29 CVE-2010-4612 89 1 Exec Code Sql 2010-12-29 2018-10-10
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in index.php in Hycus CMS 1.0.3, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) user_name and (2) usr_email parameters to user/1/hregister.html, (3) usr_email parameter to user/1/hlogin.html, (4) useremail parameter to user/1/forgotpass.html, and the (5) q parameter to search/1.html. NOTE: some of these details are obtained from third party information.
30 CVE-2010-4611 200 1 +Info 2010-12-29 2017-08-17
5.0
 None Remote Low Not required Partial None None
Html-edit CMS 3.1.8 allows remote attackers to obtain sensitive information via a direct request to (1) pages.php and (2) menu.php in includes/core_files and (3) extensions/login/frontend/pages/antihacker.php, which reveals the installation path in an error message.
31 CVE-2010-4610 79 1 XSS 2010-12-29 2011-01-04
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in index.php in Html-edit CMS 3.1.8 allows remote attackers to inject arbitrary web script or HTML via the error parameter.
32 CVE-2010-4609 89 1 Exec Code Sql 2010-12-29 2011-01-04
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in index.php in Html-edit CMS 3.1.8 allows remote attackers to execute arbitrary SQL commands via the nuser parameter in a registrate action.
33 CVE-2010-4608 200 1 +Info 2010-12-29 2010-12-30
5.0
 None Remote Low Not required Partial None None
Habari 0.6.5 allows remote attackers to obtain sensitive information via a direct request to (1) header.php and (2) comments_items.php in system/admin/, which reveals the installation path in an error message.
34 CVE-2010-4607 79 1 XSS 2010-12-29 2011-01-04
2.6
 None Remote High Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Habari 0.6.5, when register_globals is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) additem_form parameter to system/admin/dash_additem.php and the (2) status_data[] parameter to system/admin/dash_status.php. NOTE: some of these details are obtained from third party information.
35 CVE-2010-4606 Exec Code 2010-12-29 2022-12-13
7.5
 None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in the Space Management client in the Hierarchical Storage Management (HSM) component in IBM Tivoli Storage Manager (TSM) 5.4.x before 5.4.3.4, 5.5.x before 5.5.3, 6.1.x before 6.1.4, and 6.2.x before 6.2.2 on Unix and Linux allows remote attackers to execute arbitrary commands via unknown vectors, related to a "script execution vulnerability."
36 CVE-2010-4605 2010-12-29 2011-01-04
6.6
 None Local Low Not required None Complete Complete
Unspecified vulnerability in the backup-archive client in IBM Tivoli Storage Manager (TSM) 5.3.x before 5.3.6.10, 5.4.x before 5.4.3.4, 5.5.x before 5.5.3, 6.1.x before 6.1.4, and 6.2.x before 6.2.2 on Unix and Linux allows local users to overwrite arbitrary files via unknown vectors.
37 CVE-2010-4604 787 1 Overflow +Priv 2010-12-29 2022-12-13
7.2
 None Local Low Not required Complete Complete Complete
Stack-based buffer overflow in the GeneratePassword function in dsmtca (aka the Trusted Communications Agent or TCA) in the backup-archive client in IBM Tivoli Storage Manager (TSM) 5.3.x before 5.3.6.10, 5.4.x before 5.4.3.4, 5.5.x before 5.5.2.10, and 6.1.x before 6.1.3.1 on Unix and Linux allows local users to gain privileges by specifying a long LANG environment variable, and then sending a request over a pipe.
38 CVE-2010-4603 DoS 2010-12-29 2017-08-17
6.5
 None Remote Low ??? Partial Partial Partial
IBM Rational ClearQuest 7.0.x before 7.0.1.11, 7.1.1.x before 7.1.1.4, and 7.1.2.x before 7.1.2.1 does not prevent modification of back-reference fields, which allows remote authenticated users to interfere with intended record relationships, and possibly cause a denial of service (loop) or have unspecified other impact, by (1) adding or (2) removing a back reference.
39 CVE-2010-4602 264 Bypass 2010-12-29 2017-08-17
4.0
 None Remote Low ??? Partial None None
The Web client in IBM Rational ClearQuest 7.1.1.x before 7.1.1.4 and 7.1.2.x before 7.1.2.1 allows remote authenticated users to bypass "restricted user" limitations, and read arbitrary records, via a modified record number in the URL for a RECORD action, as demonstrated by a modified bookmark.
40 CVE-2010-4601 2010-12-29 2011-01-04
10.0
 None Remote Low Not required Complete Complete Complete
Multiple unspecified vulnerabilities in IBM Rational ClearQuest 7.0.x before 7.0.1.11, 7.1.1.x before 7.1.1.4, and 7.1.2.x before 7.1.2.1 allow attackers to have an unknown impact via vectors related to third-party .ocx files.
41 CVE-2010-4600 200 +Info 2010-12-29 2011-01-04
5.0
 None Remote Low Not required Partial None None
Dojo Toolkit, as used in the Web client in IBM Rational ClearQuest 7.1.1.x before 7.1.1.4 and 7.1.2.x before 7.1.2.1, allows remote attackers to read cookies by navigating to a Dojo file, related to an "open direct" issue.
42 CVE-2010-4599 +Priv 2010-12-23 2011-01-11
6.9
 None Local Medium Not required Complete Complete Complete
Untrusted search path vulnerability in Ecava IntegraXor 3.6.4000.0 allows local users to gain privileges via a Trojan horse dwmapi.dll file in the current working directory. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
43 CVE-2010-4598 22 1 Dir. Trav. 2010-12-23 2011-01-14
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in Ecava IntegraXor 3.6.4000.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the file_name parameter in an open request.
44 CVE-2010-4597 119 1 Exec Code Overflow 2010-12-23 2011-01-11
10.0
 None Remote Low Not required Complete Complete Complete
Stack-based buffer overflow in the save method in the IntegraXor.Project ActiveX control in igcomm.dll in Ecava IntegraXor Human-Machine Interface (HMI) before 3.5.3900.10 allows remote attackers to execute arbitrary code via a long string in the second argument.
45 CVE-2010-4595 264 Bypass 2010-12-22 2010-12-27
5.0
 None Remote Low Not required None Partial None
The Connection Manager in IBM Lotus Mobile Connect before 6.1.4 disables the http.device.stanza blacklisting functionality for HTTP Access Services (HTTP-AS), which allows remote attackers to bypass intended access restrictions via an HTTP request that contains a disallowed User-Agent header.
46 CVE-2010-4594 399 DoS 2010-12-22 2010-12-27
4.3
 None Remote Medium Not required None None Partial
The Connection Manager in IBM Lotus Mobile Connect before 6.1.4, when HTTP Access Services (HTTP-AS) is enabled, does not properly process TCP connection requests, which allows remote attackers to cause a denial of service (memory consumption and HTTP-AS hang) by making many connection requests that trigger "queue size delta errors," related to a "timing hole" issue.
47 CVE-2010-4593 399 DoS 2010-12-22 2011-01-11
4.0
 None Remote Low ??? None None Partial
The Connection Manager in IBM Lotus Mobile Connect before 6.1.4 does not properly maintain a certain reference count, which allows remote authenticated users to cause a denial of service (IP address exhaustion) by making invalid attempts to establish sessions with the same VPN ID from multiple devices.
48 CVE-2010-4592 399 DoS 2010-12-22 2011-01-11
4.3
 None Remote Medium Not required None None Partial
The Mobile Network Connections functionality in the Connection Manager in IBM Lotus Mobile Connect before 6.1.4, when HTTP Access Services (HTTP-AS) is enabled, does not properly handle failed attempts at establishing HTTP-TCP sessions, which allows remote attackers to cause a denial of service (memory consumption and daemon crash) by making many TCP connection attempts.
49 CVE-2010-4591 287 2010-12-22 2011-01-11
4.4
 None Local Medium Not required Partial Partial Partial
The Connection Manager in IBM Lotus Mobile Connect (LMC) before 6.1.4, when HTTP Access Services (HTTP-AS) is enabled, does not delete LTPA tokens in response to use of the iNotes Logoff button, which might allow physically proximate attackers to obtain access via an unattended client, related to a cookie domain mismatch.
50 CVE-2010-4590 79 XSS 2010-12-22 2010-12-27
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in HTTP Access Services (HTTP-AS) in the Connection Manager in IBM Lotus Mobile Connect (LMC) before 6.1.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Total number of vulnerabilities : 4653   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.