CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In August 2010

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
101 CVE-2010-3001 2010-08-30 2017-09-19
9.3
None Remote Medium Not required Complete Complete Complete
Unspecified vulnerability in an ActiveX control in the Internet Explorer (IE) plugin in RealNetworks RealPlayer 11.0 through 11.1 and RealPlayer SP 1.0 through 1.1.4 on Windows has unknown impact and attack vectors related to "multiple browser windows."
102 CVE-2010-3000 189 Exec Code Overflow 2010-08-30 2018-10-10
9.3
None Remote Medium Not required Complete Complete Complete
Multiple integer overflows in the ParseKnownType function in RealNetworks RealPlayer 11.0 through 11.1 and RealPlayer SP 1.0 through 1.1.4 on Windows allow remote attackers to execute arbitrary code via crafted (1) HX_FLV_META_AMF_TYPE_MIXEDARRAY or (2) HX_FLV_META_AMF_TYPE_ARRAY data in an FLV file.
103 CVE-2010-2996 94 Exec Code 2010-08-30 2018-10-10
9.3
None Remote Medium Not required Complete Complete Complete
Array index error in RealNetworks RealPlayer 11.0 through 11.1 on Windows allows remote attackers to execute arbitrary code via a malformed header in a RealMedia .IVR file.
104 CVE-2010-2995 189 DoS Exec Code Overflow 2010-08-13 2017-09-19
10.0
None Remote Low Not required Complete Complete Complete
The SigComp Universal Decompressor Virtual Machine (UDVM) in Wireshark 0.10.8 through 1.0.14 and 1.2.0 through 1.2.9 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to sigcomp-udvm.c and an off-by-one error, which triggers a buffer overflow, different vulnerabilities than CVE-2010-2287.
105 CVE-2010-2994 119 Overflow 2010-08-13 2017-09-19
10.0
None Remote Low Not required Complete Complete Complete
Stack-based buffer overflow in the ASN.1 BER dissector in Wireshark 0.10.13 through 1.0.14 and 1.2.0 through 1.2.9 has unknown impact and remote attack vectors. NOTE: this issue exists because of a CVE-2010-2284 regression.
106 CVE-2010-2993 20 DoS 2010-08-13 2017-09-19
5.0
None Remote Low Not required None None Partial
The IPMI dissector in Wireshark 1.2.0 through 1.2.9 allows remote attackers to cause a denial of service (infinite loop) via unknown vectors.
107 CVE-2010-2992 DoS 2010-08-13 2017-09-19
5.0
None Remote Low Not required None None Partial
packet-gsm_a_rr.c in the GSM A RR dissector in Wireshark 1.2.2 through 1.2.9 allows remote attackers to cause a denial of service (crash) via unknown vectors that trigger a NULL pointer dereference.
108 CVE-2010-2991 94 DoS Exec Code Mem. Corr. 2010-08-11 2010-08-12
9.3
None Remote Medium Not required Complete Complete Complete
The IICAClient interface in the ICAClient library in the ICA Client ActiveX Object (aka ICO) component in Citrix Online Plug-in for Windows for XenApp & XenDesktop before 12.0.3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted HTML document that triggers the reading of a .ICA file.
109 CVE-2010-2990 119 Exec Code Overflow 2010-08-11 2018-10-10
9.3
None Remote Medium Not required Complete Complete Complete
Citrix Online Plug-in for Windows for XenApp & XenDesktop before 11.2, Citrix Online Plug-in for Mac for XenApp & XenDesktop before 11.0, Citrix ICA Client for Linux before 11.100, Citrix ICA Client for Solaris before 8.63, and Citrix Receiver for Windows Mobile before 11.5 allow remote attackers to execute arbitrary code via (1) a crafted HTML document, (2) a crafted .ICA file, or (3) a crafted type field in an ICA graphics packet, related to a "heap offset overflow" issue.
110 CVE-2010-2989 200 +Info 2010-08-10 2018-10-10
5.0
None Remote Low Not required Partial None None
nessusd_www_server.nbin in the Nessus Web Server plugin 1.2.4 for Nessus allows remote attackers to obtain sensitive information via a request to the /feed method, which reveals the version in a response.
111 CVE-2010-2988 79 XSS 2010-08-10 2010-08-10
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Cisco Unified Wireless Network (UWN) Solution 7.x before 7.0.98.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCtf35333.
112 CVE-2010-2987 79 XSS 2010-08-10 2010-08-10
4.3
None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Cisco Wireless Control System (WCS) 7.x before 7.0.164, as used in Cisco Unified Wireless Network (UWN) Solution 7.x before 7.0.98.0, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCtg33854.
113 CVE-2010-2986 79 XSS 2010-08-10 2018-10-10
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in webacs/QuickSearchAction.do in the search feature in the web interface in Cisco Wireless Control System (WCS) before 6.0(194.0) and 7.x before 7.0.164 allows remote attackers to inject arbitrary web script or HTML via the searchText parameter, aka Bug ID CSCtf14288.
114 CVE-2010-2985 79 XSS 2010-08-10 2010-08-10
4.3
None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in IBM WebSphere Service Registry and Repository (WSRR) 6.3 allow remote attackers to inject arbitrary web script or HTML via (1) the searchTerm parameter to ServiceRegistry/HelpSearch.do or (2) the queryItems[0].value parameter to ServiceRegistry/QueryWizardProcessStep1.do.
115 CVE-2010-2984 Bypass 2010-08-10 2010-08-10
10.0
None Remote Low Not required Complete Complete Complete
Cisco Unified Wireless Network (UWN) Solution 7.x before 7.0.98.0 on 4404 series controllers does not properly implement the WEBAUTH_REQD state, which allows remote attackers to bypass intended access restrictions via WLAN traffic, aka Bug ID CSCtb75305.
116 CVE-2010-2983 DoS 2010-08-10 2010-08-10
7.8
None Remote Low Not required None None Complete
The workgroup bridge (aka WGB) functionality in Cisco Unified Wireless Network (UWN) Solution 7.x before 7.0.98.0 allows remote attackers to cause a denial of service (dropped connection) via a series of spoofed EAPoL-Logoff frames, related to an "EAPoL logoff attack," aka Bug ID CSCte43374.
117 CVE-2010-2982 200 +Info 2010-08-10 2010-08-10
7.1
None Remote Medium Not required Complete None None
Cisco Unified Wireless Network (UWN) Solution 7.x before 7.0.98.0 allows remote attackers to discover a group password via a series of SNMP requests, as demonstrated by an SNMP walk, aka Bug ID CSCtb74037.
118 CVE-2010-2981 DoS 2010-08-10 2010-08-10
7.1
None Remote Medium Not required None None Complete
Cisco Unified Wireless Network (UWN) Solution 7.x before 7.0.98.0 allows remote attackers to cause a denial of service (device crash) by pinging a virtual interface, aka Bug ID CSCte55370.
119 CVE-2010-2980 119 DoS Overflow 2010-08-10 2010-08-10
7.8
None Remote Low Not required None None Complete
Cisco Unified Wireless Network (UWN) Solution 7.x before 7.0.98.0 on 5508 series controllers allows remote attackers to cause a denial of service (pbuf exhaustion and device crash) via fragmented traffic, aka Bug ID CSCtd26794.
120 CVE-2010-2979 119 DoS Overflow 2010-08-10 2010-08-10
7.8
None Remote Low Not required None None Complete
Cisco Unified Wireless Network (UWN) Solution 7.x before 7.0.98.0 on 5508 series controllers allows remote attackers to cause a denial of service (buffer leak and device crash) via ARP requests that trigger an ARP storm, aka Bug ID CSCte43508.
121 CVE-2010-2978 310 Bypass 2010-08-10 2010-08-10
10.0
None Remote Low Not required Complete Complete Complete
Cisco Unified Wireless Network (UWN) Solution 7.x before 7.0.98.0 does not use an adequate message-digest algorithm for a self-signed certificate, which allows remote attackers to bypass intended access restrictions via vectors involving collisions, aka Bug ID CSCtd67660.
122 CVE-2010-2977 16 2010-08-10 2010-08-10
10.0
None Remote Low Not required Complete Complete Complete
Cisco Unified Wireless Network (UWN) Solution 7.x before 7.0.98.0 does not properly implement TLS and SSL, which has unspecified impact and remote attack vectors, aka Bug ID CSCtd01611.
123 CVE-2010-2976 255 2010-08-10 2010-08-10
10.0
None Remote Low Not required Complete Complete Complete
The controller in Cisco Unified Wireless Network (UWN) Solution 7.x through 7.0.98.0 has (1) a default SNMP read-only community of public, (2) a default SNMP read-write community of private, and a value of "default" for the (3) SNMP v3 username, (4) SNMP v3 authentication password, and (5) SNMP v3 privacy password, which makes it easier for remote attackers to obtain access.
124 CVE-2010-2975 200 +Info 2010-08-10 2010-08-10
2.1
None Local Low Not required Partial None None
Cisco Unified Wireless Network (UWN) Solution 7.x through 7.0.98.0 does not properly handle multiple SSH sessions, which allows physically proximate attackers to read a password, related to an "arrow key failure," aka Bug ID CSCtg51544.
125 CVE-2010-2974 119 Exec Code Overflow 2010-08-05 2010-08-09
9.3
None Remote Medium Not required Complete Complete Complete
Stack-based buffer overflow in the IConfigurationAccess interface in the Invensys Wonderware Archestra ConfigurationAccessComponent ActiveX control in Wonderware Application Server (WAS) before 3.1 SP2 P01, as used in the Wonderware Archestra Integrated Development Environment (IDE) and the InFusion Integrated Engineering Environment (IEE), allows remote attackers to execute arbitrary code via the first argument to the UnsubscribeData method.
126 CVE-2010-2973 264 1 Overflow +Priv 2010-08-05 2010-08-18
6.9
None Local Medium Not required Complete Complete Complete
Integer overflow in IOSurface in Apple iOS before 4.0.2 on the iPhone and iPod touch, and before 3.2.2 on the iPad, allows local users to gain privileges via vectors involving IOSurface properties, as demonstrated by JailbreakMe.
127 CVE-2010-2972 119 Exec Code Overflow Mem. Corr. 2010-08-05 2010-08-09
9.3
None Remote Medium Not required Complete Complete Complete
An unspecified component, when running on Apple iOS 4.0.1 on iPhone, iPad, and iPod, allows remote attackers to execute arbitrary code via a PDF file with crafted Compact Font Format (CFF) data, which triggers memory corruption, as demonstrated by JailbreakMe. NOTE: some of these details are obtained from third party information.
128 CVE-2010-2971 119 Overflow 2010-08-05 2018-01-05
9.3
None Remote Medium Not required Complete Complete Complete
loaders/load_it.c in libmikmod, possibly 3.1.12, does not properly account for the larger size of name##env relative to name##tick and name##node, which allows remote attackers to trigger a buffer over-read and possibly have unspecified other impact via a crafted Impulse Tracker file, a related issue to CVE-2010-2546. NOTE: this issue exists because of an incomplete fix for CVE-2009-3995.
129 CVE-2010-2970 79 XSS 2010-08-05 2010-08-05
4.3
None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) action/SlideShow.py, (2) action/anywikidraw.py, and (3) action/language_setup.py, a similar issue to CVE-2010-2487.
130 CVE-2010-2969 79 XSS 2010-08-05 2010-08-05
4.3
None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.7.3 and earlier, and 1.9.x before 1.9.3, allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) action/LikePages.py, (2) action/chart.py, and (3) action/userprofile.py, a similar issue to CVE-2010-2487.
131 CVE-2010-2968 264 2010-08-05 2010-08-05
7.8
None Remote Low Not required Complete None None
The FTP daemon in Wind River VxWorks does not close the TCP connection after a number of failed login attempts, which makes it easier for remote attackers to obtain access via a brute-force attack.
132 CVE-2010-2967 310 2010-08-05 2010-08-05
7.8
None Remote Low Not required Complete None None
The loginDefaultEncrypt algorithm in loginLib in Wind River VxWorks before 6.9 does not properly support a large set of distinct possible passwords, which makes it easier for remote attackers to obtain access via a (1) telnet, (2) rlogin, or (3) FTP session.
133 CVE-2010-2966 255 2010-08-05 2010-08-05
7.8
None Remote Low Not required Complete None None
The INCLUDE_SECURITY functionality in Wind River VxWorks 6.x, 5.x, and earlier uses the LOGIN_USER_NAME and LOGIN_USER_PASSWORD (aka LOGIN_PASSWORD) parameters to create hardcoded credentials, which makes it easier for remote attackers to obtain access via a (1) telnet, (2) rlogin, or (3) FTP session.
134 CVE-2010-2965 264 2010-08-05 2010-08-05
10.0
None Remote Low Not required Complete Complete Complete
The WDB target agent debug service in Wind River VxWorks 6.x, 5.x, and earlier, as used on the Rockwell Automation 1756-ENBT series A with firmware 3.2.6 and 3.6.1 and other products, allows remote attackers to read or modify arbitrary memory locations, perform function calls, or manage tasks via requests to UDP port 17185, a related issue to CVE-2005-3804.
135 CVE-2010-2947 119 DoS Exec Code Overflow 2010-08-24 2011-01-14
10.0
None Remote Low Not required Complete Complete Complete
Heap-based buffer overflow in the HX_split function in string.c in libHX before 3.6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a string that is inconsistent with the expected number of fields.
136 CVE-2010-2945 16 +Priv 2010-08-30 2010-08-31
6.9
None Local Medium Not required Complete Complete Complete
The default configuration of SLiM before 1.3.2 places ./ (dot slash) at the beginning of the default_path option, which might allow local users to gain privileges via a Trojan horse program in the current working directory, related to slim.conf and cfg.cpp.
137 CVE-2010-2944 287 +Priv 2010-08-20 2010-08-23
7.5
None Remote Low Not required Partial Partial Partial
The authenticate function in LDAPUserFolder/LDAPUserFolder.py in zope-ldapuserfolder 2.9-1 does not verify the password for the emergency account, which allows remote attackers to gain privileges.
138 CVE-2010-2940 287 Bypass 2010-08-30 2017-08-17
5.1
None Remote High Not required Partial Partial Partial
The auth_send function in providers/ldap/ldap_auth.c in System Security Services Daemon (SSSD) 1.3.0, when LDAP authentication and anonymous bind are enabled, allows remote attackers to bypass the authentication requirements of pam_authenticate via an empty password.
139 CVE-2010-2939 399 DoS Exec Code 2010-08-17 2018-10-10
4.3
None Remote Medium Not required None None Partial
Double free vulnerability in the ssl3_get_key_exchange function in the OpenSSL client (ssl/s3_clnt.c) in OpenSSL 1.0.0a, 0.9.8, 0.9.7, and possibly other versions, when using ECDH, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted private key with an invalid prime. NOTE: some sources refer to this as a use-after-free issue.
140 CVE-2010-2937 20 DoS 2010-08-20 2017-09-19
5.0
None Remote Low Not required None None Partial
The ReadMetaFromId3v2 function in taglib.cpp in the TagLib plugin in VideoLAN VLC media player 0.9.0 through 1.1.2 does not properly process ID3v2 tags, which allows remote attackers to cause a denial of service (application crash) via a crafted media file.
141 CVE-2010-2936 189 DoS Exec Code Overflow 2010-08-25 2017-09-19
9.3
None Remote Medium Not required Complete Complete Complete
Integer overflow in simpress.bin in the Impress module in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted polygons in a PowerPoint document that triggers a heap-based buffer overflow.
142 CVE-2010-2935 189 DoS Exec Code Overflow 2010-08-25 2017-09-19
9.3
None Remote Medium Not required Complete Complete Complete
simpress.bin in the Impress module in OpenOffice.org (OOo) 2.x and 3.x before 3.3 does not properly handle integer values associated with dictionary property items, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PowerPoint document that triggers a heap-based buffer overflow, related to an "integer truncation error."
143 CVE-2010-2934 DoS 2010-08-17 2010-08-18
5.0
None Remote Low Not required None None Partial
Multiple unspecified vulnerabilities in ZNC 0.092 allow remote attackers to cause a denial of service (exception and daemon crash) via unknown vectors related to "unsafe substr() calls."
144 CVE-2010-2933 89 1 Exec Code Sql 2010-08-05 2017-08-17
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in AV Scripts AV Arcade 3 allows remote attackers to execute arbitrary SQL commands via the ava_code cookie to the "main page," related to index.php and the login task.
145 CVE-2010-2932 119 3 Exec Code Overflow 2010-08-05 2017-08-17
9.3
None Remote Medium Not required Complete Complete Complete
Buffer overflow in BarCodeWiz BarCode 3.29 ActiveX control (BarcodeWiz.dll) allows remote attackers to execute arbitrary code via a long argument to the LoadProperties method.
146 CVE-2010-2931 119 1 Exec Code Overflow 2010-08-05 2017-09-19
9.3
None Remote Medium Not required Complete Complete Complete
Stack-based buffer overflow in SigPlus Pro 3.74 ActiveX control allows remote attackers to execute arbitrary code via a long eighth argument (HexString) to the LCDWriteString method.
147 CVE-2010-2930 119 Overflow +Priv 2010-08-02 2017-08-17
7.2
None Local Low Not required Complete Complete Complete
Multiple stack-based buffer overflows in hsolinkcontrol in hsolink 1.0.118 allow local users to gain privileges via long command-line arguments, a different vulnerability than CVE-2010-1671. NOTE: some of these details are obtained from third party information.
148 CVE-2010-2929 264 +Priv 2010-08-02 2017-08-17
7.2
None Local Low Not required Complete Complete Complete
Untrusted search path vulnerability in hsolinkcontrol in hsolink 1.0.118 allows local users to gain privileges via a modified PATH environment variable, which is used during execution of the (1) route, (2) mv, and (3) cp programs, a different vulnerability than CVE-2010-1671.
149 CVE-2010-2927 287 DoS 2010-08-02 2017-08-17
5.0
None Remote Low Not required None None Partial
The slapi_printmessage function in IBM Tivoli Directory Server (ITDS) before 6.0.0.8-TIV-ITDS-IF0006 allows remote attackers to cause a denial of service (daemon crash) via multiple incomplete DIGEST-MD5 connection attempts.
150 CVE-2010-2882 119 DoS Exec Code Overflow Mem. Corr. 2010-08-26 2018-10-10
9.3
None Remote Medium Not required Complete Complete Complete
DIRAPI.dll in Adobe Shockwave Player before 11.5.8.612 does not properly parse .dir files, which allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a malformed file containing an invalid value, as demonstrated by a value at position 0x3812 of a certain file.
Total number of vulnerabilities : 381   Page : 1 2 3 (This Page)4 5 6 7 8
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.