Skip to content
OpenAdvisories

Archive

April 2010

Vulnerabilities first published in this month (UTC), newest first.

← March 2010 2010 / April May 2010 →
  1. 148
  2. 2 
  3. 3 
  4. 4 
  5. 543
  6. 624
  7. 711
  8. 815
  9. 918
  10. 10 
  11. 11 
  12. 1221
  13. 1366
  14. 1440
  15. 1510
  16. 1614
  17. 17 
  18. 18 
  19. 1913
  20. 2027
  21. 2119
  22. 2216
  23. 2328
  24. 24 
  25. 25 
  26. 2617
  27. 2724
  28. 2818
  29. 2928
  30. 3016
All Critical High Medium Low Exploited only Public exploit

516 results · Feed

  • Unscored —
    CVE-2010-1664

    Google Chrome before 4.1.249.1064 does not properly handle HTML5 media, which allows remote attackers to cause a denial…

  • Unscored —
    CVE-2010-1659 Public exploit Scanner template EPSS 14%

    Directory traversal vulnerability in the Ultimate Portfolio (com_ultimateportfolio) component 1.0 for Joomla! allows re…

  • Unscored —
    CVE-2010-1657 Public exploit Scanner template EPSS 19%

    Directory traversal vulnerability in the SmartSite (com_smartsite) component 1.0.0 for Joomla! allows remote attackers …

  • Unscored —
    CVE-2010-1656 Public exploit

    SQL injection vulnerability in the Airiny ABC (com_abc) component 1.1.7 for Joomla! allows remote attackers to execute …

  • Unscored —
    CVE-2010-1653 Public exploit Scanner template EPSS 13%

    Directory traversal vulnerability in graphics.php in the Graphics (com_graphics) component 1.0.6 and 1.5.0 for Joomla! …

  • Unscored —
    CVE-2010-1651

    IBM WebSphere Application Server (WAS) 6.1.x before 6.1.0.31 and 7.0.x before 7.0.0.11, when Basic authentication and S…

  • Unscored —
    CVE-2010-1660 Public exploit

    SQL injection vulnerability in help-details.php in CLScript Classifieds Script allows remote attackers to execute arbit…

  • Unscored —
    CVE-2010-1655

    Cross-site scripting (XSS) vulnerability in User/User_ChkLogin.asp in PowerEasy 2006 and PowerEasy SiteWeaver 6.8 allow…

  • Unscored —
    CVE-2010-1661 Public exploit

    Multiple SQL injection vulnerabilities in PHP-Quick-Arcade (PHPQA) 3.0.21 allow remote attackers to execute arbitrary S…

  • Unscored —
    CVE-2010-1665

    Google Chrome before 4.1.249.1064 does not properly handle fonts, which allows remote attackers to cause a denial of se…

  • Unscored —
    CVE-2010-1652 Public exploit

    Directory traversal vulnerability in the HelpCenter module in Help Center Live (HCL) 2.0.6 and 2.1.7 allows remote atta…

  • Unscored —
    CVE-2010-1663 Public exploit EPSS 54%

    The Google URL Parsing Library (aka google-url or GURL) in Google Chrome before 4.1.249.1064 allows remote attackers to…

  • Unscored —
    CVE-2010-1658 Public exploit Scanner template EPSS 16%

    Directory traversal vulnerability in the Code-Garage NoticeBoard (com_noticeboard) component 1.3 for Joomla! allows rem…

  • Unscored —
    CVE-2010-1650

    IBM WebSphere Application Server (WAS) 6.0.x before 6.0.2.41, 6.1.x before 6.1.0.31, and 7.0.x before 7.0.0.11, when th…

  • Unscored —
    CVE-2010-1662 Public exploit

    Cross-site scripting (XSS) vulnerability in acpmoderate.php in PHP-Quick-Arcade (PHPQA) 3.0.21 allows remote attackers …

  • Unscored —
    CVE-2010-1654 Public exploit

    Multiple SQL injection vulnerabilities in system_member_login.php in Infocus Real Estate Enterprise Edition allow remot…

  • Unscored —
    CVE-2010-0817 Public exploit EPSS 29%

    Cross-site scripting (XSS) vulnerability in _layouts/help.aspx in Microsoft SharePoint Server 2007 12.0.0.6421 and poss…

  • Low —
    CVE-2010-1614

    Moodle vulnerable to Cross-site Scripting

    Multiple cross-site scripting (XSS) vulnerabilities in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) the Login-As feature or (2) when the global search feature is ena…

    moodle/moodle Packagist
  • Low —
    CVE-2010-1619

    Moodle vulnerable to Cross-site Scripting

    Cross-site scripting (XSS) vulnerability in the fix_non_standard_entities function in the KSES HTML text cleaning library (weblib.php), as used in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8, allows remote attackers to inject arbitrary web script or HTM…

    moodle/moodle Packagist
  • Medium —
    CVE-2010-1618

    phpCAS client library and Moodle Cross-site Scripting vulnerability

    Cross-site scripting (XSS) vulnerability in the phpCAS client library before 1.1.0, as used in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8, allows remote attackers to inject arbitrary web script or HTML via a crafted URL, which is not properly handled i…

    moodle/moodle apereo/phpcas Packagist
  • Medium —
    CVE-2010-1613

    Moodle Session Fixation vulnerability

    Moodle 1.8.x and 1.9.x before 1.9.8 does not enable the "Regenerate session id during login" setting by default, which makes it easier for remote attackers to conduct session fixation attacks.

    moodle/moodle Packagist
  • Low —
    CVE-2010-1617

    Moodle doesn't properly check role

    user/view.php in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 does not properly check a role, which allows remote authenticated users to obtain the full names of other users via the course profile page.

    moodle/moodle Packagist
  • Medium —
    CVE-2010-1616

    Moodle is vulnerable to unauthorized new accounts creation

    Moodle 1.8.x and 1.9.x before 1.9.8 can create new roles when restoring a course, which allows teachers to create new accounts even if they do not have the moodle/user:create capability.

    moodle/moodle Packagist
  • Unscored —
    CVE-2010-1166

    The fbComposite function in fbpict.c in the Render extension in the X server in X.Org X11R7.1 allows remote authenticat…

  • High —
    CVE-2010-1615

    Moodle vulnerable to SQL injection

    Multiple SQL injection vulnerabilities in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) the add_to_log function in mod/wiki/view.php in the wiki module, or (2) "data valid…

    moodle/moodle Packagist
  • Unscored —
    CVE-2010-1612

    The IBM WebSphere DataPower XML Accelerator XA35, Low Latency Appliance XM70, Integration Appliance XI50, B2B Appliance…

  • Unscored —
    CVE-2010-1610

    Cross-site request forgery (CSRF) vulnerability in index.php in OpenCart 1.4 allows remote attackers to hijack the auth…

  • Unscored —
    CVE-2010-1611 Public exploit

    Cross-site request forgery (CSRF) vulnerability in AlegroCart 1.1 allows remote attackers to hijack the authentication …

  • Unscored —
    CVE-2009-4831

    Cerulean Studios Trillian 3.1 Basic does not check SSL certificates during MSN authentication, which allows remote atta…

  • Unscored —
    CVE-2009-4833

    MySQL Connector/NET before 6.0.4, when using encryption, does not verify SSL certificates during connection, which allo…

  • Unscored —
    CVE-2009-4832 Public exploit

    The dlpcrypt.sys kernel driver 0.1.1.27 in DESlock+ 4.0.2 allows local users to gain privileges via a crafted IOCTL 0x8…

  • Unscored —
    CVE-2010-1606 Public exploit

    Multiple cross-site scripting (XSS) vulnerabilities in NCT Jobs Portal Script allow remote attackers to inject arbitrar…

  • Unscored —
    CVE-2010-1602 Public exploit Scanner template EPSS 16%

    Directory traversal vulnerability in the ZiMB Comment (com_zimbcomment) component 0.8.1 for Joomla! allows remote attac…

  • Unscored —
    CVE-2010-1604 Public exploit

    Multiple SQL injection vulnerabilities in admin_login.php in NCT Jobs Portal Script allow remote attackers to execute a…

  • Unscored —
    CVE-2010-1601 Public exploit Scanner template EPSS 16%

    Directory traversal vulnerability in the JA Comment (com_jacomment) component for Joomla! allows remote attackers to re…

  • Unscored —
    CVE-2010-1608

    Stack-based buffer overflow in IBM Lotus Notes 8.5 and 8.5fp1, and possibly other versions, allows remote attackers to …

  • Unscored —
    CVE-2010-1600 Public exploit

    SQL injection vulnerability in the Media Mall Factory (com_mediamall) component 1.0.4 for Joomla! allows remote attacke…

  • Unscored —
    CVE-2010-1603 Public exploit Scanner template

    Directory traversal vulnerability in the ZiMB Core (aka ZiMBCore or com_zimbcore) component 0.1 in the ZiMB Manager col…

  • Unscored —
    CVE-2010-1607 Public exploit Scanner template

    Directory traversal vulnerability in wmi.php in the Webmoney Web Merchant Interface (aka WMI or com_wmi) component 1.5.…

  • Unscored —
    CVE-2010-1599 Public exploit

    SQL injection vulnerability in loadorder.php in NKInFoWeb 2.5 and 5.2.2.0 allows remote attackers to execute arbitrary …