Skip to content
OpenAdvisories

Archive

29 April 2010

Vulnerabilities first published on this day (UTC), newest first.

← March 2010 2010 / April /29 May 2010 →
  1. 148
  2. 2 
  3. 3 
  4. 4 
  5. 543
  6. 624
  7. 711
  8. 815
  9. 918
  10. 10 
  11. 11 
  12. 1221
  13. 1366
  14. 1440
  15. 1510
  16. 1614
  17. 17 
  18. 18 
  19. 1913
  20. 2027
  21. 2119
  22. 2216
  23. 2328
  24. 24 
  25. 25 
  26. 2617
  27. 2724
  28. 2818
  29. 2928
  30. 3016
All Critical High Medium Low Exploited only Public exploit

28 results · Feed

  • Unscored —
    CVE-2010-0817 Public exploit EPSS 29%

    Cross-site scripting (XSS) vulnerability in _layouts/help.aspx in Microsoft SharePoint Server 2007 12.0.0.6421 and poss…

  • Low —
    CVE-2010-1614

    Moodle vulnerable to Cross-site Scripting

    Multiple cross-site scripting (XSS) vulnerabilities in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) the Login-As feature or (2) when the global search feature is ena…

    moodle/moodle Packagist
  • Low —
    CVE-2010-1619

    Moodle vulnerable to Cross-site Scripting

    Cross-site scripting (XSS) vulnerability in the fix_non_standard_entities function in the KSES HTML text cleaning library (weblib.php), as used in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8, allows remote attackers to inject arbitrary web script or HTM…

    moodle/moodle Packagist
  • Medium —
    CVE-2010-1618

    phpCAS client library and Moodle Cross-site Scripting vulnerability

    Cross-site scripting (XSS) vulnerability in the phpCAS client library before 1.1.0, as used in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8, allows remote attackers to inject arbitrary web script or HTML via a crafted URL, which is not properly handled i…

    moodle/moodle apereo/phpcas Packagist
  • Medium —
    CVE-2010-1613

    Moodle Session Fixation vulnerability

    Moodle 1.8.x and 1.9.x before 1.9.8 does not enable the "Regenerate session id during login" setting by default, which makes it easier for remote attackers to conduct session fixation attacks.

    moodle/moodle Packagist
  • Low —
    CVE-2010-1617

    Moodle doesn't properly check role

    user/view.php in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 does not properly check a role, which allows remote authenticated users to obtain the full names of other users via the course profile page.

    moodle/moodle Packagist
  • Medium —
    CVE-2010-1616

    Moodle is vulnerable to unauthorized new accounts creation

    Moodle 1.8.x and 1.9.x before 1.9.8 can create new roles when restoring a course, which allows teachers to create new accounts even if they do not have the moodle/user:create capability.

    moodle/moodle Packagist
  • Unscored —
    CVE-2010-1166

    The fbComposite function in fbpict.c in the Render extension in the X server in X.Org X11R7.1 allows remote authenticat…

  • High —
    CVE-2010-1615

    Moodle vulnerable to SQL injection

    Multiple SQL injection vulnerabilities in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) the add_to_log function in mod/wiki/view.php in the wiki module, or (2) "data valid…

    moodle/moodle Packagist
  • Unscored —
    CVE-2010-1612

    The IBM WebSphere DataPower XML Accelerator XA35, Low Latency Appliance XM70, Integration Appliance XI50, B2B Appliance…

  • Unscored —
    CVE-2010-1610

    Cross-site request forgery (CSRF) vulnerability in index.php in OpenCart 1.4 allows remote attackers to hijack the auth…

  • Unscored —
    CVE-2010-1611 Public exploit

    Cross-site request forgery (CSRF) vulnerability in AlegroCart 1.1 allows remote attackers to hijack the authentication …

  • Unscored —
    CVE-2009-4831

    Cerulean Studios Trillian 3.1 Basic does not check SSL certificates during MSN authentication, which allows remote atta…

  • Unscored —
    CVE-2009-4833

    MySQL Connector/NET before 6.0.4, when using encryption, does not verify SSL certificates during connection, which allo…

  • Unscored —
    CVE-2009-4832 Public exploit

    The dlpcrypt.sys kernel driver 0.1.1.27 in DESlock+ 4.0.2 allows local users to gain privileges via a crafted IOCTL 0x8…

  • Unscored —
    CVE-2010-1606 Public exploit

    Multiple cross-site scripting (XSS) vulnerabilities in NCT Jobs Portal Script allow remote attackers to inject arbitrar…

  • Unscored —
    CVE-2010-1602 Public exploit Scanner template EPSS 16%

    Directory traversal vulnerability in the ZiMB Comment (com_zimbcomment) component 0.8.1 for Joomla! allows remote attac…

  • Unscored —
    CVE-2010-1604 Public exploit

    Multiple SQL injection vulnerabilities in admin_login.php in NCT Jobs Portal Script allow remote attackers to execute a…

  • Unscored —
    CVE-2010-1601 Public exploit Scanner template EPSS 16%

    Directory traversal vulnerability in the JA Comment (com_jacomment) component for Joomla! allows remote attackers to re…

  • Unscored —
    CVE-2010-1608

    Stack-based buffer overflow in IBM Lotus Notes 8.5 and 8.5fp1, and possibly other versions, allows remote attackers to …

  • Unscored —
    CVE-2010-1600 Public exploit

    SQL injection vulnerability in the Media Mall Factory (com_mediamall) component 1.0.4 for Joomla! allows remote attacke…

  • Unscored —
    CVE-2010-1603 Public exploit Scanner template

    Directory traversal vulnerability in the ZiMB Core (aka ZiMBCore or com_zimbcore) component 0.1 in the ZiMB Manager col…

  • Unscored —
    CVE-2010-1607 Public exploit Scanner template

    Directory traversal vulnerability in wmi.php in the Webmoney Web Merchant Interface (aka WMI or com_wmi) component 1.5.…

  • Unscored —
    CVE-2010-1599 Public exploit

    SQL injection vulnerability in loadorder.php in NKInFoWeb 2.5 and 5.2.2.0 allows remote attackers to execute arbitrary …

  • Unscored —
    CVE-2010-1605

    Multiple SQL injection vulnerabilities in isearch.php in NCT Jobs Portal Script allow remote attackers to execute arbit…

  • Unscored —
    CVE-2010-1609

    Cross-site scripting (XSS) vulnerability in SAP NetWeaver 2004 before SP21 and 2004s before SP13 allows remote attacker…

  • Unscored —
    CVE-2010-1598

    phpThumb.php in phpThumb() 1.7.9 and possibly other versions, when ImageMagick is installed, allows remote attackers to…

  • Unscored —
    CVE-2010-1597 Public exploit EPSS 12%

    Stack-based buffer overflow in zgtips.dll in ZipGenius 6.3.1.2552 allows user-assisted remote attackers to execute arbi…