Skip to content
OpenAdvisories

Archive

October 2010

Vulnerabilities first published in this month (UTC), newest first.

← September 2010 2010 / October November 2010 →
  1. 1 
  2. 2 
  3. 3 
  4. 46
  5. 533
  6. 628
  7. 77
  8. 811
  9. 9 
  10. 10 
  11. 11 
  12. 1216
  13. 1386
  14. 1438
  15. 15 
  16. 16 
  17. 17 
  18. 1820
  19. 1948
  20. 2032
  21. 2131
  22. 228
  23. 23 
  24. 24 
  25. 2516
  26. 2612
  27. 2711
  28. 2818
  29. 2913
  30. 30 
  31. 31 
All Critical High Medium Low Exploited only Public exploit

15 results · Clear filters · Feed

  • Medium —
    CVE-2010-3700

    Authentication Bypass Using an Alternate Path or Channel in SpringSource Spring Security and Acegi Security

    VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server (WAS) 6.1 and 7.0, allows remote attackers to bypass security constraints via a path parameter.

    org.springframework.security:spring-security-core org.acegisecurity:acegi-security Maven
  • Medium —
    CVE-2010-3933

    Rails activerecord gem has Improper Input Validation vulnerability

    Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form inputs.

    activerecord RubyGems
  • Medium —
    CVE-2010-3715

    TYPO3 cross-site scripting (XSS) vulnerability in the RemoveXSS function and the backend

    Multiple cross-site scripting (XSS) vulnerabilities in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) the RemoveXSS function, and allow remote auth…

    typo3/cms-backend Packagist
  • Medium —
    CVE-2010-2057

    Improper Authentication in Apache MyFaces

    shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modificatio…

    org.apache.myfaces.core:myfaces-impl org.apache.myfaces.shared:myfaces-shared-core Maven
  • Medium 4.3
    CVE-2008-7264

    Improper input validation in pyftpdlib

    The ftp_QUIT function in ftpserver.py in pyftpdlib before 0.5.0 allows remote authenticated users to cause a denial of service (file descriptor exhaustion and daemon outage) by sending a QUIT command during a disallowed data-transfer attempt.

    pyftpdlib PyPI
  • Medium 6.3
    CVE-2008-7262

    Directory traversal in pyftpdlib

    Multiple directory traversal vulnerabilities in FTPServer.py in pyftpdlib before 0.3.0 allow remote authenticated users to access arbitrary files and directories via vectors involving a symlink in a pathname to a (1) CWD, (2) DELE, (3) STOR, or (4) RETR comma…

    pyftpdlib PyPI
  • Medium —
    CVE-2010-3495

    Zope Object Database Denial of Service vulnerability

    Race condition in ZEO/StorageServer.py in Zope Object Database (ZODB) before 3.10.0 allows remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading to the accept function having an un…

    zodb3 PyPI
  • Medium —
    CVE-2009-5011

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in pyftpdlib

    Race condition in the FTPHandler class in ftpserver.py in pyftpdlib before 0.5.2 allows remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading to the getpeername function having an …

    pyftpdlib python-pyftpdlib Debian PyPI
  • Medium —
    CVE-2009-5013

    Uncontrolled Resource Consumption in pyftpdlib

    Memory leak in the on_dtp_close function in ftpserver.py in pyftpdlib before 0.5.2 allows remote authenticated users to cause a denial of service (memory consumption) by sending a QUIT command during a data transfer.

    pyftpdlib python-pyftpdlib Debian PyPI
  • Medium —
    CVE-2009-5010

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in pyftpdlib

    Race condition in the FTPHandler class in ftpserver.py in pyftpdlib before 0.5.1 allows remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading to the accept function having an unexp…

    pyftpdlib PyPI
  • Medium 6.3
    CVE-2007-6741

    Improper privilege management in pyftpdlib

    The ftp_PORT function in FTPServer.py in pyftpdlib before 0.2.0 does not prevent TCP connections to privileged ports if the destination IP address matches the source IP address of the connection from the FTP client, which might allow remote authenticated user…

    pyftpdlib PyPI
  • Medium 6.5
    CVE-2007-6740

    pyftpdlib vulnerable to allocation of resources without limits

    The ftp_STOU function in FTPServer.py in pyftpdlib before 0.2.0 does not limit the number of attempts to discover a unique filename, which might allow remote authenticated users to cause a denial of service via a STOU command.

    pyftpdlib PyPI
  • Medium 6.3
    CVE-2007-6736

    Directory Traversal in pyftpdlib

    Multiple directory traversal vulnerabilities in FTPServer.py in pyftpdlib before 0.2.0 allow remote authenticated users to access arbitrary files and directories via a .. (dot dot) in a (1) LIST, (2) STOR, or (3) RETR command.

    pyftpdlib PyPI
  • Medium 6.5
    CVE-2010-3330 EPSS 22%

    Microsoft Internet Explorer 6 through 8 does not properly restrict script access to content from a different (1) domain…

  • Medium 4.3
    CVE-2010-3243 EPSS 16%

    Cross-site scripting (XSS) vulnerability in the toStaticHTML function in Microsoft Internet Explorer 8, and the SafeHTM…