Skip to content
OpenAdvisories

Archive

November 2010

Vulnerabilities first published in this month (UTC), newest first.

← October 2010 2010 / November December 2010 →
  1. 118
  2. 2 
  3. 39
  4. 44
  5. 537
  6. 6 
  7. 720
  8. 86
  9. 919
  10. 1015
  11. 11 
  12. 1215
  13. 13 
  14. 14 
  15. 1518
  16. 1637
  17. 177
  18. 18 
  19. 19 
  20. 2026
  21. 21 
  22. 228
  23. 23 
  24. 24 
  25. 25 
  26. 2623
  27. 27 
  28. 28 
  29. 299
  30. 307
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium —
    CVE-2010-4312

    Apache Tomcat has cookies without HTTPOnly flag in Set-Cookie header

    The default configuration of Apache Tomcat 6.x does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to hijack a session via script access to a cookie.

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2010-4172 Public exploit EPSS 42%

    Improper Neutralization of Input During Web Page Generation in Apache Tomcat

    Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) orderBy or (2) sort parameter to sessionsLi…

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2010-3978

    Spree allows remote attackers to obtain sensitive information

    Spree 0.11.x before 0.11.2 and 0.30.x before 0.30.0 exchanges data using JavaScript Object Notation (JSON) without a mechanism for validating requests, which allows remote attackers to obtain sensitive information via vectors involving (1) admin/products.json…

    spree RubyGems
  • Medium 6.1
    CVE-2010-2477

    Paste is vulnerable to Cross-site Scripting via vectors involving a 404 status code

    Multiple cross-site scripting (XSS) vulnerabilities in the paste.httpexceptions implementation in Paste before 1.7.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving a 404 status code, related to (1) paste.urlparser.StaticUR…

    paste paste Debian PyPI
  • Medium —
    CVE-2010-4183

    HTML Purifier cross-site scripting (XSS) vulnerability

    Multiple cross-site scripting (XSS) vulnerabilities in HTML Purifier before 4.1.0, when Internet Explorer is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) background-image, (2) background, or (3) font-family Cascading S…

    ezyang/htmlpurifier php-htmlpurifier Debian Packagist
  • Medium —
    CVE-2010-3863 Public exploit EPSS 55%

    Apache Shiro Path Traversal vulnerability

    Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./accou…

    org.apache.shiro:shiro-root Maven