Exploits

    Dashboard / Exploits

    2.6
    Low

    CVE-2010-1856

    Last Modified: 17 Jun 2014

    Cross-site scripting (XSS) vulnerability in index.php in RepairShop2 1.9.023 Trial, when magic_quotes_gpc is disabled, allows remote attackers to inject arbitrary web script or HTML via the prod parameter in a products.details action.

    Source:kaMtiEz
    Published:7 May 2010
    7.5
    High

    CVE-2010-1855

    Last Modified: 11 Apr 2025

    SQL injection vulnerability in auktion.php in Pay Per Watch & Bid Auktions System allows remote attackers to execute arbitrary SQL commands via the id_auk parameter.

    Source:Easy Laster
    Published:7 May 2010
    7.5
    High

    CVE-2010-1840

    Last Modified: 1 Dec 2010

    Stack-based buffer overflow in the password-validation functionality in Directory Services in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors.

    Source:Rodrigo Rubira
    Published:15 Nov 2010
    9.3
    Critical

    CVE-2010-1818

    Last Modified: 30 Aug 2010

    The IPersistPropertyBag2::Read function in QTPlugin.ocx in Apple QuickTime 6.x, 7.x before 7.6.8, and other versions allows remote attackers to execute arbitrary code via the _Marshaled_pUnk attribute, which triggers unmarshalling of an untrusted pointer.

    Source:Ruben Santamarta
    Published:31 Aug 2010
    6.8
    Medium

    CVE-2010-1813

    Last Modified: 10 Sept 2010

    WebKit in Apple iOS before 4.1 on the iPhone and iPod touch allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors involving HTML object outlines.

    Source:Jose A. Vazquez
    Published:8 Sept 2010
    9.3
    Critical

    CVE-2010-1807

    Last Modified: 18 Dec 2018

    WebKit in Apple Safari 4.x before 4.1.2 and 5.x before 5.0.2; Android before 2.2; and webkitgtk before 1.2.6; does not properly validate floating-point data, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted HTML document, related to non-standard NaN representation.

    Source:MJ Keith
    Published:7 Sept 2010
    9.3
    Critical

    CVE-2010-1799

    Last Modified: 10 Mar 2011

    Stack-based buffer overflow in the error-logging functionality in Apple QuickTime before 7.6.7 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file.

    Source:Metasploit
    Published:16 Aug 2010
    9.3
    Critical

    CVE-2010-1797

    Last Modified: 2 Mar 2018

    Multiple stack-based buffer overflows in the cff_decoder_parse_charstrings function in the CFF Type2 CharStrings interpreter in cff/cffgload.c in FreeType before 2.4.2, as used in Apple iOS before 4.0.2 on the iPhone and iPod touch and before 3.2.2 on the iPad, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted CFF opcodes in embedded fonts in a PDF document, as demonstrated by JailbreakMe. NOTE: some of these details are obtained from third party information.

    Source:jailbreakme
    Published:5 Aug 2010
    9.3
    Critical

    CVE-2010-1759

    Last Modified: 1 Feb 2012

    Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to the Node.normalize method.

    Source:MJ Keith
    Published:7 Jun 2010
    4.3
    Medium

    CVE-2010-1748

    Last Modified: 23 Jul 2014

    The cgi_initialize_string function in cgi-bin/var.c in the web interface in CUPS before 1.4.4, as used on Apple Mac OS X 10.5.8, Mac OS X 10.6 before 10.6.4, and other platforms, does not properly handle parameter values containing a % (percent) character without two subsequent hex characters, which allows context-dependent attackers to obtain sensitive information from cupsd process memory via a crafted request, as demonstrated by the (1) /admin?OP=redirect&URL=% and (2) /admin?URL=/admin/&OP=% URIs.

    Source:Luca Carettoni
    Published:14 Jun 2010
    4.3
    Medium

    CVE-2010-1746

    Last Modified: 7 Nov 2016

    Multiple cross-site scripting (XSS) vulnerabilities in the Table JX (com_grid) component for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) data_search and (2) rpp parameters to index.php.

    Source:Valentin
    Published:6 May 2010
    7.5
    High

    CVE-2010-1744

    Last Modified: 11 Apr 2025

    SQL injection vulnerability in product.html in B2B Gold Script allows remote attackers to execute arbitrary SQL commands via the id parameter.

    Source:v3n0m
    Published:6 May 2010
    7.5
    High

    CVE-2010-1743

    Last Modified: 11 Apr 2025

    SQL injection vulnerability in projects.php in Scratcher allows remote attackers to execute arbitrary SQL commands via the id parameter.

    Source:cr4wl3r
    Published:6 May 2010
    4.3
    Medium

    CVE-2010-1742

    Last Modified: 11 Apr 2025

    Cross-site scripting (XSS) vulnerability in projects.php in Scratcher allows remote attackers to inject arbitrary web script or HTML via the show parameter.

    Source:cr4wl3r
    Published:6 May 2010
    7.5
    High

    CVE-2010-1741

    Last Modified: 29 Jun 2014

    SQL injection vulnerability in request_account.php in Billwerx RC 5.2.2 PL2 allows remote attackers to execute arbitrary SQL commands via the primary_number parameter.

    Source:indoushka
    Published:6 May 2010
    7.5
    High

    CVE-2010-1740

    Last Modified: 11 Apr 2025

    SQL injection vulnerability in newsletter.php in GuppY 4.5.18 allows remote attackers to execute arbitrary SQL commands via the lng parameter.

    Source:indoushka
    Published:6 May 2010
    7.5
    High

    CVE-2010-1739

    Last Modified: 19 Dec 2016

    SQL injection vulnerability in the Newsfeeds (com_newsfeeds) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the feedid parameter in a categories action to index.php.

    Source:Archimonde
    Published:6 May 2010
    6.8
    Medium

    CVE-2010-1737

    Last Modified: 11 Apr 2025

    PHP remote file inclusion vulnerability in core/includes/gfw_smarty.php in Gallo 0.1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the config[gfwroot] parameter.

    Source:cr4wl3r
    Published:6 May 2010
    4.9
    Medium

    CVE-2010-1735

    Last Modified: 11 Apr 2025

    The SfnLOGONNOTIFY function in win32k.sys in the kernel in Microsoft Windows 2000, XP, and Server 2003 allows local users to cause a denial of service (system crash) via a 0x4c value in the second argument (aka the Msg argument) of a PostMessage function call for the DDEMLEvent window.

    Source:MJ0011
    Published:5 May 2010
    4.9
    Medium

    CVE-2010-1734

    Last Modified: 11 Apr 2025

    The SfnINSTRING function in win32k.sys in the kernel in Microsoft Windows 2000, XP, and Server 2003 allows local users to cause a denial of service (system crash) via a 0x18d value in the second argument (aka the Msg argument) of a PostMessage function call for the DDEMLEvent window.

    Source:MJ0011
    Published:5 May 2010
    7.5
    High

    CVE-2010-1727

    Last Modified: 11 Apr 2025

    SQL injection vulnerability in type.asp in JobPost 1.0 allows remote attackers to execute arbitrary SQL commands via the iType parameter. NOTE: some of these details are obtained from third party information.

    Source:Sid3^effects
    Published:5 May 2010
    7.5
    High

    CVE-2010-1726

    Last Modified: 11 Apr 2025

    SQL injection vulnerability in offers_buy.php in EC21 Clone 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.

    Source:v3n0m
    Published:5 May 2010
    7.5
    High

    CVE-2010-1725

    Last Modified: 11 Apr 2025

    SQL injection vulnerability in offers_buy.php in Alibaba Clone Platinum allows remote attackers to execute arbitrary SQL commands via the id parameter.

    Source:v3n0m
    Published:5 May 2010
    4.3
    Medium

    CVE-2010-1724

    Last Modified: 27 Jun 2014

    Multiple cross-site scripting (XSS) vulnerabilities in Zikula Application Framework 1.2.2, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) func parameter to index.php, or the (2) lang parameter to index.php, which is not properly handled by ZLanguage.php.

    Source:High-Tech Bridge SA
    Published:5 May 2010
    6.8
    Medium

    CVE-2010-1723

    Last Modified: 19 Dec 2016

    Directory traversal vulnerability in the iNetLanka Contact Us Draw Root Map (com_drawroot) component 1.1 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.

    Source:AntiSecurity
    Published:4 May 2010
    6.8
    Medium

    CVE-2010-1722

    Last Modified: 19 Dec 2016

    Directory traversal vulnerability in the Online Market (com_market) component 2.x for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.

    Source:AntiSecurity
    Published:4 May 2010
    7.5
    High

    CVE-2010-1721

    Last Modified: 19 Dec 2016

    SQL injection vulnerability in the Intellectual Property (aka IProperty or com_iproperty) component 1.5.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in an agentproperties action to index.php.

    Source:v3n0m
    Published:4 May 2010
    7.5
    High

    CVE-2010-1720

    Last Modified: 20 Dec 2016

    SQL injection vulnerability in the Q-Personel (com_qpersonel) component 1.0.2 and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the katid parameter in a qpListele action to index.php.

    Source:Valentin Hoebel
    Published:4 May 2010
    6.8
    Medium

    CVE-2010-1719

    Last Modified: 19 Dec 2016

    Directory traversal vulnerability in the MT Fire Eagle (com_mtfireeagle) component 1.2 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.

    Source:AntiSecurity
    Published:4 May 2010
    6.8
    Medium

    CVE-2010-1718

    Last Modified: 15 Dec 2016

    Directory traversal vulnerability in archeryscores.php in the Archery Scores (com_archeryscores) component 1.0.6 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.

    Source:wishnusakti + inc0mp13te
    Published:4 May 2010
    7.5
    High

    CVE-2010-1717

    Last Modified: 19 Dec 2016

    Directory traversal vulnerability in the iF surfALERT (com_if_surfalert) component 1.2 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.

    Source:AntiSecurity
    Published:4 May 2010
    7.5
    High

    CVE-2010-1716

    Last Modified: 15 Dec 2016

    SQL injection vulnerability in the Agenda Address Book (com_agenda) component 1.0.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action to index.php.

    Source:v3n0m
    Published:4 May 2010
    6.8
    Medium

    CVE-2010-1715

    Last Modified: 20 Dec 2016

    Directory traversal vulnerability in the Online Examination (aka Online Exam or com_onlineexam) component 1.5.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php. NOTE: some of these details are obtained from third party information.

    Source:AntiSecurity
    Published:4 May 2010
    5
    Medium

    CVE-2010-1714

    Last Modified: 15 Dec 2016

    Directory traversal vulnerability in the Arcade Games (com_arcadegames) component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.

    Source:AntiSecurity
    Published:4 May 2010
    7.5
    High

    CVE-2010-1713

    Last Modified: 11 Apr 2025

    SQL injection vulnerability in modules.php in PostNuke 0.764 allows remote attackers to execute arbitrary SQL commands via the sid parameter in a News article modload action.

    Source:BILGE_KAGAN
    Published:4 May 2010
    4.3
    Medium

    CVE-2010-1712

    Last Modified: 11 Apr 2025

    Multiple cross-site scripting (XSS) vulnerabilities in base/Comments.php in Webmobo WB News 2.3.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name and possibly (2) message parameters. NOTE: some of these details are obtained from third party information.

    Source:ITSecTeam
    Published:4 May 2010
    4.3
    Medium

    CVE-2010-1711

    Last Modified: 11 Apr 2025

    Cross-site scripting (XSS) vulnerability in carga_foto_al.php in Siestta 2.0, when register_globals is enabled, allows remote attackers to inject arbitrary web script or HTML via the usuario parameter.

    Source:JosS
    Published:4 May 2010
    6.8
    Medium

    CVE-2010-1710

    Last Modified: 11 Apr 2025

    Directory traversal vulnerability in login.php in Siestta 2.0, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the idioma parameter.

    Source:JosS
    Published:4 May 2010
    7.5
    High

    CVE-2010-1708

    Last Modified: 11 Apr 2025

    Multiple SQL injection vulnerabilities in agentadmin.php in Free Realty allow remote attackers to execute arbitrary SQL commands via the (1) login field (aka agentname parameter) or (2) password field (aka agentpassword parameter).

    Source:Sid3^effects
    Published:4 May 2010
    7.5
    High

    CVE-2010-1706

    Last Modified: 11 Apr 2025

    Multiple SQL injection vulnerabilities in login.php in 2daybiz Auction Script allow remote attackers to execute arbitrary SQL commands via (1) the login field (aka the username parameter), and possibly (2) the password field, to index.php. NOTE: some of these details are obtained from third party information.

    Source:Sid3^effects
    Published:4 May 2010
    7.5
    High

    CVE-2010-1705

    Last Modified: 11 Apr 2025

    SQL injection vulnerability in casting_view.php in Modelbook allows remote attackers to execute arbitrary SQL commands via the adnum parameter.

    Source:v3n0m
    Published:4 May 2010
    7.5
    High

    CVE-2010-1704

    Last Modified: 11 Apr 2025

    Multiple SQL injection vulnerabilities in 2daybiz Polls (aka Advanced Poll) Script allow remote attackers to execute arbitrary SQL commands via (1) the password field to login.php, (2) the login field (aka email parameter) to login.php, (3) the password field (aka pass parameter) to the default URI under admin/, and possibly (4) the login field to the default URI under admin/. NOTE: some of these details are obtained from third party information.

    Source:Sid3^effects
    Published:4 May 2010
    4.3
    Medium

    CVE-2010-1703

    Last Modified: 11 Apr 2025

    Multiple cross-site scripting (XSS) vulnerabilities in index_search.php in 2daybiz Polls (aka Advanced Poll) Script allow remote attackers to inject arbitrary web script or HTML via the (1) category parameter or (2) search field.

    Source:Sid3^effects
    Published:4 May 2010
    7.5
    High

    CVE-2010-1702

    Last Modified: 24 Jan 2017

    SQL injection vulnerability in submitticket.php in WHMCompleteSolution (WHMCS) 4.2 allows remote attackers to execute arbitrary SQL commands via the deptid parameter.

    Source:Islam DefenDers
    Published:4 May 2010
    7.5
    High

    CVE-2010-1701

    Last Modified: 11 Apr 2025

    SQL injection vulnerability in browse.html in PHP Video Battle Script allows remote attackers to execute arbitrary SQL commands via the cat parameter.

    Source:v3n0m
    Published:4 May 2010
    9.3
    Critical

    CVE-2010-1688

    Last Modified: 15 Nov 2017

    Stack-based buffer overflow in 2BrightSparks SyncBack Freeware 3.2.20.0, and possibly other versions before 3.2.21, allows user-assisted remote attackers to execute arbitrary code via a long filename in a (1) .sps or (2) zip profile.

    Source:Lincoln
    Published:24 May 2010
    5
    Medium

    CVE-2010-1687

    Last Modified: 11 Apr 2025

    Stack-based buffer overflow in lpd.exe in Mocha W32 LPD 1.9 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted "recieve jobs" request. NOTE: some of these details are obtained from third party information.

    Source:mr_me
    Published:4 May 2010
    9.3
    Critical

    CVE-2010-1686

    Last Modified: 11 Apr 2025

    Stack-based buffer overflow in (1) Urgent Backup 3.20, and (2) ABC Backup Pro 5.20 and ABC Backup 5.50, allows user-assisted remote attackers to execute arbitrary code via a crafted ZIP archive.

    Source:Lincoln
    Published:4 May 2010
    9.3
    Critical

    CVE-2010-1685

    Last Modified: 11 Apr 2025

    Stack-based buffer overflow in CursorArts ZipWrangler 1.20 allows user-assisted remote attackers to execute arbitrary code via a ZIP file containing a file with a long filename.

    Source:TecR0c & Sud0
    Published:4 May 2010
    7.6
    High

    CVE-2010-1681

    Last Modified: 26 Jun 2011

    Buffer overflow in VISIODWG.DLL before 10.0.6880.4 in Microsoft Office Visio allows user-assisted remote attackers to execute arbitrary code via a crafted DXF file, a different vulnerability than CVE-2010-0254 and CVE-2010-0256.

    Source:Metasploit
    Published:5 May 2010
    Items Per Page