CVE-2010-4705

CVE-2010-4705 is described as an integer overflow in the Vorbis decoder of FFmpeg (function vorbis_residue_decode_internal in libavcodec/vorbis_dec.c), with unspecified impact. The CVE may overlap CVE-2011-0480. Debian/OpenVAS entries group this with FFmpeg vulnerabilities and indicate a fix was ...

CVE-2010-4586

The default configuration of Opera before 11.00 enables WebSockets functionality, which has unspecified impact and remote attack vectors, possibly a related issue to CVE-2010-4508...

CVE-2010-4586

The CVE-2010-4586 issue concerns Opera before 11.00, where WebSockets functionality is enabled by default. The description indicates an unspecified impact and remote attack vectors, and notes a possible relation to CVE-2010-4508. Connected sources confirm that Opera 11.00 includes fixes, implying...

Design/Logic Flaw

RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.4, RealPlayer Enterprise 2.1.2, and Mac RealPlayer 11.0 through 12.0.0.1444 do not properly parse spectral data in AAC files, which has unspecified impact and remote attack vectors...

CVE-2010-0125

RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.4, RealPlayer Enterprise 2.1.2, and Mac RealPlayer 11.0 through 12.0.0.1444 do not properly parse spectral data in AAC files, which has unspecified impact and remote attack vectors...

CVE-2010-4508

The WebSockets implementation in Mozilla Firefox 4 through 4.0 Beta 7 does not properly perform proxy upgrade negotiation, which has unspecified impact and remote attack vectors, related to an "inherent problem" with the WebSocket specification...

CVE-2010-4508

CVE-2010-4508 affects Mozilla Firefox 4 through 4.0 Beta 7, in the WebSockets implementation. The vulnerability arises from improper handling of proxy upgrade negotiation, tied to an described “inherent problem” with the WebSocket spec. The impact is described as unspecified in the provided sourc...

CVE-2010-3186

IBM WebSphere Application Server 7.x before 7.0.0.13 and WebSphere Application Server Feature Pack for Web Services 6.1.0.9 through 6.1.0.32 are affected when using a JAX-WS application; the WS-Security policy IncludeTimestamp setting is not handled correctly, with unspecified impact and remote a...

CVE-2010-2361

Winny 2.0b7.1 and earlier contains a vulnerability in the processing of BBS information. This flaw can enable a remote attacker to participate in distributed denial-of-service (DDoS) activities. The public sources (e.g., JVN/JVNDB) explicitly advise not using Winny as the mitigation. No patch or ...

CVE-2010-2362

Winny 2.0b7.1 and earlier does not properly process node information, which has unspecified impact and remote attack vectors that might lead to use of the product's host for DDoS attacks...

CVE-2010-1386

page/Geolocation.cpp in WebCore in WebKit before r56188 and before 1.2.5 does not properly restrict access to the lastPosition function, which has unspecified impact and remote attack vectors, aka rdar problem 7746357...

CVE-2010-1760

loader/DocumentThreadableLoader.cpp in the XMLHttpRequest implementation in WebCore in WebKit before r58409 does not properly handle credentials during a cross-origin synchronous request, which has unspecified impact and remote attack vectors, aka rdar problem 7905150...

Hardcoded credentials

loader/DocumentThreadableLoader.cpp in the XMLHttpRequest implementation in WebCore in WebKit before r58409 does not properly handle credentials during a cross-origin synchronous request, which has unspecified impact and remote attack vectors, aka rdar problem 7905150...

CVE-2010-1760

loader/DocumentThreadableLoader.cpp in the XMLHttpRequest implementation in WebCore in WebKit before r58409 does not properly handle credentials during a cross-origin synchronous request, which has unspecified impact and remote attack vectors, aka rdar problem 7905150...

CVE-2010-1760

Removed by vendor...

CVE-2010-1386

page/Geolocation.cpp in WebCore in WebKit before r56188 and before 1.2.5 does not properly restrict access to the lastPosition function, which has unspecified impact and remote attack vectors, aka rdar problem 7746357...

CVE-2010-1386

The concrete details in connected documents show CVE-2010-1386 affects WebKit/WebCore: page/Geolocation.cpp did not properly restrict access to the lastPosition function, with unspecified impact and remote attack vectors. Root cause is insufficient access control in Geolocation.lastPosition. Affe...

CVE-2010-1760

CVE-2010-1760 affects loader/DocumentThreadableLoader.cpp in the WebKit WebCore XMLHttpRequest implementation, before r58409. The vulnerability arises because credentials are not properly handled during a cross-origin synchronous request. The description specifies an unspecified impact with poten...

CVE-2010-2994

CVE-2010-2994 concerns a stack-based buffer overflow in the ASN.1 BER dissector of Wireshark. Affected versions are Wireshark 0.10.13–1.0.14 and 1.2.0–1.2.9. The vulnerability has unknown impact and remote attack vectors, and it is noted as a regression related to CVE-2010-2284. The provided conn...

CVE-2010-2994

Stack-based buffer overflow in the ASN.1 BER dissector in Wireshark 0.10.13 through 1.0.14 and 1.2.0 through 1.2.9 has unknown impact and remote attack vectors. NOTE: this issue exists because of a CVE-2010-2284 regression...