CVE-2010-0840

CVE-2010-0840 is an unspecified vulnerability in the Java Runtime Environment within Oracle Java SE/Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 that can affect confidentiality, integrity, and availability via unknown vectors. The March 2010 CPU note references a possible issue with privileg...

CVE-2010-0806

CVE-2010-0806 is a use-after-free in Internet Explorer’s iepeers.dll (affecting IE 6/6 SP1/7). The vulnerability arises from access to an invalid pointer after object deletion, enabling remote code execution. It was exploited in the wild around March 2010. Public fixes include Microsoft Security ...

CVE-2010-0760

CVE-2010-0760 is a vulnerability in the Core Design Scriptegrator plugin for Joomla! Affected component: libraries/jquery/js/ui/jsloader.php (parameter: file) and libraries/jquery/js/jsloader.php (parameter: files[]) allow remote attackers to perform directory traversal and include/execute local ...

CVE-2010-0759

Joomla! Core Design Scriptegrator plugin 1.4.1 contains a directory traversal vulnerability in plugins/system/cdscriptegrator/libraries/highslide/js/jsloader.php (files[] parameter) that could allow an attacker to read arbitrary server files and potentially include/execute them. This is a Local F...

CVE-2010-0188

CVE-2010-0188 is an Adobe Reader/Acrobat vulnerability in the PDF handling stack (notably LibTIFF-related parsing) that could allow denial of service or remote code execution via a crafted PDF. Affected products include Adobe Reader/Acrobat 8.x (before 8.2.1) and 9.x (before 9.3.1). Public analys...

CVE-2009-3960

CVE-2009-3960 is an information-disclosure vulnerability in Adobe BlazeDS and related Adobe data services components (e.g., LiveCycle, ColdFusion) where XML External Entity/XML Injection flaws can allow remote attackers to obtain sensitive information. Root cause: injected tags and external entit...

CVE-2010-0232

CVE-2010-0232 is a Windows kernel elevation-of-privilege vulnerability affecting 16‑bit BIOS call handling in NTVDM. When 16‑bit app access is enabled on 32‑bit x86, the kernel fails to validate certain BIOS calls, allowing a local user to craft a VDM_TIB in the TEB and trigger the NTVDM NtVdmCon...

CVE-2010-0249

CVE-2010-0249 is a use-after-free vulnerability in Microsoft Internet Explorer (IE6/IE7/IE8 on multiple Windows versions) that could allow remote code execution by accessing a pointer to a deleted memory object, related to memory handling issues. The connected KB/MS security update (MS10-002) add...

CVE-2009-3953

CVE-2009-3953 affects Adobe Reader/Acrobat U3D handling in PDFs. The vulnerability arises from a CLODProgressiveMeshDeclaration array boundary issue in the U3D implementation, allowing remote code execution when processing malformed U3D data. Affected product versions include Acrobat/Reader 9.x p...

CVE-2009-4324

Adobe Reader/Acrobat (Windows/macOS) is affected by CVE-2009-4324 due to a use-after-free in Doc.media.newPlayer inside Multimedia.api. A crafted PDF with ZLib streams can trigger remote code execution. The vulnerability is reported as exploited in the wild in December 2009. Affected versions inc...

CVE-2009-3843

CVE-2009-3843 : The HP Operations Manager 8.10 on Windows is reported to contain a hidden Tomcat user account in an XML file. This enables a remote attacker to perform an unrestricted file upload via /manager/html/upload and execute arbitrary code. Connected sources reference Tomcat manager uploa...

CVE-2009-3129

CVE-2009-3129 concerns a remote-code-execution vulnerability in Microsoft Office Excel and related components caused by a FEATHEADER record with an invalid cbHdrData size that affects a pointer offset. Affected products include Excel 2002 SP3, 2003 SP3, 2007 SP1/SP2, Open XML File Format Converte...

CVE-2009-3547

CVE-2009-3547 refers to multiple race conditions in fs/pipe.c of the Linux kernel before 2.6.32-rc6. The flaws can allow local users to cause a denial of service (NULL pointer dereference and system crash) or gain privileges by opening an anonymous pipe via a /proc/*/fd/ pathname. A fix is availa...

CVE-2009-2267

CVE-2009-2267 affects VMware products (Workstation, Player, ACE, Server, Fusion, ESXi/ESX) where Virtual-8086 mode is used. The root cause is an improper setting of the exception code on a page fault (#PF), allowing guest OS users to gain privileges on the guest OS by supplying a crafted value fo...

CVE-2009-2994

CVE-2009-2994 is described in connected advisories as a memory corruption vulnerability in Adobe Reader and Acrobat, caused by an index boundary error when handling U3D/CLODMeshDeclaration data in PDFs. This could allow remote code execution via specially crafted PDF documents. The advisories con...

CVE-2009-3459

CVE-2009-3459 is a heap-based buffer overflow in Adobe Reader and Acrobat prior to versions 7.1.4 (7.x), 8.x prior to 8.1.7, and 9.x prior to 9.2, allowing remote code execution via a crafted PDF. The issue can corrupt memory and was exploited in the wild during Oct 2009. Affected products are Ad...

CVE-2009-2908

CVE-2009-2908 affects the Linux kernel 2.6.31: the d_delete function in fs/ecryptfs/inode.c can lead to a negative dentry and a NULL pointer dereference. Local users can cause a kernel OOPS and potentially execute arbitrary code; exploitation demonstrated via a Mutt temporary directory in an eCry...

CVE-2009-2698

CVE-2009-2698 affects the Linux kernel UDP implementation (net/ipv4/udp.c and net/ipv6/udp.c) prior to 2.6.19. Local users can gain privileges or cause a denial of service (NULL pointer dereference/system crash) via UDP socket use with MSG_MORE. Oracle Linux/MiracleLinux advisories reference this...

CVE-2009-2055

Cisco IOS XR (Cisco IOS XR software) versions 3.4.0–3.8.1 are affected by a BGP UPDATE handling DoS vulnerability (CVE-2009-2055). The issue allows remote attackers to cause a denial of service by sending a BGP UPDATE with an invalid attribute, resulting in a session reset of the BGP peering. Dem...

CVE-2009-2692

CVE-2009-2692 stems from uninitialized proto_ops in the Linux kernel (SOCKOPS_WRAP), allowing local users to trigger a NULL pointer dereference via mmap of page zero and gain privileges by invoking an unavailable operation (e.g., sock_sendpage on PF_PPPOX). Public details reference local privileg...