Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: January 2010

35 records · 3 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2010-0157
    34Monitor

    Directory traversal vulnerability in the Bible Study (com_biblestudy) component 6.1 for Joomla! allows remote attackers to include and execu

    HighCVSS 7.5Proof of conceptEPSS 12%

    joomla · joomla\!Jan 6, 2010

  • CVE-2009-4588
    47Plan

    Heap-based buffer overflow in the WindsPlayerIE.View.1 ActiveX control in WindsPly.ocx 3.5.0.0 Beta, 3.0.0.5, and earlier in AwingSoft Awake

    CriticalCVSS 9.3WeaponizedEPSS 32%

    awingsoft · awakening winds3d playerJan 7, 2010

  • CVE-2009-4009
    45Plan

    Buffer overflow in PowerDNS Recursor before 3.1.7.2 allows remote attackers to cause a denial of service (daemon crash) or possibly execute

    CriticalCVSS 10.0No exploitEPSS 17%

    powerdns · recursorJan 8, 2010

  • CVE-2009-4010
    33Monitor

    Unspecified vulnerability in PowerDNS Recursor before 3.1.7.2 allows remote attackers to spoof DNS data via crafted zones.

    HighCVSS 7.5No exploitEPSS 10%

    powerdns · recursorJan 8, 2010

  • CVE-2010-0013
    34Monitor

    Directory traversal vulnerability in slp.c in the MSN protocol plugin in libpurple in Pidgin 2.6.4 and Adium 1.3.8 allows remote attackers t

    HighCVSS 7.5Proof of conceptEPSS 12%

    adium · adiumJan 9, 2010

  • CVE-2009-3953
    90Now

    The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remot

    HighCVSS 8.8KEVWeaponizedEPSS 83%

    adobe · acrobatJan 13, 2010

  • CVE-2009-3955
    45Plan

    Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a

    CriticalCVSS 10.0No exploitEPSS 15%

    adobe · acrobatJan 13, 2010

  • CVE-2009-3958
    56Plan

    Multiple stack-based buffer overflows in the NOS Microsystems getPlus Helper ActiveX control before 1.6.2.49 in gp.ocx in the Download Manag

    CriticalCVSS 10.0Proof of conceptEPSS 52%

    adobe · acrobatJan 13, 2010

  • CVE-2009-3959
    43Plan

    Integer overflow in the U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows re

    CriticalCVSS 10.0No exploitEPSS 11%

    adobe · acrobatJan 13, 2010

  • CVE-2010-0018
    45Plan

    Integer overflow in the Embedded OpenType (EOT) Font Engine (t2embed.dll) in Microsoft Windows 2000 SP4; Windows XP SP2 and SP3; Windows Ser

    CriticalCVSS 9.3No exploitEPSS 26%

    microsoft · windows 2000Jan 13, 2010

  • CVE-2009-4487
    36Monitor

    nginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's

    MediumCVSS 6.8Proof of conceptEPSS 29%

    f5 · nginxJan 13, 2010

  • CVE-2009-4488
    43Plan

    Varnish 2.0.6 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's

    CriticalCVSS 9.8Proof of conceptEPSS 12%

    varnish.projects.linpro · varnishJan 13, 2010

  • CVE-2009-4490
    23Monitor

    mini_httpd 1.19 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window

    MediumCVSS 5.0Proof of conceptEPSS 10%

    acme · mini httpdJan 13, 2010

  • CVE-2009-4491
    43Plan

    thttpd 2.25b0 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's

    CriticalCVSS 9.8Proof of conceptEPSS 13%

    acme · thttpdJan 13, 2010

  • CVE-2009-4492
    35Monitor

    WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through patchlevel 248, 1.8.8dev, 1.9.1 through patchlevel 376, and 1.9.2dev write

    HighCVSS 7.5Proof of conceptEPSS 16%

    ruby-lang · webrickJan 13, 2010

  • CVE-2009-4496
    24Monitor

    Boa 0.94.14rc21 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window

    MediumCVSS 5.0Proof of conceptEPSS 12%

    boa · boaJan 13, 2010

  • CVE-2009-4611
    31Monitor

    Mort Bay Jetty 6.x through 6.1.22 and 7.0.0 writes backtrace data without sanitizing non-printable characters, which might allow remote atta

    HighCVSS 7.5No exploitEPSS 3%

    mortbay · jettyJan 13, 2010

  • CVE-2010-0249
    93Now

    Use-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2

    HighCVSS 8.8KEVWeaponizedEPSS 91%

    microsoft · internet explorerJan 15, 2010

  • CVE-2010-0317
    34Monitor

    Novell Netware 6.5 SP8 allows remote attackers to cause a denial of service (NULL pointer dereference, memory consumption, ABEND, and crash)

    HighCVSS 7.8Proof of conceptEPSS 10%

    novell · netwareJan 15, 2010

  • CVE-2010-0356
    46Plan

    Stack-based buffer overflow in the MOVIEPLAYER.MoviePlayerCtrl.1 ActiveX control in MoviePlayer.ocx 6.8.0.0 in Viscom Software Movie Player

    CriticalCVSS 9.3WeaponizedEPSS 30%

    viscomsoft · movie player pro sdk activexJan 18, 2010

  • CVE-2010-0359
    46Plan

    Buffer overflow in the SSLv2 support in Zeus Web Server before 4.3r5 allows remote attackers to cause a denial of service (daemon crash) or

    CriticalCVSS 10.0Proof of conceptEPSS 19%

    zeus · zeus web serverJan 20, 2010

  • CVE-2010-0361
    64This week

    Stack-based buffer overflow in the WebDAV implementation in webservd in Sun Java System Web Server (aka SJWS) 7.0 Update 7 allows remote att

    CriticalCVSS 10.0WeaponizedEPSS 80%

    sun · java system web serverJan 20, 2010

  • CVE-2009-3999
    61This week

    Stack-based buffer overflow in goform/formExportDataLogs in HP Power Manager before 4.2.10 allows remote attackers to execute arbitrary code

    CriticalCVSS 10.0WeaponizedEPSS 71%

    hp · power managerJan 20, 2010

  • CVE-2009-4000
    46Plan

    Directory traversal vulnerability in goform/formExportDataLogs in HP Power Manager before 4.2.10 allows remote attackers to overwrite arbitr

    CriticalCVSS 10.0No exploitEPSS 19%

    hp · power managerJan 20, 2010

  • CVE-2010-0232
    70This week

    The kernel in Microsoft Windows NT 3.1 through Windows 7, including Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windo

    HighCVSS 7.8KEVWeaponizedEPSS 28%

    microsoft · windows 2000Jan 21, 2010

  • CVE-2010-0379
    42Plan

    Multiple unspecified vulnerabilities in the Macromedia Flash ActiveX control in Adobe Flash Player 6, as distributed in Microsoft Windows XP

    CriticalCVSS 9.3No exploitEPSS 16%

    adobe · flash playerJan 21, 2010

  • CVE-2010-0027
    47Plan

    The URL validation functionality in Microsoft Internet Explorer 5.01, 6, 6 SP1, 7 and 8, and the ShellExecute API function in Windows 2000 S

    CriticalCVSS 9.3Proof of conceptEPSS 33%

    microsoft · internet explorerJan 22, 2010

  • CVE-2010-0244
    43Plan

    Microsoft Internet Explorer 6, 6 SP1, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrar

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · internet explorerJan 22, 2010

  • CVE-2010-0245
    43Plan

    Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessi

    CriticalCVSS 9.3No exploitEPSS 19%

    microsoft · internet explorerJan 22, 2010

  • CVE-2010-0246
    43Plan

    Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessi

    CriticalCVSS 9.3No exploitEPSS 19%

    microsoft · internet explorerJan 22, 2010

  • CVE-2010-0247
    43Plan

    Microsoft Internet Explorer 5.01 SP4, 6, and 6 SP1 does not properly handle objects in memory, which allows remote attackers to execute arbi

    CriticalCVSS 9.3No exploitEPSS 19%

    microsoft · internet explorerJan 22, 2010

  • CVE-2010-0248
    60This week

    Microsoft Internet Explorer 6, 6 SP1, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrar

    HighCVSS 8.1WeaponizedEPSS 53%

    microsoft · internet explorerJan 22, 2010

  • CVE-2009-4273
    45Plan

    stap-server in SystemTap before 1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in stap command-line argu

    CriticalCVSS 10.0Proof of conceptEPSS 17%

    systemtap · systemtapJan 26, 2010

  • CVE-2009-4272
    33Monitor

    A certain Red Hat patch for net/ipv4/route.c in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5 allows remote attackers to caus

    HighCVSS 7.5No exploitEPSS 11%

    linux · linux kernelJan 27, 2010

  • CVE-2009-2902
    20Monitor

    Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-dire

    MediumCVSS 4.3No exploitEPSS 10%

    apache · tomcatJan 28, 2010