Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: February 2010

50 records · 2 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2010-0010
    40Plan

    Integer overflow in the ap_proxy_send_fb function in proxy/proxy_util.c in mod_proxy in the Apache HTTP Server before 1.3.42 on 64-bit platf

    MediumCVSS 6.8No exploitEPSS 43%

    apache · http serverFeb 2, 2010

  • CVE-2010-0467
    36Monitor

    Directory traversal vulnerability in the ccNewsletter (com_ccnewsletter) component 1.0.5 for Joomla! allows remote attackers to read arbitra

    MediumCVSS 5.8Proof of conceptEPSS 43%

    joomla · joomla\!Feb 2, 2010

  • CVE-2010-0442
    30Monitor

    The bitsubstr function in backend/utils/adt/varbit.c in PostgreSQL 8.0.23, 8.1.11, and 8.3.8 allows remote authenticated users to cause a de

    MediumCVSS 6.5Proof of conceptEPSS 13%

    postgresql · postgresqlFeb 2, 2010

  • CVE-2010-0304
    52Plan

    Multiple buffer overflows in the LWRES dissector in Wireshark 0.9.15 through 1.0.10 and 1.2.0 through 1.2.5 allow remote attackers to cause

    HighCVSS 7.5WeaponizedEPSS 74%

    wireshark · wiresharkFeb 3, 2010

  • CVE-2010-0308
    24Monitor

    lib/rfc1035.c in Squid 2.x, 3.0 through 3.0.STABLE22, and 3.1 through 3.1.0.15 allows remote attackers to cause a denial of service (asserti

    MediumCVSS 4.0No exploitEPSS 27%

    squid-cache · squidFeb 3, 2010

  • CVE-2010-0295
    24Monitor

    lighttpd before 1.4.26, and 1.5.x, allocates a buffer for each read operation that occurs for a request, which allows remote attackers to ca

    MediumCVSS 5.0Proof of conceptEPSS 12%

    lighttpd · lighttpdFeb 3, 2010

  • CVE-2010-0555
    43Plan

    Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, 7, and 8 does not prevent rendering of non-HTML local files as HTML documents, which allows

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · internet explorerFeb 4, 2010

  • CVE-2010-0255
    28Monitor

    Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, 7, and 8 does not prevent rendering of non-HTML local files as HTML documents, which allows

    MediumCVSS 4.3No exploitEPSS 36%

    microsoft · internet explorerFeb 4, 2010

  • CVE-2003-1582
    13Monitor

    Microsoft Internet Information Services (IIS) 6.0, when DNS resolution is enabled for client IP addresses, allows remote attackers to inject

    LowCVSS 2.6No exploitEPSS 10%

    microsoft · internet information serverFeb 5, 2010

  • CVE-2010-0557
    46Plan

    IBM Cognos Express 9.0 allows attackers to obtain unspecified access to the Tomcat Manager component, and cause a denial of service, by leve

    HighCVSS 7.5WeaponizedEPSS 51%

    ibm · cognos expressFeb 5, 2010

  • CVE-2009-4637
    45Plan

    FFmpeg 0.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors that trigger

    CriticalCVSS 10.0Proof of conceptEPSS 17%

    ffmpeg · ffmpegFeb 9, 2010

  • CVE-2010-0017
    46Plan

    Race condition in the SMB client implementation in Microsoft Windows Server 2008 R2 and Windows 7 allows remote SMB servers and man-in-the-m

    CriticalCVSS 9.3WeaponizedEPSS 30%

    microsoft · windows 7Feb 10, 2010

  • CVE-2010-0020
    46Plan

    The SMB implementation in the Server service in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista G

    CriticalCVSS 9.0No exploitEPSS 32%

    microsoft · windows 2000Feb 10, 2010

  • CVE-2010-0021
    27Monitor

    Multiple race conditions in the SMB implementation in the Server service in Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008

    MediumCVSS 5.9No exploitEPSS 13%

    microsoft · windows 2000Feb 10, 2010

  • CVE-2010-0022
    55Plan

    The SMB implementation in the Server service in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista G

    HighCVSS 7.8No exploitEPSS 78%

    microsoft · windows 2000Feb 10, 2010

  • CVE-2010-0028
    51Plan

    Integer overflow in Microsoft Paint in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to execute arbitrary co

    CriticalCVSS 9.3Proof of conceptEPSS 48%

    microsoft · windows 2000Feb 10, 2010

  • CVE-2010-0029
    44Plan

    Buffer overflow in Microsoft Office PowerPoint 2002 SP3 allows remote attackers to execute arbitrary code via a crafted PowerPoint document,

    CriticalCVSS 9.3No exploitEPSS 22%

    microsoft · powerpointFeb 10, 2010

  • CVE-2010-0030
    44Plan

    Heap-based buffer overflow in Microsoft Office PowerPoint 2002 SP3 and 2003 SP3 allows remote attackers to execute arbitrary code via a craf

    CriticalCVSS 9.3No exploitEPSS 24%

    microsoft · powerpointFeb 10, 2010

  • CVE-2010-0031
    43Plan

    Array index error in Microsoft Office PowerPoint 2002 SP3 and 2003 SP3, and PowerPoint in Office 2004 for Mac, allows remote attackers to ex

    CriticalCVSS 9.3No exploitEPSS 21%

    microsoft · officeFeb 10, 2010

  • CVE-2010-0032
    43Plan

    Use-after-free vulnerability in Microsoft Office PowerPoint 2002 SP3 and 2003 SP3 allows remote attackers to execute arbitrary code via a cr

    CriticalCVSS 9.3No exploitEPSS 21%

    microsoft · powerpointFeb 10, 2010

  • CVE-2010-0033
    52Plan

    Stack-based buffer overflow in Microsoft Office PowerPoint 2003 SP3 allows remote attackers to execute arbitrary code via a crafted PowerPoi

    CriticalCVSS 9.3WeaponizedEPSS 51%

    microsoft · powerpointFeb 10, 2010

  • CVE-2010-0034
    46Plan

    Stack-based buffer overflow in Microsoft Office PowerPoint 2003 SP3 allows remote attackers to execute arbitrary code via a crafted PowerPoi

    CriticalCVSS 9.3No exploitEPSS 28%

    microsoft · powerpointFeb 10, 2010

  • CVE-2010-0035
    30Monitor

    The Key Distribution Center (KDC) in Kerberos in Microsoft Windows 2000 SP4, Server 2003 SP2, and Server 2008 Gold and SP2, when a trust rel

    MediumCVSS 6.3No exploitEPSS 16%

    microsoft · windows 2000Feb 10, 2010

  • CVE-2010-0231
    52Plan

    The SMB implementation in the Server service in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista G

    CriticalCVSS 10.0Proof of conceptEPSS 41%

    microsoft · windows 2000Feb 10, 2010

  • CVE-2010-0239
    58Plan

    The TCP/IP implementation in Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2, when IPv6 is enabled, does not properl

    CriticalCVSS 10.0Proof of conceptEPSS 61%

    microsoft · windows server 2008Feb 10, 2010

  • CVE-2010-0240
    55Plan

    The TCP/IP implementation in Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2, when a custom network driver is used,

    CriticalCVSS 10.0No exploitEPSS 48%

    microsoft · windows server 2008Feb 10, 2010

  • CVE-2010-0241
    55Plan

    The TCP/IP implementation in Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2, when IPv6 is enabled, does not properl

    CriticalCVSS 10.0No exploitEPSS 49%

    microsoft · windows server 2008Feb 10, 2010

  • CVE-2010-0242
    51Plan

    The TCP/IP implementation in Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2 allows remote attackers to cause a deni

    HighCVSS 7.8No exploitEPSS 65%

    microsoft · windows server 2008Feb 10, 2010

  • CVE-2010-0243
    44Plan

    Buffer overflow in MSO.DLL in Microsoft Office XP SP3 and Office 2004 for Mac allows remote attackers to execute arbitrary code via a crafte

    CriticalCVSS 9.3No exploitEPSS 23%

    microsoft · officeFeb 10, 2010

  • CVE-2010-0250
    47Plan

    Heap-based buffer overflow in DirectShow in Microsoft DirectX, as used in the AVI Filter on Windows 2000 SP4, Windows XP SP2 and SP3, and Wi

    CriticalCVSS 9.3No exploitEPSS 31%

    microsoft · windows 7Feb 10, 2010

  • CVE-2010-0252
    46Plan

    The Microsoft Data Analyzer ActiveX control (aka the Office Excel ActiveX control for Data Analysis) in max3activex.dll in Microsoft Windows

    CriticalCVSS 9.3No exploitEPSS 28%

    microsoft · windows 2000Feb 10, 2010

  • CVE-2009-3960
    83Now

    Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and

    MediumCVSS 6.5KEVWeaponizedEPSS 90%

    adobe · blazedsFeb 15, 2010

  • CVE-2010-0187
    22Monitor

    Adobe Flash Player before 10.0.45.2 and Adobe AIR before 1.5.3.9130 allow remote attackers to cause a denial of service (application crash)

    MediumCVSS 4.3Proof of conceptEPSS 15%

    adobe · adobe airFeb 15, 2010

  • CVE-2010-0287
    23Monitor

    Directory traversal vulnerability in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25b allows remote attackers to

    MediumCVSS 5.0Proof of conceptEPSS 10%

    dokuwiki · dokuwikiFeb 15, 2010

  • CVE-2010-0288
    33Monitor

    A typo in the administrator permission check in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25b allows remote a

    HighCVSS 7.5Proof of conceptEPSS 10%

    dokuwiki · dokuwikiFeb 15, 2010

  • CVE-2010-0639
    29Monitor

    The htcpHandleTstRequest function in htcp.c in Squid 2.x before 2.6.STABLE24 and 2.7 before 2.7.STABLE8, and htcp.cc in 3.0 before 3.0.STABL

    MediumCVSS 5.0No exploitEPSS 31%

    squid-cache · squidFeb 15, 2010

  • CVE-2009-2949
    41Plan

    Integer overflow in the XPMReader::ReadXPM function in filter.vcl/ixpm/svt_xpmread.cxx in OpenOffice.org (OOo) before 3.2 allows remote atta

    CriticalCVSS 9.3No exploitEPSS 14%

    apache · openofficeFeb 16, 2010

  • CVE-2009-2950
    41Plan

    Heap-based buffer overflow in the GIFLZWDecompressor::GIFLZWDecompressor function in filter.vcl/lgif/decode.cxx in OpenOffice.org (OOo) befo

    CriticalCVSS 9.3No exploitEPSS 13%

    apache · openofficeFeb 16, 2010

  • CVE-2009-3301
    41Plan

    Integer underflow in filter/ww8/ww8par2.cxx in OpenOffice.org (OOo) before 3.2 allows remote attackers to cause a denial of service (applica

    CriticalCVSS 9.3No exploitEPSS 11%

    apache · openofficeFeb 16, 2010

  • CVE-2009-3302
    41Plan

    filter/ww8/ww8par2.cxx in OpenOffice.org (OOo) before 3.2 allows remote attackers to cause a denial of service (application crash) or possib

    CriticalCVSS 9.3No exploitEPSS 11%

    apache · openofficeFeb 16, 2010

  • CVE-2010-0416
    33Monitor

    Buffer overflow in the Unescape function in common/util/hxurl.cpp and player/hxclientkit/src/CHXClientSink.cpp in Helix Player 1.0.6 and Rea

    HighCVSS 7.5Proof of conceptEPSS 11%

    realnetworks · helix playerFeb 18, 2010

  • CVE-2010-0108
    46Plan

    Buffer overflow in the cliproxy.objects.1 ActiveX control in the Symantec Client Proxy (CLIproxy.dll) in Symantec AntiVirus 10.0.x, 10.1.x b

    CriticalCVSS 10.0Proof of conceptEPSS 19%

    symantec · antivirusFeb 19, 2010

  • CVE-2010-0188
    87Now

    Unspecified vulnerability in Adobe Reader and Acrobat 8.x before 8.2.1 and 9.x before 9.3.1 allows attackers to cause a denial of service (a

    HighCVSS 7.8KEVWeaponizedEPSS 88%

    adobe · acrobatFeb 22, 2010

  • CVE-2010-0679
    48Plan

    Multiple stack-based buffer overflows in the HyleosChemView.HLChemView ActiveX control (HyleosChemView.ocx) in Hyleos ChemView 1.9.5.1 allow

    CriticalCVSS 9.3WeaponizedEPSS 35%

    hyleos · chemviewFeb 22, 2010

  • CVE-2010-0696
    28Monitor

    Directory traversal vulnerability in includes/download.php in the JoomlaWorks AllVideos (Jw_allVideos) plugin 3.0 through 3.2 for Joomla! al

    MediumCVSS 5.0Proof of conceptEPSS 28%

    joomlaworks · jw allvideosFeb 23, 2010

  • CVE-2010-0682
    19Monitor

    WordPress 2.9 before 2.9.2 allows remote authenticated users to read trash posts from other authors via a direct request with a modified p p

    MediumCVSS 4.0Proof of conceptEPSS 10%

    wordpress · wordpressFeb 23, 2010

  • CVE-2010-0620
    43Plan

    Directory traversal vulnerability in the SSL Service in EMC HomeBase Server 6.2.x before 6.2.3 and 6.3.x before 6.3.2 allows remote attacker

    CriticalCVSS 9.3Proof of conceptEPSS 19%

    emc · homebase serverFeb 24, 2010

  • CVE-2009-4653
    40Plan

    Stack-based buffer overflow in the dhost module in Novell eDirectory 8.8 SP5 for Windows allows remote authenticated users to cause a denial

    CriticalCVSS 9.0Proof of conceptEPSS 12%

    novell · edirectoryFeb 26, 2010

  • CVE-2009-4655
    45Plan

    The dhost web service in Novell eDirectory 8.8.5 uses a predictable session cookie, which makes it easier for remote attackers to hijack ses

    HighCVSS 7.5WeaponizedEPSS 50%

    novell · edirectoryFeb 26, 2010

  • CVE-2010-0759
    35Monitor

    Directory traversal vulnerability in plugins/system/cdscriptegrator/libraries/highslide/js/jsloader.php in the Core Design Scriptegrator plu

    HighCVSS 7.5Proof of conceptEPSS 15%

    greatjoomla · scriptegrator pluginFeb 26, 2010