Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: March 2010

55 records · 1 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2010-0483
    56Plan

    vbscript.dll in VBScript 5.1, 5.6, 5.7, and 5.8 in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2, when Internet Explorer i

    HighCVSS 7.6WeaponizedEPSS 86%

    microsoft · windows 2000Mar 3, 2010

  • CVE-2010-0917
    37Monitor

    Stack-based buffer overflow in VBScript in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2, when Internet Explorer is used,

    HighCVSS 7.6No exploitEPSS 24%

    microsoft · windows 2000Mar 3, 2010

  • CVE-2009-4656
    46Plan

    Stack-based buffer overflow in E-Soft DJ Studio Pro 4.2 including 4.2.2.7.5, and 5.x including 5.1.4.3.1, allows user-assisted remote attack

    CriticalCVSS 9.3WeaponizedEPSS 31%

    e-soft.co · dj studio proMar 3, 2010

  • CVE-2009-4660
    59Plan

    Stack-based buffer overflow in the AntServer Module (AntServer.exe) in BigAnt IM Server 2.50 allows remote attackers to execute arbitrary co

    CriticalCVSS 10.0WeaponizedEPSS 62%

    bigantsoft · bigant messengerMar 3, 2010

  • CVE-2009-4663
    40Plan

    Heap-based buffer overflow in the Quiksoft EasyMail Objects 6 ActiveX control allows remote attackers to execute arbitrary code via a long a

    CriticalCVSS 9.3Proof of conceptEPSS 10%

    quiksoft · easymail objectsMar 3, 2010

  • CVE-2009-2753
    43Plan

    Multiple buffer overflows in the authentication functionality in librpc.dll in the Informix Storage Manager (ISM) Portmapper service (aka po

    CriticalCVSS 10.0Proof of conceptEPSS 10%

    ibm · informix dynamic serverMar 5, 2010

  • CVE-2009-2754
    52Plan

    Integer signedness error in the authentication functionality in librpc.dll in the Informix Storage Manager (ISM) Portmapper service (aka por

    CriticalCVSS 10.0Proof of conceptEPSS 40%

    ibm · informix dynamic serverMar 5, 2010

  • CVE-2010-0408
    26Monitor

    The ap_proxy_ajp_request function in mod_proxy_ajp.c in mod_proxy_ajp in the Apache HTTP Server 2.2.x before 2.2.15 does not properly handle

    MediumCVSS 5.0No exploitEPSS 21%

    apache · http serverMar 5, 2010

  • CVE-2010-0425
    68This week

    modules/arch/win32/mod_isapi.c in mod_isapi in the Apache HTTP Server 2.0.37 through 2.0.63, 2.2.0 through 2.2.14, and 2.3.x before 2.3.7, w

    CriticalCVSS 10.0WeaponizedEPSS 94%

    apache · http serverMar 5, 2010

  • CVE-2010-0434
    23Monitor

    The ap_read_request function in server/protocol.c in the Apache HTTP Server 2.2.x before 2.2.15, when a multithreaded MPM is used, does not

    MediumCVSS 4.3No exploitEPSS 18%

    apache · http serverMar 5, 2010

  • CVE-2010-0943
    25Monitor

    Directory traversal vulnerability in the JA Showcase (com_jashowcase) component for Joomla! allows remote attackers to read arbitrary files

    MediumCVSS 5.0Proof of conceptEPSS 15%

    joomla · joomla\!Mar 8, 2010

  • CVE-2010-0944
    24Monitor

    Directory traversal vulnerability in the JCollection (com_jcollection) component for Joomla! allows remote attackers to read arbitrary files

    MediumCVSS 5.0Proof of conceptEPSS 14%

    joomla · joomla\!Mar 8, 2010

  • CVE-2010-0103
    45Plan

    UsbCharger.dll in the Energizer DUO USB battery charger software contains a backdoor that is implemented through the Arucer.dll file in the

    CriticalCVSS 9.3WeaponizedEPSS 27%

    energizer · duo usbMar 10, 2010

  • CVE-2010-0926
    40Plan

    The default configuration of smbd in Samba before 3.3.11, 3.4.x before 3.4.6, and 3.5.x before 3.5.0rc3, when a writable share exists, allow

    LowCVSS 3.5WeaponizedEPSS 30%

    samba · sambaMar 10, 2010

  • CVE-2010-0257
    43Plan

    Microsoft Office Excel 2002 SP3 does not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a

    CriticalCVSS 9.3No exploitEPSS 18%

    microsoft · excelMar 10, 2010

  • CVE-2010-0258
    49Plan

    Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Offic

    HighCVSS 7.8No exploitEPSS 60%

    microsoft · excelMar 10, 2010

  • CVE-2010-0260
    44Plan

    Heap-based buffer overflow in Microsoft Office Excel 2007 SP1 and SP2; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Wo

    CriticalCVSS 9.3No exploitEPSS 23%

    microsoft · excelMar 10, 2010

  • CVE-2010-0261
    44Plan

    Heap-based buffer overflow in Microsoft Office Excel 2007 SP1 and SP2 and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 Fil

    CriticalCVSS 9.3No exploitEPSS 23%

    microsoft · excelMar 10, 2010

  • CVE-2010-0262
    43Plan

    Microsoft Office Excel 2007 SP1 and SP2 and Office 2004 for Mac do not properly parse the Excel file format, which allows remote attackers t

    CriticalCVSS 9.3No exploitEPSS 21%

    microsoft · excelMar 10, 2010

  • CVE-2010-0263
    45Plan

    Microsoft Office Excel 2007 SP1 and SP2; Office 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer SP1 and SP2; Offic

    CriticalCVSS 9.3No exploitEPSS 25%

    microsoft · excelMar 10, 2010

  • CVE-2010-0264
    43Plan

    Microsoft Office Excel 2002 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac do not properly parse the Excel fi

    CriticalCVSS 9.3No exploitEPSS 21%

    microsoft · excelMar 10, 2010

  • CVE-2010-0265
    45Plan

    Buffer overflow in Microsoft Windows Movie Maker 2.1, 2.6, and 6.0, and Microsoft Producer 2003, allows remote attackers to execute arbitrar

    CriticalCVSS 9.3Proof of conceptEPSS 26%

    microsoft · windows movie makerMar 10, 2010

  • CVE-2010-0806
    90Now

    Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, and 7 allows remote at

    HighCVSS 8.8KEVWeaponizedEPSS 82%

    microsoft · internet explorerMar 10, 2010

  • CVE-2010-0049
    40Plan

    Use-after-free vulnerability in WebKit in Apple Safari before 4.0.5 allows remote attackers to execute arbitrary code or cause a denial of s

    CriticalCVSS 9.3Proof of conceptEPSS 10%

    apple · safariMar 15, 2010

  • CVE-2010-0050
    38Monitor

    Use-after-free vulnerability in WebKit in Apple Safari before 4.0.5 allows remote attackers to execute arbitrary code or cause a denial of s

    HighCVSS 8.8Proof of conceptEPSS 11%

    apple · safariMar 15, 2010

  • CVE-2010-0972
    34Monitor

    Directory traversal vulnerability in the GCalendar (com_gcalendar) component 2.1.5 for Joomla! allows remote attackers to include and execut

    HighCVSS 7.5Proof of conceptEPSS 13%

    joomla · joomla\!Mar 16, 2010

  • CVE-2010-0397
    23Monitor

    The xmlrpc extension in PHP 5.3.1 does not properly handle a missing methodName element in the first argument to the xmlrpc_decode_request f

    MediumCVSS 5.0Proof of conceptEPSS 11%

    php · phpMar 16, 2010

  • CVE-2010-0985
    34Monitor

    Directory traversal vulnerability in the Abbreviations Manager (com_abbrev) component 1.1 for Joomla! allows remote attackers to include and

    HighCVSS 7.5Proof of conceptEPSS 13%

    joomla · joomla\!Mar 16, 2010

  • CVE-2010-0688
    48Plan

    Stack-based buffer overflow in Orbital Viewer 1.04 allows user-assisted remote attackers to execute arbitrary code via a crafted (1) .orb or

    CriticalCVSS 9.3WeaponizedEPSS 37%

    orbitals · orbital viewerMar 19, 2010

  • CVE-2010-1029
    24Monitor

    Stack consumption vulnerability in the WebCore::CSSSelector function in WebKit, as used in Apple Safari 4.0.4, Apple Safari on iPhone OS and

    MediumCVSS 5.0Proof of conceptEPSS 11%

    apple · safariMar 19, 2010

  • CVE-2010-1042
    20Monitor

    Microsoft Windows Media Player 11 does not properly perform colorspace conversion, which allows remote attackers to cause a denial of servic

    MediumCVSS 4.3Proof of conceptEPSS 10%

    microsoft · windows media playerMar 22, 2010

  • CVE-2010-1056
    30Monitor

    Directory traversal vulnerability in the RokDownloads (com_rokdownloads) component before 1.0.1 for Joomla! allows remote attackers to inclu

    MediumCVSS 6.8Proof of conceptEPSS 11%

    joomla · joomla\!Mar 23, 2010

  • CVE-2010-1081
    24Monitor

    Directory traversal vulnerability in the Community Polls (com_communitypolls) component 1.5.2, and possibly earlier, for Core Joomla! allows

    MediumCVSS 5.0Proof of conceptEPSS 14%

    joomla · joomla\!Mar 23, 2010

  • CVE-2010-0437
    35Monitor

    The ip6_dst_lookup_tail function in net/ipv6/ip6_output.c in the Linux kernel before 2.6.27 does not properly handle certain circumstances i

    HighCVSS 7.8Proof of conceptEPSS 12%

    linux · linux kernelMar 24, 2010

  • CVE-2010-1098
    32Monitor

    The ANI parser in Microsoft Windows before 7 on the x86 platform, as used in Internet Explorer and other applications, allows remote attacke

    HighCVSS 7.1No exploitEPSS 14%

    microsoft · windows vistaMar 24, 2010

  • CVE-2010-0167
    40Plan

    The browser engine in Mozilla Firefox 3.0.x before 3.0.18, 3.5.x before 3.5.8, and 3.6.x before 3.6.2; Thunderbird before 3.0.2; and SeaMonk

    CriticalCVSS 9.3Proof of conceptEPSS 10%

    mozilla · firefoxMar 25, 2010

  • CVE-2010-0168
    34Monitor

    The nsDocument::MaybePreLoadImage function in content/base/src/nsDocument.cpp in the image-preloading implementation in Mozilla Firefox 3.6

    HighCVSS 7.6Proof of conceptEPSS 12%

    mozilla · firefoxMar 25, 2010

  • CVE-2010-1117
    34Monitor

    Heap-based buffer overflow in Internet Explorer 8 on Microsoft Windows 7 allows remote attackers to discover the base address of a Windows .

    HighCVSS 7.6No exploitEPSS 14%

    microsoft · internet explorerMar 25, 2010

  • CVE-2010-1118
    47Plan

    Unspecified vulnerability in Internet Explorer 8 on Microsoft Windows 7 allows remote attackers to execute arbitrary code via unknown vector

    CriticalCVSS 10.0No exploitEPSS 22%

    microsoft · internet explorerMar 25, 2010

  • CVE-2010-1119
    46Plan

    Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, Safari before 4.1 on Mac OS X 1

    CriticalCVSS 10.0Proof of conceptEPSS 19%

    apple · safariMar 25, 2010

  • CVE-2010-0740
    26Monitor

    The ssl3_get_record function in ssl/s3_pkt.c in OpenSSL 0.9.8f through 0.9.8m allows remote attackers to cause a denial of service (crash) v

    MediumCVSS 5.0Proof of conceptEPSS 20%

    openssl · opensslMar 26, 2010

  • CVE-2010-1127
    26Monitor

    Microsoft Internet Explorer 6 and 7 does not initialize certain data structures during execution of the createElement method, which allows r

    MediumCVSS 5.0No exploitEPSS 18%

    microsoft · internet explorerMar 26, 2010

  • CVE-2010-1175
    41Plan

    Microsoft Internet Explorer 7.0 on Windows XP and Windows Server 2003 allows remote attackers to have an unspecified impact via a certain XM

    CriticalCVSS 9.3Proof of conceptEPSS 14%

    microsoft · internet explorerMar 29, 2010

  • CVE-2010-1185
    45Plan

    Stack-based buffer overflow in serv.exe in SAP MaxDB 7.4.3.32, and 7.6.0.37 through 7.6.06 allows remote attackers to execute arbitrary code

    CriticalCVSS 10.0Proof of conceptEPSS 15%

    sap · maxdbMar 29, 2010

  • CVE-2010-0520
    33Monitor

    Heap-based buffer overflow in QuickTimeAuthoring.qtx in QuickTime in Apple Mac OS X before 10.6.3 allows remote attackers to execute arbitra

    MediumCVSS 6.8Proof of conceptEPSS 18%

    apple · mac os xMar 30, 2010

  • CVE-2010-0529
    41Plan

    Heap-based buffer overflow in QuickTime.qts in Apple QuickTime before 7.6.6 on Windows allows remote attackers to execute arbitrary code or

    CriticalCVSS 9.3No exploitEPSS 12%

    apple · quicktimeMar 31, 2010

  • CVE-2010-0267
    47Plan

    Microsoft Internet Explorer 6, 6 SP1, and 7 does not properly handle objects in memory, which allows remote attackers to execute arbitrary c

    CriticalCVSS 9.3No exploitEPSS 34%

    microsoft · internet explorerMar 31, 2010

  • CVE-2010-0488
    35Monitor

    Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, and 7 does not properly handle unspecified "encoding strings," which allows remote attackers

    MediumCVSS 6.5No exploitEPSS 29%

    microsoft · internet explorerMar 31, 2010

  • CVE-2010-0489
    44Plan

    Race condition in Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via a crafted HTML

    CriticalCVSS 9.3No exploitEPSS 23%

    microsoft · internet explorerMar 31, 2010

  • CVE-2010-0490
    46Plan

    Microsoft Internet Explorer 6, 6 SP1, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrar

    CriticalCVSS 9.3No exploitEPSS 29%

    microsoft · internet explorerMar 31, 2010

  • CVE-2010-0491
    46Plan

    Use-after-free vulnerability in Microsoft Internet Explorer 5.01 SP4, 6, and 6 SP1 allows remote attackers to execute arbitrary code by chan

    CriticalCVSS 9.3No exploitEPSS 29%

    microsoft · internet explorerMar 31, 2010

  • CVE-2010-0492
    40Plan

    Use-after-free vulnerability in mstime.dll in Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code via vectors re

    HighCVSS 8.1No exploitEPSS 27%

    microsoft · internet explorerMar 31, 2010

  • CVE-2010-0494
    24Monitor

    Cross-domain vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 allows user-assisted remote attackers to bypass the Same Origin

    MediumCVSS 4.3No exploitEPSS 22%

    microsoft · internet explorerMar 31, 2010

  • CVE-2010-0805
    61This week

    The Tabular Data Control (TDC) ActiveX control in Microsoft Internet Explorer 5.01 SP4, 6 on Windows XP SP2 and SP3, and 6 SP1 allows remote

    CriticalCVSS 9.3WeaponizedEPSS 80%

    microsoft · internet explorerMar 31, 2010

  • CVE-2010-0807
    46Plan

    Microsoft Internet Explorer 7 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessi

    CriticalCVSS 9.3No exploitEPSS 29%

    microsoft · internet explorerMar 31, 2010