Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: April 2010

71 records · 3 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2010-0094
    54Plan

    Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18 and 5.0 Update 23 al

    HighCVSS 7.5WeaponizedEPSS 80%

    sun · jreApr 1, 2010

  • CVE-2010-0838
    34Monitor

    Unspecified vulnerability in the Java 2D component in Oracle Java SE and Java for Business 6 Update 18, 5.0, Update, and 23 allows remote at

    HighCVSS 7.5Proof of conceptEPSS 14%

    sun · jreApr 1, 2010

  • CVE-2010-0840
    98Now

    Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and

    CriticalCVSS 9.8KEVWeaponizedEPSS 96%

    oracle · jreApr 1, 2010

  • CVE-2010-0842
    53Plan

    Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27

    HighCVSS 7.5WeaponizedEPSS 77%

    sun · jreApr 1, 2010

  • CVE-2010-1225
    45Plan

    The memory-management implementation in the Virtual Machine Monitor (aka VMM or hypervisor) in Microsoft Virtual PC 2007 Gold and SP1, Virtu

    CriticalCVSS 9.3Proof of conceptEPSS 27%

    microsoft · virtual pcApr 1, 2010

  • CVE-2010-1240
    59Plan

    Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, do not restrict the contents of one text field in t

    CriticalCVSS 9.3WeaponizedEPSS 73%

    adobe · acrobat readerApr 5, 2010

  • CVE-2009-2936
    49Plan

    The Command Line Interface (aka Server CLI or administration interface) in the master process in the reverse proxy server in Varnish before

    HighCVSS 7.5WeaponizedEPSS 63%

    varnish.projects.linpro · varnishApr 5, 2010

  • CVE-2010-1223
    45Plan

    Multiple buffer overflows in CA XOsoft r12.0 and r12.5 allow remote attackers to execute arbitrary code via (1) a malformed request to the w

    CriticalCVSS 10.0No exploitEPSS 16%

    ca · xosoft content distributionApr 7, 2010

  • CVE-2010-1299
    23Monitor

    Multiple PHP remote file inclusion vulnerabilities in DynPG CMS 4.1.0, and possibly earlier, when magic_quotes_gpc is disabled and register_

    MediumCVSS 5.1Proof of conceptEPSS 10%

    dynpg · dynpgApr 7, 2010

  • CVE-2010-1304
    24Monitor

    Directory traversal vulnerability in userstatus.php in the User Status (com_userstatus) component 1.21.16 for Joomla! allows remote attacker

    MediumCVSS 5.0Proof of conceptEPSS 14%

    joomla · joomla\!Apr 8, 2010

  • CVE-2010-1305
    26Monitor

    Directory traversal vulnerability in jinventory.php in the JInventory (com_jinventory) component 1.23.02 and possibly other versions before

    MediumCVSS 5.0Proof of conceptEPSS 20%

    joomlamo · com jinventoryApr 8, 2010

  • CVE-2010-1306
    35Monitor

    Directory traversal vulnerability in the Picasa (com_joomlapicasa2) component 2.0 and 2.0.5 for Joomla! allows remote attackers to read arbi

    HighCVSS 7.5Proof of conceptEPSS 15%

    joomla · joomla\!Apr 8, 2010

  • CVE-2010-1307
    23Monitor

    Directory traversal vulnerability in the Magic Updater (com_joomlaupdater) component for Joomla! allows remote attackers to read arbitrary f

    MediumCVSS 5.0Proof of conceptEPSS 10%

    joomla · joomla\!Apr 8, 2010

  • CVE-2010-1308
    24Monitor

    Directory traversal vulnerability in the SVMap (com_svmap) component 1.1.1 for Joomla! allows remote attackers to read arbitrary files via a

    MediumCVSS 5.0Proof of conceptEPSS 13%

    joomla · joomla\!Apr 8, 2010

  • CVE-2010-1312
    24Monitor

    Directory traversal vulnerability in the iJoomla News Portal (com_news_portal) component 1.5.x for Joomla! allows remote attackers to read a

    MediumCVSS 5.0Proof of conceptEPSS 13%

    ijoomla · com news portalApr 8, 2010

  • CVE-2010-1314
    25Monitor

    Directory traversal vulnerability in the Highslide JS (com_hsconfig) component 1.5 and 2.0.9 for Joomla! allows remote attackers to read arb

    MediumCVSS 5.0Proof of conceptEPSS 15%

    joomla · joomla\!Apr 8, 2010

  • CVE-2010-1340
    24Monitor

    Directory traversal vulnerability in jresearch.php in the J!Research (com_jresearch) component for Joomla! allows remote attackers to read a

    MediumCVSS 5.0Proof of conceptEPSS 13%

    joomla · joomla\!Apr 9, 2010

  • CVE-2010-1345
    25Monitor

    Directory traversal vulnerability in the Cookex Agency CKForms (com_ckforms) component 1.3.3 for Joomla! allows remote attackers to read arb

    MediumCVSS 5.0Proof of conceptEPSS 16%

    cookex · com ckformsApr 9, 2010

  • CVE-2009-3732
    45Plan

    Format string vulnerability in vmware-vmrc.exe build 158248 in VMware Remote Console (aka VMrc) allows remote attackers to execute arbitrary

    CriticalCVSS 10.0Proof of conceptEPSS 16%

    vmware · aceApr 12, 2010

  • CVE-2010-1152
    23Monitor

    memcached.c in memcached before 1.4.3 allows remote attackers to cause a denial of service (daemon hang or crash) via a long line that trigg

    MediumCVSS 5.0Proof of conceptEPSS 10%

    memcachedb · memcachedApr 12, 2010

  • CVE-2010-1349
    46Plan

    Integer overflow in Opera 10.10 through 10.50 allows remote attackers to execute arbitrary code via a large Content-Length value, which trig

    CriticalCVSS 10.0Proof of conceptEPSS 19%

    opera · opera browserApr 12, 2010

  • CVE-2010-1352
    24Monitor

    Directory traversal vulnerability in the JOOFORGE Jutebox (com_jukebox) component 1.0 and 1.7 for Joomla! allows remote attackers to read ar

    MediumCVSS 5.0Proof of conceptEPSS 13%

    jooforge · com jukeboxApr 12, 2010

  • CVE-2010-1353
    26Monitor

    Directory traversal vulnerability in the LoginBox Pro (com_loginbox) component for Joomla! allows remote attackers to read arbitrary files v

    MediumCVSS 5.0Proof of conceptEPSS 18%

    joomla · joomla\!Apr 12, 2010

  • CVE-2010-1354
    25Monitor

    Directory traversal vulnerability in the VJDEO (com_vjdeo) component 1.0 and 1.0.1 for Joomla! allows remote attackers to read arbitrary fil

    MediumCVSS 5.0Proof of conceptEPSS 15%

    joomla · joomla\!Apr 12, 2010

  • CVE-2010-0866
    29Monitor

    Unspecified vulnerability in the JavaVM component in Oracle Database 11.1.0.7 and 11.2.0.1 allows remote authenticated users to affect confi

    MediumCVSS 6.5WeaponizedEPSS 11%

    oracle · database serverApr 13, 2010

  • CVE-2010-0870
    18Monitor

    Unspecified vulnerability in the Change Data Capture component in Oracle Database 9.2.0.8 and 9.2.0.8DV allows remote authenticated users to

    LowCVSS 3.6WeaponizedEPSS 12%

    oracle · database serverApr 13, 2010

  • CVE-2010-0024
    23Monitor

    The SMTP component in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, and Server 2008 Gold, SP2, and R2, and Exchange Server 20

    MediumCVSS 5.0No exploitEPSS 10%

    microsoft · windows 2000Apr 14, 2010

  • CVE-2010-0025
    26Monitor

    The SMTP component in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, and Server 2008 Gold, SP2, and R2, and Exchange Server 20

    MediumCVSS 5.0No exploitEPSS 21%

    microsoft · windows 2000Apr 14, 2010

  • CVE-2010-0254
    35Monitor

    Microsoft Office Visio 2002 SP2, 2003 SP3, and 2007 SP1 and SP2 does not properly validate attributes in Visio files, which allows remote at

    HighCVSS 7.6No exploitEPSS 17%

    microsoft · visioApr 14, 2010

  • CVE-2010-0256
    35Monitor

    Microsoft Office Visio 2002 SP2, 2003 SP3, and 2007 SP1 and SP2 does not properly calculate unspecified indexes associated with Visio files,

    HighCVSS 7.6No exploitEPSS 17%

    microsoft · visioApr 14, 2010

  • CVE-2010-0268
    43Plan

    Unspecified vulnerability in the Windows Media Player ActiveX control in Windows Media Player (WMP) 9 on Microsoft Windows 2000 SP4 and XP S

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · windows media playerApr 14, 2010

  • CVE-2010-0269
    49Plan

    The SMB client in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Ser

    CriticalCVSS 10.0Proof of conceptEPSS 28%

    microsoft · windows 7Apr 14, 2010

  • CVE-2010-0270
    54Plan

    The SMB client in Microsoft Windows Server 2008 R2 and Windows 7 does not properly validate fields in SMB transaction responses, which allow

    CriticalCVSS 10.0Proof of conceptEPSS 48%

    microsoft · windows 7Apr 14, 2010

  • CVE-2010-0476
    50Plan

    The SMB client in Microsoft Windows Server 2003 SP2, Vista Gold, SP1, and SP2, and Windows Server 2008 Gold and SP2 allows remote SMB server

    CriticalCVSS 10.0Proof of conceptEPSS 34%

    microsoft · windows 7Apr 14, 2010

  • CVE-2010-0477
    55Plan

    The SMB client in Microsoft Windows Server 2008 R2 and Windows 7 does not properly handle (1) SMBv1 and (2) SMBv2 response packets, which al

    CriticalCVSS 10.0Proof of conceptEPSS 50%

    microsoft · windows 7Apr 14, 2010

  • CVE-2010-0478
    55Plan

    Stack-based buffer overflow in nsum.exe in the Windows Media Unicast Service in Media Services for Microsoft Windows 2000 Server SP4 allows

    CriticalCVSS 9.3WeaponizedEPSS 60%

    microsoft · windows 2000Apr 14, 2010

  • CVE-2010-0479
    44Plan

    Buffer overflow in Microsoft Office Publisher 2002 SP3, 2003 SP3, and 2007 SP1 and SP2 allows remote attackers to execute arbitrary code via

    CriticalCVSS 9.3No exploitEPSS 23%

    microsoft · publisherApr 14, 2010

  • CVE-2010-0480
    57Plan

    Multiple stack-based buffer overflows in the MPEG Layer-3 audio codecs in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista

    CriticalCVSS 9.3WeaponizedEPSS 67%

    microsoft · windows 2000Apr 14, 2010

  • CVE-2010-0486
    44Plan

    The WinVerifyTrust function in Authenticode Signature Verification 5.1, 6.0, and 6.1 in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3,

    CriticalCVSS 9.3No exploitEPSS 22%

    microsoft · windows 7Apr 14, 2010

  • CVE-2010-0487
    44Plan

    The Authenticode Signature verification functionality in cabview.dll in Cabinet File Viewer Shell Extension 5.1, 6.0, and 6.1 in Microsoft W

    CriticalCVSS 9.3No exploitEPSS 24%

    microsoft · windows 7Apr 14, 2010

  • CVE-2010-0812
    30Monitor

    Microsoft Windows XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allow remote attackers to bypass i

    MediumCVSS 6.4No exploitEPSS 17%

    microsoft · windows xpApr 14, 2010

  • CVE-2010-0432
    24Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in the Apache Open For Business Project (aka OFBiz) 09.04 and earlier, as used in Openta

    MediumCVSS 4.3Proof of conceptEPSS 22%

    apache · ofbizApr 15, 2010

  • CVE-2010-1423
    54Plan

    Argument injection vulnerability in the URI handler in (a) Java NPAPI plugin and (b) Java Deployment Toolkit in Java 6 Update 10, 19, and ot

    CriticalCVSS 9.3WeaponizedEPSS 55%

    oracle · jdkApr 15, 2010

  • CVE-2010-1465
    46Plan

    Stack-based buffer overflow in Trellian FTP client 3.01, including 3.1.3.1789, allows remote attackers to execute arbitrary code via a long

    CriticalCVSS 9.3WeaponizedEPSS 31%

    trellian · ftpApr 16, 2010

  • CVE-2010-1470
    34Monitor

    Directory traversal vulnerability in the Web TV (com_webtv) component 1.0 for Joomla! allows remote attackers to read arbitrary files and po

    HighCVSS 7.5Proof of conceptEPSS 13%

    joomla · joomlaApr 19, 2010

  • CVE-2010-1471
    35Monitor

    Directory traversal vulnerability in the AddressBook (com_addressbook) component 1.5.0 for Joomla! allows remote attackers to read arbitrary

    HighCVSS 7.5Proof of conceptEPSS 16%

    joomla · joomla\!Apr 19, 2010

  • CVE-2010-1472
    34Monitor

    Directory traversal vulnerability in the Daily Horoscope (com_horoscope) component 1.5.0 for Joomla! allows remote attackers to read arbitra

    HighCVSS 7.5Proof of conceptEPSS 13%

    joomla · joomla\!Apr 19, 2010

  • CVE-2009-4769
    48Plan

    Multiple format string vulnerabilities in the tolog function in httpdx 1.4, 1.4.5, 1.4.6, 1.4.6b, and 1.5 allow (1) remote attackers to exec

    CriticalCVSS 9.3WeaponizedEPSS 37%

    jasper · httpdxApr 20, 2010

  • CVE-2010-1318
    57Plan

    Stack-based buffer overflow in the AgentX::receive_agentx function in AgentX++ 1.4.16, as used in RealNetworks Helix Server and Helix Mobile

    CriticalCVSS 10.0WeaponizedEPSS 58%

    realnetworks · helix mobile serverApr 20, 2010

  • CVE-2010-1489
    21Monitor

    The XSS Filter in Microsoft Internet Explorer 8 does not properly perform neutering for the SCRIPT tag, which allows remote attackers to con

    MediumCVSS 4.3No exploitEPSS 14%

    microsoft · internet explorerApr 20, 2010

  • CVE-2010-0886
    61This week

    Unspecified vulnerability in the Java Deployment Toolkit component in Oracle Java SE and Java for Business JDK and JRE 6 Update 10 through 1

    CriticalCVSS 10.0WeaponizedEPSS 69%

    sun · jreApr 20, 2010

  • CVE-2010-1033
    41Plan

    Multiple stack-based buffer overflows in a certain Tetradyne ActiveX control in HP Operations Manager 7.5, 8.10, and 8.16 might allow remote

    CriticalCVSS 9.3Proof of conceptEPSS 12%

    hp · operations managerApr 21, 2010

  • CVE-2010-1320
    20Monitor

    Double free vulnerability in do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7.x and 1.8.x before 1.8.2 all

    MediumCVSS 4.0Proof of conceptEPSS 11%

    mit · kerberos 5Apr 22, 2010

  • CVE-2010-1157
    26Monitor

    Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by

    LowCVSS 2.6Proof of conceptEPSS 52%

    apache · tomcatApr 23, 2010

  • CVE-2010-1491
    24Monitor

    Directory traversal vulnerability in the MMS Blog (com_mmsblog) component 2.3.0 for Joomla! allows remote attackers to read arbitrary files

    MediumCVSS 5.0Proof of conceptEPSS 13%

    joomla · joomla\!Apr 23, 2010

  • CVE-2010-1494
    25Monitor

    Directory traversal vulnerability in the AWDwall (com_awdwall) component 1.5.4 for Joomla! allows remote attackers to read arbitrary files v

    MediumCVSS 5.0Proof of conceptEPSS 16%

    joomla · joomla\!Apr 23, 2010

  • CVE-2010-1495
    36Monitor

    Directory traversal vulnerability in the Matamko (com_matamko) component 1.01 for Joomla! allows remote attackers to read arbitrary files vi

    HighCVSS 7.5Proof of conceptEPSS 18%

    matamko · com matamkoApr 23, 2010

  • CVE-2010-1531
    35Monitor

    Directory traversal vulnerability in the redSHOP (com_redshop) component 1.0.x for Joomla! allows remote attackers to read arbitrary files v

    HighCVSS 7.5Proof of conceptEPSS 16%

    joomla · joomla\!Apr 26, 2010

  • CVE-2010-1532
    25Monitor

    Directory traversal vulnerability in the givesight PowerMail Pro (com_powermail) component 1.5.3 for Joomla! allows remote attackers to read

    MediumCVSS 5.0Proof of conceptEPSS 15%

    givesight · com powermailApr 26, 2010

  • CVE-2010-1533
    35Monitor

    Directory traversal vulnerability in the TweetLA (com_tweetla) component 1.0.1 for Joomla! allows remote attackers to read arbitrary files v

    HighCVSS 7.5Proof of conceptEPSS 15%

    joomla · joomla\!Apr 26, 2010

  • CVE-2010-1534
    24Monitor

    Directory traversal vulnerability in the Shoutbox Pro (com_shoutbox) component for Joomla! allows remote attackers to read arbitrary files v

    MediumCVSS 5.0Proof of conceptEPSS 13%

    joomla · joomla\!Apr 26, 2010

  • CVE-2010-1535
    35Monitor

    Directory traversal vulnerability in the TRAVELbook (com_travelbook) component 1.0.1 for Joomla! allows remote attackers to read arbitrary f

    HighCVSS 7.5Proof of conceptEPSS 15%

    joomla · joomla\!Apr 26, 2010

  • CVE-2010-1429
    36Monitor

    Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 allows remote attacke

    MediumCVSS 5.0WeaponizedEPSS 53%

    redhat · jboss enterprise application platformApr 28, 2010

  • CVE-2010-1586
    20Monitor

    Open redirect vulnerability in red2301.html in HP System Management Homepage (SMH) 2.x.x.x allows remote attackers to redirect users to arbi

    MediumCVSS 4.3Proof of conceptEPSS 10%

    hp · system management homepageApr 28, 2010

  • CVE-2010-1587
    43Plan

    The Jetty ResourceHandler in Apache ActiveMQ 5.x before 5.3.2 and 5.4.x before 5.4.0 allows remote attackers to read JSP source code via a /

    MediumCVSS 5.0WeaponizedEPSS 78%

    apache · activemqApr 28, 2010

  • CVE-2010-0738
    73This week

    The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 a

    MediumCVSS 5.3KEVWeaponizedEPSS 74%

    redhat · jboss enterprise application platformApr 28, 2010

  • CVE-2010-1428
    78This week

    The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09

    HighCVSS 7.5KEVWeaponizedEPSS 61%

    redhat · jboss enterprise application platformApr 28, 2010

  • CVE-2010-1597
    41Plan

    Stack-based buffer overflow in zgtips.dll in ZipGenius 6.3.1.2552 allows user-assisted remote attackers to execute arbitrary code via a ZIP

    CriticalCVSS 9.3Proof of conceptEPSS 11%

    zipgenius · zipgeniusApr 29, 2010

  • CVE-2010-1601
    25Monitor

    Directory traversal vulnerability in the JA Comment (com_jacomment) component for Joomla! allows remote attackers to read arbitrary files vi

    MediumCVSS 5.0Proof of conceptEPSS 15%

    joomla · joomla\!Apr 29, 2010

  • CVE-2010-1602
    35Monitor

    Directory traversal vulnerability in the ZiMB Comment (com_zimbcomment) component 0.8.1 for Joomla! allows remote attackers to read arbitrar

    HighCVSS 7.5Proof of conceptEPSS 15%

    joomla · joomla\!Apr 29, 2010

  • CVE-2010-0817
    26Monitor

    Cross-site scripting (XSS) vulnerability in _layouts/help.aspx in Microsoft SharePoint Server 2007 12.0.0.6421 and possibly earlier, and Sha

    MediumCVSS 4.3Proof of conceptEPSS 28%

    microsoft · sharepoint serverApr 29, 2010