Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: October 2010

60 records · 1 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2010-1623
    26Monitor

    Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util) be

    MediumCVSS 5.0No exploitEPSS 20%

    apache · apr-utilOct 4, 2010

  • CVE-2010-2889
    45Plan

    Unspecified vulnerability in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows attackers to exec

    CriticalCVSS 9.3No exploitEPSS 27%

    adobe · acrobatOct 6, 2010

  • CVE-2010-3631
    41Plan

    Array index error in Adobe Reader and Acrobat 8.x before 8.2.5 and 9.x before 9.4 on Mac OS X allows attackers to execute arbitrary code via

    CriticalCVSS 9.3Proof of conceptEPSS 11%

    adobe · acrobatOct 6, 2010

  • CVE-2010-3886
    22Monitor

    The CTimeoutEventList::InsertIntoTimeoutList function in Microsoft mshtml.dll uses a certain pointer value as part of producing Timer ID val

    MediumCVSS 4.3Proof of conceptEPSS 16%

    microsoft · internet explorerOct 8, 2010

  • CVE-2010-2951
    29Monitor

    dns_internal.cc in Squid 3.1.6, when IPv6 DNS resolution is not enabled, accesses an invalid socket during an IPv4 TCP DNS query, which allo

    MediumCVSS 5.0No exploitEPSS 31%

    squid-cache · squidOct 12, 2010

  • CVE-2010-1883
    38Monitor

    Integer overflow in the Embedded OpenType (EOT) Font Engine in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1

    HighCVSS 7.8No exploitEPSS 23%

    microsoft · windows 2003 serverOct 13, 2010

  • CVE-2010-2745
    44Plan

    Microsoft Windows Media Player (WMP) 9 through 12 does not properly deallocate objects during a browser reload action, which allows user-ass

    CriticalCVSS 9.3Proof of conceptEPSS 23%

    microsoft · windows media playerOct 13, 2010

  • CVE-2010-2746
    41Plan

    Heap-based buffer overflow in Comctl32.dll (aka the common control library) in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Wi

    HighCVSS 7.6Proof of conceptEPSS 35%

    microsoft · windows 2003 serverOct 13, 2010

  • CVE-2010-2747
    43Plan

    Microsoft Word 2002 SP3 and Office 2004 for Mac do not properly handle an uninitialized pointer during parsing of a Word document, which all

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · officeOct 13, 2010

  • CVE-2010-2748
    43Plan

    Microsoft Word 2002 SP3 and Office 2004 for Mac do not properly check an unspecified boundary during parsing of a Word document, which allow

    CriticalCVSS 9.3No exploitEPSS 19%

    microsoft · officeOct 13, 2010

  • CVE-2010-2750
    43Plan

    Array index error in Microsoft Word 2002 SP3 and Office 2004 for Mac allows remote attackers to execute arbitrary code via a crafted Word do

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · officeOct 13, 2010

  • CVE-2010-3214
    44Plan

    Stack-based buffer overflow in Microsoft Word 2002 SP3, 2003 SP3, 2007 SP2, and 2010; Office 2004 and 2008 for Mac; Open XML File Format Con

    CriticalCVSS 9.3No exploitEPSS 24%

    microsoft · officeOct 13, 2010

  • CVE-2010-3215
    43Plan

    Microsoft Word 2002 SP3 and Office 2004 for Mac do not properly handle unspecified return values during parsing of a Word document, which al

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · officeOct 13, 2010

  • CVE-2010-3216
    43Plan

    Microsoft Word 2002 SP3 and Office 2004 for Mac allow remote attackers to execute arbitrary code via a crafted Word document containing book

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · officeOct 13, 2010

  • CVE-2010-3217
    49Plan

    Double free vulnerability in Microsoft Word 2002 SP3 allows remote attackers to execute arbitrary code via a Word document with crafted List

    CriticalCVSS 9.3No exploitEPSS 40%

    microsoft · wordOct 13, 2010

  • CVE-2010-3218
    44Plan

    Heap-based buffer overflow in Microsoft Word 2002 SP3 allows remote attackers to execute arbitrary code via malformed records in a Word docu

    CriticalCVSS 9.3No exploitEPSS 23%

    microsoft · wordOct 13, 2010

  • CVE-2010-3219
    43Plan

    Array index vulnerability in Microsoft Word 2002 SP3 allows remote attackers to execute arbitrary code via a crafted Word document that trig

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · wordOct 13, 2010

  • CVE-2010-3220
    43Plan

    Unspecified vulnerability in Microsoft Word 2002 SP3 and Office 2004 for Mac allows remote attackers to execute arbitrary code via a crafted

    CriticalCVSS 9.3No exploitEPSS 19%

    microsoft · officeOct 13, 2010

  • CVE-2010-3221
    43Plan

    Microsoft Word 2002 SP3 and 2003 SP3, Office 2004 for Mac, and Word Viewer do not properly handle a malformed record during parsing of a Wor

    CriticalCVSS 9.3No exploitEPSS 19%

    microsoft · officeOct 13, 2010

  • CVE-2010-3223
    34Monitor

    The user interface in Microsoft Cluster Service (MSCS) in Microsoft Windows Server 2008 R2 does not properly set administrative-share permis

    HighCVSS 7.5No exploitEPSS 12%

    microsoft · windows server 2008Oct 13, 2010

  • CVE-2010-3225
    35Monitor

    Use-after-free vulnerability in the Media Player Network Sharing Service in Microsoft Windows Vista SP1 and SP2 and Windows 7 allows remote

    HighCVSS 7.6No exploitEPSS 16%

    microsoft · windows vistaOct 13, 2010

  • CVE-2010-3228
    43Plan

    The JIT compiler in Microsoft .NET Framework 4.0 on 64-bit platforms does not properly perform optimizations, which allows remote attackers

    CriticalCVSS 9.3No exploitEPSS 19%

    microsoft · .net frameworkOct 13, 2010

  • CVE-2010-3229
    43Plan

    The Secure Channel (aka SChannel) security package in Microsoft Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Window

    HighCVSS 7.1No exploitEPSS 50%

    microsoft · windows 7Oct 13, 2010

  • CVE-2010-3230
    43Plan

    Integer overflow in Microsoft Excel 2002 SP3 allows remote attackers to execute arbitrary code via an Excel document with crafted record inf

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · excelOct 13, 2010

  • CVE-2010-3231
    43Plan

    Microsoft Excel 2002 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac do not properly validate record informati

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · excelOct 13, 2010

  • CVE-2010-3232
    43Plan

    Microsoft Excel 2003 SP3 and 2007 SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Excel Viewer SP2; and Office Co

    CriticalCVSS 9.3No exploitEPSS 21%

    microsoft · excelOct 13, 2010

  • CVE-2010-3233
    43Plan

    Microsoft Excel 2002 SP3 and 2003 SP3 does not properly validate record information, which allows remote attackers to execute arbitrary code

    CriticalCVSS 9.3No exploitEPSS 21%

    microsoft · excelOct 13, 2010

  • CVE-2010-3234
    43Plan

    Microsoft Excel 2002 SP3 does not properly validate formula information, which allows remote attackers to execute arbitrary code via a craft

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · excelOct 13, 2010

  • CVE-2010-3235
    43Plan

    Microsoft Excel 2002 SP3 does not properly validate formula information, which allows remote attackers to execute arbitrary code via a craft

    CriticalCVSS 9.3No exploitEPSS 21%

    microsoft · excelOct 13, 2010

  • CVE-2010-3236
    43Plan

    Microsoft Excel 2002 SP3 and 2003 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac do not properly validate rec

    CriticalCVSS 9.3No exploitEPSS 21%

    microsoft · excelOct 13, 2010

  • CVE-2010-3237
    43Plan

    Microsoft Excel 2002 SP3 and Office 2004 for Mac do not properly validate record information, which allows remote attackers to execute arbit

    CriticalCVSS 9.3No exploitEPSS 21%

    microsoft · excelOct 13, 2010

  • CVE-2010-3238
    43Plan

    Microsoft Excel 2002 SP3 and 2003 SP3, and Office 2004 for Mac, does not properly validate binary file-format information, which allows remo

    CriticalCVSS 9.3No exploitEPSS 21%

    microsoft · excelOct 13, 2010

  • CVE-2010-3239
    43Plan

    Microsoft Excel 2002 SP3 does not properly validate record information, which allows remote attackers to execute arbitrary code via a crafte

    CriticalCVSS 9.3No exploitEPSS 21%

    microsoft · excelOct 13, 2010

  • CVE-2010-3240
    43Plan

    Microsoft Excel 2002 SP3 and 2007 SP2; Excel Viewer SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2

    CriticalCVSS 9.3No exploitEPSS 21%

    microsoft · excelOct 13, 2010

  • CVE-2010-3241
    43Plan

    Microsoft Excel 2002 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac do not properly validate binary file-form

    CriticalCVSS 9.3No exploitEPSS 21%

    microsoft · excelOct 13, 2010

  • CVE-2010-3242
    43Plan

    Microsoft Excel 2002 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac do not properly validate record informati

    CriticalCVSS 9.3No exploitEPSS 21%

    microsoft · excelOct 13, 2010

  • CVE-2010-3243
    22Monitor

    Cross-site scripting (XSS) vulnerability in the toStaticHTML function in Microsoft Internet Explorer 8, and the SafeHTML function in Microso

    MediumCVSS 4.3No exploitEPSS 15%

    microsoft · sharepoint serverOct 13, 2010

  • CVE-2010-3325
    24Monitor

    Microsoft Internet Explorer 6 through 8 does not properly handle unspecified special characters in Cascading Style Sheets (CSS) documents, w

    MediumCVSS 4.3Proof of conceptEPSS 22%

    microsoft · internet explorerOct 13, 2010

  • CVE-2010-3326
    44Plan

    Microsoft Internet Explorer 6 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessi

    CriticalCVSS 9.3No exploitEPSS 24%

    microsoft · internet explorerOct 13, 2010

  • CVE-2010-3327
    21Monitor

    The implementation of HTML content creation in Microsoft Internet Explorer 6 through 8 does not remove the Anchor element during pasting and

    MediumCVSS 4.3No exploitEPSS 14%

    microsoft · internet explorerOct 13, 2010

  • CVE-2010-3328
    45Plan

    Use-after-free vulnerability in the CAttrArray::PrivateFind function in mshtml.dll in Microsoft Internet Explorer 6 through 8 allows remote

    HighCVSS 8.8No exploitEPSS 31%

    microsoft · internet explorerOct 13, 2010

  • CVE-2010-3329
    46Plan

    mshtmled.dll in Microsoft Internet Explorer 7 and 8 allows remote attackers to execute arbitrary code via a crafted Microsoft Office documen

    CriticalCVSS 9.3Proof of conceptEPSS 28%

    microsoft · internet explorerOct 13, 2010

  • CVE-2010-3330
    33Monitor

    Microsoft Internet Explorer 6 through 8 does not properly restrict script access to content from a different (1) domain or (2) zone, which a

    MediumCVSS 6.5No exploitEPSS 22%

    microsoft · internet explorerOct 13, 2010

  • CVE-2010-3331
    44Plan

    Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory in certain circumstances involving use of Microsoft Word

    CriticalCVSS 9.3No exploitEPSS 24%

    microsoft · internet explorerOct 13, 2010

  • CVE-2010-2415
    40Plan

    Unspecified vulnerability in the Change Data Capture component in Oracle Database Server 10.1.0.5, 10.2.0.4, 11.1.0.7, and 11.2.0.1 allows r

    MediumCVSS 4.9WeaponizedEPSS 9%

    oracle · database serverOct 13, 2010

  • CVE-2010-3585
    52Plan

    Unspecified vulnerability in the OracleVM component in Oracle VM 2.2.1 allows remote authenticated users to affect confidentiality, integrit

    CriticalCVSS 9.0WeaponizedEPSS 52%

    oracle · vmOct 14, 2010

  • CVE-2010-0219
    67This week

    Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default pass

    CriticalCVSS 10.0WeaponizedEPSS 90%

    apache · axis2Oct 18, 2010

  • CVE-2010-3747
    47Plan

    An ActiveX control in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.4, and RealPlayer Enterprise 2.1.2 does not p

    CriticalCVSS 9.3WeaponizedEPSS 34%

    realnetworks · realplayerOct 18, 2010

  • CVE-2010-3749
    45Plan

    The browser-plugin implementation in RealNetworks RealPlayer 11.0 through 11.1 and RealPlayer SP 1.0 through 1.1 allows remote attackers to

    CriticalCVSS 9.3Proof of conceptEPSS 25%

    realnetworks · realplayerOct 18, 2010

  • CVE-2010-3552
    64This week

    Unspecified vulnerability in the New Java Plug-in component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to a

    CriticalCVSS 10.0WeaponizedEPSS 80%

    sun · jreOct 19, 2010

  • CVE-2010-3563
    65This week

    Unspecified vulnerability in the Deployment component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect

    CriticalCVSS 10.0WeaponizedEPSS 84%

    sun · jreOct 19, 2010

  • CVE-2010-3573
    23Monitor

    Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21 and 5.0 Update 25 allows remote at

    MediumCVSS 5.1Proof of conceptEPSS 10%

    sun · jreOct 19, 2010

  • CVE-2010-3179
    40Plan

    Stack-based buffer overflow in the text-rendering functionality in Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before

    CriticalCVSS 9.3Proof of conceptEPSS 10%

    mozilla · firefoxOct 21, 2010

  • CVE-2010-3714
    40Plan

    The jumpUrl (aka access tracking) implementation in tslib/class.tslib_fe.php in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x bef

    HighCVSS 7.1WeaponizedEPSS 24%

    typo3 · typo3Oct 25, 2010

  • CVE-2010-3653
    59Plan

    The Director module (dirapi.dll) in Adobe Shockwave Player before 11.5.9.615 allows remote attackers to execute arbitrary code or cause a de

    CriticalCVSS 9.3WeaponizedEPSS 74%

    adobe · shockwave playerOct 26, 2010

  • CVE-2010-4094
    40Plan

    The Tomcat server in IBM Rational Quality Manager and Rational Test Lab Manager has a default password for the ADMIN account, which makes it

    MediumCVSS 5.0WeaponizedEPSS 64%

    ibm · rational quality managerOct 26, 2010

  • CVE-2010-3227
    43Plan

    Stack-based buffer overflow in the UpdateFrameTitleForDocument method in the CFrameWnd class in mfc42.dll in the Microsoft Foundation Class

    CriticalCVSS 9.3Proof of conceptEPSS 20%

    microsoft · windows 7Oct 26, 2010

  • CVE-2010-2891
    34Monitor

    Buffer overflow in the smiGetNode function in lib/smi.c in libsmi 0.4.8 allows context-dependent attackers to execute arbitrary code via an

    HighCVSS 7.5Proof of conceptEPSS 14%

    tu-braunschweig · libsmiOct 27, 2010

  • CVE-2010-3765
    94Now

    Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, and SeaMonkey 2.x bef

    CriticalCVSS 9.8KEVWeaponizedEPSS 83%

    mozilla · firefoxOct 27, 2010

  • CVE-2010-3654
    58Plan

    Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris and 10.1.95.1 on Android, and authp

    CriticalCVSS 9.3WeaponizedEPSS 69%

    adobe · flash playerOct 29, 2010