Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: November 2010

27 records · 3 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2010-4142
    59Plan

    Multiple stack-based buffer overflows in DATAC RealWin 2.0 Build 6.1.8.10 and earlier allow remote attackers to cause a denial of service (c

    CriticalCVSS 10.0WeaponizedEPSS 62%

    realflex · realwinNov 1, 2010

  • CVE-2010-4182
    44Plan

    Untrusted search path vulnerability in the Data Access Objects (DAO) library (dao360.dll) in Microsoft Windows XP Professional SP3, Windows

    CriticalCVSS 9.3No exploitEPSS 24%

    microsoft · windows 7Nov 4, 2010

  • CVE-2010-3863
    36Monitor

    Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, whic

    MediumCVSS 5.0Proof of conceptEPSS 54%

    apache · shiroNov 5, 2010

  • CVE-2010-3962
    91Now

    Use-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code via vectors relate

    HighCVSS 8.1KEVWeaponizedEPSS 96%

    microsoft · internet explorerNov 5, 2010

  • CVE-2010-3639
    43Plan

    Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 1

    CriticalCVSS 9.3Proof of conceptEPSS 21%

    adobe · flash playerNov 7, 2010

  • CVE-2010-4091
    43Plan

    The EScript.api plugin in Adobe Reader and Acrobat 10.x before 10.0.1, 9.x before 9.4.1, and 8.x before 8.2.6 on Windows and Mac OS X allows

    CriticalCVSS 9.3Proof of conceptEPSS 18%

    adobe · acrobat readerNov 7, 2010

  • CVE-2010-3709
    21Monitor

    The ZipArchive::getArchiveComment function in PHP 5.2.x through 5.2.14 and 5.3.x through 5.3.3 allows context-dependent attackers to cause a

    MediumCVSS 4.3Proof of conceptEPSS 13%

    php · phpNov 8, 2010

  • CVE-2010-4221
    67This week

    Multiple stack-based buffer overflows in the pr_netio_telnet_gets function in netio.c in ProFTPD before 1.3.3c allow remote attackers to exe

    CriticalCVSS 10.0WeaponizedEPSS 91%

    proftpd · proftpdNov 9, 2010

  • CVE-2010-2572
    79This week

    Buffer overflow in Microsoft PowerPoint 2002 SP3 and 2003 SP3 allows remote attackers to execute arbitrary code via a crafted PowerPoint 95

    HighCVSS 7.8KEVWeaponizedEPSS 58%

    microsoft · powerpointNov 9, 2010

  • CVE-2010-2573
    43Plan

    Integer underflow in Microsoft PowerPoint 2002 SP3 and 2003 SP3, PowerPoint Viewer SP2, and Office 2004 for Mac allows remote attackers to e

    CriticalCVSS 9.3No exploitEPSS 20%

    microsoft · officeNov 9, 2010

  • CVE-2010-2732
    27Monitor

    Open redirect vulnerability in the web interface in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, 2010 Update 1, and 2010 Upda

    MediumCVSS 5.8No exploitEPSS 13%

    microsoft · forefront unified access gatewayNov 9, 2010

  • CVE-2010-2733
    21Monitor

    Cross-site scripting (XSS) vulnerability in the Web Monitor in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, 2010 Update 1, an

    MediumCVSS 4.3No exploitEPSS 14%

    microsoft · forefront unified access gatewayNov 9, 2010

  • CVE-2010-2734
    21Monitor

    Cross-site scripting (XSS) vulnerability in the mobile portal in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, 2010 Update 1,

    MediumCVSS 4.3No exploitEPSS 14%

    microsoft · forefront unified access gatewayNov 9, 2010

  • CVE-2010-3333
    88Now

    Stack-based buffer overflow in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office

    HighCVSS 7.8KEVWeaponizedEPSS 89%

    microsoft · officeNov 9, 2010

  • CVE-2010-3334
    45Plan

    Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File

    CriticalCVSS 9.3No exploitEPSS 25%

    microsoft · officeNov 9, 2010

  • CVE-2010-3335
    44Plan

    Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File

    CriticalCVSS 9.3No exploitEPSS 23%

    microsoft · officeNov 9, 2010

  • CVE-2010-3336
    44Plan

    Microsoft Office XP SP3, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac allow remote attacker

    CriticalCVSS 9.3No exploitEPSS 23%

    microsoft · officeNov 9, 2010

  • CVE-2010-3337
    40Plan

    Untrusted search path vulnerability in Microsoft Office 2007 SP2 and 2010 allows local users to gain privileges via a Trojan horse DLL in th

    CriticalCVSS 9.3No exploitEPSS 10%

    microsoft · officeNov 9, 2010

  • CVE-2010-3936
    23Monitor

    Cross-site scripting (XSS) vulnerability in Signurl.asp in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, 2010 Update 1, and 20

    MediumCVSS 4.3No exploitEPSS 18%

    microsoft · forefront unified access gatewayNov 9, 2010

  • CVE-2010-4156
    24Monitor

    The mb_strcut function in Libmbfl 1.1.0, as used in PHP 5.3.x through 5.3.3, allows context-dependent attackers to obtain potentially sensit

    MediumCVSS 5.0Proof of conceptEPSS 12%

    php · phpNov 9, 2010

  • CVE-2010-3870
    30Monitor

    The utf8_decode function in PHP before 5.3.4 does not properly handle non-shortest form UTF-8 encoding and ill-formed subsequences in UTF-8

    MediumCVSS 6.8Proof of conceptEPSS 11%

    php · phpNov 12, 2010

  • CVE-2010-3894
    41Plan

    Stack-based buffer overflow in the Java_com_ibm_es_oss_CryptionNative_ESEncrypt function in /opt/IBM/es/lib/libffq.cryptionjni.so in the log

    CriticalCVSS 9.3Proof of conceptEPSS 12%

    ibm · omnifindNov 12, 2010

  • CVE-2010-4231
    36Monitor

    Directory traversal vulnerability in the web-based administration interface on the Camtron CMNC-200 Full HD IP Camera and TecVoz CMNC-200 Me

    HighCVSS 7.8Proof of conceptEPSS 16%

    camtron · cmnc-200 firmwareNov 16, 2010

  • CVE-2010-3864
    37Monitor

    Multiple race conditions in ssl/t1_lib.c in OpenSSL 0.9.8f through 0.9.8o, 1.0.0, and 1.0.0a, when multi-threading and internal caching are

    HighCVSS 7.6No exploitEPSS 22%

    openssl · opensslNov 17, 2010

  • CVE-2010-4107
    35Monitor

    The default configuration of the PJL Access value in the File System External Access settings on HP LaserJet MFP printers, Color LaserJet MF

    HighCVSS 7.8Proof of conceptEPSS 13%

    hp · 9000Nov 17, 2010

  • CVE-2010-4300
    34Monitor

    Heap-based buffer overflow in the dissect_ldss_transfer function (epan/dissectors/packet-ldss.c) in the LDSS dissector in Wireshark 1.2.0 th

    HighCVSS 7.5Proof of conceptEPSS 13%

    wireshark · wiresharkNov 26, 2010

  • CVE-2010-4172
    30Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0.

    MediumCVSS 4.3Proof of conceptEPSS 42%

    apache · tomcatNov 26, 2010