# CVEs published 2010-04-20

27 CVEs were published on April 20, 2010: 0 critical, 0 high. Days are UTC.

- [CVE-2010-0886](https://cve.now/CVE-2010-0886.md): Unspecified vulnerability in the Java Deployment Toolkit component in Oracle Java SE and Java for Business JDK and JRE 6 Update 10 through 1 (no CVSS)
- [CVE-2010-0887](https://cve.now/CVE-2010-0887.md): Unspecified vulnerability in the New Java Plug-in component in Oracle Java SE and Java for Business JDK and JRE 6 Update 18 and 19 allows re (no CVSS)
- [CVE-2010-1153](https://cve.now/CVE-2010-1153.md): PHP remote file inclusion vulnerability in the autoloader in TYPO3 4.3.x before 4.3.3 allows remote attackers to execute arbitrary PHP code (no CVSS, typo3/cms)
- [CVE-2008-7255](https://cve.now/CVE-2008-7255.md): login\_screen.tcl in aMSN (aka Alvaro's Messenger) before 0.97.1 saves a password after logout, which allows physically proximate attackers t (no CVSS)
- [CVE-2010-0996](https://cve.now/CVE-2010-0996.md): Unrestricted file upload vulnerability in e107 before 0.7.20 allows remote authenticated users to execute arbitrary code by uploading a .php (no CVSS)
- [CVE-2010-0997](https://cve.now/CVE-2010-0997.md): Cross-site scripting (XSS) vulnerability in 107\_plugins/content/content\_manager.php in the Content Management plugin in e107 before 0.7.20, (no CVSS)
- [CVE-2010-1151](https://cve.now/CVE-2010-1151.md): Race condition in the mod\_auth\_shadow module for the Apache HTTP Server allows remote attackers to bypass authentication, and read and possi (no CVSS)
- [CVE-2010-1458](https://cve.now/CVE-2010-1458.md): Stack-based buffer overflow in Create and Extract Zips TweakFS Zip Utility 1.0 for Flight Simulator X (FSX) allows remote attackers to execu (no CVSS)
- [CVE-2010-1489](https://cve.now/CVE-2010-1489.md): The XSS Filter in Microsoft Internet Explorer 8 does not properly perform neutering for the SCRIPT tag, which allows remote attackers to con (no CVSS)
- [CVE-2010-0744](https://cve.now/CVE-2010-0744.md): aMSN (aka Alvaro's Messenger) 0.98.3 and earlier, when SSL is used, does not verify that the server hostname matches a domain name in the su (no CVSS)
- [CVE-2010-1150](https://cve.now/CVE-2010-1150.md): MediaWiki before 1.15.3, and 1.6.x before 1.16.0beta2, does not properly handle a correctly authenticated but unintended login attempt, whic (no CVSS)
- [CVE-2010-1158](https://cve.now/CVE-2010-1158.md): Integer overflow in the regular expression engine in Perl 5.8.x allows context-dependent attackers to cause a denial of service (stack consu (no CVSS)
- [CVE-2010-1162](https://cve.now/CVE-2010-1162.md): The release\_one\_tty function in drivers/char/tty\_io.c in the Linux kernel before 2.6.34-rc4 omits certain required calls to the put\_pid func (no CVSS)
- [CVE-2010-1164](https://cve.now/CVE-2010-1164.md): Multiple cross-site scripting (XSS) vulnerabilities in Atlassian JIRA 3.12 through 4.1 allow remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2010-1165](https://cve.now/CVE-2010-1165.md): Atlassian JIRA 3.12 through 4.1 allows remote authenticated administrators to execute arbitrary code by modifying the (1) attachment (aka at (no CVSS)
- [CVE-2010-1317](https://cve.now/CVE-2010-1317.md): Heap-based buffer overflow in the NTLM authentication functionality in RealNetworks Helix Server and Helix Mobile Server 11.x, 12.x, and 13. (no CVSS)
- [CVE-2010-1318](https://cve.now/CVE-2010-1318.md): Stack-based buffer overflow in the AgentX::receive\_agentx function in AgentX++ 1.4.16, as used in RealNetworks Helix Server and Helix Mobile (no CVSS)
- [CVE-2010-1319](https://cve.now/CVE-2010-1319.md): Integer overflow in the AgentX::receive\_agentx function in AgentX++ 1.4.16, as used in RealNetworks Helix Server and Helix Mobile Server 11. (no CVSS)
- [CVE-2010-1487](https://cve.now/CVE-2010-1487.md): IBM Lotus Notes 7.0, 8.0, and 8.5 stores administrative credentials in cleartext in SURunAs.exe, which allows local users to obtain sensitiv (no CVSS)
- [CVE-2010-1488](https://cve.now/CVE-2010-1488.md): The proc\_oom\_score function in fs/proc/base.c in the Linux kernel before 2.6.34-rc4 uses inappropriate data structures during selection of a (no CVSS)
- [CVE-2009-4767](https://cve.now/CVE-2009-4767.md): Multiple cross-site scripting (XSS) vulnerabilities in index.php in Plohni Shoutbox 1.0 allow remote attackers to inject arbitrary web scrip (no CVSS)
- [CVE-2009-4768](https://cve.now/CVE-2009-4768.md): Unspecified vulnerability in the JASS script interpreter in Warcraft III: The Frozen Throne 1.24b and earlier allows user-assisted remote at (no CVSS)
- [CVE-2009-4769](https://cve.now/CVE-2009-4769.md): Multiple format string vulnerabilities in the tolog function in httpdx 1.4, 1.4.5, 1.4.6, 1.4.6b, and 1.5 allow (1) remote attackers to exec (no CVSS)
- [CVE-2009-4770](https://cve.now/CVE-2009-4770.md): The FTP server component in httpdx 1.4, 1.4.5, 1.4.6, 1.4.6b, and 1.5 has a default password of pass123 for the moderator account, which mak (no CVSS)
- [CVE-2009-4771](https://cve.now/CVE-2009-4771.md): The PayPal Website Payments Standard functionality in the Ubercart module 5.x before 5.x-1.9 and 6.x before 6.x-2.1 for Drupal does not prop (no CVSS)
- [CVE-2009-4772](https://cve.now/CVE-2009-4772.md): Unspecified vulnerability in the PayPal Website Payments Standard functionality in the Ubercart module 5.x before 5.x-1.9 and 6.x before 6.x (no CVSS)
- [CVE-2009-4773](https://cve.now/CVE-2009-4773.md): Cross-site request forgery (CSRF) vulnerability in the order-management functionality in the Ubercart module 5.x before 5.x-1.9 and 6.x befo (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2010-04-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.