# CVEs published 2010-04-29 28 CVEs were published on April 29, 2010: 0 critical, 0 high. Days are UTC. - [CVE-2010-0817](https://cve.now/CVE-2010-0817.md): Cross-site scripting (XSS) vulnerability in \_layouts/help.aspx in Microsoft SharePoint Server 2007 12.0.0.6421 and possibly earlier, and Sha (no CVSS) - [CVE-2010-1166](https://cve.now/CVE-2010-1166.md): The fbComposite function in fbpict.c in the Render extension in the X server in X.Org X11R7.1 allows remote authenticated users to cause a d (no CVSS) - [CVE-2010-1613](https://cve.now/CVE-2010-1613.md): Moodle 1.8.x and 1.9.x before 1.9.8 does not enable the "Regenerate session id during login" setting by default, which makes it easier for r (no CVSS, moodle/moodle) - [CVE-2010-1614](https://cve.now/CVE-2010-1614.md): Multiple cross-site scripting (XSS) vulnerabilities in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 allow remote attackers to inject ar (no CVSS, moodle/moodle) - [CVE-2010-1615](https://cve.now/CVE-2010-1615.md): Multiple SQL injection vulnerabilities in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 allow remote attackers to execute arbitrary SQL (no CVSS, moodle/moodle) - [CVE-2010-1616](https://cve.now/CVE-2010-1616.md): Moodle 1.8.x and 1.9.x before 1.9.8 can create new roles when restoring a course, which allows teachers to create new accounts even if they (no CVSS, moodle/moodle) - [CVE-2010-1617](https://cve.now/CVE-2010-1617.md): user/view.php in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 does not properly check a role, which allows remote authenticated users t (no CVSS, moodle/moodle) - [CVE-2010-1618](https://cve.now/CVE-2010-1618.md): Cross-site scripting (XSS) vulnerability in the phpCAS client library before 1.1.0, as used in Moodle 1.8.x before 1.8.12 and 1.9.x before 1 (no CVSS, apereo/phpcas ยท moodle/moodle) - [CVE-2010-1619](https://cve.now/CVE-2010-1619.md): Cross-site scripting (XSS) vulnerability in the fix\_non\_standard\_entities function in the KSES HTML text cleaning library (weblib.php), as u (no CVSS, moodle/moodle) - [CVE-2009-4831](https://cve.now/CVE-2009-4831.md): Cerulean Studios Trillian 3.1 Basic does not check SSL certificates during MSN authentication, which allows remote attackers to obtain MSN c (no CVSS) - [CVE-2009-4832](https://cve.now/CVE-2009-4832.md): The dlpcrypt.sys kernel driver 0.1.1.27 in DESlock+ 4.0.2 allows local users to gain privileges via a crafted IOCTL 0x80012010 request to th (no CVSS) - [CVE-2009-4833](https://cve.now/CVE-2009-4833.md): MySQL Connector/NET before 6.0.4, when using encryption, does not verify SSL certificates during connection, which allows remote attackers t (no CVSS) - [CVE-2010-1610](https://cve.now/CVE-2010-1610.md): Cross-site request forgery (CSRF) vulnerability in index.php in OpenCart 1.4 allows remote attackers to hijack the authentication of an appl (no CVSS) - [CVE-2010-1611](https://cve.now/CVE-2010-1611.md): Cross-site request forgery (CSRF) vulnerability in AlegroCart 1.1 allows remote attackers to hijack the authentication of the administrator (no CVSS) - [CVE-2010-1612](https://cve.now/CVE-2010-1612.md): The IBM WebSphere DataPower XML Accelerator XA35, Low Latency Appliance XM70, Integration Appliance XI50, B2B Appliance XB60, and XML Securi (no CVSS) - [CVE-2010-1599](https://cve.now/CVE-2010-1599.md): SQL injection vulnerability in loadorder.php in NKInFoWeb 2.5 and 5.2.2.0 allows remote attackers to execute arbitrary SQL commands via the (no CVSS) - [CVE-2010-1600](https://cve.now/CVE-2010-1600.md): SQL injection vulnerability in the Media Mall Factory (com\_mediamall) component 1.0.4 for Joomla! allows remote attackers to execute arbitra (no CVSS) - [CVE-2010-1601](https://cve.now/CVE-2010-1601.md): Directory traversal vulnerability in the JA Comment (com\_jacomment) component for Joomla! allows remote attackers to read arbitrary files vi (no CVSS) - [CVE-2010-1602](https://cve.now/CVE-2010-1602.md): Directory traversal vulnerability in the ZiMB Comment (com\_zimbcomment) component 0.8.1 for Joomla! allows remote attackers to read arbitrar (no CVSS) - [CVE-2010-1603](https://cve.now/CVE-2010-1603.md): Directory traversal vulnerability in the ZiMB Core (aka ZiMBCore or com\_zimbcore) component 0.1 in the ZiMB Manager collection for Joomla! a (no CVSS) - [CVE-2010-1604](https://cve.now/CVE-2010-1604.md): Multiple SQL injection vulnerabilities in admin\_login.php in NCT Jobs Portal Script allow remote attackers to execute arbitrary SQL commands (no CVSS) - [CVE-2010-1605](https://cve.now/CVE-2010-1605.md): Multiple SQL injection vulnerabilities in isearch.php in NCT Jobs Portal Script allow remote attackers to execute arbitrary SQL commands via (no CVSS) - [CVE-2010-1606](https://cve.now/CVE-2010-1606.md): Multiple cross-site scripting (XSS) vulnerabilities in NCT Jobs Portal Script allow remote attackers to inject arbitrary web script or HTML (no CVSS) - [CVE-2010-1607](https://cve.now/CVE-2010-1607.md): Directory traversal vulnerability in wmi.php in the Webmoney Web Merchant Interface (aka WMI or com\_wmi) component 1.5.0 for Joomla! allows (no CVSS) - [CVE-2010-1608](https://cve.now/CVE-2010-1608.md): Stack-based buffer overflow in IBM Lotus Notes 8.5 and 8.5fp1, and possibly other versions, allows remote attackers to execute arbitrary cod (no CVSS) - [CVE-2010-1609](https://cve.now/CVE-2010-1609.md): Cross-site scripting (XSS) vulnerability in SAP NetWeaver 2004 before SP21 and 2004s before SP13 allows remote attackers to inject arbitrary (no CVSS) - [CVE-2010-1597](https://cve.now/CVE-2010-1597.md): Stack-based buffer overflow in zgtips.dll in ZipGenius 6.3.1.2552 allows user-assisted remote attackers to execute arbitrary code via a ZIP (no CVSS) - [CVE-2010-1598](https://cve.now/CVE-2010-1598.md): phpThumb.php in phpThumb() 1.7.9 and possibly other versions, when ImageMagick is installed, allows remote attackers to execute arbitrary co (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2010-04-29 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.