# CVEs published 2010-05-05 23 CVEs were published on May 5, 2010: 0 critical, 0 high. Days are UTC. - [CVE-2009-4835](https://cve.now/CVE-2009-4835.md): The (1) htk\_read\_header, (2) alaw\_init, (3) ulaw\_init, (4) pcm\_init, (5) float32\_init, and (6) sds\_read\_header functions in libsndfile 1.0.2 (no CVSS) - [CVE-2009-4836](https://cve.now/CVE-2009-4836.md): Eval injection vulnerability in system/services/init.php in Movie PHP Script 2.0 allows remote attackers to execute arbitrary PHP code via t (no CVSS) - [CVE-2009-4837](https://cve.now/CVE-2009-4837.md): Multiple cross-site scripting (XSS) vulnerabilities in Basic Analysis and Security Engine (BASE) before 1.4.3.1 allow remote attackers to in (no CVSS) - [CVE-2009-4838](https://cve.now/CVE-2009-4838.md): SQL injection vulnerability in base\_ag\_common.php in Basic Analysis and Security Engine (BASE) before 1.4.3.1 allows remote attackers to exe (no CVSS) - [CVE-2009-4839](https://cve.now/CVE-2009-4839.md): Multiple cross-site scripting (XSS) vulnerabilities in Basic Analysis and Security Engine (BASE), possibly 1.4.4 and earlier, allow remote a (no CVSS) - [CVE-2009-4840](https://cve.now/CVE-2009-4840.md): Heap-based buffer overflow in the IAManager ActiveX control in IAManager.dll in Roxio CinePlayer 3.2 allows remote attackers to execute arbi (no CVSS) - [CVE-2009-4841](https://cve.now/CVE-2009-4841.md): Heap-based buffer overflow in the SonicMediaPlayer ActiveX control in SonicMediaPlayer.dll in Roxio CinePlayer 3.2 allows remote attackers t (no CVSS) - [CVE-2010-1583](https://cve.now/CVE-2010-1583.md): SQL injection vulnerability in the loadByKey function in the TznDbConnection class in tzn\_mysql.php in Tirzen (aka TZN) Framework 1.5, as us (no CVSS) - [CVE-2010-1681](https://cve.now/CVE-2010-1681.md): Buffer overflow in VISIODWG.DLL before 10.0.6880.4 in Microsoft Office Visio allows user-assisted remote attackers to execute arbitrary code (no CVSS) - [CVE-2010-1732](https://cve.now/CVE-2010-1732.md): Cross-site request forgery (CSRF) vulnerability in the users module in Zikula Application Framework before 1.2.3 allows remote attackers to (no CVSS) - [CVE-2010-1733](https://cve.now/CVE-2010-1733.md): Multiple SQL injection vulnerabilities in OCS Inventory NG before 1.02.3 allow remote attackers to execute arbitrary SQL commands via (1) mu (no CVSS) - [CVE-2010-1734](https://cve.now/CVE-2010-1734.md): The SfnINSTRING function in win32k.sys in the kernel in Microsoft Windows 2000, XP, and Server 2003 allows local users to cause a denial of (no CVSS) - [CVE-2010-1735](https://cve.now/CVE-2010-1735.md): The SfnLOGONNOTIFY function in win32k.sys in the kernel in Microsoft Windows 2000, XP, and Server 2003 allows local users to cause a denial (no CVSS) - [CVE-2010-0995](https://cve.now/CVE-2010-0995.md): Stack-based buffer overflow in Internet Download Manager (IDM) before 5.19 allows remote attackers to execute arbitrary code via a crafted F (no CVSS) - [CVE-2010-1438](https://cve.now/CVE-2010-1438.md): Web Application Finger Printer (WAFP) 0.01-26c3 uses fixed pathnames under /tmp for temporary files and directories, which (1) allows local (no CVSS) - [CVE-2010-1724](https://cve.now/CVE-2010-1724.md): Multiple cross-site scripting (XSS) vulnerabilities in Zikula Application Framework 1.2.2, and possibly earlier, allow remote attackers to i (no CVSS) - [CVE-2010-1725](https://cve.now/CVE-2010-1725.md): SQL injection vulnerability in offers\_buy.php in Alibaba Clone Platinum allows remote attackers to execute arbitrary SQL commands via the id (no CVSS) - [CVE-2010-1726](https://cve.now/CVE-2010-1726.md): SQL injection vulnerability in offers\_buy.php in EC21 Clone 3.0 allows remote attackers to execute arbitrary SQL commands via the id paramet (no CVSS) - [CVE-2010-1727](https://cve.now/CVE-2010-1727.md): SQL injection vulnerability in type.asp in JobPost 1.0 allows remote attackers to execute arbitrary SQL commands via the iType parameter. (no CVSS) - [CVE-2010-1728](https://cve.now/CVE-2010-1728.md): Opera before 10.53 on Windows and Mac OS X does not properly handle a series of document modifications that occur asynchronously, which allo (no CVSS) - [CVE-2010-1729](https://cve.now/CVE-2010-1729.md): WebKit.dll in WebKit, as used in Safari.exe 4.531.9.1 in Apple Safari, allows remote attackers to cause a denial of service (application cra (no CVSS) - [CVE-2010-1730](https://cve.now/CVE-2010-1730.md): Dolphin Browser 2.5.0 on the HTC Hero allows remote attackers to cause a denial of service (application crash) via JavaScript that writes \ (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2010-05-05 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.