# CVEs published 2010-05-20 24 CVEs were published on May 20, 2010: 0 critical, 0 high. Days are UTC. - [CVE-2010-2004](https://cve.now/CVE-2010-2004.md): Stack-based buffer overflow in BS.Global BS.Player 2.51 Build 1022 Free, and possibly other versions, allows user-assisted remote attackers (no CVSS) - [CVE-2010-2005](https://cve.now/CVE-2010-2005.md): Multiple PHP remote file inclusion vulnerabilities in DataLife Engine (DLE) 8.3 allow remote attackers to execute arbitrary PHP code via a U (no CVSS) - [CVE-2010-2006](https://cve.now/CVE-2010-2006.md): Directory traversal vulnerability in op/op.Login.php in LetoDMS (formerly MyDMS) 1.7.2 and earlier allows remote authenticated users to incl (no CVSS) - [CVE-2010-2007](https://cve.now/CVE-2010-2007.md): Multiple cross-site request forgery (CSRF) vulnerabilities in LetoDMS (formerly MyDMS) 1.7.2 and earlier allow remote attackers to hijack th (no CVSS) - [CVE-2010-0745](https://cve.now/CVE-2010-0745.md): Unspecified vulnerability in Dovecot 1.2.x before 1.2.11 allows remote attackers to cause a denial of service (CPU consumption) via long hea (no CVSS) - [CVE-2010-1039](https://cve.now/CVE-2010-1039.md): Format string vulnerability in the \_msgout function in rpc.pcnfsd in IBM AIX 6.1, 5.3, and earlier; IBM VIOS 2.1, 1.5, and earlier; NFS/ONCp (no CVSS) - [CVE-2010-1986](https://cve.now/CVE-2010-1986.md): Mozilla Firefox 3.6.3 on Windows XP SP3 allows remote attackers to cause a denial of service (memory consumption and application crash) via (no CVSS) - [CVE-2010-1987](https://cve.now/CVE-2010-1987.md): Mozilla Firefox 3.6.3 on Windows XP SP3 allows remote attackers to cause a denial of service (memory consumption, out-of-bounds read, and ap (no CVSS) - [CVE-2010-1988](https://cve.now/CVE-2010-1988.md): Mozilla Firefox 3.6.3 on Windows XP SP3 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash (no CVSS) - [CVE-2010-1989](https://cve.now/CVE-2010-1989.md): Opera 9.52 executes a mail application in situations where an IMG element has a SRC attribute that is a redirect to a mailto: URL, which all (no CVSS) - [CVE-2010-1990](https://cve.now/CVE-2010-1990.md): Mozilla Firefox 3.6.x, 3.5.x, 3.0.19, and earlier, and SeaMonkey, executes a mail application in situations where an IFRAME element has a ma (no CVSS) - [CVE-2010-1991](https://cve.now/CVE-2010-1991.md): Microsoft Internet Explorer 6.0.2900.2180, 7, and 8.0.7600.16385 executes a mail application in situations where an IFRAME element has a mai (no CVSS) - [CVE-2010-1992](https://cve.now/CVE-2010-1992.md): Google Chrome 1.0.154.48 executes a mail application in situations where an IFRAME element has a mailto: URL in its SRC attribute, which all (no CVSS) - [CVE-2010-1993](https://cve.now/CVE-2010-1993.md): Opera 9.52 does not properly handle an IFRAME element with a mailto: URL in its SRC attribute, which allows remote attackers to cause a deni (no CVSS) - [CVE-2010-1994](https://cve.now/CVE-2010-1994.md): SQL injection vulnerability in index.php in TomatoCMS before 2.0.5 allows remote attackers to execute arbitrary SQL commands via the q param (no CVSS) - [CVE-2010-1995](https://cve.now/CVE-2010-1995.md): Multiple cross-site scripting (XSS) vulnerabilities in index.php in TomatoCMS before 2.0.5 allow remote authenticated users, with "Add new a (no CVSS) - [CVE-2010-1996](https://cve.now/CVE-2010-1996.md): Multiple cross-site scripting (XSS) vulnerabilities in index.php in TomatoCMS before 2.0.5 allow remote authenticated users, with certain cr (no CVSS) - [CVE-2010-1997](https://cve.now/CVE-2010-1997.md): Cross-site scripting (XSS) vulnerability in admin/edit.php in Saurus CMS 4.7.0 allows remote authenticated users, with "Article list" edit p (no CVSS) - [CVE-2010-1998](https://cve.now/CVE-2010-1998.md): Cross-site scripting (XSS) vulnerability in the CCK TableField module 6.x before 6.x-1.2 for Drupal allows remote authenticated users, with (no CVSS) - [CVE-2010-1999](https://cve.now/CVE-2010-1999.md): Directory traversal vulnerability in scr/soustab.php in OpenMairie Opencatalogue 1.024, when register\_globals is enabled, allows remote atta (no CVSS) - [CVE-2010-2000](https://cve.now/CVE-2010-2000.md): Cross-site scripting (XSS) vulnerability in the Bibliography (Biblio) module 5.x through 5.x-1.17 and 6.x through 6.x-1.9 for Drupal allows (no CVSS) - [CVE-2010-2001](https://cve.now/CVE-2010-2001.md): Cross-site scripting (XSS) vulnerability in the CiviRegister module before 6.x-1.1 for Drupal allows remote attackers to inject arbitrary we (no CVSS) - [CVE-2010-2002](https://cve.now/CVE-2010-2002.md): Cross-site scripting (XSS) vulnerability in the Wordfilter module 5.x before 5.x-1.1 and 6.x before 6.x-1.1 for Drupal allows remote authent (no CVSS) - [CVE-2010-2003](https://cve.now/CVE-2010-2003.md): Cross-site scripting (XSS) vulnerability in misc/get\_admin.php in Advanced Poll 2.08 allows remote attackers to inject arbitrary web script (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2010-05-20 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.