# CVEs published 2010-07-06 26 CVEs were published on July 6, 2010: 0 critical, 0 high. Days are UTC. - [CVE-2010-1667](https://cve.now/CVE-2010-1667.md): Multiple cross-site scripting (XSS) vulnerabilities in Mahara before 1.0.15, 1.1.x before 1.1.9, and 1.2.x before 1.2.5 allow remote attacke (no CVSS) - [CVE-2010-1668](https://cve.now/CVE-2010-1668.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Mahara before 1.0.15, 1.1.x before 1.1.9, and 1.2.x before 1.2.5 allow remote (no CVSS) - [CVE-2010-1669](https://cve.now/CVE-2010-1669.md): SQL injection vulnerability in Mahara 1.1.x before 1.1.9 and 1.2.x before 1.2.5 allows remote attackers to execute arbitrary SQL commands vi (no CVSS) - [CVE-2010-1670](https://cve.now/CVE-2010-1670.md): Mahara before 1.0.15, 1.1.x before 1.1.9, and 1.2.x before 1.2.5 has improper configuration options for authentication plugins associated wi (no CVSS) - [CVE-2010-2479](https://cve.now/CVE-2010-2479.md): Cross-site scripting (XSS) vulnerability in HTML Purifier before 4.1.1, as used in Mahara and other products, when the browser is Internet E (no CVSS, ezyang/htmlpurifier) - [CVE-2010-2645](https://cve.now/CVE-2010-2645.md): Unspecified vulnerability in Google Chrome before 5.0.375.99, when WebGL is used, allows remote attackers to cause a denial of service (out- (no CVSS) - [CVE-2010-2646](https://cve.now/CVE-2010-2646.md): Google Chrome before 5.0.375.99 does not properly isolate sandboxed IFRAME elements, which has unspecified impact and remote attack vectors. (no CVSS) - [CVE-2010-2647](https://cve.now/CVE-2010-2647.md): Google Chrome before 5.0.375.99 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other (no CVSS) - [CVE-2010-2648](https://cve.now/CVE-2010-2648.md): The implementation of the Unicode Bidirectional Algorithm (aka Bidi algorithm or UBA) in Google Chrome before 5.0.375.99 allows remote attac (no CVSS) - [CVE-2010-2649](https://cve.now/CVE-2010-2649.md): Unspecified vulnerability in Google Chrome before 5.0.375.99 allows remote attackers to cause a denial of service (application crash) via an (no CVSS) - [CVE-2010-2650](https://cve.now/CVE-2010-2650.md): Unspecified vulnerability in Google Chrome before 5.0.375.99 has unknown impact and attack vectors, related to an "annoyance with print dial (no CVSS) - [CVE-2010-2651](https://cve.now/CVE-2010-2651.md): The Cascading Style Sheets (CSS) implementation in Google Chrome before 5.0.375.99 does not properly perform style rendering, which allows r (no CVSS) - [CVE-2010-2652](https://cve.now/CVE-2010-2652.md): Google Chrome before 5.0.375.99 does not properly implement modal dialogs, which allows attackers to cause a denial of service (application (no CVSS) - [CVE-2010-2630](https://cve.now/CVE-2010-2630.md): The TIFFReadDirectory function in LibTIFF 3.9.0 does not properly validate the data types of codec-specific tags that have an out-of-order p (no CVSS) - [CVE-2010-2631](https://cve.now/CVE-2010-2631.md): LibTIFF 3.9.0 ignores tags in certain situations during the first stage of TIFF file processing and does not properly handle this during the (no CVSS) - [CVE-2010-1327](https://cve.now/CVE-2010-1327.md): Multiple SQL injection vulnerabilities in TornadoStore 1.4.3 and earlier allow remote attackers to execute arbitrary SQL commands via (1) th (no CVSS) - [CVE-2010-1328](https://cve.now/CVE-2010-1328.md): Multiple cross-site scripting (XSS) vulnerabilities in TornadoStore 1.4.3 and earlier allow remote attackers to inject arbitrary web script (no CVSS) - [CVE-2010-1575](https://cve.now/CVE-2010-1575.md): The Cisco Content Services Switch (CSS) 11500 with software 08.20.1.01 conveys authentication data through ClientCert-\* headers but does not (no CVSS) - [CVE-2010-1576](https://cve.now/CVE-2010-1576.md): The Cisco Content Services Switch (CSS) 11500 with software before 8.20.4.02 and the Application Control Engine (ACE) 4710 with software bef (no CVSS) - [CVE-2010-2251](https://cve.now/CVE-2010-2251.md): The get1 command, as used by lftpget, in LFTP before 4.0.6 does not properly validate a server-provided filename before determining the dest (no CVSS) - [CVE-2010-2252](https://cve.now/CVE-2010-2252.md): GNU Wget 1.12 and earlier uses a server-provided filename instead of the original URL to determine the destination filename of a download, w (no CVSS) - [CVE-2010-2253](https://cve.now/CVE-2010-2253.md): lwp-download in libwww-perl before 5.835 does not reject downloads to filenames that begin with a . (no CVSS) - [CVE-2010-2481](https://cve.now/CVE-2010-2481.md): The TIFFExtractData macro in LibTIFF before 3.9.4 does not properly handle unknown tag types in TIFF directory entries, which allows remote (no CVSS) - [CVE-2010-2482](https://cve.now/CVE-2010-2482.md): LibTIFF 3.9.4 and earlier does not properly handle an invalid td\_stripbytecount field, which allows remote attackers to cause a denial of se (no CVSS) - [CVE-2010-2483](https://cve.now/CVE-2010-2483.md): The TIFFRGBAImageGet function in LibTIFF 3.9.0 allows remote attackers to cause a denial of service (out-of-bounds read and application cras (no CVSS) - [CVE-2010-2629](https://cve.now/CVE-2010-2629.md): The Cisco Content Services Switch (CSS) 11500 with software 8.20.4.02 and the Application Control Engine (ACE) 4710 with software A2(3.0) do (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2010-07-06 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.