# CVEs published 2010-07-22

34 CVEs were published on July 22, 2010: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2009-4946](https://cve.now/CVE-2009-4946.md): Directory traversal vulnerability in the Messaging (com\_messaging) component before 1.5.1 for Joomla! allows remote attackers to include and (no CVSS)
- [CVE-2009-4947](https://cve.now/CVE-2009-4947.md): SQL injection vulnerability in frmLoginPwdReminderPopup.aspx in Q2 Solutions ConnX 4.0.20080606 allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2009-4948](https://cve.now/CVE-2009-4948.md): Cross-site scripting (XSS) vulnerability in the Store Locator extension before 1.2.8 for TYPO3 allows remote attackers to inject arbitrary w (no CVSS)
- [CVE-2009-4949](https://cve.now/CVE-2009-4949.md): SQL injection vulnerability in the Store Locator extension before 1.2.8 for TYPO3 allows remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2009-4950](https://cve.now/CVE-2009-4950.md): SQL injection vulnerability in the A21glossary Advanced Output (a21glossary\_advanced\_output) extension before 0.1.12 for TYPO3 allows remote (no CVSS)
- [CVE-2009-4951](https://cve.now/CVE-2009-4951.md): Unspecified vulnerability in the ClickStream Analyzer \[output\] (alternet\_csa\_out) extension 0.3.0 and earlier for TYPO3 allows remote attack (no CVSS)
- [CVE-2009-4952](https://cve.now/CVE-2009-4952.md): Directory traversal vulnerability in the Directory Listing (dir\_listing) extension 1.1.0 and earlier for TYPO3 allows remote attackers to ha (no CVSS)
- [CVE-2009-4953](https://cve.now/CVE-2009-4953.md): Cross-site scripting (XSS) vulnerability in the Userdata Create/Edit (sg\_userdata) extension before 0.91.0 for TYPO3 allows remote attackers (no CVSS)
- [CVE-2009-4954](https://cve.now/CVE-2009-4954.md): SQL injection vulnerability in the Versatile Calendar Extension \[VCE\] (sk\_calendar) extension before 0.3.4 for TYPO3 allows remote attackers (no CVSS)
- [CVE-2009-4955](https://cve.now/CVE-2009-4955.md): SQL injection vulnerability in the ultraCards (th\_ultracards) extension before 0.5.1 for TYPO3 allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2009-4956](https://cve.now/CVE-2009-4956.md): Cross-site scripting (XSS) vulnerability in the Visitor Tracking (ws\_stats) extension before 0.1.2 for TYPO3 allows remote attackers to inje (no CVSS)
- [CVE-2009-4957](https://cve.now/CVE-2009-4957.md): Directory traversal vulnerability in loadpanel.php in Interspire ActiveKB allows remote attackers to read arbitrary files and possibly have (no CVSS)
- [CVE-2009-4936](https://cve.now/CVE-2009-4936.md): Multiple SQL injection vulnerabilities in Small Pirate (SPirate) 2.1 allow remote attackers to execute arbitrary SQL commands via (1) the id (no CVSS)
- [CVE-2009-4937](https://cve.now/CVE-2009-4937.md): Cross-site scripting (XSS) vulnerability in Small Pirate (SPirate) 2.1 allows remote attackers to inject arbitrary web script or HTML via an (no CVSS)
- [CVE-2009-4938](https://cve.now/CVE-2009-4938.md): SQL injection vulnerability in the JVideo! (com\_jvideo) component 0.3.11c Beta and 0.3.x for Joomla! allows remote attackers to execute arbi (no CVSS)
- [CVE-2009-4939](https://cve.now/CVE-2009-4939.md): Multiple cross-site scripting (XSS) vulnerabilities in index.php in AdPeeps 8.5d1 allow remote attackers to inject arbitrary web script or H (no CVSS)
- [CVE-2009-4940](https://cve.now/CVE-2009-4940.md): SQL injection vulnerability in index.php in Zeus Cart 2.3 and earlier allows remote attackers to execute arbitrary SQL commands via the main (no CVSS)
- [CVE-2009-4941](https://cve.now/CVE-2009-4941.md): Cross-site scripting (XSS) vulnerability in sign\_in.php in ATRC ACollab 1.2 allows remote attackers to inject arbitrary web script or HTML v (no CVSS)
- [CVE-2009-4942](https://cve.now/CVE-2009-4942.md): Cross-site request forgery (CSRF) vulnerability in ACollab 1.2 allows remote attackers to hijack the authentication of arbitrary users for r (no CVSS)
- [CVE-2009-4943](https://cve.now/CVE-2009-4943.md): index.php in AdPeeps 8.5d1 allows remote attackers to obtain sensitive information via (1) a view\_adrates action with an invalid uid paramet (no CVSS)
- [CVE-2009-4944](https://cve.now/CVE-2009-4944.md): Multiple cross-site scripting (XSS) vulnerabilities in ATRC ACollab 1.2 allow remote attackers to inject arbitrary web script or HTML via th (no CVSS)
- [CVE-2009-4945](https://cve.now/CVE-2009-4945.md): AdPeeps 8.5d1 has a default password of admin for the admin account, which makes it easier for remote attackers to obtain access via request (no CVSS)
- [CVE-2010-2568](https://cve.now/CVE-2010-2568.md): Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or r (CVSS 7.8, KEV)
- [CVE-2010-2772](https://cve.now/CVE-2010-2772.md): Siemens Simatic WinCC and PCS 7 SCADA system uses a hard-coded password, which allows local users to access a back-end database and gain pri (no CVSS)
- [CVE-2009-4897](https://cve.now/CVE-2009-4897.md): Buffer overflow in gs/psi/iscan.c in Ghostscript 8.64 and earlier allows remote attackers to execute arbitrary code or cause a denial of ser (no CVSS)
- [CVE-2010-1766](https://cve.now/CVE-2010-1766.md): Off-by-one error in the WebSocketHandshake::readServerHandshake function in websockets/WebSocketHandshake.cpp in WebCore in WebKit before r5 (no CVSS)
- [CVE-2010-1969](https://cve.now/CVE-2010-1969.md): Cross-site scripting (XSS) vulnerability in HP Virtual Connect Enterprise Manager for Windows before 6.1 allows remote attackers to inject a (no CVSS)
- [CVE-2010-1972](https://cve.now/CVE-2010-1972.md): The default configuration of HP Client Automation (HPCA) Enterprise Infrastructure (aka Radia) allows remote attackers to read log files, an (no CVSS)
- [CVE-2010-1973](https://cve.now/CVE-2010-1973.md): Unspecified vulnerability in the Auditing subsystem in HP OpenVMS 8.3, 8.2, 7.3-2, and earlier on the ALPHA platform, and 8.3-1H1, 8.3, 8.2- (no CVSS)
- [CVE-2010-2055](https://cve.now/CVE-2010-2055.md): Ghostscript 8.71 and earlier reads initialization files from the current working directory, which allows local users to execute arbitrary Po (no CVSS)
- [CVE-2010-2056](https://cve.now/CVE-2010-2056.md): GNU gv before 3.7.0 allows local users to overwrite arbitrary files via a symlink attack on a temporary file. (no CVSS)
- [CVE-2010-2427](https://cve.now/CVE-2010-2427.md): VMware Studio 2.0 does not properly write to temporary files, which allows local users to gain privileges via unspecified vectors. (no CVSS)
- [CVE-2010-2667](https://cve.now/CVE-2010-2667.md): Multiple unspecified vulnerabilities in the Virtual Appliance Management Infrastructure (VAMI) in VMware Studio 2.0 allow remote authenticat (no CVSS)
- [CVE-2010-2771](https://cve.now/CVE-2010-2771.md): solid.exe in IBM solidDB before 6.5 FP2 allows remote attackers to execute arbitrary code via a long username field in the first handshake p (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2010-07-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.