# CVEs published 2010-09-24

23 CVEs were published on September 24, 2010: 0 critical, 0 high. Days are UTC.

- [CVE-2010-3601](https://cve.now/CVE-2010-3601.md): SQL injection vulnerability in index.php in ibPhotohost 1.1.2 allows remote attackers to execute arbitrary SQL commands via the img paramete (no CVSS)
- [CVE-2010-3602](https://cve.now/CVE-2010-3602.md): Cross-site scripting (XSS) vulnerability in ProfileView.aspx in mojoPortal 2.3.4.3 and 2.3.5.1 allows remote attackers to inject arbitrary w (no CVSS)
- [CVE-2010-3603](https://cve.now/CVE-2010-3603.md): Cross-site request forgery (CSRF) vulnerability in the file manager service (Services/FileService.ashx) in mojoPortal 2.3.4.3 and 2.3.5.1 al (no CVSS)
- [CVE-2010-3604](https://cve.now/CVE-2010-3604.md): SQL injection vulnerability in the powermail extension 1.5.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands (no CVSS, in2code/powermail)
- [CVE-2010-3605](https://cve.now/CVE-2010-3605.md): Cross-site scripting (XSS) vulnerability in the powermail extension 1.5.3 and earlier for TYPO3 allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2010-3606](https://cve.now/CVE-2010-3606.md): Multiple directory traversal vulnerabilities in AGENTS/index.php in NetArt MEDIA Real Estate Portal 2.0 allow remote emote attackers to incl (no CVSS)
- [CVE-2010-3607](https://cve.now/CVE-2010-3607.md): Cross-site scripting (XSS) vulnerability in AGENTS/index.php in NetArt MEDIA Real Estate Portal 2.0 allows remote authenticated users to inj (no CVSS)
- [CVE-2010-3608](https://cve.now/CVE-2010-3608.md): Multiple SQL injection vulnerabilities in wpQuiz 2.7 allow remote attackers to execute arbitrary SQL commands via the (1) id and (2) passwor (no CVSS)
- [CVE-2010-3081](https://cve.now/CVE-2010-3081.md): The compat\_alloc\_user\_space functions in include/asm/compat.h files in the Linux kernel before 2.6.36-rc4-git2 on 64-bit platforms do not pr (no CVSS)
- [CVE-2010-1767](https://cve.now/CVE-2010-1767.md): Cross-site request forgery (CSRF) vulnerability in loader/DocumentThreadableLoader.cpp in WebCore in WebKit before r57041, as used in Google (no CVSS)
- [CVE-2010-1772](https://cve.now/CVE-2010-1772.md): Use-after-free vulnerability in page/Geolocation.cpp in WebCore in WebKit before r59859, as used in Google Chrome before 5.0.375.70, allows (no CVSS)
- [CVE-2010-1773](https://cve.now/CVE-2010-1773.md): Off-by-one error in the toAlphabetic function in rendering/RenderListMarker.cpp in WebCore in WebKit before r59950, as used in Google Chrome (no CVSS)
- [CVE-2010-1823](https://cve.now/CVE-2010-1823.md): Use-after-free vulnerability in WebKit before r65958, as used in Google Chrome before 6.0.472.59, allows remote attackers to cause a denial (no CVSS)
- [CVE-2010-1824](https://cve.now/CVE-2010-1824.md): Use-after-free vulnerability in WebKit, as used in Apple iTunes before 10.2 on Windows, Apple Safari, and Google Chrome before 6.0.472.59, a (no CVSS)
- [CVE-2010-1825](https://cve.now/CVE-2010-1825.md): Use-after-free vulnerability in WebKit, as used in Google Chrome before 6.0.472.59, allows remote attackers to cause a denial of service or (no CVSS)
- [CVE-2010-2491](https://cve.now/CVE-2010-2491.md): Cross-site scripting (XSS) vulnerability in cgi/client.py in Roundup before 1.4.14 allows remote attackers to inject arbitrary web script or (no CVSS, roundup)
- [CVE-2010-3261](https://cve.now/CVE-2010-3261.md): Directory traversal vulnerability in RSA Authentication Agent 7.0 before P2 for Web allows remote attackers to read unspecified data via unk (no CVSS)
- [CVE-2010-3283](https://cve.now/CVE-2010-3283.md): Open redirect vulnerability in HP System Management Homepage (SMH) before 6.2 allows remote attackers to redirect users to arbitrary web sit (no CVSS)
- [CVE-2010-3284](https://cve.now/CVE-2010-3284.md): Unspecified vulnerability in HP System Management Homepage (SMH) before 6.2 allows remote attackers to obtain sensitive information via unkn (no CVSS)
- [CVE-2010-3285](https://cve.now/CVE-2010-3285.md): Unspecified vulnerability in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to cause a denial of service vi (no CVSS)
- [CVE-2010-3294](https://cve.now/CVE-2010-3294.md): Cross-site scripting (XSS) vulnerability in apc.php in the Alternative PHP Cache (APC) extension before 3.1.4 for PHP allows remote attacker (no CVSS)
- [CVE-2010-3304](https://cve.now/CVE-2010-3304.md): The ACL plugin in Dovecot 1.2.x before 1.2.13 propagates INBOX ACLs to newly created mailboxes in certain configurations, which might allow (no CVSS)
- [CVE-2010-3306](https://cve.now/CVE-2010-3306.md): Directory traversal vulnerability in the modURL function in instance.c in Weborf before 0.12.3 allows remote attackers to read arbitrary fil (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2010-09-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.