# CVEs published 2010-10-27

11 CVEs were published on October 27, 2010: 1 critical, 0 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2010-2891](https://cve.now/CVE-2010-2891.md): Buffer overflow in the smiGetNode function in lib/smi.c in libsmi 0.4.8 allows context-dependent attackers to execute arbitrary code via an (no CVSS)
- [CVE-2010-3711](https://cve.now/CVE-2010-3711.md): libpurple in Pidgin before 2.7.4 does not properly validate the return value of the purple\_base64\_decode function, which allows remote authe (no CVSS)
- [CVE-2010-3712](https://cve.now/CVE-2010-3712.md): Cross-site scripting (XSS) vulnerability in Joomla! 1.5.x before 1.5.21 and 1.6.x before 1.6.1 allows remote attackers to inject arbitrary w (no CVSS)
- [CVE-2010-3713](https://cve.now/CVE-2010-3713.md): rss.php in UseBB before 1.0.11 does not properly handle forum configurations in which a user has the view permission but not the read permis (no CVSS)
- [CVE-2010-3765](https://cve.now/CVE-2010-3765.md): Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, and SeaMonkey 2.x bef (CVSS 9.8, KEV)
- [CVE-2010-3842](https://cve.now/CVE-2010-3842.md): Absolute path traversal vulnerability in curl 7.20.0 through 7.21.1, when the --remote-header-name or -J option is used, allows remote serve (no CVSS)
- [CVE-2010-3933](https://cve.now/CVE-2010-3933.md): Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by chang (no CVSS, activerecord)
- [CVE-2010-4096](https://cve.now/CVE-2010-4096.md): share/ma/keys\_for\_user in Monkeysphere 0.31 and 0.32 allows local users to execute arbitrary code via unknown manipulations related to the " (no CVSS)
- [CVE-2010-4097](https://cve.now/CVE-2010-4097.md): Multiple cross-site scripting (XSS) vulnerabilities in index.php in Aardvark Topsites PHP 5.2.0 and 5.2.1 allow remote attackers to inject a (no CVSS)
- [CVE-2010-4098](https://cve.now/CVE-2010-4098.md): monotone before 0.48.1, when configured to allow remote commands, allows remote attackers to cause a denial of service (crash) via an empty (no CVSS)
- [CVE-2010-4099](https://cve.now/CVE-2010-4099.md): ess.pm in NitroSecurity NitroView ESM 8.4.0a, when ESSPMDebug is enabled, allows remote attackers to execute arbitrary commands via shell me (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2010-10-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.