# CVEs published 2010-11-05

37 CVEs were published on November 5, 2010: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2009-5014](https://cve.now/CVE-2009-5014.md): The default quickstart configuration of TurboGears2 (aka tg2) before 2.0.2 has a weak cookie salt, which makes it easier for remote attacker (no CVSS)
- [CVE-2009-5015](https://cve.now/CVE-2009-5015.md): The URL dispatch mechanism in TurboGears2 (aka tg2) before 2.0.2 exposes controller methods even when an @expose decoration is not used, whi (no CVSS)
- [CVE-2010-1523](https://cve.now/CVE-2010-1523.md): Multiple heap-based buffer overflows in vp6.w5s (aka the VP6 codec) in Winamp before 5.59 Beta build 3033 might allow remote attackers to ex (no CVSS)
- [CVE-2010-2477](https://cve.now/CVE-2010-2477.md): Multiple cross-site scripting (XSS) vulnerabilities in the paste.httpexceptions implementation in Paste before 1.7.4 allow remote attackers (no CVSS, paste)
- [CVE-2010-3852](https://cve.now/CVE-2010-3852.md): The default configuration of Luci 0.22.4 and earlier in Red Hat Conga uses "\[INSERT SECRET HERE\]" as its secret key for cookies, which makes (no CVSS)
- [CVE-2010-3915](https://cve.now/CVE-2010-3915.md): Unspecified vulnerability in JustSystems Ichitaro and Ichitaro Government allows remote attackers to execute arbitrary code via a crafted do (no CVSS)
- [CVE-2010-3916](https://cve.now/CVE-2010-3916.md): Unspecified vulnerability in JustSystems Ichitaro and Ichitaro Government allows remote attackers to execute arbitrary code via a crafted do (no CVSS)
- [CVE-2010-3998](https://cve.now/CVE-2010-3998.md): The (1) banshee-1 and (2) muinshee scripts in Banshee 1.8.0 and earlier place a zero-length directory name in the LD\_LIBRARY\_PATH, which all (no CVSS)
- [CVE-2010-4000](https://cve.now/CVE-2010-4000.md): gnome-shell in GNOME Shell 2.31.5 places a zero-length directory name in the LD\_LIBRARY\_PATH, which allows local users to gain privileges vi (no CVSS)
- [CVE-2010-4001](https://cve.now/CVE-2010-4001.md): GMXRC.bash in Gromacs 4.5.1 and earlier places a zero-length directory name in the LD\_LIBRARY\_PATH, which allows local users to gain privile (no CVSS)
- [CVE-2010-4005](https://cve.now/CVE-2010-4005.md): The (1) tomboy and (2) tomboy-panel scripts in GNOME Tomboy 1.5.2 and earlier place a zero-length directory name in the LD\_LIBRARY\_PATH, whi (no CVSS)
- [CVE-2010-4197](https://cve.now/CVE-2010-4197.md): Use-after-free vulnerability in WebKit, as used in Google Chrome before 7.0.517.44, webkitgtk before 1.2.6, and other products, allows remot (no CVSS)
- [CVE-2010-4198](https://cve.now/CVE-2010-4198.md): WebKit, as used in Google Chrome before 7.0.517.44, webkitgtk before 1.2.6, and other products, does not properly handle large text areas, w (no CVSS)
- [CVE-2010-4199](https://cve.now/CVE-2010-4199.md): Google Chrome before 7.0.517.44 does not properly perform a cast of an unspecified variable during processing of an SVG use element, which a (no CVSS)
- [CVE-2010-4201](https://cve.now/CVE-2010-4201.md): Use-after-free vulnerability in Google Chrome before 7.0.517.44 allows remote attackers to cause a denial of service or possibly have unspec (no CVSS)
- [CVE-2010-4202](https://cve.now/CVE-2010-4202.md): Multiple integer overflows in Google Chrome before 7.0.517.44 on Linux allow remote attackers to cause a denial of service or possibly have (no CVSS)
- [CVE-2010-4203](https://cve.now/CVE-2010-4203.md): WebM libvpx (aka the VP8 Codec SDK) before 0.9.5, as used in Google Chrome before 7.0.517.44, allows remote attackers to cause a denial of s (no CVSS)
- [CVE-2010-4204](https://cve.now/CVE-2010-4204.md): WebKit, as used in Google Chrome before 7.0.517.44, webkitgtk before 1.2.6, and other products, accesses a frame object after this object ha (no CVSS)
- [CVE-2010-4205](https://cve.now/CVE-2010-4205.md): Google Chrome before 7.0.517.44 does not properly handle the data types of event objects, which allows remote attackers to cause a denial of (no CVSS)
- [CVE-2010-4206](https://cve.now/CVE-2010-4206.md): Array index error in the FEBlend::apply function in WebCore/platform/graphics/filters/FEBlend.cpp in WebKit, as used in Google Chrome before (no CVSS)
- [CVE-2010-4092](https://cve.now/CVE-2010-4092.md): Use-after-free vulnerability in an unspecified compatibility component in Adobe Shockwave Player before 11.5.9.620 allows user-assisted remo (no CVSS)
- [CVE-2010-4185](https://cve.now/CVE-2010-4185.md): SQL injection vulnerability in index.php in Energine, possibly 2.3.8 and earlier, allows remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2010-4186](https://cve.now/CVE-2010-4186.md): SQL injection vulnerability in process.asp in OnlineTechTools Online Work Order System (OWOS) Professional Edition 2.10 allows remote attack (no CVSS)
- [CVE-2010-3702](https://cve.now/CVE-2010-3702.md): The Gfx::getPos function in the PDF parser in xpdf before 3.02pl5, poppler 0.8.7 and possibly other versions up to 0.15.1, CUPS, kdegraphics (no CVSS)
- [CVE-2010-3703](https://cve.now/CVE-2010-3703.md): The PostScriptFunction::PostScriptFunction function in poppler/Function.cc in the PDF parser in poppler 0.8.7 and possibly other versions up (no CVSS)
- [CVE-2010-3704](https://cve.now/CVE-2010-3704.md): The FoFiType1::parse function in fofi/FoFiType1.cc in the PDF parser in xpdf before 3.02pl5, poppler 0.8.7 and possibly other versions up to (no CVSS)
- [CVE-2010-2941](https://cve.now/CVE-2010-2941.md): ipp.c in cupsd in CUPS 1.4.4 and earlier does not properly allocate memory for attribute values with invalid string data types, which allows (no CVSS)
- [CVE-2010-3172](https://cve.now/CVE-2010-3172.md): CRLF injection vulnerability in Bugzilla before 3.2.9, 3.4.x before 3.4.9, 3.6.x before 3.6.3, and 4.0.x before 4.0rc1, when Server Push is (no CVSS)
- [CVE-2010-3764](https://cve.now/CVE-2010-3764.md): The Old Charts implementation in Bugzilla 2.12 through 3.2.8, 3.4.8, 3.6.2, 3.7.3, and 4.1 creates graph files with predictable names in gra (no CVSS)
- [CVE-2010-3846](https://cve.now/CVE-2010-3846.md): Array index error in the apply\_rcs\_change function in rcs.c in CVS 1.11.23 allows local users to gain privileges via an RCS file containing (no CVSS)
- [CVE-2010-3863](https://cve.now/CVE-2010-3863.md): Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, whic (no CVSS, org.apache.shiro:shiro-root)
- [CVE-2010-3913](https://cve.now/CVE-2010-3913.md): CRLF injection vulnerability in TransWARE Active! mail 6 build 6.40.010047750 and earlier allows remote attackers to inject arbitrary HTTP h (no CVSS)
- [CVE-2010-3962](https://cve.now/CVE-2010-3962.md): Use-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code via vectors relate (CVSS 8.1, KEV)
- [CVE-2010-3996](https://cve.now/CVE-2010-3996.md): festival\_server in Centre for Speech Technology Research (CSTR) Festival, probably 2.0.95-beta and earlier, places a zero-length directory n (no CVSS)
- [CVE-2010-3999](https://cve.now/CVE-2010-3999.md): gnc-test-env in GnuCash 2.3.15 and earlier places a zero-length directory name in the LD\_LIBRARY\_PATH, which allows local users to gain priv (no CVSS)
- [CVE-2010-4183](https://cve.now/CVE-2010-4183.md): Multiple cross-site scripting (XSS) vulnerabilities in HTML Purifier before 4.1.0, when Internet Explorer is used, allow remote attackers to (no CVSS, ezyang/htmlpurifier)
- [CVE-2010-4184](https://cve.now/CVE-2010-4184.md): NetSupport Manager (NSM) before 11.00.0005 sends HTTP headers with cleartext fields containing details about client machines, which allows r (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2010-11-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.