# CVEs published 2010-11-12

15 CVEs were published on November 12, 2010: 0 critical, 0 high. Days are UTC.

- [CVE-2009-5016](https://cve.now/CVE-2009-5016.md): Integer overflow in the xml\_utf8\_decode function in ext/xml/xml.c in PHP before 5.2.11 makes it easier for remote attackers to bypass cross- (no CVSS)
- [CVE-2009-5017](https://cve.now/CVE-2009-5017.md): Mozilla Firefox before 3.6 Beta 3 does not properly handle overlong UTF-8 encoding, which makes it easier for remote attackers to bypass cro (no CVSS)
- [CVE-2010-3892](https://cve.now/CVE-2010-3892.md): Session fixation vulnerability in the login form in the administrator interface in IBM OmniFind Enterprise Edition 8.x and 9.x allows remote (no CVSS)
- [CVE-2010-3893](https://cve.now/CVE-2010-3893.md): The administrator interface in IBM OmniFind Enterprise Edition 8.x and 9.x does not restrict use of a session ID (aka SID) value to a single (no CVSS)
- [CVE-2010-3894](https://cve.now/CVE-2010-3894.md): Stack-based buffer overflow in the Java\_com\_ibm\_es\_oss\_CryptionNative\_ESEncrypt function in /opt/IBM/es/lib/libffq.cryptionjni.so in the log (no CVSS)
- [CVE-2010-3895](https://cve.now/CVE-2010-3895.md): esRunCommand in IBM OmniFind Enterprise Edition before 9.1 allows local users to gain privileges by specifying an arbitrary command name as (no CVSS)
- [CVE-2010-3896](https://cve.now/CVE-2010-3896.md): The ESSearchApplication directory tree in IBM OmniFind Enterprise Edition 8.x and 9.x does not require authentication, which allows remote a (no CVSS)
- [CVE-2010-3897](https://cve.now/CVE-2010-3897.md): ESSearchApplication/palette.do in IBM OmniFind Enterprise Edition 8.x and 9.x includes the administrator password in the HTML source code, w (no CVSS)
- [CVE-2010-3898](https://cve.now/CVE-2010-3898.md): IBM OmniFind Enterprise Edition 8.x and 9.x does not properly restrict the cookie path of administrator (aka ESAdmin) cookies, which might a (no CVSS)
- [CVE-2010-3899](https://cve.now/CVE-2010-3899.md): IBM OmniFind Enterprise Edition 8.x and 9.x performs web crawls with an unlimited recursion depth, which allows remote web servers to cause (no CVSS)
- [CVE-2010-4236](https://cve.now/CVE-2010-4236.md): Untrusted search path vulnerability in estaskwrapper in IBM OmniFind Enterprise Edition before 9.1 allows local users to gain privileges via (no CVSS)
- [CVE-2010-2637](https://cve.now/CVE-2010-2637.md): IBM WebSphere MQ 6.0 before 6.0.2.9 and 7.0 before 7.0.1.1 does not encrypt the username and password in the security parameters field, whic (no CVSS)
- [CVE-2010-3870](https://cve.now/CVE-2010-3870.md): The utf8\_decode function in PHP before 5.3.4 does not properly handle non-shortest form UTF-8 encoding and ill-formed subsequences in UTF-8 (no CVSS)
- [CVE-2010-3890](https://cve.now/CVE-2010-3890.md): Cross-site scripting (XSS) vulnerability in IBM OmniFind Enterprise Edition before 9.1 allows remote attackers to inject arbitrary web scrip (no CVSS)
- [CVE-2010-3891](https://cve.now/CVE-2010-3891.md): Cross-site request forgery (CSRF) vulnerability in ESAdmin/security.do in the administrator interface in IBM OmniFind Enterprise Edition bef (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2010-11-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.