# CVEs published 2010-11-26

23 CVEs were published on November 26, 2010: 0 critical, 0 high. Days are UTC.

- [CVE-2008-7266](https://cve.now/CVE-2008-7266.md): Cross-site scripting (XSS) vulnerability in an unspecified Shockwave Flash file in RSA Adaptive Authentication 2.x and 5.7.x allows remote a (no CVSS)
- [CVE-2010-3705](https://cve.now/CVE-2010-3705.md): The sctp\_auth\_asoc\_get\_hmac function in net/sctp/auth.c in the Linux kernel before 2.6.36 does not properly validate the hmac\_ids array of a (no CVSS)
- [CVE-2010-3814](https://cve.now/CVE-2010-3814.md): Heap-based buffer overflow in the Ins\_SHZ function in ttinterp.c in FreeType 2.4.3 and earlier allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2010-3827](https://cve.now/CVE-2010-3827.md): Apple iOS before 4.2 does not properly validate signatures before displaying a configuration profile in the configuration installation utili (no CVSS)
- [CVE-2010-3828](https://cve.now/CVE-2010-3828.md): iAd Content Display in Apple iOS before 4.2 allows man-in-the-middle attackers to make calls via a crafted URL in an ad. (no CVSS)
- [CVE-2010-3829](https://cve.now/CVE-2010-3829.md): WebKit in Apple iOS before 4.2 allows remote attackers to bypass the remote image loading setting in Mail via an HTML LINK element with a DN (no CVSS)
- [CVE-2010-3830](https://cve.now/CVE-2010-3830.md): Networking in Apple iOS before 4.2 accesses an invalid pointer during the processing of packet filter rules, which allows local users to gai (no CVSS)
- [CVE-2010-3831](https://cve.now/CVE-2010-3831.md): Photos in Apple iOS before 4.2 enables support for HTTP Basic Authentication over an unencrypted connection, which allows man-in-the-middle (no CVSS)
- [CVE-2010-3832](https://cve.now/CVE-2010-3832.md): Heap-based buffer overflow in the GSM mobility management implementation in Telephony in Apple iOS before 4.2 on the iPhone and iPad allows (no CVSS)
- [CVE-2010-3855](https://cve.now/CVE-2010-3855.md): Buffer overflow in the ft\_var\_readpackedpoints function in truetype/ttgxvar.c in FreeType 2.4.3 and earlier allows remote attackers to cause (no CVSS)
- [CVE-2010-3909](https://cve.now/CVE-2010-3909.md): Incomplete blacklist vulnerability in config.template.php in vtiger CRM before 5.2.1 allows remote authenticated users to execute arbitrary (no CVSS)
- [CVE-2010-3910](https://cve.now/CVE-2010-3910.md): Multiple directory traversal vulnerabilities in the return\_application\_language function in include/utils/utils.php in vtiger CRM before 5.2 (no CVSS)
- [CVE-2010-3911](https://cve.now/CVE-2010-3911.md): Multiple cross-site scripting (XSS) vulnerabilities in vtiger CRM before 5.2.1 allow remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2010-4172](https://cve.now/CVE-2010-4172.md): Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0. (no CVSS, org.apache.tomcat:tomcat)
- [CVE-2010-4298](https://cve.now/CVE-2010-4298.md): SQL injection vulnerability in the download module in Free Simple Software 1.0 allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2010-4311](https://cve.now/CVE-2010-4311.md): Free Simple Software 1.0 stores passwords in cleartext, which allows context-dependent attackers to obtain sensitive information. (no CVSS)
- [CVE-2010-4312](https://cve.now/CVE-2010-4312.md): The default configuration of Apache Tomcat 6.x does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote a (no CVSS, org.apache.tomcat:tomcat)
- [CVE-2010-2962](https://cve.now/CVE-2010-2962.md): drivers/gpu/drm/i915/i915\_gem.c in the Graphics Execution Manager (GEM) in the Intel i915 driver in the Direct Rendering Manager (DRM) subsy (no CVSS)
- [CVE-2010-2963](https://cve.now/CVE-2010-2963.md): drivers/media/video/v4l2-compat-ioctl32.c in the Video4Linux (V4L) implementation in the Linux kernel before 2.6.36 on 64-bit platforms does (no CVSS)
- [CVE-2010-3445](https://cve.now/CVE-2010-3445.md): Stack consumption vulnerability in the dissect\_ber\_unknown function in epan/dissectors/packet-ber.c in the BER dissector in Wireshark 1.4.x (no CVSS)
- [CVE-2010-3698](https://cve.now/CVE-2010-3698.md): The KVM implementation in the Linux kernel before 2.6.36 does not properly reload the FS and GS segment registers, which allows host OS user (no CVSS)
- [CVE-2010-4300](https://cve.now/CVE-2010-4300.md): Heap-based buffer overflow in the dissect\_ldss\_transfer function (epan/dissectors/packet-ldss.c) in the LDSS dissector in Wireshark 1.2.0 th (no CVSS)
- [CVE-2010-4301](https://cve.now/CVE-2010-4301.md): epan/dissectors/packet-zbee-zcl.c in the ZigBee ZCL dissector in Wireshark 1.4.0 through 1.4.1 allows remote attackers to cause a denial of (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2010-11-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.