# CVEs published 2010-12-02 24 CVEs were published on December 2, 2010: 0 critical, 0 high. Days are UTC. - [CVE-2010-4278](https://cve.now/CVE-2010-4278.md): operation/agentes/networkmap.php in Pandora FMS before 3.1.1 allows remote authenticated users to execute arbitrary commands via shell metac (no CVSS) - [CVE-2010-4279](https://cve.now/CVE-2010-4279.md): The default configuration of Pandora FMS 3.1 and earlier specifies an empty string for the loginhash\_pwd field, which allows remote attacker (no CVSS) - [CVE-2010-4280](https://cve.now/CVE-2010-4280.md): Multiple SQL injection vulnerabilities in Pandora FMS before 3.1.1 allow remote authenticated users to execute arbitrary SQL commands via (1 (no CVSS) - [CVE-2010-4281](https://cve.now/CVE-2010-4281.md): Incomplete blacklist vulnerability in the safe\_url\_extraclean function in ajax.php in Pandora FMS before 3.1.1 allows remote attackers to ex (no CVSS) - [CVE-2010-4282](https://cve.now/CVE-2010-4282.md): Multiple directory traversal vulnerabilities in Pandora FMS before 3.1.1 allow remote attackers to include and execute arbitrary local files (no CVSS) - [CVE-2010-4283](https://cve.now/CVE-2010-4283.md): PHP remote file inclusion vulnerability in extras/pandora\_diag.php in Pandora FMS before 3.1.1 allows remote attackers to execute arbitrary (no CVSS) - [CVE-2010-4313](https://cve.now/CVE-2010-4313.md): Unrestricted file upload vulnerability in fileman\_file\_upload.php in Orbis CMS 1.0.2 allows remote authenticated users to execute arbitrary (no CVSS) - [CVE-2009-5020](https://cve.now/CVE-2009-5020.md): Open redirect vulnerability in awredir.pl in AWStats before 6.95 allows remote attackers to redirect users to arbitrary web sites and conduc (no CVSS) - [CVE-2010-1323](https://cve.now/CVE-2010-1323.md): MIT Kerberos 5 (aka krb5) 1.3.x, 1.4.x, 1.5.x, 1.6.x, 1.7.x, and 1.8.x through 1.8.3 does not properly determine the acceptability of checks (no CVSS) - [CVE-2010-1324](https://cve.now/CVE-2010-1324.md): MIT Kerberos 5 (aka krb5) 1.7.x and 1.8.x through 1.8.3 does not properly determine the acceptability of checksums, which might allow remote (no CVSS) - [CVE-2010-2586](https://cve.now/CVE-2010-2586.md): Multiple integer overflows in in\_nsv.dll in the in\_nsv plugin in Winamp before 5.6 allow remote attackers to execute arbitrary code via a cr (no CVSS) - [CVE-2010-3266](https://cve.now/CVE-2010-3266.md): Multiple cross-site scripting (XSS) vulnerabilities in BugTracker.NET before 3.4.5 allow remote authenticated users to inject arbitrary web (no CVSS) - [CVE-2010-3267](https://cve.now/CVE-2010-3267.md): Multiple SQL injection vulnerabilities in BugTracker.NET before 3.4.5 allow remote authenticated users to execute arbitrary SQL commands via (no CVSS) - [CVE-2010-4020](https://cve.now/CVE-2010-4020.md): MIT Kerberos 5 (aka krb5) 1.8.x through 1.8.3 does not reject RC4 key-derivation checksums, which might allow remote authenticated users to (no CVSS) - [CVE-2010-4021](https://cve.now/CVE-2010-4021.md): The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7 does not properly restrict the use of TGT credentials for armoring TGS re (no CVSS) - [CVE-2010-4329](https://cve.now/CVE-2010-4329.md): Cross-site scripting (XSS) vulnerability in the PMA\_linkOrButton function in libraries/common.lib.php in the database (db) search script in (no CVSS) - [CVE-2010-4367](https://cve.now/CVE-2010-4367.md): awstats.cgi in AWStats before 7.0 accepts a configdir parameter in the URL, which allows remote attackers to execute arbitrary commands via (no CVSS) - [CVE-2010-4368](https://cve.now/CVE-2010-4368.md): awstats.cgi in AWStats before 7.0 on Windows accepts a configdir parameter in the URL, which allows remote attackers to execute arbitrary co (no CVSS) - [CVE-2010-4369](https://cve.now/CVE-2010-4369.md): Directory traversal vulnerability in AWStats before 7.0 allows remote attackers to have an unspecified impact via a crafted LoadPlugin direc (no CVSS) - [CVE-2010-4370](https://cve.now/CVE-2010-4370.md): Multiple integer overflows in the in\_midi plugin in Winamp before 5.6 allow remote attackers to execute arbitrary code via a crafted MIDI fi (no CVSS) - [CVE-2010-4371](https://cve.now/CVE-2010-4371.md): Buffer overflow in the in\_mod plugin in Winamp before 5.6 allows remote attackers to have an unspecified impact via vectors related to the c (no CVSS) - [CVE-2010-4372](https://cve.now/CVE-2010-4372.md): Integer overflow in the in\_nsv plugin in Winamp before 5.6 allows remote attackers to have an unspecified impact via vectors related to impr (no CVSS) - [CVE-2010-4373](https://cve.now/CVE-2010-4373.md): The in\_mp4 plugin in Winamp before 5.6 allows remote attackers to cause a denial of service (application crash) via crafted (1) metadata or (no CVSS) - [CVE-2010-4374](https://cve.now/CVE-2010-4374.md): The in\_mkv plugin in Winamp before 5.6 allows remote attackers to cause a denial of service (application crash) via a Matroska Video (MKV) f (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2010-12-02 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.