# CVEs published 2010-12-09 20 CVEs were published on December 9, 2010: 0 critical, 0 high. Days are UTC. - [CVE-2010-4513](https://cve.now/CVE-2010-4513.md): Multiple cross-site scripting (XSS) vulnerabilities in Zimplit CMS 3.0, and possibly earlier, allow remote attackers to inject arbitrary web (no CVSS) - [CVE-2010-4514](https://cve.now/CVE-2010-4514.md): Cross-site scripting (XSS) vulnerability in Install/InstallWizard.aspx in DotNetNuke 5.05.01 and 5.06.00 allows remote attackers to inject a (no CVSS) - [CVE-2010-4515](https://cve.now/CVE-2010-4515.md): Cross-site scripting (XSS) vulnerability in Citrix Web Interface 5.0, 5.1, and 5.3 allows remote attackers to inject arbitrary web script or (no CVSS) - [CVE-2010-4516](https://cve.now/CVE-2010-4516.md): Multiple cross-site scripting (XSS) vulnerabilities in the JXtended Comments component before 1.3.1 for Joomla allow remote attackers to inj (no CVSS) - [CVE-2010-4517](https://cve.now/CVE-2010-4517.md): SQL injection vulnerability in the JExtensions JE Auto (com\_jeauto) component 1.0 for Joomla!, when magic\_quotes\_gpc is disabled, allows rem (no CVSS) - [CVE-2010-4518](https://cve.now/CVE-2010-4518.md): Cross-site scripting (XSS) vulnerability in wp-safe-search/wp-safe-search-jx.php in the Safe Search plugin 0.7 for WordPress allows remote a (no CVSS) - [CVE-2009-5021](https://cve.now/CVE-2009-5021.md): Cobbler before 1.6.1 does not properly determine whether an installation has the default password, which makes it easier for attackers to ob (no CVSS) - [CVE-2010-0530](https://cve.now/CVE-2010-0530.md): Apple QuickTime before 7.6.9 on Windows sets weak permissions for the Apple Computer directory in the profile of a user account, which allow (no CVSS) - [CVE-2010-1508](https://cve.now/CVE-2010-1508.md): Heap-based buffer overflow in Apple QuickTime before 7.6.9 on Windows allows remote attackers to execute arbitrary code or cause a denial of (no CVSS) - [CVE-2010-2235](https://cve.now/CVE-2010-2235.md): template\_api.py in Cobbler before 2.0.7, as used in Red Hat Network Satellite Server and other products, does not disable the ability of the (no CVSS, cobbler) - [CVE-2010-3800](https://cve.now/CVE-2010-3800.md): Apple QuickTime before 7.6.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and applicati (no CVSS) - [CVE-2010-3801](https://cve.now/CVE-2010-3801.md): Apple QuickTime before 7.6.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and applicati (no CVSS) - [CVE-2010-3802](https://cve.now/CVE-2010-3802.md): Integer signedness error in Apple QuickTime before 7.6.9 allows remote attackers to execute arbitrary code or cause a denial of service (mem (no CVSS) - [CVE-2010-3921](https://cve.now/CVE-2010-3921.md): Cross-site scripting (XSS) vulnerability in Movable Type 4.x before 4.35 and 5.x before 5.04 allows remote attackers to inject arbitrary web (no CVSS) - [CVE-2010-3922](https://cve.now/CVE-2010-3922.md): SQL injection vulnerability in Movable Type 4.x before 4.35 and 5.x before 5.04 allows remote attackers to execute arbitrary SQL commands vi (no CVSS) - [CVE-2010-4009](https://cve.now/CVE-2010-4009.md): Integer overflow in Apple QuickTime before 7.6.9 allows remote attackers to execute arbitrary code or cause a denial of service (application (no CVSS) - [CVE-2010-4508](https://cve.now/CVE-2010-4508.md): The WebSockets implementation in Mozilla Firefox 4 through 4.0 Beta 7 does not properly perform proxy upgrade negotiation, which has unspeci (no CVSS) - [CVE-2010-4509](https://cve.now/CVE-2010-4509.md): Multiple unspecified vulnerabilities in Movable Type 4.x before 4.35 and 5.x before 5.04 have unknown impact and attack vectors related to t (no CVSS) - [CVE-2010-4511](https://cve.now/CVE-2010-4511.md): Unspecified vulnerability in Movable Type 4.x before 4.35 and 5.x before 5.04 has unknown impact and attack vectors related to the "dynamic (no CVSS) - [CVE-2010-4512](https://cve.now/CVE-2010-4512.md): Cobbler before 2.0.4 uses an incorrect umask value, which allows local users to have an unspecified impact by leveraging world writable perm (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2010-12-09 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.