# CVEs published 2010-12-22

45 CVEs were published on December 22, 2010: 0 critical, 1 high. Days are UTC.

- [CVE-2010-2644](https://cve.now/CVE-2010-2644.md): IBM WebSphere Service Registry and Repository (WSRR) 7.0.0 before FP1 does not properly implement access control, which allows remote attack (no CVSS)
- [CVE-2010-3268](https://cve.now/CVE-2010-3268.md): The GetStringAMSHandler function in prgxhndl.dll in hndlrsvc.exe in the Intel Alert Handler service (aka Symantec Intel Handler service) in (no CVSS)
- [CVE-2010-3905](https://cve.now/CVE-2010-3905.md): The password reset feature in the administrator interface for Eucalyptus 2.0.0 and 2.0.1 does not perform authentication, which allows remot (no CVSS)
- [CVE-2010-3970](https://cve.now/CVE-2010-3970.md): Stack-based buffer overflow in the CreateSizedDIBSECTION function in shimgvw.dll in the Windows Shell graphics processor (aka graphics rende (no CVSS)
- [CVE-2010-3971](https://cve.now/CVE-2010-3971.md): Use-after-free vulnerability in the CSharedStyleSheet::Notify function in the Cascading Style Sheets (CSS) parser in mshtml.dll, as used in (no CVSS)
- [CVE-2010-4110](https://cve.now/CVE-2010-4110.md): Unspecified vulnerability in HP OpenVMS 8.3, 8.3-1H1, and 8.4 on the Itanium platform on Integrity servers allows local users to gain privil (no CVSS)
- [CVE-2010-4111](https://cve.now/CVE-2010-4111.md): Cross-site scripting (XSS) vulnerability in HP Insight Diagnostics Online Edition before 8.5.1.3712 allows remote attackers to inject arbitr (no CVSS)
- [CVE-2010-4112](https://cve.now/CVE-2010-4112.md): HP Insight Management Agents before 8.6 allows remote attackers to obtain sensitive information via an unspecified request that triggers dis (no CVSS)
- [CVE-2010-4113](https://cve.now/CVE-2010-4113.md): Stack-based buffer overflow in HP Power Manager (HPPM) before 4.3.2 allows remote attackers to execute arbitrary code via a long Login varia (no CVSS)
- [CVE-2010-4114](https://cve.now/CVE-2010-4114.md): Cross-site scripting (XSS) vulnerability in HP Discovery & Dependency Mapping Inventory (DDMI) 2.5x, 7.5x, and 7.6x allows remote attackers (no CVSS)
- [CVE-2010-4277](https://cve.now/CVE-2010-4277.md): Cross-site scripting (XSS) vulnerability in lembedded-video.php in the Embedded Video plugin 4.1 for WordPress allows remote attackers to in (no CVSS)
- [CVE-2010-4346](https://cve.now/CVE-2010-4346.md): The install\_special\_mapping function in mm/mmap.c in the Linux kernel before 2.6.37-rc6 does not make an expected security\_file\_mmap functio (no CVSS)
- [CVE-2010-4347](https://cve.now/CVE-2010-4347.md): The ACPI subsystem in the Linux kernel before 2.6.36.2 uses 0222 permissions for the debugfs custom\_method file, which allows local users to (no CVSS)
- [CVE-2010-4573](https://cve.now/CVE-2010-4573.md): The Update Installer in VMware ESXi 4.1, when a modified sfcb.cfg is present, does not properly configure the SFCB authentication mode, whic (no CVSS)
- [CVE-2010-4589](https://cve.now/CVE-2010-4589.md): Cross-site scripting (XSS) vulnerability in IBM ENOVIA 6 allows remote attackers to inject arbitrary web script or HTML via vectors related (no CVSS)
- [CVE-2010-4590](https://cve.now/CVE-2010-4590.md): Cross-site scripting (XSS) vulnerability in HTTP Access Services (HTTP-AS) in the Connection Manager in IBM Lotus Mobile Connect (LMC) befor (no CVSS)
- [CVE-2010-4591](https://cve.now/CVE-2010-4591.md): The Connection Manager in IBM Lotus Mobile Connect (LMC) before 6.1.4, when HTTP Access Services (HTTP-AS) is enabled, does not delete LTPA (no CVSS)
- [CVE-2010-4592](https://cve.now/CVE-2010-4592.md): The Mobile Network Connections functionality in the Connection Manager in IBM Lotus Mobile Connect before 6.1.4, when HTTP Access Services ( (no CVSS)
- [CVE-2010-4593](https://cve.now/CVE-2010-4593.md): The Connection Manager in IBM Lotus Mobile Connect before 6.1.4 does not properly maintain a certain reference count, which allows remote au (no CVSS)
- [CVE-2010-4594](https://cve.now/CVE-2010-4594.md): The Connection Manager in IBM Lotus Mobile Connect before 6.1.4, when HTTP Access Services (HTTP-AS) is enabled, does not properly process T (no CVSS)
- [CVE-2010-4595](https://cve.now/CVE-2010-4595.md): The Connection Manager in IBM Lotus Mobile Connect before 6.1.4 disables the http.device.stanza blacklisting functionality for HTTP Access S (no CVSS)
- [CVE-2009-2189](https://cve.now/CVE-2009-2189.md): The ICMPv6 implementation on the Apple Time Capsule, AirPort Extreme Base Station, and AirPort Express Base Station with firmware before 7.5 (no CVSS)
- [CVE-2010-0039](https://cve.now/CVE-2010-0039.md): The Application-Level Gateway (ALG) on the Apple Time Capsule, AirPort Extreme Base Station, and AirPort Express Base Station with firmware (no CVSS)
- [CVE-2010-1804](https://cve.now/CVE-2010-1804.md): Unspecified vulnerability in the network bridge functionality on the Apple Time Capsule, AirPort Extreme Base Station, and AirPort Express B (no CVSS)
- [CVE-2010-2590](https://cve.now/CVE-2010-2590.md): Heap-based buffer overflow in the CrystalReports12.CrystalPrintControl.1 ActiveX control in PrintControl.dll 12.3.2.753 in SAP Crystal Repor (no CVSS)
- [CVE-2010-4275](https://cve.now/CVE-2010-4275.md): Multiple cross-site scripting (XSS) vulnerabilities in Radius Manager 3.8.0 allow remote authenticated administrators to inject arbitrary we (no CVSS)
- [CVE-2010-4332](https://cve.now/CVE-2010-4332.md): Pointter PHP Content Management System 1.0 allows remote attackers to bypass authentication and obtain administrative privileges via arbitra (no CVSS)
- [CVE-2010-4333](https://cve.now/CVE-2010-4333.md): Pointter PHP Micro-Blogging Social Network 1.8 allows remote attackers to bypass authentication and obtain administrative privileges via arb (no CVSS)
- [CVE-2010-4579](https://cve.now/CVE-2010-4579.md): Opera before 11.00 does not properly constrain dialogs to appear on top of rendered documents, which makes it easier for remote attackers to (no CVSS)
- [CVE-2010-4580](https://cve.now/CVE-2010-4580.md): Opera before 11.00 does not clear WAP WML form fields after manual navigation to a new web site, which allows remote attackers to obtain sen (no CVSS)
- [CVE-2010-4581](https://cve.now/CVE-2010-4581.md): Unspecified vulnerability in Opera before 11.00 has unknown impact and attack vectors, related to "a high severity issue." (no CVSS)
- [CVE-2010-4582](https://cve.now/CVE-2010-4582.md): Opera before 11.00 does not properly handle security policies during updates to extensions, which might allow remote attackers to bypass int (no CVSS)
- [CVE-2010-4583](https://cve.now/CVE-2010-4583.md): Opera before 11.00, when Opera Turbo is enabled, does not display a page's security indication, which makes it easier for remote attackers t (no CVSS)
- [CVE-2010-4584](https://cve.now/CVE-2010-4584.md): Opera before 11.00, when Opera Turbo is used, does not properly present information about problematic X.509 certificates on https web sites, (no CVSS)
- [CVE-2010-4585](https://cve.now/CVE-2010-4585.md): Unspecified vulnerability in the auto-update functionality in Opera before 11.00 allows remote attackers to cause a denial of service (appli (no CVSS)
- [CVE-2010-4586](https://cve.now/CVE-2010-4586.md): The default configuration of Opera before 11.00 enables WebSockets functionality, which has unspecified impact and remote attack vectors, po (no CVSS)
- [CVE-2010-4587](https://cve.now/CVE-2010-4587.md): Opera before 11.00 on Windows does not properly implement the Insecure Third Party Module warning message, which might make it easier for us (no CVSS)
- [CVE-2010-0114](https://cve.now/CVE-2010-0114.md): fw\_charts.php in the reporting module in the Manager (aka SEPM) component in Symantec Endpoint Protection (SEP) 11.x before 11 RU6 MP2 allow (no CVSS)
- [CVE-2010-1676](https://cve.now/CVE-2010-1676.md): Heap-based buffer overflow in Tor before 0.2.1.28 and 0.2.2.x before 0.2.2.20-alpha allows remote attackers to cause a denial of service (da (no CVSS)
- [CVE-2010-4116](https://cve.now/CVE-2010-4116.md): Unspecified vulnerability in HP StorageWorks Storage Mirroring 5.x before 5.2.2.1771.2 allows remote attackers to execute arbitrary code via (no CVSS)
- [CVE-2010-4574](https://cve.now/CVE-2010-4574.md): The Pickle::Pickle function in base/pickle.cc in Google Chrome before 8.0.552.224 and Chrome OS before 8.0.552.343 on 64-bit Linux platforms (no CVSS)
- [CVE-2010-4575](https://cve.now/CVE-2010-4575.md): The ThemeInstalledInfoBarDelegate::Observe function in browser/extensions/theme\_installed\_infobar\_delegate.cc in Google Chrome before 8.0.55 (no CVSS)
- [CVE-2010-4576](https://cve.now/CVE-2010-4576.md): browser/worker\_host/message\_port\_dispatcher.cc in Google Chrome before 8.0.552.224 and Chrome OS before 8.0.552.343 does not properly handle (no CVSS)
- [CVE-2010-4577](https://cve.now/CVE-2010-4577.md): The CSSParser::parseFontFaceSrc function in WebCore/css/CSSParser.cpp in WebKit, as used in Google Chrome before 8.0.552.224, Chrome OS befo (CVSS 7.5)
- [CVE-2010-4578](https://cve.now/CVE-2010-4578.md): Google Chrome before 8.0.552.224 and Chrome OS before 8.0.552.343 do not properly perform cursor handling, which allows remote attackers to (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2010-12-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.