Vulnerabilities > High

DATE CVE VULNERABILITY TITLE RISK
2010-07-30 CVE-2010-2753 Use After Free vulnerability in multiple products
Integer overflow in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1, and SeaMonkey before 2.0.6 allows remote attackers to execute arbitrary code via a large selection attribute in a XUL tree element, which triggers a use-after-free.
network
low complexity
mozilla suse opensuse CWE-416
8.8
2010-07-30 CVE-2010-1208 Use After Free vulnerability in Mozilla Firefox and Seamonkey
Use-after-free vulnerability in the attribute-cloning functionality in the DOM implementation in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, and SeaMonkey before 2.0.6, allows remote attackers to execute arbitrary code via vectors related to deletion of an event attribute node with a nonzero reference count.
network
low complexity
mozilla CWE-416
8.8
2010-07-22 CVE-2010-2772 Use of Hard-coded Credentials vulnerability in Siemens Simatic PCS 7 and Simatic Wincc
Siemens Simatic WinCC and PCS 7 SCADA system uses a hard-coded password, which allows local users to access a back-end database and gain privileges, as demonstrated in the wild in July 2010 by the Stuxnet worm, a different vulnerability than CVE-2010-2568.
local
low complexity
siemens CWE-798
7.8
2010-07-22 CVE-2010-2568 Unspecified vulnerability in Microsoft products
Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1) .LNK or (2) .PIF shortcut file, which is not properly handled during icon display in Windows Explorer, as demonstrated in the wild in July 2010, and originally reported for malware that leverages CVE-2010-2772 in Siemens WinCC SCADA systems.
local
low complexity
microsoft
7.8
2010-06-16 CVE-2010-2073 Use of Hard-coded Credentials vulnerability in Debian Pyftpd 0.8.4
auth_db_config.py in Pyftpd 0.8.4 contains hard-coded usernames and passwords for the (1) test, (2) user, and (3) roxon accounts, which allows remote attackers to read arbitrary files from the FTP server.
network
low complexity
debian CWE-798
7.5
2010-06-08 CVE-2010-1297 Out-of-bounds Write vulnerability in multiple products
Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, related to authplay.dll and the ActionScript Virtual Machine 2 (AVM2) newfunction instruction, as exploited in the wild in June 2010.
local
low complexity
adobe suse opensuse CWE-787
7.8
2010-05-13 CVE-2010-1283 Out-of-bounds Write vulnerability in Adobe Shockwave Player
Adobe Shockwave Player before 11.5.7.609 does not properly parse 3D objects in .dir (aka Director) files, which allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a modified field in a 0xFFFFFF49 record.
network
low complexity
adobe CWE-787
8.8
2010-05-13 CVE-2010-1281 Out-of-bounds Write vulnerability in Adobe Shockwave Player
iml32.dll in Adobe Shockwave Player before 11.5.7.609 does not validate a certain value from a file before using it in file-pointer calculations, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted .dir (aka Director) file.
network
low complexity
adobe CWE-787
8.8
2010-05-13 CVE-2010-1280 Out-of-bounds Write vulnerability in Adobe Shockwave Player
Adobe Shockwave Player before 11.5.7.609 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted .dir (aka Director) file, related to (1) an erroneous dereference and (2) a certain Shock.dir file.
network
low complexity
adobe CWE-787
8.8
2010-05-13 CVE-2010-0987 Out-of-bounds Write vulnerability in Adobe Shockwave Player
Heap-based buffer overflow in Adobe Shockwave Player before 11.5.7.609 might allow remote attackers to execute arbitrary code via crafted embedded fonts in a Shockwave file.
network
low complexity
adobe CWE-787
8.8