CVSS: 5.0EPSS: 0%CPEs: 2EXPL: 0CVE-2010-2791 – httpd: Reverse proxy sends wrong responses after time-outs
https://notcve.org/view.php?id=CVE-2010-2791
mod_proxy in httpd in Apache HTTP Server 2.2.9, when running on Unix, does not close the backend connection if a timeout occurs when reading a response from a persistent connection, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request. NOTE: this is the same issue as CVE-2010-2068, but for a different OS and set of affected versions. mod_proxy en httpd del servidor HTTP Apache v2.2.9, cuando se ejecuta en Unix, no cierra la conexión interna si se produce un fin de tiempo de espera al leer una respuesta de una conexión persistente, lo que permite a atacantes remotos obtener una respuesta potencialmente sensibles, destinada a un cliente diferente en circunstancias oportunistas a través de una petición HTTP normal. NOTA: este es el mismo problema que CVE-2010-2068, pero para un Sistema Operativo diferente y un conjunto de versiones afectadas. • http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 http://www.openwall.com/lists/oss-security/2010/07/30/1 http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html http://www.redhat.com/support/errata/RHSA-2010-0659.html http://www.securityfocus.com/bid/42102 https://exchange.xforce.ibmcloud.com/vulnerabilities/60883 https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E https://lists.apache.org/thread.html&# • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 240EXPL: 0CVE-2010-2665
https://notcve.org/view.php?id=CVE-2010-2665
Cross-site scripting (XSS) vulnerability in Opera before 10.54 on Windows and Mac OS X, and before 10.11 on UNIX platforms, allows remote attackers to inject arbitrary web script or HTML via a data: URI, related to incorrect detection of the "opening site." Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en Opera anterior a v10.54 en Windows y Mac OS X, y anterior a v10.11 en las plataformas UNIX, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de un data: URI, relacionados con la detección incorrecta de "opening site" (abriendo sitio). • http://secunia.com/advisories/40250 http://www.opera.com/docs/changelogs/mac/1054 http://www.opera.com/docs/changelogs/unix/1011 http://www.opera.com/docs/changelogs/windows/1054 http://www.opera.com/support/kb/view/955 http://www.securityfocus.com/bid/40973 http://www.vupen.com/english/advisories/2010/1529 https://exchange.xforce.ibmcloud.com/vulnerabilities/60646 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11362 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 243EXPL: 0CVE-2010-2661
https://notcve.org/view.php?id=CVE-2010-2661
Opera before 10.54 on Windows and Mac OS X, and before 10.60 on UNIX platforms, does not properly restrict access to the full pathname of a file selected for upload, which allows remote attackers to obtain potentially sensitive information via unspecified DOM manipulations. Opera anterior a v10.54 en Windows y Mac OS X, y anterior a v10.60 en las plataformas UNIX, no restringe adecuadamente el acceso a la ruta completa de un archivo seleccionado para la carga, lo cual permite a atacantes remotos obtener información sensible a través de manipulaciones DOM no especificados. • http://secunia.com/advisories/40250 http://www.opera.com/docs/changelogs/mac/1054 http://www.opera.com/docs/changelogs/unix/1060 http://www.opera.com/docs/changelogs/windows/1054 http://www.opera.com/support/search/view/960 http://www.securityfocus.com/bid/40973 http://www.vupen.com/english/advisories/2010/1529 http://www.vupen.com/english/advisories/2010/1673 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11669 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 238EXPL: 0CVE-2010-2659
https://notcve.org/view.php?id=CVE-2010-2659
Opera before 10.50 on Windows, before 10.52 on Mac OS X, and before 10.60 on UNIX platforms makes widget properties accessible to third-party domains, which allows remote attackers to obtain potentially sensitive information via a crafted web site. Opera anterior a v10.50 en Windows, anterior a v10.52 en Mac OS X, y anterior a v10.60 en plataformas UNIX hace accesibles las propiedades de los widges a dominios de terceros, lo cual permite a los atacantes remotos obtener información potencialmente sensible a través de sitios web manipulados. • http://www.opera.com/docs/changelogs/mac/1052 http://www.opera.com/docs/changelogs/unix/1060 http://www.opera.com/docs/changelogs/windows/1050 http://www.opera.com/support/search/view/959 http://www.vupen.com/english/advisories/2010/1673 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11096 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 243EXPL: 0CVE-2010-2660
https://notcve.org/view.php?id=CVE-2010-2660
Opera before 10.54 on Windows and Mac OS X, and before 10.60 on UNIX platforms, does not properly restrict certain uses of homograph characters in domain names, which makes it easier for remote attackers to spoof IDN domains via unspecified choices of characters. Opera anterior a v10.54 en Windows y Mac OS X, y anterior a v10.60 en las plataformas UNIX, no limita propiamente determinados usos de los caracteres en los nombres de dominio homógrafos, lo cual facilita a los atacantes remotos suplantar dominios IDN a través de opciones no especificadas de caracteres. • http://secunia.com/advisories/40250 http://www.opera.com/docs/changelogs/mac/1054 http://www.opera.com/docs/changelogs/unix/1060 http://www.opera.com/docs/changelogs/windows/1054 http://www.opera.com/support/search/view/961 http://www.securityfocus.com/bid/40973 http://www.vupen.com/english/advisories/2010/1529 http://www.vupen.com/english/advisories/2010/1673 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11603 • CWE-264: Permissions, Privileges, and Access Controls •