4.3

CVE-2010-4388

The (1) Upsell.htm, (2) Main.html, and (3) Custsupport.html components in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.5, and RealPlayer Enterprise 2.1.2 and 2.1.3 allow remote attackers to inject code into the RealOneActiveXObject process, and consequently bypass intended Local Machine Zone restrictions and load arbitrary ActiveX controls, via unspecified vectors.

Data is provided by the National Vulnerability Database (NVD)
Realnetworks ≫ Realplayer Version11.0
Realnetworks ≫ Realplayer Version11.0.1
Realnetworks ≫ Realplayer Version11.0.2
Realnetworks ≫ Realplayer Version11.0.3
Realnetworks ≫ Realplayer Version11.0.4
Realnetworks ≫ Realplayer Version11.0.5
Realnetworks ≫ Realplayer Version11.1
Realnetworks ≫ Realplayer Sp Version1.0.0
Realnetworks ≫ Realplayer Sp Version1.0.1
Realnetworks ≫ Realplayer Sp Version1.0.2
Realnetworks ≫ Realplayer Sp Version1.0.5
Realnetworks ≫ Realplayer Sp Version1.1
Realnetworks ≫ Realplayer Sp Version1.1.1
Realnetworks ≫ Realplayer Sp Version1.1.2
Realnetworks ≫ Realplayer Sp Version1.1.3
Realnetworks ≫ Realplayer Sp Version1.1.4
Realnetworks ≫ Realplayer Sp Version1.1.5
Realnetworks ≫ Realplayer Version2.1.2 Editionenterprise
Realnetworks ≫ Realplayer Version2.1.3 Editionenterprise
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.39% 0.568
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.