CVE-2010-0939
published 2010-03-08CVE-2010-0939: Visialis ABB Forum 1.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database…
PriorityP337medium5CVSS 2.0
AVNACLAuNCPINAN
EXPLOIT
EPSS
2.44%
82.3th percentile
Visialis ABB Forum 1.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for fpdb/abb.mdb.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| visialis | abb_forum | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Visialis ABB Forum 1.1 fpdb/abb.mdb access control (EDB-11096 / XFDB-55505)
vuldb·2026-05-02·CVSS 5.0
CVE-2010-0939 [MEDIUM] Visialis ABB Forum 1.1 fpdb/abb.mdb access control (EDB-11096 / XFDB-55505)
A vulnerability was found in Visialis ABB Forum 1.1 and classified as problematic. This affects an unknown part of the file fpdb/abb.mdb. The manipulation results in improper access controls.
This vulnerability was named CVE-2010-0939. The attack may be performed from remote. In addition, an exploit is available.
GHSA
GHSA-mwp8-f4m3-3rcf: Visialis ABB Forum 1
ghsa_unreviewed·2022-05-02
CVE-2010-0939 [MEDIUM] GHSA-mwp8-f4m3-3rcf: Visialis ABB Forum 1
Visialis ABB Forum 1.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for fpdb/abb.mdb.
No detection rules found.
Bugzilla
CVE-2010-3708 JBoss drools deserialization remote code execution
bugzilla·2010-09-14·CVSS 7.5
CVE-2010-3708 [HIGH] CVE-2010-3708 JBoss drools deserialization remote code execution
CVE-2010-3708 JBoss drools deserialization remote code execution
The drools serialization format allows to embed class files.
Upon deserialization those are loaded by the VM that runs
the drools engine. If that (attacker-controlled) class files
defines code in a static initializer it is executed during
deserialization.
Discussion:
This issue has been addressed in following products:
JBEAP 4.3.0 for RHEL 4
Via RHSA-2010:0937 https://rhn.redhat.com/errata/RHSA-2010-0937.html
---
This issue has been addressed in following products:
JBEAP 4.3.0 for RHEL 5
Via RHSA-2010:0938 https://rhn.redhat.com/errata/RHSA-2010-0938.html
---
This issue has been addressed in following products:
JBoss Enterprise Application Platform 4.3.0
Via RHSA-2010:0939 https://rhn.redhat.com/errata/RHSA-2010-
Bugzilla
CVE-2010-3878 JBoss EAP jmx console FileDeployment CSRF
bugzilla·2010-06-16·CVSS 4.3
CVE-2010-3878 [MEDIUM] CVE-2010-3878 JBoss EAP jmx console FileDeployment CSRF
CVE-2010-3878 JBoss EAP jmx console FileDeployment CSRF
A Cross-Site Request Forgery (CSRF) flaw was found in the JMX Console. A remote attacker could use this flaw to deploy a WAR file of their choosing on the target server, if they are able to trick a user, who is logged into the JMX Console as the admin user, into visiting a specially-crafted web page.
Discussion:
This issue has been addressed in following products:
JBEAP 4.3.0 for RHEL 4
Via RHSA-2010:0937 https://rhn.redhat.com/errata/RHSA-2010-0937.html
---
This issue has been addressed in following products:
JBEAP 4.3.0 for RHEL 5
Via RHSA-2010:0938 https://rhn.redhat.com/errata/RHSA-2010-0938.html
---
This issue has been addressed in following products:
JBoss Enterprise Application Platform 4.3.0
Via RHSA-2010:0939 htt
http://packetstormsecurity.org/1001-exploits/abbforums-dislclose.txthttp://www.exploit-db.com/exploits/11096https://exchange.xforce.ibmcloud.com/vulnerabilities/55505http://packetstormsecurity.org/1001-exploits/abbforums-dislclose.txthttp://www.exploit-db.com/exploits/11096https://exchange.xforce.ibmcloud.com/vulnerabilities/55505
2010-03-08
Published