{"id":"CVE-2010-4388","url":"https://www.cyber-defence.io/tools/cve/CVE-2010-4388","generatedAt":"2026-10-27T20:52:22.159Z","title":"The (1) Upsell.htm, (2) Main.html, and (3) Custsupport.html components in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.5, and RealPlayer Enterprise 2.1.2 and 2.1.3 allow remote attackers to inject code into the…","description":"The (1) Upsell.htm, (2) Main.html, and (3) Custsupport.html components in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.5, and RealPlayer Enterprise 2.1.2 and 2.1.3 allow remote attackers to inject code into the RealOneActiveXObject process, and consequently bypass intended Local Machine Zone restrictions and load arbitrary ActiveX controls, via unspecified vectors.","published":"2010-12-14T16:00:05.000Z","lastModified":"2026-06-16T23:24:42.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"2.0","score":4.3,"severity":"MEDIUM","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N"},"cwe":["CWE-20"],"affected":["realnetworks/realplayer","realnetworks/realplayer sp"],"epss":{"score":0.01464,"percentile":0.73459,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (1.46%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"http://osvdb.org/69857","source":"cve@mitre.org"},{"url":"http://osvdb.org/69858","source":"cve@mitre.org"},{"url":"http://osvdb.org/69859","source":"cve@mitre.org"},{"url":"http://service.real.com/realplayer/security/12102010_player/en/","tags":["Vendor Advisory"],"source":"cve@mitre.org"},{"url":"http://www.securitytracker.com/id?1024861","source":"cve@mitre.org"},{"url":"http://www.zerodayinitiative.com/advisories/ZDI-10-276","source":"cve@mitre.org"},{"url":"http://www.zerodayinitiative.com/advisories/ZDI-10-277","source":"cve@mitre.org"},{"url":"http://www.zerodayinitiative.com/advisories/ZDI-10-278","source":"cve@mitre.org"},{"url":"http://osvdb.org/69857","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://osvdb.org/69858","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://osvdb.org/69859","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://service.real.com/realplayer/security/12102010_player/en/","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securitytracker.com/id?1024861","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.zerodayinitiative.com/advisories/ZDI-10-276","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.zerodayinitiative.com/advisories/ZDI-10-277","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.zerodayinitiative.com/advisories/ZDI-10-278","source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2010-4388","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}