{"api_version":"1","generated_at":"2026-07-23T08:44:43+00:00","cve":"CVE-2010-0189","urls":{"html":"https://cve.report/CVE-2010-0189","api":"https://cve.report/api/cve/CVE-2010-0189.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2010-0189","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2010-0189"},"summary":{"title":"CVE-2010-0189","description":"A certain ActiveX control in NOS Microsystems getPlus Download Manager (aka DLM or Downloader) 1.5.2.35, as used in Adobe Download Manager, improperly validates requests involving web sites that are not in subdomains, which allows remote attackers to force the download and installation of arbitrary programs via a crafted name for a download site.","state":"PUBLISHED","assigner":"adobe","published_at":"2010-02-23 20:30:00","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-20","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"9.3","severity":"","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:C/I:C/A:C","baseScore":9.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"}}],"references":[{"url":"http://www.vupen.com/english/advisories/2010/0459","name":"http://www.vupen.com/english/advisories/2010/0459","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.adobe.com/support/security/bulletins/apsb10-08.html","name":"http://www.adobe.com/support/security/bulletins/apsb10-08.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"Adobe - Security Bulletins: APSB10-08 Security update available for Adobe Download Manager","mime":"text/xml","httpstatus":"200","archivestatus":"200"},{"url":"http://www.akitasecurity.nl/advisory.php?id=AK20090401","name":"http://www.akitasecurity.nl/advisory.php?id=AK20090401","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"getPlus insufficient domain name validation vulnerability - Security advisories - Akita Software Security","mime":"text/xml","httpstatus":"200","archivestatus":"200"},{"url":"http://www.osvdb.org/62547","name":"http://www.osvdb.org/62547","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://blogs.adobe.com/psirt/2010/02/adobe_download_manager_issue.html","name":"http://blogs.adobe.com/psirt/2010/02/adobe_download_manager_issue.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Adobe Download Manager issue  - Adobe Product Security Incident Response Team (PSIRT)","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://securitytracker.com/id?1023651","name":"http://securitytracker.com/id?1023651","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityTracker.com Archives - Adobe Download Manager Flaw Lets Remote Users Download and Install Arbitrary Software","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/38729","name":"http://secunia.com/advisories/38729","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Adobe getPlus DLM Unauthorised Installation Vulnerability - Advisories - Community","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/56370","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/56370","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=856","name":"http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=856","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Public Advisory: 02.23.10 // iDefense Labs","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://aviv.raffon.net/2010/02/18/SkeletonsInAdobesSecurityCloset.aspx","name":"http://aviv.raffon.net/2010/02/18/SkeletonsInAdobesSecurityCloset.aspx","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Aviv Raff On .NET - Skeletons in Adobe's security closet","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/38313","name":"http://www.securityfocus.com/bid/38313","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"NOS getPlus Downloader Domain Validation Arbitrary File Download Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://blogs.zdnet.com/security/?p=5505","name":"http://blogs.zdnet.com/security/?p=5505","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Skeletons in Adobe's security closet | ZDNet","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7182","name":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7182","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Repository  /  Oval Repository","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-0189","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-0189","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2010","cve_id":"189","vulnerable":"1","versionEndIncluding":"1.6.2.60","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"adobe","cpe5":"download_manager","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2010","cve_id":"189","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"nos_microsystems","cpe5":"getplus_download_manager","cpe6":"1.5.2.35","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T00:37:54.133Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.adobe.com/support/security/bulletins/apsb10-08.html"},{"name":"1023651","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://securitytracker.com/id?1023651"},{"name":"38313","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/38313"},{"name":"ADV-2010-0459","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2010/0459"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://blogs.zdnet.com/security/?p=5505"},{"name":"20100223 Multiple Vendor NOS Microsystems getPlus Downloader Input Validation Vulnerability","tags":["third-party-advisory","x_refsource_IDEFENSE","x_transferred"],"url":"http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=856"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.akitasecurity.nl/advisory.php?id=AK20090401"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://aviv.raffon.net/2010/02/18/SkeletonsInAdobesSecurityCloset.aspx"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://blogs.adobe.com/psirt/2010/02/adobe_download_manager_issue.html"},{"name":"38729","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/38729"},{"name":"oval:org.mitre.oval:def:7182","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred"],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7182"},{"name":"62547","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/62547"},{"name":"adobe-dlmanager-unspecified-file-download(56370)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/56370"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2010-02-18T00:00:00.000Z","descriptions":[{"lang":"en","value":"A certain ActiveX control in NOS Microsystems getPlus Download Manager (aka DLM or Downloader) 1.5.2.35, as used in Adobe Download Manager, improperly validates requests involving web sites that are not in subdomains, which allows remote attackers to force the download and installation of arbitrary programs via a crafted name for a download site."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-09-18T12:57:01.000Z","orgId":"078d4453-3bcd-4900-85e6-15281da43538","shortName":"adobe"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"http://www.adobe.com/support/security/bulletins/apsb10-08.html"},{"name":"1023651","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://securitytracker.com/id?1023651"},{"name":"38313","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/38313"},{"name":"ADV-2010-0459","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2010/0459"},{"tags":["x_refsource_MISC"],"url":"http://blogs.zdnet.com/security/?p=5505"},{"name":"20100223 Multiple Vendor NOS Microsystems getPlus Downloader Input Validation Vulnerability","tags":["third-party-advisory","x_refsource_IDEFENSE"],"url":"http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=856"},{"tags":["x_refsource_MISC"],"url":"http://www.akitasecurity.nl/advisory.php?id=AK20090401"},{"tags":["x_refsource_MISC"],"url":"http://aviv.raffon.net/2010/02/18/SkeletonsInAdobesSecurityCloset.aspx"},{"tags":["x_refsource_MISC"],"url":"http://blogs.adobe.com/psirt/2010/02/adobe_download_manager_issue.html"},{"name":"38729","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/38729"},{"name":"oval:org.mitre.oval:def:7182","tags":["vdb-entry","signature","x_refsource_OVAL"],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7182"},{"name":"62547","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/62547"},{"name":"adobe-dlmanager-unspecified-file-download(56370)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/56370"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@adobe.com","ID":"CVE-2010-0189","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"A certain ActiveX control in NOS Microsystems getPlus Download Manager (aka DLM or Downloader) 1.5.2.35, as used in Adobe Download Manager, improperly validates requests involving web sites that are not in subdomains, which allows remote attackers to force the download and installation of arbitrary programs via a crafted name for a download site."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://www.adobe.com/support/security/bulletins/apsb10-08.html","refsource":"CONFIRM","url":"http://www.adobe.com/support/security/bulletins/apsb10-08.html"},{"name":"1023651","refsource":"SECTRACK","url":"http://securitytracker.com/id?1023651"},{"name":"38313","refsource":"BID","url":"http://www.securityfocus.com/bid/38313"},{"name":"ADV-2010-0459","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2010/0459"},{"name":"http://blogs.zdnet.com/security/?p=5505","refsource":"MISC","url":"http://blogs.zdnet.com/security/?p=5505"},{"name":"20100223 Multiple Vendor NOS Microsystems getPlus Downloader Input Validation Vulnerability","refsource":"IDEFENSE","url":"http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=856"},{"name":"http://www.akitasecurity.nl/advisory.php?id=AK20090401","refsource":"MISC","url":"http://www.akitasecurity.nl/advisory.php?id=AK20090401"},{"name":"http://aviv.raffon.net/2010/02/18/SkeletonsInAdobesSecurityCloset.aspx","refsource":"MISC","url":"http://aviv.raffon.net/2010/02/18/SkeletonsInAdobesSecurityCloset.aspx"},{"name":"http://blogs.adobe.com/psirt/2010/02/adobe_download_manager_issue.html","refsource":"MISC","url":"http://blogs.adobe.com/psirt/2010/02/adobe_download_manager_issue.html"},{"name":"38729","refsource":"SECUNIA","url":"http://secunia.com/advisories/38729"},{"name":"oval:org.mitre.oval:def:7182","refsource":"OVAL","url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7182"},{"name":"62547","refsource":"OSVDB","url":"http://www.osvdb.org/62547"},{"name":"adobe-dlmanager-unspecified-file-download(56370)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/56370"}]}}}},"cveMetadata":{"assignerOrgId":"078d4453-3bcd-4900-85e6-15281da43538","assignerShortName":"adobe","cveId":"CVE-2010-0189","datePublished":"2010-02-23T20:00:00.000Z","dateReserved":"2010-01-06T00:00:00.000Z","dateUpdated":"2024-08-07T00:37:54.133Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2010-02-23 20:30:00","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-20","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:C/I:C/A:C","baseScore":9.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.6,"impactScore":10,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:nos_microsystems:getplus_download_manager:1.5.2.35:*:*:*:*:*:*:*","matchCriteriaId":"8C521C4C-822C-4308-B1C7-FE0795441F5F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:adobe:download_manager:*:*:*:*:*:*:*:*","versionEndIncluding":"1.6.2.60","matchCriteriaId":"952B9AE6-57AC-4096-8865-A239C74A0AA4"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2010","CveId":"189","Ordinal":"1","Title":"CVE-2010-0189","CVE":"CVE-2010-0189","Year":"2010"},"notes":[{"CveYear":"2010","CveId":"189","Ordinal":"1","NoteData":"A certain ActiveX control in NOS Microsystems getPlus Download Manager (aka DLM or Downloader) 1.5.2.35, as used in Adobe Download Manager, improperly validates requests involving web sites that are not in subdomains, which allows remote attackers to force the download and installation of arbitrary programs via a crafted name for a download site.","Type":"Description","Title":"CVE-2010-0189"},{"CveYear":"2010","CveId":"189","Ordinal":"2","NoteData":"2010-02-23","Type":"Other","Title":"Published"},{"CveYear":"2010","CveId":"189","Ordinal":"3","NoteData":"2017-09-18","Type":"Other","Title":"Modified"}]}}}