CVE-2010-0189 json
A certain ActiveX control in NOS Microsystems getPlus Download Manager (aka DLM or Downloader) 1.5.2.35, as used in Adobe Download Manager,…
published 2010-02-23 16 y ago modified 2026-06-16 4 mo ago also EUVD-2010-0220
- cvss
- 9.3
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 5.2%
- EPSS 5.2% chance of exploitation in 30 days, percentile 92%
- public exploits
- 0
- none known
Summary
A certain ActiveX control in NOS Microsystems getPlus Download Manager (aka DLM or Downloader) 1.5.2.35, as used in Adobe Download Manager, improperly validates requests involving web sites that are not in subdomains, which allows remote attackers to force the download and installation of arbitrary programs via a crafted name for a download site.
Patch / fix
Exploit prediction
5.18% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
adobe.com
/support/security/bulletins/apsb10-08.html
patch, vendor-advisory
-
vupen.com
/english/advisories/2010/0459
vdb-entry, vendor-advisory
-
secunia.com
/advisories/38729
third-party-advisory, vendor-advisory
-
securitytracker.com
/id?1023651
vdb-entry
-
securityfocus.com
/bid/38313
vdb-entry
- blogs.zdnet.com /security/?p=5505
-
labs.idefense.com
/intelligence/vulnerabilities/display.php?id=856
third-party-advisory
- akitasecurity.nl /advisory.php?id=AK20090401
- aviv.raffon.net /2010/02/18/SkeletonsInAdobesSecurityCloset.aspx
- blogs.adobe.com /psirt/2010/02/adobe_download_manager_issue.html
-
oval.cisecurity.org
/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7182
vdb-entry, signature
-
osvdb.org
/62547
vdb-entry
-
exchange.xforce.ibmcloud.com
/vulnerabilities/56370
vdb-entry
Sources
- CVE List CVE-2010-0189
- NVD CVE-2010-0189
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.