{"id":"CVE-2010-4254","aliases":["EUVD-2010-4227","GHSA-2fxv-5465-p76g"],"status":"published","title":"Mono, when Moonlight before 2.3.0.1 or 2.99.x before 2.99.0.10 is used, does not properly...","description":"Mono, when Moonlight before 2.3.0.1 or 2.99.x before 2.99.0.10 is used, does not properly validate arguments to generic methods, which allows remote attackers to bypass generic constraints, and possibly execute arbitrary code, via a crafted method call.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.13649,"percentile":0.96509,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-20"],"published":"2010-12-03T20:00:00Z","modified":"2026-06-16T23:24:26Z","exploits":[{"source":"exploitdb","id":"EDB-15974","title":"Mono/Moonlight Generic Type Argument - Privilege Escalation","type":"dos","platform":"linux","date":"2011-01-11","verified":true,"url":"https://www.exploit-db.com/exploits/15974"}],"products":[{"vendor":"mono","product":"mono"},{"vendor":"novell","product":"moonlight"}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00003.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"http://secunia.com/advisories/42373","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://www.mono-project.com/Vulnerabilities#Moonlight_Generic_Constraints_Bypass_Vulnerability","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.exploit-db.com/exploits/15974","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"url":"https://bugzilla.novell.com/show_bug.cgi?id=655847","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://secunia.com/advisories/42877","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"https://github.com/mono/mono/commit/4905ef1130feb26c3150b28b97e4a96752e0d399","tags":["x_refsource_CONFIRM","x_transferred","Patch"]},{"url":"https://github.com/mono/mono/commit/cf1ec146f7c6acdc6697032b3aaafc68ffacdcac","tags":["x_refsource_CONFIRM","x_transferred","Patch"]},{"url":"http://www.securityfocus.com/bid/45051","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.vupen.com/english/advisories/2011/0076","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://github.com/mono/mono/commit/65292a69c837b8a5f7a392d34db63de592153358","tags":["x_refsource_CONFIRM","x_transferred","Patch"]},{"url":"https://bugzilla.novell.com/show_bug.cgi?id=654136","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-4254"},{"url":"https://github.com/advisories/GHSA-2fxv-5465-p76g"}],"sources":{"cve":[{"id":"CVE-2010-4254","description":"Mono, when Moonlight before 2.3.0.1 or 2.99.x before 2.99.0.10 is used, does not properly validate arguments to generic methods, which allows remote attackers to bypass generic constraints, and possibly execute arbitrary code, via a crafted method call.","status":"published","published":"2010-12-03T20:00:00Z","modified":"2024-08-07T03:34:37.992Z","updated_at":"2026-11-02T14:33:28.50039Z"}],"euvd":[{"id":"EUVD-2010-4227","description":"Mono, when Moonlight before 2.3.0.1 or 2.99.x before 2.99.0.10 is used, does not properly validate arguments to generic methods, which allows remote attackers to bypass generic constraints, and possibly execute arbitrary code, via a crafted method call.","status":"published","published":"2010-12-03T20:00:00Z","modified":"2024-08-07T03:34:37Z","updated_at":"2026-11-03T01:39:31.025742Z"}],"ghsa":[{"id":"GHSA-2fxv-5465-p76g","title":"Mono, when Moonlight before 2.3.0.1 or 2.99.x before 2.99.0.10 is used, does not properly...","description":"Mono, when Moonlight before 2.3.0.1 or 2.99.x before 2.99.0.10 is used, does not properly validate arguments to generic methods, which allows remote attackers to bypass generic constraints, and possibly execute arbitrary code, via a crafted method call.","status":"published","published":"2022-05-17T05:43:50Z","modified":"2023-01-28T05:04:18Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:44:09.057427Z"}],"nvd":[{"id":"CVE-2010-4254","description":"Mono, when Moonlight before 2.3.0.1 or 2.99.x before 2.99.0.10 is used, does not properly validate arguments to generic methods, which allows remote attackers to bypass generic constraints, and possibly execute arbitrary code, via a crafted method call.","status":"published","published":"2010-12-06T13:44:54.157Z","modified":"2026-06-16T23:24:26.833Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:00.37682Z"}]}}