CVE-2009-10007 | Critical | 9.1 | 2026-06-09 | Catalyst::Plugin::Authentication versions before 0.10_027 for Perl is susceptible to session fixation attacks.
Catalyst::Plugin::Authentication does not autom… |
CVE-2009-20007 | | | 2025-09-16 | Talkative IRC v0.4.4.16 is vulnerable to a stack-based buffer overflow when processing specially crafted response strings sent to a connected client. An attack… |
CVE-2009-20006 | | | 2025-09-16 | osCommerce versions up to and including 2.2 RC2a contain a vulnerability in its administrative file manager utility (admin/file_manager.php). The interface all… |
CVE-2009-20005 | | | 2025-09-16 | A stack-based buffer overflow exists in the UtilConfigHome.csp endpoint of InterSystems Caché 2009.1. The vulnerability is triggered by sending a specially cra… |
CVE-2009-20011 | | | 2025-08-30 | ContentKeeper Web Appliance (now maintained by Impero Software) versions prior to 125.10 are vulnerable to remote command execution due to insecure handling of… |
CVE-2009-20010 | | | 2025-08-30 | Dogfood CRM version 2.0.10 contains a remote command execution vulnerability in the spell.php script used by its mail subsystem. The vulnerability arises from… |
CVE-2009-20009 | | | 2025-08-30 | Belkin Bulldog Plus version 4.0.2 build 1219 contains a stack-based buffer overflow vulnerability in its web service authentication handler. When a specially c… |
CVE-2009-20008 | | | 2025-08-30 | Green Dam Youth Escort version 3.17 is vulnerable to a stack-based buffer overflow when processing overly long URLs. The flaw resides in the URL filtering comp… |
CVE-2009-10006 | | | 2025-08-22 | UFO: Alien Invasion versions up to and including 2.2.1 contain a buffer overflow vulnerability in its built-in IRC client component. When the client connects t… |
CVE-2009-20004 | | | 2025-08-21 | gAlan 0.2.1, a modular audio processing environment for Windows, is vulnerable to a stack-based buffer overflow when parsing .galan files. The application fail… |
CVE-2009-20003 | | | 2025-08-21 | Xenorate versions up to and including 2.50, a Windows-based multimedia player, is vulnerable to a stack-based buffer overflow when processing .xpl playlist fil… |
CVE-2009-20002 | | | 2025-08-21 | Millenium MP3 Studio versions up to and including 2.0 is vulnerable to a stack-based buffer overflow when parsing .pls playlist files. The application fails to… |
CVE-2009-10005 | | | 2025-08-20 | ContentKeeper Web Appliance (now maintained by Impero Software) versions prior to 125.10 expose the mimencode binary via a CGI endpoint, allowing unauthenticat… |
CVE-2009-4123 | High | 7.5 | 2023-12-12 | The jruby-openssl gem before 0.6 for JRuby mishandles SSL certificate validation. |
CVE-2009-10004 | Low | 3.5 | 2023-04-10 | A vulnerability was found in Turante Sandbox Theme up to 1.5.2. It has been classified as problematic. This affects the function sandbox_body_class of the file… |
CVE-2009-10003 | Low | 3.5 | 2023-01-29 | A vulnerability was found in capnsquarepants wordcraft up to 0.6. It has been classified as problematic. Affected is an unknown function of the file tag.php. T… |
CVE-2009-10002 | Low | 3.5 | 2023-01-13 | A vulnerability, which was classified as problematic, has been found in dpup fittr-flickr. This issue affects some unknown processing of the file fittr-flickr/… |
CVE-2009-10001 | Low | 3.5 | 2023-01-13 | A vulnerability classified as problematic was found in jianlinwei cool-php-captcha up to 0.2. This vulnerability affects unknown code of the file example-form… |
CVE-2009-1143 | High | 7.0 | 2022-11-23 | An issue was discovered in open-vm-tools 2009.03.18-154848. Local users can bypass intended access restrictions on mounting shares via a symlink attack that le… |
CVE-2009-1142 | Medium | 6.7 | 2022-11-23 | An issue was discovered in open-vm-tools 2009.03.18-154848. Local users can gain privileges via a symlink attack on /tmp files if vmware-user-suid-wrapper is s… |
CVE-2009-0948 | Critical | 9.8 | 2021-06-02 | Multiple buffer overflows in the (1) cdf_read_sat, (2) cdf_read_long_sector_chain, and (3) cdf_read_ssat function in file before 5.02. |
CVE-2009-0947 | Critical | 9.8 | 2021-06-02 | Multiple integer overflows in the (1) cdf_read_property_info and (2) cdf_read_sat functions in file before 5.02. |
CVE-2009-3721 | High | 7.8 | 2021-05-26 | Multiple directory traversal and buffer overflow vulnerabilities were discovered in yTNEF, and in Evolution's TNEF parser that is derived from yTNEF. A crafted… |
CVE-2009-20001 | High | 8.1 | 2021-03-07 | An issue was discovered in MantisBT before 2.24.5. It associates a unique cookie string with each user. This string is not reset upon logout (i.e., the user se… |
CVE-2009-5159 | Medium | 6.1 | 2020-03-13 | Invision Power Board (aka IPB or IP.Board) 2.x through 3.0.4, when Internet Explorer 5 is used, allows XSS via a .txt attachment. |
CVE-2009-5140 | High | 8.8 | 2020-02-12 | The SIP implementation on the Linksys SPA2102 phone adapter provides hashed credentials in a response to an invalid authentication challenge, which makes it ea… |
CVE-2009-5139 | High | 7.5 | 2020-02-12 | The SIP implementation on the Gizmo5 software phone provides hashed credentials in a response to an invalid authentication challenge, which makes it easier for… |
CVE-2009-4067 | Medium | 6.8 | 2020-02-11 | Buffer overflow in the auerswald_probe function in the Auerswald Linux USB driver for the Linux kernel before 2.6.27 allows physically proximate attackers to e… |
CVE-2009-5068 | High | 7.2 | 2020-01-15 | There is a file disclosure vulnerability in SMF (Simple Machines Forum) affecting versions through v2.0.3. On some configurations a SMF deployment is shared by… |
CVE-2009-5025 | High | 7.5 | 2020-01-15 | A backdoor (aka BMSA-2009-07) was found in PyForum v1.0.3 where an attacker who knows a valid user email could force a password reset on behalf of that user. |
CVE-2009-3724 | Medium | 6.1 | 2020-01-15 | python-markdown2 before 1.0.1.14 has multiple cross-site scripting (XSS) issues. |
CVE-2009-1120 | Critical | 9.8 | 2020-01-15 | EMC RepliStor Server Service before ESA-09-003 has a DoASOCommand Remote Code Execution Vulnerability. The flaw exists within the DoRcvRpcCall RPC function -ex… |
CVE-2009-5004 | Medium | 6.5 | 2019-11-09 | qpid-cpp 1.0 crashes when a large message is sent and the Digest-MD5 mechanism with a security layer is in use . |
CVE-2009-4011 | High | 8.1 | 2019-11-09 | dtc-xen 0.5.x before 0.5.4 suffers from a race condition where an attacker could potentially get a bash access as xenXX user on the dom0, and then access a pot… |
CVE-2009-3614 | Low | 3.3 | 2019-11-09 | liboping 1.3.2 allows users reading arbitrary files upon the local system. |
CVE-2009-3552 | Low | 3.1 | 2019-11-09 | In RHEV-M VDC 2.2.0, it was found that the SSL certificate was not verified when using the client-side Red Hat Enterprise Virtualization Manager interface (a W… |
CVE-2009-2802 | Medium | 6.1 | 2019-11-09 | MantisBT 1.2.x before 1.2.2 insecurely handles attachments and MIME types. Arbitrary inline attachment rendering could lead to cross-domain scripting or other… |
CVE-2009-0035 | Medium | 5.5 | 2019-11-09 | alsa-utils 1.0.19 and later versions allows local users to overwrite arbitrary files via a symlink attack via the /usr/bin/alsa-info and /usr/bin/alsa-info.sh… |
CVE-2009-5046 | Medium | 6.1 | 2019-11-06 | JSP Dump and Session Dump Servlet XSS in jetty before 6.1.22. |
CVE-2009-5045 | High | 7.5 | 2019-11-06 | Dump Servlet information leak in jetty before 6.1.22. |
CVE-2009-5050 | High | 7.5 | 2019-11-06 | konversation before 1.2.3 allows attackers to cause a denial of service. |
CVE-2009-5049 | Medium | 6.1 | 2019-11-06 | WebApp JSP Snoop page XSS in jetty though 6.1.21. |
CVE-2009-5048 | Medium | 6.1 | 2019-11-06 | Cookie Dump Servlet stored XSS vulnerability in jetty though 6.1.20. |
CVE-2009-5043 | Critical | 9.8 | 2019-10-31 | burn allows file names to escape via mishandled quotation marks |
CVE-2009-5042 | Critical | 9.1 | 2019-10-31 | python-docutils allows insecure usage of temporary files |
CVE-2009-5041 | Critical | 9.8 | 2019-10-31 | overkill has buffer overflow via long player names that can corrupt data on the server machine |
CVE-2009-3887 | Critical | 9.8 | 2019-10-29 | ytnef has directory traversal |
CVE-2009-3723 | High | 7.5 | 2019-10-29 | asterisk allows calls on prohibited networks |
CVE-2009-4900 | Medium | 6.1 | 2019-10-28 | pixelpost 1.7.1 has XSS |
CVE-2009-4899 | Critical | 9.8 | 2019-10-28 | pixelpost 1.7.1 has SQL injection |
CVE-2009-5158 | Medium | 6.1 | 2019-08-22 | The google-analyticator plugin before 5.2.1 for WordPress has insufficient HTML sanitization for Google Analytics API text. |
CVE-2009-5157 | High | 8.8 | 2019-06-11 | On Linksys WAG54G2 1.00.10 devices, there is authenticated command injection via shell metacharacters in the setup.cgi c4_ping_ipaddr variable. |
CVE-2009-5156 | Critical | 9.8 | 2019-06-11 | An issue was discovered on ASMAX AR-804gu 66.34.1 devices. There is Command Injection via the cgi-bin/script query string. |
CVE-2009-5155 | High | 7.5 | 2019-02-26 | In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of ser… |
CVE-2009-5154 | Critical | 9.8 | 2019-02-09 | An issue was discovered on MOBOTIX S14 MX-V4.2.1.61 devices. There is a default password of meinsm for the admin account. |
CVE-2009-5153 | Critical | 9.8 | 2018-11-21 | In Novell NetWare before 6.5 SP8, a stack buffer overflow in processing of CALLIT RPC calls in the NFS Portmapper daemon in PKERNEL.NLM allowed remote unauthen… |
CVE-2009-5152 | Medium | 4.1 | 2018-05-11 | Absolute Computrace Agent, as distributed on certain Dell Inspiron systems through 2009, has a race condition with the Dell Client Configuration Utility (DCCU)… |
CVE-2009-5151 | Medium | 6.7 | 2018-05-11 | The stub component of Absolute Computrace Agent V70.785 executes code from a disk's inter-partition space without requiring a digital signature for that code… |
CVE-2009-5150 | Medium | 6.7 | 2018-05-11 | Absolute Computrace Agent V80.845 and V80.866 does not have a digital signature for the configuration block, which allows attackers to set up communication wit… |
CVE-2009-4267 | Medium | 6.5 | 2018-02-19 | The console in Apache jUDDI 3.0.0 does not properly escape line feeds, which allows remote authenticated users to spoof log entries via the numRows parameter. |
CVE-2009-5144 | High | 7.5 | 2018-02-03 | mod-gnutls does not validate client certificates when "GnuTLSClientVerify require" is set in a directory context, which allows remote attackers to spoof client… |
CVE-2009-1198 | Medium | 6.1 | 2017-10-30 | Cross-site scripting (XSS) vulnerability in Apache jUDDI before 2.0 allows remote attackers to inject arbitrary web script or HTML via the dsname parameter to… |
CVE-2009-1197 | Medium | 5.3 | 2017-10-30 | Apache jUDDI before 2.0 allows attackers to spoof entries in log files via vectors related to error logging of keys from uddiget.jsp. |
CVE-2009-5145 | Medium | 6.1 | 2017-08-07 | Cross-site scripting (XSS) vulnerability in ZMI pages that use the manage_tabs_message in Zope 2.11.4, 2.11.2, 2.10.9, 2.10.7, 2.10.6, 2.10.5, 2.10.4, 2.10.2… |
CVE-2009-5147 | High | 7.3 | 2017-03-29 | DL::dlopen in Ruby 1.8, 1.9.0, 1.9.2, 1.9.3, 2.0.0 before patchlevel 648, and 2.1 before 2.1.8 opens libraries with tainted names. |
CVE-2009-2197 | Medium | 4.3 | 2016-03-24 | Apple Safari before 9.1 allows remote attackers to spoof the user interface via a web page that places text in a crafted context, leading to unintended use of… |
CVE-2009-5149 | | | 2015-11-21 | Arris DG860A, TG862A, and TG862G devices with firmware TS0703128_100611 through TS0705125D_031115 have predictable technician passwords, which makes it easier… |
CVE-2009-5143 | | | 2015-08-04 | GE Healthcare Discovery 530C has a password of #bigguy1 for the (1) acqservice user and (2) wsservice user of the Xeleris System, which has unspecified impact… |
CVE-2009-5142 | | | 2014-08-21 | Cross-site scripting (XSS) vulnerability in timthumb.php in TimThumb 1.09 and earlier, as used in Mimbo Pro 2.3.1 and other products, allows remote attackers t… |
CVE-2009-5023 | | | 2014-06-10 | The (1) dshield.conf, (2) mail-buffered.conf, (3) mynetwatchman.conf, and (4) mynetwatchman.conf actions in action.d/ in Fail2ban before 0.8.5 allows local use… |
CVE-2009-5141 | | | 2014-04-01 | Format string vulnerability in War FTP Daemon (warftpd) 1.82 RC 12 allows remote authenticated users to cause a denial of service (crash) via format string spe… |
CVE-2009-5138 | | | 2014-03-07 | GnuTLS before 2.7.6, when the GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT flag is not enabled, treats version 1 X.509 certificates as intermediate CAs, which allows rem… |
CVE-2009-5137 | | | 2014-01-03 | Stack-based buffer overflow in Mini-stream CastRipper 2.50.70 allows remote attackers to execute arbitrary code via a long URL in the [playlist] section in a… |
CVE-2009-5136 | | | 2013-10-11 | The policy definition evaluator in Condor before 7.4.2 does not properly handle attributes in a WANT_SUSPEND policy that evaluate to an UNDEFINED state, which… |
CVE-2009-5029 | | | 2013-05-02 | Integer overflow in the __tzfile_read function in glibc before 2.15 allows context-dependent attackers to cause a denial of service (crash) and possibly execut… |
CVE-2009-5135 | | | 2013-05-02 | The Java XML parser in Echo before 2.1.1 and 3.x before 3.0.b6 allows remote attackers to read arbitrary files via a request containing an external entity decl… |
CVE-2009-5134 | | | 2013-01-18 | Buffer overflow in the "create torrent dialog" functionality in uTorrent 1.8.3 build 15772, and possibly other versions before 1.8.3 (Build 16010), allows user… |
CVE-2009-4738 | | | 2013-01-18 | Unspecified vulnerability in JustSystems Corporation ATOK 2006 through 2009 and ATOK flat-rate service, and Just Smile 4 with the ATOK Smile module, allows phy… |
CVE-2009-2899 | | | 2012-12-05 | The monitor perl script in the Sybase database plug-in in SpringSource Hyperic HQ before 4.3 allows local users to obtain the database password by listing the… |
CVE-2009-5067 | | | 2012-10-10 | Directory traversal vulnerability in html2ps before 1.0b6 allows remote attackers to read arbitrary files via a .. (dot dot) in the "include file" SSI directiv… |
CVE-2009-5132 | | | 2012-08-26 | The Filtering Service in Websense Web Security and Web Filter before 6.3.1 Hotfix 106 and 7.x before 7.1 allow remote attackers to cause a denial of service (f… |
CVE-2009-5131 | | | 2012-08-26 | The Receive Service in Websense Email Security before 7.1 does not recognize domain extensions in the blacklist, which allows remote attackers to bypass intend… |
CVE-2009-5130 | | | 2012-08-26 | The Rules Service in Websense Email Security before 7.1 allows remote attackers to cause a denial of service (service crash) via an attachment with a crafted s… |
CVE-2009-5129 | | | 2012-08-26 | The Websense V10000 appliance before 1.0.1 allows remote attackers to cause a denial of service (intermittent LDAP authentication outage) via a login attempt w… |
CVE-2009-5128 | | | 2012-08-26 | The Websense V10000 appliance before 1.0.1 allows remote attackers to cause a denial of service (memory consumption and process crash) via a large file that is… |
CVE-2009-5127 | | | 2012-08-26 | The Antivirus component in Comodo Internet Security before 3.8.64739.471 allows remote attackers to cause a denial of service (application crash) via a crafted… |
CVE-2009-5126 | | | 2012-08-26 | The Antivirus component in Comodo Internet Security before 3.8.65951.477 allows remote attackers to cause a denial of service (application crash) via a crafted… |
CVE-2009-5125 | | | 2012-08-26 | Comodo Internet Security before 3.9.95478.509 allows remote attackers to bypass malware detection in an RAR archive via an unspecified manipulation of the arch… |
CVE-2009-5124 | | | 2012-08-26 | The Antivirus component in Comodo Internet Security before 3.11.108364.552 allows remote attackers to cause a denial of service (application crash) via a craft… |
CVE-2009-5123 | | | 2012-08-26 | The Antivirus component in Comodo Internet Security before 3.11.108364.552 allows remote attackers to cause a denial of service (memory consumption) via a craf… |
CVE-2009-5122 | | | 2012-08-23 | The Personal Email Manager component in Websense Email Security before 7.2 allows remote attackers to obtain potentially sensitive information from the JBoss s… |
CVE-2009-5121 | | | 2012-08-23 | Websense Email Security 7.1 before Hotfix 4 allows remote attackers to bypass the sender-based blacklist by using the 8BITMIME EHLO keyword in the SMTP session. |
CVE-2009-5120 | | | 2012-08-23 | The default configuration of Apache Tomcat in Websense Manager in Websense Web Security 7.0 and Web Filter 7.0 allows connections to TCP port 1812 from arbitra… |
CVE-2009-5119 | | | 2012-08-23 | The default configuration of Apache Tomcat in Websense Manager in Websense Web Security 7.0 and Web Filter 7.0 enables weak SSL ciphers in conf/server.xml, whi… |
CVE-2009-5118 | | | 2012-08-22 | Untrusted search path vulnerability in McAfee VirusScan Enterprise before 8.7i allows local users to gain privileges via a Trojan horse DLL in an unspecified d… |
CVE-2009-5117 | | | 2012-08-22 | The Web Post Protection feature in McAfee Host Data Loss Prevention (DLP) 3.x before 3.0.100.10 and 9.x before 9.0.0.422, when HTTP Capture mode is enabled, al… |
CVE-2009-5116 | | | 2012-08-22 | McAfee LinuxShield 1.5.1 and earlier does not properly implement client authentication, which allows remote authenticated users to obtain Admin access to the s… |
CVE-2009-5115 | | | 2012-08-22 | McAfee Common Management Agent (CMA) 3.5.5 through 3.5.5.588 and 3.6.0 through 3.6.0.608, and McAfee Agent 4.0 before Patch 3, allows remote authenticated user… |
CVE-2009-5026 | | | 2012-08-17 | The executable comment feature in MySQL 5.0.x before 5.0.93 and 5.1.x before 5.1.50, when running in certain slave configurations in which the slave is running… |
CVE-2009-5066 | | | 2012-08-13 | twiddle.sh in JBoss AS 5.0 and EAP 5.0 and earlier accepts credentials as command-line arguments, which allows local users to read the credentials by listing t… |