2009 CVEs (page 44)
Page 44 of 50 — CVEs published in 2009, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2009-0081 | | 2009-03-10 | The graphics device interface (GDI) implementation in the kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, an… | |
CVE-2009-0868 | | 2009-03-10 | CRLF injection vulnerability in the WebLink template in Fujitsu Jasmine2000 Enterprise Edition allows remote attackers to inject arbitrary HTTP headers and con… | |
CVE-2009-0867 | | 2009-03-10 | The HRM-S service in Fujitsu Enhanced Support Facility 3.0 and 3.0.1 allows remote attackers to obtain (1) hardware and (2) software information via unspecifie… | |
CVE-2009-0866 | | 2009-03-10 | pHNews Alpha 1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a dir… | |
CVE-2009-0865 | | 2009-03-10 | Directory traversal vulnerability in the SnapShotToFile method in the GeoVision LiveX (aka LiveX_v8200) ActiveX control 8.1.2 and 8.2.0 in LIVEX_~1.OCX allows… | |
CVE-2009-0864 | | 2009-03-10 | S-Cms 1.1 Stable allows remote attackers to bypass authentication and obtain administrative access via an OK value for the login cookie. | |
CVE-2009-0863 | | 2009-03-10 | SQL injection vulnerability in admin/delete_page.php in S-Cms 1.1 Stable allows remote attackers to execute arbitrary SQL commands via the id parameter. | |
CVE-2009-0862 | | 2009-03-10 | Cross-site scripting (XSS) vulnerability in the hook_cntrlr_error_output function in modules/page/hooks/listeners.php in the admincp component in TangoCMS 2.2… | |
CVE-2009-0861 | | 2009-03-10 | Cross-site scripting (XSS) vulnerability in phpDenora before 1.2.3 allows remote attackers to inject arbitrary web script or HTML via an IRC channel name. NOT… | |
CVE-2009-0860 | | 2009-03-10 | Cross-site scripting (XSS) vulnerability in the web user interface in the login application in NetMRI 3.0.1 and earlier allows remote attackers to inject arbit… | |
CVE-2009-0859 | | 2009-03-09 | The shm_get_stat function in ipc/shm.c in the shm subsystem in the Linux kernel before 2.6.28.5, when CONFIG_SHMEM is disabled, misinterprets the data type of… | |
CVE-2009-0858 | | 2009-03-09 | The response_addname function in response.c in Daniel J. Bernstein djbdns 1.05 and earlier does not constrain offsets in the required manner, which allows remo… | |
CVE-2009-0857 | | 2009-03-09 | Cross-site scripting (XSS) vulnerability in /prm/reports in the Performance Reporting Module (PRM) for Sun Management Center (SunMC) 3.6.1 and 4.0 allows remot… | |
CVE-2009-0856 | | 2009-03-09 | Multiple cross-site scripting (XSS) vulnerabilities in sample applications in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.35, and 6.1 before 6.1… | |
CVE-2009-0855 | | 2009-03-09 | Cross-site scripting (XSS) vulnerability in the administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.23 on z/OS allows remote atta… | |
CVE-2009-0825 | | 2009-03-09 | SQL injection vulnerability in system/rss.php in TinX/cms 3.x before 3.5.1 allows remote attackers to execute arbitrary SQL commands via the id parameter. | |
CVE-2009-0781 | | 2009-03-09 | Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat 4.1.0 through 4.1.39… | |
CVE-2009-0537 | | 2009-03-09 | Integer overflow in the fts_build function in fts.c in libc in (1) OpenBSD 4.4 and earlier and (2) Microsoft Interix 6.0 build 10.0.6030.0 allows context-depen… | |
CVE-2009-0027 | | 2009-03-09 | The request handler in JBossWS in JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP06 and 4.3 before 4.3.0.CP04 does not prope… | |
CVE-2009-0853 | | 2009-03-09 | login.php in CelerBB 0.0.2, when magic_quotes_gpc is disabled, allows remote attackers to bypass authentication and obtain administrative access via special ch… | |
CVE-2009-0852 | | 2009-03-09 | showme.php in CelerBB 0.0.2 allows remote attackers to obtain "reserved information" via the user parameter. | |
CVE-2009-0851 | | 2009-03-09 | Multiple SQL injection vulnerabilities in CelerBB 0.0.2, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the id… | |
CVE-2009-0850 | | 2009-03-09 | Cross-site scripting (XSS) vulnerability in BitDefender Internet Security 2009 allows user-assisted remote attackers to inject arbitrary web script or HTML via… | |
CVE-2009-0849 | | 2009-03-09 | Stack-based buffer overflow in the DtbClsLogin function in NovaStor NovaNET 12 allows remote attackers to (1) execute arbitrary code on Linux platforms via a l… | |
CVE-2009-0838 | | 2009-03-06 | The crypto pseudo device driver in Sun Solaris 10, and OpenSolaris snv_88 through snv_102, does not properly free memory, which allows local users to cause a d… | |
CVE-2009-0835 | | 2009-03-06 | The __secure_computing function in kernel/seccomp.c in the seccomp subsystem in the Linux kernel 2.6.28.7 and earlier on the x86_64 platform, when CONFIG_SECCO… | |
CVE-2009-0834 | | 2009-03-06 | The audit_syscall_entry function in the Linux kernel 2.6.28.7 and earlier on the x86_64 platform does not properly handle (1) a 32-bit process making a 64-bit… | |
CVE-2009-0770 | | 2009-03-06 | dkim-milter 2.6.0 through 2.8.0 allows remote attackers to cause a denial of service (crash) by signing a message with a key that has been revoked in DNS, whic… | |
CVE-2009-0769 | | 2009-03-06 | QIP 2005 build 8082 allows remote attackers to cause a denial of service (CPU consumption and application hang) via a crafted Rich Text Format (RTF) ICQ messag… | |
CVE-2009-0768 | | 2009-03-06 | SQL injection vulnerability in forumhop.php in YapBB 1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the forumID parameter in a n… | |
CVE-2009-0767 | | 2009-03-06 | Kipper 2.01 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a file containing crede… | |
CVE-2009-0766 | | 2009-03-06 | Directory traversal vulnerability in default.php in Kipper 2.01 allows remote attackers to include and execute arbitrary local files via directory traversal se… | |
CVE-2009-0765 | | 2009-03-06 | Directory traversal vulnerability in index.php in Kipper 2.01 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the co… | |
CVE-2009-0764 | | 2009-03-06 | Multiple cross-site scripting (XSS) vulnerabilities in Kipper 2.01 allow remote attackers to inject arbitrary web script or HTML via the charm parameter to (1)… | |
CVE-2009-0763 | | 2009-03-06 | Cross-site scripting (XSS) vulnerability in default.php in Kipper 2.01 allows remote attackers to inject arbitrary web script or HTML via the charm parameter. | |
CVE-2009-0762 | | 2009-03-06 | Cross-site scripting (XSS) vulnerability in ScriptsEz Ez PHP Comment allows remote attackers to inject arbitrary web script or HTML via the name parameter. NO… | |
CVE-2009-0761 | | 2009-03-06 | Cross-site scripting (XSS) vulnerability in online.asp in Team Board 1.x allows remote attackers to inject arbitrary web script or HTML via the lookname parame… | |
CVE-2009-0760 | | 2009-03-06 | Team Board 1.x and 2.x stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database c… | |
CVE-2009-0833 | | 2009-03-05 | Heap-based buffer overflow in gen_msn.dll in the gen_msn plugin 0.31 for Winamp 5.541 allows remote attackers to execute arbitrary code via a playlist (.pls) f… | |
CVE-2009-0832 | | 2009-03-05 | SQL injection vulnerability in items.php in the E-Cart module 1.3 for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the CA parameter. | |
CVE-2009-0831 | | 2009-03-05 | SQL injection vulnerability in members.php in the Members CV (job) module 1.0 for PHP-Fusion, when magic_quotes_gpc is disabled, allows remote authenticated us… | |
CVE-2009-0830 | | 2009-03-05 | Cross-site scripting (XSS) vulnerability in QuoteBook allows remote attackers to inject arbitrary web script or HTML via the (1) QuoteName and (2) QuoteText pa… | |
CVE-2009-0829 | | 2009-03-05 | Multiple SQL injection vulnerabilities in QuoteBook allow remote attackers to execute arbitrary SQL commands via the (1) MyBox and (2) selectFavorites paramete… | |
CVE-2009-0828 | | 2009-03-05 | QuoteBook stores quotes.inc under the web root with insufficient access control, which allows remote attackers to obtain sensitive database information, includ… | |
CVE-2009-0827 | | 2009-03-05 | PollHelper stores poll.inc under the web root with insufficient access control, which allows remote attackers to download the database file containing user cre… | |
CVE-2009-0826 | | 2009-03-05 | BlogHelper stores common_db.inc under the web root with insufficient access control, which allows remote attackers to download the database file containing use… | |
CVE-2009-0821 | | 2009-03-05 | Mozilla Firefox 2.0.0.20 and earlier allows remote attackers to cause a denial of service (application crash) via nested calls to the window.print function, as… | |
CVE-2009-0820 | | 2009-03-05 | Multiple eval injection vulnerabilities in phpScheduleIt before 1.2.11 allow remote attackers to execute arbitrary code via (1) the end_date parameter to reser… | |
CVE-2009-0819 | | 2009-03-05 | sql/item_xmlfunc.cc in MySQL 5.1 before 5.1.32 and 6.0 before 6.0.10 allows remote authenticated users to cause a denial of service (crash) via "an XPath expre… | |
CVE-2009-0818 | | 2009-03-05 | Cross-site scripting (XSS) vulnerability in the taxonomy_theme_admin_table_builder function (taxonomy_theme_admin.inc) in Taxonomy Theme module before 5.x-1.2… | |
CVE-2009-0817 | | 2009-03-05 | Cross-site scripting (XSS) vulnerability in the Protected Node module 5.x before 5.x-1.4 and 6.x before 6.x-1.5, a module for Drupal, allows remote authenticat… | |
CVE-2009-0816 | | 2009-03-05 | Multiple cross-site scripting (XSS) vulnerabilities in the backend user interface in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1 before 4.1.10, 4.2 befor… | |
CVE-2009-0815 | | 2009-03-05 | The jumpUrl mechanism in class.tslib_fe.php in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1 before 4.1.10, 4.2 before 4.2.6, and 4.3alpha1 leaks a hash se… | |
CVE-2009-0814 | | 2009-03-05 | Cross-site scripting (XSS) vulnerability in Widgets.aspx in Blogsa 1.0 Beta 3 and earlier allows remote attackers to inject arbitrary web script or HTML via th… | |
CVE-2009-0813 | | 2009-03-05 | Insecure method vulnerability in the ImeraIEPlugin ActiveX control (ImeraIEPlugin.dll 1.0.2.54) in Imera TeamLinks Client allows remote attackers to force the… | |
CVE-2009-0777 | | 2009-03-05 | Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 decode invisible characters when they are displayed in the location bar… | |
CVE-2009-0776 | | 2009-03-05 | nsIRDFService in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 allows remote attackers to bypass the same-origin polic… | |
CVE-2009-0775 | | 2009-03-05 | Double free vulnerability in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 allows remote attackers to execute arbitrar… | |
CVE-2009-0774 | | 2009-03-05 | The layout engine in Mozilla Firefox 2 and 3 before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey 1.1.15 allows remote attackers to cause a denial of servi… | |
CVE-2009-0773 | | 2009-03-05 | The JavaScript engine in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey 1.1.15 allows remote attackers to cause a denial of service (… | |
CVE-2009-0772 | | 2009-03-05 | The layout engine in Mozilla Firefox 2 and 3 before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey 1.1.15 allows remote attackers to cause a denial of servi… | |
CVE-2009-0771 | | 2009-03-05 | The layout engine in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey 1.1.15 allows remote attackers to cause a denial of service (cras… | |
CVE-2009-0619 | | 2009-03-05 | Unspecified vulnerability in the Session Border Controller (SBC) before 3.0(2) for Cisco 7600 series routers allows remote attackers to cause a denial of servi… | |
CVE-2009-0578 | | 2009-03-05 | GNOME NetworkManager before 0.7.0.99 does not properly verify privileges for dbus (1) modify and (2) delete requests, which allows local users to change or rem… | |
CVE-2009-0367 | | 2009-03-05 | The Python AI module in Wesnoth 1.4.x and 1.5 before 1.5.11 allows remote attackers to escape the sandbox and execute arbitrary code by using a whitelisted mod… | |
CVE-2009-0365 | | 2009-03-05 | nm-applet.conf in GNOME NetworkManager before 0.7.0.99 contains an incorrect deny setting, which allows local users to discover (1) network connection password… | |
CVE-2009-0186 | | 2009-03-05 | Integer overflow in libsndfile 1.0.18, as used in Winamp and other products, allows context-dependent attackers to execute arbitrary code via crafted descripti… | |
CVE-2009-0037 | | 2009-03-05 | The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPT_FOLLOWLOCATION is enabled, accepts arbitrary Location values, which might all… | |
CVE-2009-0812 | | 2009-03-04 | Stack-based buffer overflow in BreakPoint Software Hex Workshop 4.23, 6.0.1.4603, and other 6.x and earlier versions allows remote attackers to execute arbitra… | |
CVE-2009-0811 | | 2009-03-04 | Insecure method vulnerability in the SopCast SopCore ActiveX control in sopocx.ocx 3.0.3.501 allows remote attackers to execute arbitrary programs via an execu… | |
CVE-2009-0810 | | 2009-03-04 | SQL injection vulnerability in login.php in xGuestbook 2.0 allows remote attackers to execute arbitrary SQL commands via the user parameter. | |
CVE-2009-0809 | | 2009-03-04 | The Web Editor in Dassault Systemes ENOVIA SmarTeam V5 before Release 18 Service Pack 8, and possibly CATIA and other products, allows remote authenticated use… | |
CVE-2009-0808 | | 2009-03-04 | Multiple SQL injection vulnerabilities in SimpleCMMS before 0.1.0 allow remote attackers to execute arbitrary SQL commands via unspecified vectors. | |
CVE-2009-0807 | | 2009-03-04 | zFeeder 1.6 allows remote attackers to gain administrative access via a direct request to admin.php. | |
CVE-2009-0806 | | 2009-03-04 | Unspecified vulnerability in OpenGoo before 1.2.1 allows remote authenticated users to modify their own permissions via unknown attack vectors. | |
CVE-2009-0805 | | 2009-03-04 | Cross-site scripting (XSS) vulnerability in piCal 0.91h and earlier, a module for XOOPS, allows remote attackers to inject arbitrary web script or HTML via the… | |
CVE-2009-0804 | | 2009-03-04 | Ziproxy 2.6.0, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote endpoint, which allows remote attackers to bypa… | |
CVE-2009-0803 | | 2009-03-04 | SmoothWall SmoothGuardian, as used in SmoothWall Firewall, NetworkGuardian, and SchoolGuardian 2008, when transparent interception mode is enabled, uses the HT… | |
CVE-2009-0802 | | 2009-03-04 | Qbik WinGate, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote endpoint, which allows remote attackers to bypas… | |
CVE-2009-0801 | | 2009-03-04 | Squid, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote endpoint, which allows remote attackers to bypass acces… | |
CVE-2009-0780 | | 2009-03-04 | The aspath_prepend function in rde_attr.c in bgpd in OpenBSD 4.3 and 4.4 allows remote attackers to cause a denial of service (application crash) via an Autono… | |
CVE-2009-0779 | | 2009-03-04 | Buffer overflow in pppdial in IBM AIX 5.3 and 6.1 allows local users to gain privileges via a long "input string." | |
CVE-2009-0759 | | 2009-03-03 | Multiple CRLF injection vulnerabilities in webadmin in ZNC before 0.066 allow remote authenticated users to modify the znc.conf configuration file and gain pri… | |
CVE-2009-0758 | | 2009-03-03 | The originates_from_local_legacy_unicast_socket function in avahi-core/server.c in avahi-daemon 0.6.23 does not account for the network byte order of a port nu… | |
CVE-2009-0757 | | 2009-03-03 | Multiple buffer overflows in GNU MPFR 2.4.0 allow context-dependent attackers to cause a denial of service (crash) via the (1) mpfr_snprintf and (2) mpfr_vsnpr… | |
CVE-2009-0756 | | 2009-03-03 | The JBIG2Stream::readSymbolDictSeg function in Poppler before 0.10.4 allows remote attackers to cause a denial of service (crash) via a PDF file that triggers… | |
CVE-2009-0755 | | 2009-03-03 | The FormWidgetChoice::loadDefaults function in Poppler before 0.10.4 allows remote attackers to cause a denial of service (crash) via a PDF file with an invali… | |
CVE-2009-0754 | | 2009-03-03 | PHP 4.4.4, 5.1.6, and other versions, when running on Apache, allows local users to modify behavior of other sites hosted on the same web server by modifying t… | |
CVE-2009-0753 | | 2009-03-03 | Absolute path traversal vulnerability in MLDonkey 2.8.4 through 2.9.7 allows remote attackers to read arbitrary files via a leading "//" (double slash) in the… | |
CVE-2009-0752 | | 2009-03-03 | Unspecified vulnerability in Movable Type Pro and Community Solution 4.x before 4.24 has unknown impact and attack vectors, possibly related to the password re… | |
CVE-2009-0751 | | 2009-03-02 | Yaws before 1.80 allows remote attackers to cause a denial of service (memory consumption and crash) via a request with a large number of headers. | |
CVE-2009-0750 | | 2009-03-02 | SQL injection vulnerability in login.php in the smNews example script for txtSQL 2.2 Final allows remote attackers to execute arbitrary SQL commands via the us… | |
CVE-2009-0368 | | 2009-03-02 | OpenSC before 0.11.7 allows physically proximate attackers to bypass intended PIN requirements and read private data objects via a (1) low level APDU command o… | |
CVE-2009-0749 | High | 7.8 | 2009-03-02 | Use-after-free vulnerability in the GIFReadNextExtension function in lib/pngxtern/gif/gifread.c in OptiPNG 0.6.2 and earlier allows context-dependent attackers… |
CVE-2009-0748 | | 2009-02-27 | The ext4_fill_super function in fs/ext4/super.c in the Linux kernel 2.6.27 before 2.6.27.19 and 2.6.28 before 2.6.28.7 does not validate the superblock configu… | |
CVE-2009-0747 | | 2009-02-27 | The ext4_isize function in fs/ext4/ext4.h in the Linux kernel 2.6.27 before 2.6.27.19 and 2.6.28 before 2.6.28.7 uses the i_size_high structure member during o… | |
CVE-2009-0746 | | 2009-02-27 | The make_indexed_dir function in fs/ext4/namei.c in the Linux kernel 2.6.27 before 2.6.27.19 and 2.6.28 before 2.6.28.7 does not validate a certain rec_len fie… | |
CVE-2009-0745 | | 2009-02-27 | The ext4_group_add function in fs/ext4/resize.c in the Linux kernel 2.6.27 before 2.6.27.19 and 2.6.28 before 2.6.28.7 does not properly initialize the group d… | |
CVE-2009-0744 | | 2009-02-27 | Apple Safari 4 Beta build 528.16 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a feeds: URI beginni… | |
CVE-2009-0743 | | 2009-02-27 | Cross-site scripting (XSS) vulnerability in the edit account page in the Web Server in Cisco Unified MeetingPlace Web Conferencing 6.0 before 6.0(517.0) (aka 6… |