Archive
March 2009
Vulnerabilities first published in this month (UTC), newest first.
553 results · Feed
-
Unscored —CVE-2009-0827 Public exploit
PollHelper stores poll.inc under the web root with insufficient access control, which allows remote attackers to downlo…
-
Unscored —CVE-2009-0829 Public exploit
Multiple SQL injection vulnerabilities in QuoteBook allow remote attackers to execute arbitrary SQL commands via the (1…
-
Unscored —
Integer overflow in libsndfile 1.0.18, as used in Winamp and other products, allows context-dependent attackers to exec…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Protected Node module 5.x before 5.x-1.4 and 6.x before 6.x-1.5, a modu…
-
Unscored —
The layout engine in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey 1.1.15 allows remote atta…
-
Unscored —
nm-applet.conf in GNOME NetworkManager before 0.7.0.99 contains an incorrect deny setting, which allows local users to …
-
Unscored —
The layout engine in Mozilla Firefox 2 and 3 before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey 1.1.15 allows rem…
-
Unscored —
sql/item_xmlfunc.cc in MySQL 5.1 before 5.1.32 and 6.0 before 6.0.10 allows remote authenticated users to cause a denia…
-
Unscored —
The JavaScript engine in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey 1.1.15 allows remote …
-
Unscored —CVE-2009-0814 Public exploit
Cross-site scripting (XSS) vulnerability in Widgets.aspx in Blogsa 1.0 Beta 3 and earlier allows remote attackers to in…
-
Unscored —
The layout engine in Mozilla Firefox 2 and 3 before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey 1.1.15 allows rem…
-
Medium —
Typo3 Backend XSS Vulnerability
Multiple cross-site scripting (XSS) vulnerabilities in the backend user interface in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1 before 4.1.10, 4.2 before 4.2.6, and 4.3alpha1 allow remote attackers to inject arbitrary web script or HTML via unspecified…
-
Unscored —
nsIRDFService in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 allows remote a…
-
Medium —
TYPO3 leaks a hash secret in an error message
The jumpUrl mechanism in class.tslib_fe.php in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1 before 4.1.10, 4.2 before 4.2.6, and 4.3alpha1 leaks a hash secret (juHash) in an error message, which allows remote attackers to read arbitrary files by includin…
-
Unscored —
The Python AI module in Wesnoth 1.4.x and 1.5 before 1.5.11 allows remote attackers to escape the sandbox and execute a…
-
Unscored —
GNOME NetworkManager before 0.7.0.99 does not properly verify privileges for dbus (1) modify and (2) delete requests, w…
-
Unscored —
Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 decode invisible characters when…
-
Unscored —CVE-2009-0037 Public exploit
The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPT_FOLLOWLOCATION is enabled, accepts ar…
-
Unscored —
Unspecified vulnerability in the Session Border Controller (SBC) before 3.0(2) for Cisco 7600 series routers allows rem…
-
Unscored —
Double free vulnerability in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 all…
-
Unscored —CVE-2009-0813 Public exploit
Insecure method vulnerability in the ImeraIEPlugin ActiveX control (ImeraIEPlugin.dll 1.0.2.54) in Imera TeamLinks Clie…
-
Unscored —CVE-2009-0820 Public exploit
Multiple eval injection vulnerabilities in phpScheduleIt before 1.2.11 allow remote attackers to execute arbitrary code…
-
Unscored —CVE-2009-0821 Public exploit
Mozilla Firefox 2.0.0.20 and earlier allows remote attackers to cause a denial of service (application crash) via neste…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the taxonomy_theme_admin_table_builder function (taxonomy_theme_admin.inc) …
-
Unscored —CVE-2008-6394 Public exploit
SQL injection vulnerability in core/user.php in CS-Cart 1.3.5 and earlier allows remote attackers to execute arbitrary …
-
Unscored —CVE-2008-6396 Public exploit
Cross-site scripting (XSS) vulnerability in account.php in Celerondude Uploader 6.1 allows remote attackers to inject a…
-
Unscored —
The web management interface in 3Com Wireless 8760 Dual Radio 11a/b/g PoE Access Point allows remote attackers to cause…
-
Unscored —
rlatex in AlcoveBook sgml2x 1.0.0 allows local users to overwrite arbitrary files via a symlink attack on temporary fil…
-
Unscored —
sng_regress in SNG 1.0.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/recompile…
-
Unscored —CVE-2009-0807 Public exploit
zFeeder 1.6 allows remote attackers to gain administrative access via a direct request to admin.php.
-
Unscored —CVE-2009-0810 Public exploit
SQL injection vulnerability in login.php in xGuestbook 2.0 allows remote attackers to execute arbitrary SQL commands vi…
-
Unscored —
Cross-site scripting (XSS) vulnerability in piCal 0.91h and earlier, a module for XOOPS, allows remote attackers to inj…
-
Unscored —CVE-2009-0812 Public exploit
Stack-based buffer overflow in BreakPoint Software Hex Workshop 4.23, 6.0.1.4603, and other 6.x and earlier versions al…
-
Unscored —
The Web Editor in Dassault Systemes ENOVIA SmarTeam V5 before Release 18 Service Pack 8, and possibly CATIA and other p…
-
Unscored —
Multiple SQL injection vulnerabilities in SimpleCMMS before 0.1.0 allow remote attackers to execute arbitrary SQL comma…
-
Unscored —CVE-2009-0811 Public exploit
Insecure method vulnerability in the SopCast SopCore ActiveX control in sopocx.ocx 3.0.3.501 allows remote attackers to…
-
Unscored —
Unspecified vulnerability in OpenGoo before 1.2.1 allows remote authenticated users to modify their own permissions via…
-
Unscored —
Qbik WinGate, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote endpoint…
-
Unscored —
SmoothWall SmoothGuardian, as used in SmoothWall Firewall, NetworkGuardian, and SchoolGuardian 2008, when transparent i…
-
Unscored —
Squid, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote endpoint, which…