Archive
May 2009
Vulnerabilities first published in this month (UTC), newest first.
364 results · Feed
-
Unscored —
Stack-based buffer overflow in the MPS.StormPlayer.1 ActiveX control in mps.dll 3.9.4.27 in Baofeng Storm allows remote…
-
Unscored —
Unspecified vulnerability in LimeSurvey before 1.82 allows remote attackers to execute commands and obtain sensitive da…
-
Unscored —
Multiple buffer overflows in Microchip MPLAB IDE 8.30 and possibly earlier versions allow user-assisted remote attacker…
-
Unscored —CVE-2009-1607 Public exploit
Cross-site scripting (XSS) vulnerability in the administrator panel in phpForm.net LinkBase 2.0 allows remote attackers…
-
Medium 5.4
Heap-based buffer overflow in the loadexponentialfunc function in mupdf/pdf_function.c in MuPDF in the mupdf-20090223-w…
-
Unscored —CVE-2009-1609 Public exploit
Unrestricted file upload vulnerability in admin/uploadform.asp in Battle Blog 1.25 allows remote attackers to execute a…
-
Unscored —CVE-2009-1610 Public exploit
admin/changepassword.php in Job Script Job Board Software 2.0 allows remote attackers to change the administrator passw…
-
Unscored —CVE-2009-1611 Public exploit
Stack-based buffer overflow in ElectraSoft 32bit FTP 09.04.24 allows remote FTP servers to execute arbitrary code via a…
-
Unscored —
Multiple stack-based and heap-based buffer overflows in Dafolo DafoloControl ActiveX control (DafoloFFControl.dll) 1.10…
-
Unscored —
src/tools/pkcs11-tool.c in pkcs11-tool in OpenSC 0.11.7, when used with unspecified third-party PKCS#11 modules, genera…
-
Unscored —
The domain-locking implementation in the GARMINAXCONTROL.GarminAxControl_t.1 ActiveX control in npGarmin.dll in the Gar…
-
Unscored —
Mozilla Firefox executes DOM calls in response to a javascript: URI in the target attribute of a submit element within …
-
Unscored —CVE-2009-1602 Public exploit
Pablo Software Solutions Quick 'n Easy Mail Server 3.3 allows remote attackers to cause a denial of service (daemon out…
-
Unscored —
Google Chrome executes DOM calls in response to a javascript: URI in the target attribute of a submit element within a …
-
Unscored —
The Ubuntu clamav-milter.init script in clamav-milter before 0.95.1+dfsg-1ubuntu1.2 in Ubuntu 9.04 sets the ownership o…
-
Unscored —
Opera executes DOM calls in response to a javascript: URI in the target attribute of a submit element within a form con…
-
Unscored —
Apple Safari executes DOM calls in response to a javascript: URI in the target attribute of a submit element within a f…
-
Unscored —
Integer overflow in the pango_glyph_string_set_size function in pango/glyphstring.c in Pango before 1.24 allows context…
-
Medium —CVE-2009-1595 Public exploit
Ignite Realtime Openfire Allows Users to Change Passwords of Arbitrary Accounts
The jabber:iq:auth implementation in IQAuthHandler.java in Ignite Realtime Openfire before 3.6.4 allows remote authenticated users to change the passwords of arbitrary accounts via a modified username element in a passwd_change action.
-
Unscored —
Ignite Realtime Openfire before 3.6.5 does not properly implement the register.password (aka canChangePassword) console…
-
Unscored —
Cross-site scripting (XSS) vulnerability in CGI RESCUE MiniBBS 8t before 8.95t, 8 before 8.95, 9 before 9.08, and 10 be…
-
Unscored —
Unspecified vulnerability in CGI RESCUE MiniBBS22 before 1.01 allows remote attackers to send email to arbitrary recipi…
-
Unscored —CVE-2009-1592 Public exploit
Stack-based buffer overflow in ElectraSoft 32bit FTP 09.04.24 allows remote FTP servers to execute arbitrary code via a…
-
Unscored —
Unspecified vulnerability in CGI RESCUE FORM2MAIL before 1.42 allows remote attackers to send email to arbitrary recipi…
-
Unscored —
CRLF injection vulnerability in CGI RESCUE Web Mailer before 1.04 allows remote attackers to inject arbitrary HTTP head…
-
Unscored —CVE-2008-6802 Public exploit
Multiple SQL injection vulnerabilities in index.php in phPhotoGallery 0.92 allow remote attackers to execute arbitrary …
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in Vivvo CMS before 4.0.4 allows remote attackers to hijack the authent…
-
Unscored —CVE-2008-6799 Public exploit
connection.php in FlashChat 5.0.8 allows remote attackers to bypass the role filter mechanism and gain administrative p…
-
Unscored —CVE-2009-1586 Public exploit
Stack-based buffer overflow in the NZB importer feature in GrabIt 1.7.2 Beta 3 and earlier allows remote attackers to e…
-
Unscored —CVE-2009-1587 Public exploit
index.php in PHP Site Lock 2.0 allows remote attackers to bypass authentication and obtain administrative access by set…
-
Unscored —CVE-2009-1584 Public exploit
Multiple SQL injection vulnerabilities in TemaTres 1.0.3 and 1.031, when magic_quotes_gpc is disabled, allow remote att…
-
Unscored —CVE-2009-1582 Public exploit
Million Dollar Text Links 1.0 does not properly restrict administrator access to admin.home.php, which allows remote at…
-
Unscored —CVE-2009-1583 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in TemaTres 1.0.3 and 1.031 allow remote attackers to inject arbitr…
-
Unscored —CVE-2009-1585 Public exploit
Multiple SQL injection vulnerabilities in TemaTres 1.031, when magic_quotes_gpc is disabled, allow remote attackers to …
-
Unscored —
The server in Mitel NuPoint Messenger R11 and R3 sends usernames and passwords in cleartext to Exchange servers, which …
-
Unscored —CVE-2008-6798 Public exploit
Multiple SQL injection vulnerabilities in login.php in Pre Projects Pre Real Estate Listings allow remote attackers to …
-
Unscored —CVE-2008-6794 Public exploit
SQL injection vulnerability in directory.php in Scripts For Sites (SFS) EZ Pub Site allows remote attackers to execute …
-
Unscored —CVE-2008-6795 Public exploit
SQL injection vulnerability in view_news.php in nicLOR Vibro-School-CMS allows remote attackers to execute arbitrary SQ…
-
Unscored —CVE-2008-6793 Public exploit
The get_file_type function in lib/file_content.php in DFLabs PTK 0.1, 0.2, and 1.0 allows remote attackers to execute a…
-
Unscored —
system-tools-backends before 2.6.0-1ubuntu1.1 in Ubuntu 8.10, as used by "Users and Groups" in GNOME System Tools, hash…