Archive
June 2009
Vulnerabilities first published in this month (UTC), newest first.
450 results · Feed
-
Unscored —
SQL injection vulnerability in the References database (t3references) extension 0.1.1 and earlier for TYPO3 allows remo…
-
Unscored —
SQL injection vulnerability in the Frontend MP3 Player (fe_mp3player) 0.2.3 and earlier extension for TYPO3 allows remo…
-
Unscored —
SQL injection vulnerability in the Virtual Civil Services (civserv) extension 4.3.2 and earlier for TYPO3 allows remote…
-
Unscored —CVE-2009-2101 Public exploit
Directory traversal vulnerability in archive.php in TorrentVolve 1.4, when register_globals is enabled, allows remote a…
-
Unscored —
SQL injection vulnerability in system/application/controllers/catalog.php in Zoki Soft Zoki Catalog (aka Smart Catalog)…
-
Unscored —
Directory traversal vulnerability in the JoomlaPraise Projectfork (com_projectfork) component 2.0.10 for Joomla! allows…
-
Unscored —CVE-2009-2095 Public exploit
PHP remote file inclusion vulnerability in template/simpledefault/admin/_masterlayout.php in Mundi Mail 0.8.2, when reg…
-
Unscored —
Buffer overflow in the RTL8169 NIC driver (drivers/net/r8169.c) in the Linux kernel before 2.6.30 allows remote attacke…
-
Unscored —
The Aqua Look and Feel for Java implementation in Java 1.5 on Mac OS X 10.5 allows remote attackers to execute arbitrar…
-
Unscored —
The message engine in CA ARCserve Backup r12.0 and r12.0 SP1 for Windows allows remote attackers to cause a denial of s…
-
Unscored —CVE-2009-1391 Public exploit
Off-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2.017, as used in AMaViS,…
-
Unscored —
Simple Linux Utility for Resource Management (SLURM) 1.2 and 1.3 before 1.3.14 does not properly set supplementary grou…
-
Medium 5.3CVE-2008-5515 EPSS 19%
Directory Traversal in Apache Tomcat
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass int…
-
Unscored —
Mutt 1.5.19, when linked against (1) OpenSSL (mutt_ssl.c) or (2) GnuTLS (mutt_ssl_gnutls.c), allows connections when on…
-
Unscored —
SQL injection vulnerability in insidepage.php in Creative Web Solutions Multi-Level CMS 1.21 allows remote attackers to…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the term data detail page in Taxonomy manager 5.x before 5.x-1.2, a module …
-
Unscored —
Worldweaver DX Studio Player 3.0.29.0, 3.0.22.0, 3.0.12.0, and probably other versions before 3.0.29.1, when used as a …
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Booktree 5.x before 5.x-7.3 and 6.x before 6.x-1.1, a module for…
-
Unscored —CVE-2009-2081 Public exploit
Directory traversal vulnerability in help.php in phpWebThings 1.5.2 and earlier, when magic_quotes_gpc is disabled, all…
-
Unscored —
Cross-site scripting (XSS) vulnerability in Views 6.x before 6.x-2.6, a module for Drupal, allows remote authenticated …
-
Unscored —CVE-2009-2080 Public exploit
admin.php in MRCGIGUY The Ticket System 2.0 does not properly restrict access, which allows remote attackers to (1) obt…
-
Unscored —
Drupal 6.x before 6.x-2.6, a module for Drupal, allows remote authenticated users to bypass access restrictions and (1)…
-
Unscored —
Cross-site scripting (XSS) vulnerability in Nodequeue 5.x before 5.x-2.7 and 6.x before 6.x-2.2, a module for Drupal, a…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the administrative page interface in Taxonomy manager 5.x before 5.x-1.2 an…
-
Unscored —
Nodequeue 5.x before 5.x-2.7 and 6.x before 6.x-2.2, a module for Drupal, does not properly restrict access when displa…
-
Unscored —
Google Chrome before 1.0.154.53 displays a cached certificate for a (1) 4xx or (2) 5xx CONNECT response page returned b…
-
Unscored —
Apple Safari detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-…
-
Unscored —
Mozilla Firefox before 3.0.10 processes a 3xx HTTP CONNECT response before a successful SSL handshake, which allows man…
-
Unscored —
Microsoft Internet Explorer before 8 displays a cached certificate for a (1) 4xx or (2) 5xx CONNECT response page retur…
-
Unscored —
Opera displays a cached certificate for a (1) 4xx or (2) 5xx CONNECT response page returned by a proxy server, which al…
-
Unscored —
Opera, possibly before 9.25, processes a 3xx HTTP CONNECT response before a successful SSL handshake, which allows man-…
-
Unscored —
Opera detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle …
-
Unscored —
Apple Safari does not require a cached certificate before displaying a lock icon for an https web site, which allows ma…
-
Unscored —
Opera, possibly before 9.25, uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or …
-
Unscored —
Microsoft Internet Explorer 8, and possibly other versions, detects http content in https web pages only when the top-l…
-
Unscored —
Microsoft Internet Explorer before 8 uses the HTTP Host header to determine the context of a document provided in a (1)…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in Linksys WRT160N wireless router hardware 1 and firmware 1.02.2 allow…
-
Unscored —
Mozilla Firefox 3.0.10, and possibly other versions, detects http content in https web pages only when the top-level fr…
-
Unscored —
src/net/http/http_transaction_winhttp.cc in Google Chrome before 1.0.154.53 uses the HTTP Host header to determine the …
-
Unscored —
Apple Safari before 3.2.2 uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2)…