Archive
July 2009
Vulnerabilities first published in this month (UTC), newest first.
446 results · Feed
-
Unscored —
WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the …
-
Unscored —
SmartFilter Web Gateway Security 4.2.1.00 stores user credentials in cleartext in admin_backup.xml files and uses insec…
-
Unscored —CVE-2009-2428 Public exploit
Multiple SQL injection vulnerabilities in Tausch Ticket Script 3 allow remote attackers to execute arbitrary SQL comman…
-
Unscored —
Tor before 0.2.0.35 allows remote attackers to cause a denial of service (application crash) via a malformed router des…
-
Unscored —CVE-2009-2423 Public exploit
SQL injection vulnerability in category.php in Ebay Clone 2009 allows remote attackers to execute arbitrary SQL command…
-
Unscored —CVE-2009-2427 Public exploit
SQL injection vulnerability in co-profile.php in Jobbr 2.2.7 allows remote attackers to execute arbitrary SQL commands …
-
Unscored —
Unspecified vulnerability in auditconfig in Sun Solaris 8, 9, 10, and OpenSolaris snv_01 through snv_58, when Solaris A…
-
Unscored —CVE-2009-2424 Public exploit
Cross-site scripting (XSS) vulnerability in search.php in Ebay Clone 2009 allows remote attackers to inject arbitrary w…
-
Unscored —
The connection_edge_process_relay_cell_not_open function in src/or/relay.c in Tor 0.2.x before 0.2.0.35 and 0.1.x befor…
-
Unscored —CVE-2009-1891 EPSS 17%
The mod_deflate module in Apache httpd 2.2.11 and earlier compresses large files until completion even after the associ…
-
Unscored —CVE-2009-2386 Public exploit
Insecure method vulnerability in Awingsoft Awakening Winds3D Viewer plugin 3.5.0.0, 3.0.0.5, and possibly other version…
-
Critical 9.8
rails vulnerable to improper authentication
The example code for the digest authentication functionality (http_authentication.rb) in Ruby on Rails before 2.3.3 defines an authenticate_or_request_with_http_digest block that returns nil instead of false when the user does not exist, which allows context-…
-
Unscored —
Untrusted search path vulnerability in Agent/Backend.pm in Ocsinventory-Agent before 0.0.9.3, and 1.x before 1.0.1, in …
-
Unscored —CVE-2009-1724 Public exploit
Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0.2, as used on iPhone OS before 3.1, iPhon…
-
Unscored —
WebKit in Apple Safari before 4.0.2, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other …
-
Unscored —CVE-2009-2390 Public exploit
SQL injection vulnerability in the BookFlip (com_bookflip) component 2.1 for Joomla! allows remote attackers to execute…
-
Unscored —CVE-2009-2395 Public exploit
SQL injection vulnerability in the K2 (com_k2) component 1.0.1 Beta and earlier for Joomla! allows remote attackers to …
-
Unscored —CVE-2009-2394 Public exploit
SQL injection vulnerability in cat.php in SMSPages 1.0 in Mr.Saphp Arabic Script Mobile (aka Messages Library) 2.0 allo…
-
Unscored —CVE-2009-2388 Public exploit
SQL injection vulnerability in admin/index.php in Opial 1.0 allows remote attackers to execute arbitrary SQL commands v…
-
Unscored —
Unspecified vulnerability in the proc filesystem in Sun OpenSolaris snv_49 through snv_109 allows local users to cause …
-
Unscored —CVE-2009-2399 Public exploit
PHP remote file inclusion vulnerability in dm-albums/template/album.php in DM FileManager 3.9.4, when register_globals …
-
Unscored —CVE-2009-2396 Public exploit
PHP remote file inclusion vulnerability in template/album.php in DM Albums 1.9.2, as used standalone or as a WordPress …
-
Unscored —CVE-2009-2402 Public exploit
SQL injection vulnerability in index.php in the forum module in PHPEcho CMS 2.0-rc3 allows remote attackers to execute …
-
Unscored —CVE-2009-2401 Public exploit
Cross-site scripting (XSS) vulnerability in PHPEcho CMS 2.0-rc3 allows remote attackers to inject arbitrary web script …
-
Unscored —CVE-2009-2400 Public exploit
SQL injection vulnerability in the PHP (com_php) component for Joomla! allows remote attackers to execute arbitrary SQL…
-
Unscored —
Apple Safari 3.2.3 does not properly implement the file: protocol handler, which allows remote attackers to read arbitr…
-
Unscored —CVE-2009-2398 Public exploit
Directory traversal vulnerability in test/index.php in PHP-Sugar 0.80 allows remote attackers to read arbitrary files v…
-
Unscored —CVE-2009-2419 Public exploit
Use-after-free vulnerability in the servePendingRequests function in WebCore in WebKit in Apple Safari 4.0 and 4.0.1 al…
-
Unscored —CVE-2009-2392 Public exploit
SQL injection vulnerability in text.php in Virtuenetz Virtue Online Test Generator allows remote attackers to execute a…
-
Unscored —CVE-2009-2391 Public exploit
Cross-site scripting (XSS) vulnerability in text.php in Virtuenetz Virtue Online Test Generator allows remote attackers…
-
Unscored —
The CFCharacterSetInitInlineBuffer method in CoreFoundation.dll in Apple Safari 3.2.3 allows remote attackers to cause …
-
Unscored —CVE-2009-2393 Public exploit
admin/index.php in Virtuenetz Virtue Online Test Generator does not require administrative privileges, which allows rem…
-
Unscored —CVE-2009-2389 Public exploit
Multiple SQL injection vulnerabilities in newsscript.php in USOLVED NEWSolved 1.1.6, when magic_quotes_gpc is disabled,…
-
Unscored —CVE-2009-2403 Public exploit
Heap-based buffer overflow in SCMPX 1.5.1 allows remote attackers to cause a denial of service (application crash) or e…
-
Unscored —CVE-2009-2397 Public exploit
Directory traversal vulnerability in download.php in Audio Article Directory allows remote attackers to read arbitrary …
-
Unscored —
Unspecified vulnerability in Socks Server 5 before 3.7.8-8 has unknown impact and attack vectors.
-
Unscored —CVE-2009-2384 Public exploit
Buffer overflow in amp.exe in Brothersoft PEamp 1.02b allows user-assisted remote attackers to execute arbitrary code v…
-
Unscored —
Cross-site scripting (XSS) vulnerability in Advanced Forum 5.x before 5.x-1.1 and 6.x before 6.x-1.1, a module for Drup…
-
Unscored —CVE-2009-2366 Public exploit
SQL injection vulnerability in login.asp in DataCheck Solutions ForumPal FE 1.1 and ForumPal 1.5 allows remote attacker…
-
Unscored —
Drupal 5.x before 5.19 and 6.x before 6.13 does not properly sanitize failed login attempts for pages that contain a so…