Archive
November 2009
Vulnerabilities first published in this month (UTC), newest first.
308 results · Feed
-
Unscored —CVE-2009-4089 Public exploit
telepark.wiki 2.4.23 and earlier allows remote attackers to bypass authorization and (1) delete arbitrary pages via a m…
-
Unscored —CVE-2009-4086 Public exploit
CRLF injection vulnerability in Xerver HTTP Server 4.31 and 4.32 allows remote attackers to inject arbitrary HTTP heade…
-
Unscored —
Multiple unspecified vulnerabilities in ldap_cachemgr (aka the LDAP client configuration cache daemon) in Sun Solaris 9…
-
Unscored —
Untrusted search path vulnerability in dstat before r3199 allows local users to gain privileges via a Trojan horse Pyth…
-
Unscored —
Multiple untrusted search path vulnerabilities in dstat before 0.7.0 allow local users to gain privileges via a Trojan …
-
Unscored —
ltdl.c in libltdl in GNU Libtool 1.5.x, and 2.2.6 before 2.2.6b, as used in Ham Radio Control Libraries, Q, and possibl…
-
Unscored —CVE-2009-4032 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.7e allow remote attackers to inject arbitrary web scri…
-
Unscored —
The do_insn_fetch function in arch/x86/kvm/emulate.c in the x86 emulator in the KVM subsystem in the Linux kernel befor…
-
Unscored —
The proc_open function in ext/standard/proc_open.c in PHP before 5.2.11 and 5.3.x before 5.3.1 does not enforce the (1)…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in Redmine 0.8.5 and earlier allows remote attackers to hijack the auth…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail 0.2.2 and earlier allows remote attackers to hijac…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail 0.2.2 and earlier allows remote attackers to hijac…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Redmine 0.8.5 and earlier allow remote attackers to inject arbit…
-
Unscored —CVE-2009-4074 EPSS 15%
The XSS Filter in Microsoft Internet Explorer 8 allows remote attackers to leverage the "response-changing mechanism" t…
-
Unscored —
Unspecified vulnerability in the timeout mechanism in sshd in Sun Solaris 10, and OpenSolaris snv_99 through snv_123, a…
-
Unscored —
The fuse_direct_io function in fs/fuse/file.c in the fuse subsystem in the Linux kernel before 2.6.32-rc7 might allow a…
-
Unscored —
Unspecified vulnerability in ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P4, 9.5 before 9.5.2-P1, 9.6 before 9.6.1-P…
-
Unscored —
Buffer overflow in the RunCmd method in the Altiris eXpress NS Console Utilities ActiveX control in AeXNSConsoleUtiliti…
-
Unscored —CVE-2009-4073 EPSS 20%
The printing functionality in Microsoft Internet Explorer 8 allows remote attackers to discover a local pathname, and p…
-
Unscored —
SQL injection vulnerability in GForge 4.5.14, 4.7.3, and possibly other versions allows remote attackers to execute arb…
-
Unscored —
Opera before 10.10, when exception stacktraces are enabled, places scripting error messages from a web site into variab…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in GForge 4.5.14, 4.7.3, and possibly other versions allow remote a…
-
Unscored —
Unspecified vulnerability in Opera before 10.10 has unknown impact and attack vectors, related to a "moderately severe …
-
Unscored —
Directory traversal vulnerability in src/http/modules/ngx_http_dav_module.c in nginx (aka Engine X) before 0.7.63, and …
-
Unscored —CVE-2009-3578 Public exploit
Autodesk Maya 8.0, 8.5, 2008, 2009, and 2010 and Alias Wavefront Maya 6.5 and 7.0 allow remote attackers to execute arb…
-
Unscored —
Cross-site scripting (XSS) vulnerability in www/help/tracker.php in GForge 4.5.14, 4.7 rc2, and 4.8.1 allows remote att…
-
Unscored —
Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain directories at installation time, which all…
-
Unscored —CVE-2009-3896 EPSS 10%
src/http/ngx_http_parse.c in nginx (aka Engine X) 0.1.0 through 0.4.14, 0.5.x before 0.5.38, 0.6.x before 0.6.39, 0.7.x…
-
Unscored —CVE-2009-3577 Public exploit
Autodesk 3D Studio Max (3DSMax) 6 through 9 and 2008 through 2010 allows remote attackers to execute arbitrary code via…
-
Unscored —CVE-2009-3576 Public exploit
Autodesk Softimage 7.x and Softimage XSI 6.x allow remote attackers to execute arbitrary JavaScript code via a scene pa…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Gallery Assist module 6.x before 6.x-1.7 for Drupal allows remote attac…
-
Unscored —CVE-2009-4059 Public exploit
SQL injection vulnerability in the JoomClip (com_joomclip) component for Joomla! allows remote attackers to execute arb…
-
Unscored —
Multiple cross-site request forgery (CSRF) vulnerabilities in the "My Account" feature in PHPList Integration module 5 …
-
Unscored —CVE-2009-4056 Public exploit
Directory traversal vulnerability in admin/popup.php in Betsy CMS 3.5 allows remote attackers to include and execute ar…
-
Unscored —CVE-2009-4060 Public exploit
SQL injection vulnerability in includes/content/viewProd.inc.php in CubeCart before 4.3.7 remote attackers to execute a…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in the Printfriendly module 6.x before 6.x-1.6 for Drupal allow rem…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the settings page in the Strongarm module 6.x before 6.x-1.1 for Drupal all…
-
Unscored —CVE-2009-4057 Public exploit
SQL injection vulnerability in the inertialFATE iF Portfolio Nexus (com_if_nexus) component 1.1 for Joomla! allows remo…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in the Agreement module 6.x before 6.x-1.2 for Drupal allow remote …
-
Unscored —
Cross-site scripting (XSS) vulnerability in the Subgroups for Organic Groups (OG) module 5.x before 5.x-4.0 and 5.x bef…