Skip to content
OpenAdvisories

Archive

November 2009

Vulnerabilities first published in this month (UTC), newest first.

← October 2009 2009 / November December 2009 →
  1. 1 
  2. 220
  3. 36
  4. 417
  5. 514
  6. 611
  7. 7 
  8. 8 
  9. 924
  10. 1029
  11. 1115
  12. 128
  13. 1312
  14. 14 
  15. 15 
  16. 1615
  17. 177
  18. 1813
  19. 194
  20. 2020
  21. 21 
  22. 22 
  23. 2310
  24. 2425
  25. 259
  26. 26 
  27. 2721
  28. 2819
  29. 29 
  30. 309
All Critical High Medium Low Exploited only Public exploit

308 results · Feed

  • Unscored —
    CVE-2009-3547 Public exploit

    Multiple race conditions in fs/pipe.c in the Linux kernel before 2.6.32-rc6 allow local users to cause a denial of serv…

  • Unscored —
    CVE-2009-3465

    Adobe Shockwave Player before 11.5.2.602 allows remote attackers to execute arbitrary code via crafted Shockwave conten…

  • Unscored —
    CVE-2009-3720 EPSS 28%

    The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and …

    ghostscript expat matanza swish-e Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2009-3851

    Trusted Extensions in Sun Solaris 10 interferes with the operation of the xscreensaver-demo command for the XScreenSave…

  • Unscored —
    CVE-2009-3852

    Unspecified vulnerability in the XML component in IBM Runtimes for Java Technology 5.0.0 before SR10 has unknown impact…

  • Unscored —
    CVE-2009-3031 Public exploit EPSS 45%

    Stack-based buffer overflow in the BrowseAndSaveFile method in the Altiris eXpress NS ConsoleUtilities ActiveX control …

  • Unscored —
    CVE-2009-3299

    Cross-site scripting (XSS) vulnerability in the resume blocktype in Mahara before 1.0.13, and 1.1.x before 1.1.7, allow…

  • Unscored —
    CVE-2009-3298

    Mahara before 1.0.13, and 1.1.x before 1.1.7, allows remote authenticated institution administrators to reset a site ad…

  • Medium —
    CVE-2009-3628

    TYPO3 Backend Discloses Encryption Key

    The Backend subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote authenticated users to determine an encryption key via crafted input to a tt_content form element.

    typo3/cms-backend Packagist
  • Unscored —
    CVE-2009-3836

    ArubaOS 3.3.1.x, 3.3.2.x, RN 3.1.x, 3.4.x, and 3.3.2.x-FIPS on the Aruba Mobility Controller allows remote attackers to…

  • Unscored —
    CVE-2009-3837 Public exploit EPSS 32%

    Stack-based buffer overflow in Eureka Email 2.2q allows remote POP3 servers to execute arbitrary code via a long error …

  • Medium —
    CVE-2009-3636

    Typo3 API Install Tool vulnerable to Cross-site Scripting

    Cross-site scripting (XSS) vulnerability in the Install Tool subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote attackers to inject arbitrary web script or HTML via unspecified parameter…

    typo3/cms-install Packagist
  • Unscored —
    CVE-2009-3733 Public exploit EPSS 83%

    Directory traversal vulnerability in VMware Server 1.x before 1.0.10 build 203137 and 2.x before 2.0.2 build 203138 on …

  • Medium —
    CVE-2009-3630

    TYPO3 Backend vulnerable to Frame Hijacking

    The Backend subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote authenticated users to place arbitrary web sites in TYPO3 backend framesets via crafted parameters, related to a "frame hij…

    typo3/cms-backend Packagist
  • Unscored —
    CVE-2009-3834

    SQL injection vulnerability in the Photoblog (com_photoblog) component alpha 3 and alpha 3a for Joomla! allows remote a…

  • Medium —
    CVE-2009-3635

    TYPO3 Install Tool Subcomponent Allows Access Using Only a Password's MD5 Hash as a Credential

    The Install Tool subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote attackers to gain access by using only the password's md5 hash as a credential.

    typo3/cms Packagist
  • Unscored —
    CVE-2009-3833 Public exploit

    Cross-site scripting (XSS) vulnerability in index.php in TFTgallery 0.13 allows remote attackers to inject arbitrary we…

  • High —
    CVE-2009-3631

    TYPO3 Backend Command Injection via Shell Metacharacters in Uploaded File Name

    The Backend subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2, when the DAM extension or ftp upload is enabled, allows remote authenticated users to execute arbitrary commands via shell metacharacter…

    typo3/cms-backend Packagist
  • Unscored —
    CVE-2009-3605

    Multiple integer overflows in Poppler 0.10.5 and earlier allow remote attackers to cause a denial of service (applicati…

    poppler Debian
  • Unscored —
    CVE-2009-3624

    The get_instantiation_keyring function in security/keys/keyctl.c in the KEYS subsystem in the Linux kernel before 2.6.3…

  • Unscored —
    CVE-2009-3839

    Unspecified vulnerability in the Solaris Trusted Extensions Policy configuration in Sun Solaris 10, and OpenSolaris snv…

  • Unscored —
    CVE-2009-3632

    SQL injection vulnerability in the traditional frontend editing feature in the Frontend Editing subcomponent in TYPO3 4…

  • Unscored —
    CVE-2009-3835 Public exploit

    SQL injection vulnerability in the JShop (com_jshop) component for Joomla! allows remote attackers to execute arbitrary…

  • Unscored —
    CVE-2009-3634

    Cross-site scripting (XSS) vulnerability in the Frontend Login Box (aka felogin) subcomponent in TYPO3 4.2.0 through 4.…

  • Unscored —
    CVE-2009-3838 Public exploit

    Stack-based buffer overflow in Pegasus Mail (PMail) 4.41 and possibly 4.51 allows remote POP3 servers to cause a denial…

  • Low —
    CVE-2009-3629

    TYPO3 Backend vulnerable to Cross-site Scripting

    Multiple cross-site scripting (XSS) vulnerabilities in the Backend subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allow remote authenticated users to inject arbitrary web script or HTML via unspec…

    typo3/cms-backend Packagist
  • Medium —
    CVE-2009-3633

    TYPO3 API function vulnerable to Cross-site Scripting

    Cross-site scripting (XSS) vulnerability in the t3lib_div::quoteJSvalue API function in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote attackers to inject arbitrary web script or HTML via unspecifie…

    typo3/cms-core Packagist
  • Unscored —
    CVE-2009-2267 Public exploit

    VMware Workstation 6.5.x before 6.5.3 build 185404, VMware Player 2.5.x before 2.5.3 build 185404, VMware ACE 2.5.x bef…