Skip to content
OpenAdvisories

Archive

December 2009

Vulnerabilities first published in this month (UTC), newest first.

← November 2009 2009 / December January 2010 →
  1. 17
  2. 235
  3. 312
  4. 421
  5. 5 
  6. 6 
  7. 711
  8. 821
  9. 914
  10. 1036
  11. 116
  12. 12 
  13. 1310
  14. 1412
  15. 156
  16. 1623
  17. 1730
  18. 1814
  19. 19 
  20. 204
  21. 2126
  22. 2225
  23. 2316
  24. 2416
  25. 25 
  26. 26 
  27. 27 
  28. 2823
  29. 2913
  30. 3030
  31. 3129
All Critical High Medium Low Exploited only Public exploit

440 results · Feed

  • Unscored —
    CVE-2009-4221 Public exploit

    SQL injection vulnerability in classified.php in phpBazar 2.1.1fix and earlier allows remote attackers to execute arbit…

  • Unscored —
    CVE-2009-4218 Public exploit

    Multiple SQL injection vulnerabilities in files/login.asp in JiRo's Banner System eXperience (JBSX) allow remote attack…

  • Unscored —
    CVE-2009-4219 Public exploit

    Stack-based buffer overflow in the MYACTIVEX.MyActiveXCtrl.1 ActiveX control in MyActiveX.ocx 1.4.8.0 in Haihaisoft Uni…

  • Medium —
    CVE-2009-4214

    Moderate severity vulnerability that affects rails

    Cross-site scripting (XSS) vulnerability in the strip_tags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tok…

    rails rails Debian RubyGems
  • Unscored —
    CVE-2009-4224 Public exploit

    Multiple PHP remote file inclusion vulnerabilities in SweetRice 0.5.4, 0.5.3, and earlier allow remote attackers to exe…

  • Unscored —
    CVE-2009-4211

    The U.S. Defense Information Systems Agency (DISA) Security Readiness Review (SRR) script for the Solaris x86 platform …

  • Unscored —
    CVE-2009-4020

    Stack-based buffer overflow in the hfs subsystem in the Linux kernel 2.6.32 allows remote attackers to have an unspecif…

  • Unscored —
    CVE-2009-3560 EPSS 24%

    The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows co…

    ghostscript expat swish-e matanza Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2009-4203 Public exploit

    Multiple SQL injection vulnerabilities in admin/aclass/admin_func.php in Arab Portal 2.2 allow remote attackers to exec…

  • Unscored —
    CVE-2009-4201

    Multiple stack-based buffer overflows in Mp3 Tag Assistant Professional 2.92 build 300 allow remote attackers to execut…

  • Unscored —
    CVE-2009-4205 Public exploit

    Directory traversal vulnerability in admin.php in Flashlight Free Edition allows remote attackers to include and execut…

  • Unscored —
    CVE-2009-4209 Public exploit

    Multiple cross-site scripting (XSS) vulnerabilities in admin/index.php in moziloCMS 1.11.1 allow remote attackers to in…

  • Unscored —
    CVE-2009-4200 Public exploit

    SQL injection vulnerability in the Seminar (com_seminar) component 1.28 for Joomla! allows remote attackers to execute …

  • Unscored —
    CVE-2009-4199 Public exploit

    Multiple SQL injection vulnerabilities in the Mambo Resident (aka Mos Res or com_mosres) component 1.0f for Mambo and J…

  • Unscored —
    CVE-2009-4202 Public exploit Scanner template

    Directory traversal vulnerability in the Omilen Photo Gallery (com_omphotogallery) component Beta 0.5 for Joomla! allow…

  • Unscored —
    CVE-2009-4198 Public exploit

    SQL injection vulnerability in my_orders.php in MyMiniBill allows remote authenticated users to execute arbitrary SQL c…

  • Unscored —
    CVE-2009-4208 Public exploit

    SQL injection vulnerability in the os_news module in Open-school (OS) 1.0 allows remote attackers to execute arbitrary …

  • Unscored —
    CVE-2009-4206 Public exploit

    SQL injection vulnerability in admin.link.modify.php in Million Dollar Text Links 1.0 and earlier allows remote attacke…

  • Unscored —
    CVE-2009-4207

    Cross-site scripting (XSS) vulnerability in the Webform module 5.x before 5.x-2.7 and 6.x before 6.x-2.7, a module for …

    Web / CMS
  • Unscored —
    CVE-2009-4148 Public exploit

    DAZ Studio 2.3.3.161, 2.3.3.163, and 3.0.1.135 allows remote attackers to execute arbitrary JavaScript code via a (1) .…

  • Unscored —
    CVE-2009-4204 Public exploit

    SQL injection vulnerability in read.php in Flashlight Free Edition allows remote attackers to execute arbitrary SQL com…

  • Unscored —
    CVE-2009-3304

    GForge 4.5.14, 4.7 rc2, and 4.8.2 allows local users to overwrite arbitrary files via a symlink attack on authorized_ke…

  • Unscored —
    CVE-2009-4195 Public exploit EPSS 71%

    Buffer overflow in Adobe Illustrator CS4 14.0.0, CS3 13.0.3 and earlier, and CS3 13.0.0 allows remote attackers to exec…

  • Unscored —
    CVE-2009-4196 Public exploit

    Multiple cross-site scripting (XSS) vulnerabilities in multiple scripts in Forms/ in Huawei MT882 V100R002B020 ARG-T ru…

  • Unscored —
    CVE-2009-4197 Public exploit

    rpwizPppoe.htm in Huawei MT882 V100R002B020 ARG-T running firmware 3.7.9.98 contains a form that does not disable the a…

  • Unscored —
    CVE-2009-2631

    Clientless SSL VPN products break web browser domain-based security models

    Multiple clientless SSL VPN products that run in web browsers, including Stonesoft StoneGate; Cisco ASA; SonicWALL E-Class SSL VPN and SonicWALL SSL VPN; SafeNet SecureWire Access Gateway; Juniper Networks Secure Access; Nortel CallPilot; Citrix Access Gatewa…

    Cisco Palo Alto Networks PAN OS Web SSL VPN Adaptive Security Appliance Web SSL VPN Network devices
  • Unscored —
    CVE-2009-4194 Public exploit

    Directory traversal vulnerability in Golden FTP Server 4.30 Free and Professional, 4.50, and possibly other versions al…

  • Unscored —
    CVE-2009-4192 Public exploit

    Directory traversal vulnerability in dialog/file_manager.php in Interspire Knowledge Manager 5 allows remote attackers …

  • Unscored —
    CVE-2009-4193

    Merkaartor 0.14 allows local users to append data to arbitrary files via a symlink attack on the /tmp/merkaartor.log te…

    merkaartor Debian
  • Unscored —
    CVE-2009-1566

    Integer overflow in Roxio Easy Media Creator 9.0.136, and Roxio Creator 2010 before SP1, might allow remote attackers t…

  • Unscored —
    CVE-2009-0895

    Integer overflow in Novell eDirectory 8.7.3.x before 8.7.3.10 ftf2 and 8.8.x before 8.8.5.2 allows remote attackers to …

  • Unscored —
    CVE-2009-1567

    Multiple stack-based buffer overflows in the Lateral Arts Photobox uploader ActiveX control 1.x before 1.3, and 2.2.0.6…

  • Unscored —
    CVE-2009-4188 Public exploit EPSS 69%

    HP Operations Dashboard has a default password of j2deployer for the j2deployer account, which allows remote attackers …

  • Unscored —
    CVE-2009-4189 Public exploit EPSS 79%

    HP Operations Manager has a default password of OvW*busr1 for the ovwebusr account, which allows remote attackers to ex…

  • Unscored —
    CVE-2009-4187

    Multiple cross-site scripting (XSS) vulnerabilities in the Gateway component in Sun Java System Portal Server 6.3.1, 7.…

  • Unscored —
    CVE-2009-4191

    Unspecified vulnerability in the kernel in Sun Solaris 10 and OpenSolaris 2009.06 on the x86-64 platform allows local u…

  • Unscored —
    CVE-2009-4186 Public exploit

    Stack consumption vulnerability in Apple Safari 4.0.3 on Windows allows remote attackers to cause a denial of service (…

  • Unscored —
    CVE-2009-4190

    Unspecified vulnerability in the kernel in Sun OpenSolaris 2009.06 allows remote attackers to cause a denial of service…

  • Unscored —
    CVE-2009-4147 Public exploit

    The _rtld function in the Run-Time Link-Editor (rtld) in libexec/rtld-elf/rtld.c in FreeBSD 7.1 and 8.0 does not clear …

  • Unscored —
    CVE-2009-4171 Public exploit

    An ActiveX control in YahooBridgeLib.dll for Yahoo! Messenger 9.0.0.2162, and possibly other 9.0 versions, allows remot…