Skip to content
OpenAdvisories

Archive

December 2009

Vulnerabilities first published in this month (UTC), newest first.

← November 2009 2009 / December January 2010 →
  1. 17
  2. 235
  3. 312
  4. 421
  5. 5 
  6. 6 
  7. 711
  8. 821
  9. 914
  10. 1036
  11. 116
  12. 12 
  13. 1310
  14. 1412
  15. 156
  16. 1623
  17. 1730
  18. 1814
  19. 19 
  20. 204
  21. 2126
  22. 2225
  23. 2316
  24. 2416
  25. 25 
  26. 26 
  27. 27 
  28. 2823
  29. 2913
  30. 3030
  31. 3129
All Critical High Medium Low Exploited only Public exploit

440 results · Feed

  • Unscored —
    CVE-2009-4175 Public exploit

    CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allows remote attackers to obtain sensitive information via an inva…

  • Unscored —
    CVE-2009-4172 Public exploit

    Cross-site scripting (XSS) vulnerability in index.php in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews 8 and 8b, when magic…

  • Unscored —
    CVE-2009-4127

    Unspecified vulnerability in Wikipedia Toolbar extension before 0.5.9.2 for Firefox allows user-assisted remote attacke…

  • Unscored —
    CVE-2009-4173 Public exploit

    Cross-site request forgery (CSRF) vulnerability in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allows remote at…

  • Unscored —
    CVE-2009-4174 Public exploit

    The editnews module in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b, when magic_quotes_gpc is disabled, allows r…

  • Unscored —
    CVE-2009-4169

    Cross-site scripting (XSS) vulnerability in wp-cumulus.php in the WP-Cumulus Plug-in before 1.22 for WordPress allows r…

  • Unscored —
    CVE-2009-4146 Public exploit

    The _rtld function in the Run-Time Link-Editor (rtld) in libexec/rtld-elf/rtld.c in FreeBSD 7.1, 7.2, and 8.0 does not …

  • Unscored —
    CVE-2009-4170 Public exploit

    WP-Cumulus Plug-in 1.20 for WordPress, and possibly other versions, allows remote attackers to obtain sensitive informa…

  • Unscored —
    CVE-2009-4168 Public exploit

    Cross-site scripting (XSS) vulnerability in Roy Tanck tagcloud.swf, as used in the WP-Cumulus plugin before 1.23 for Wo…

  • Unscored —
    CVE-2009-4158

    SQL injection vulnerability in the Calendar Base (cal) extension before 1.2.1 for TYPO3 allows remote attackers to exec…

  • Unscored —
    CVE-2009-4161

    Cross-site scripting (XSS) vulnerability in the [AN] Search it! (an_searchit) extension 2.4.1 and earlier for TYPO3 all…

  • Unscored —
    CVE-2009-4165

    SQL injection vulnerability in the simple Glossar (simple_glossar) extension 1.0.3 and earlier for TYPO3 allows remote …

  • Unscored —
    CVE-2009-4163

    SQL injection vulnerability in the TW Productfinder (tw_productfinder) extension 0.0.2 and earlier for TYPO3 allows rem…

  • Low —
    CVE-2009-4159

    TYPO3 Direct Mail Extension Vulnerable to Cross-Site Scripting (XSS)

    Cross-site scripting (XSS) vulnerability in the newsletter configuration feature in the backend module in the Direct Mail (direct_mail) extension 2.6.4 and earlier for TYPO3 allows remote authenticated users to inject arbitrary web script or HTML via unspecif…

    directmailteam/direct-mail Packagist
  • Unscored —
    CVE-2009-4154 Public exploit

    Directory traversal vulnerability in includes/feedcreator.class.php in Elxis CMS allows remote attackers to read arbitr…

  • Medium —
    CVE-2009-4160

    TYPO3 Simple Download-System with Counter and Categories Vulnerable to Information Disclosure

    Unspecified vulnerability in the Simple download-system with counter and categories (kk_downloader) extension 1.2.1 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unknown attack vectors.

    jweiland/kk-downloader Packagist
  • Unscored —
    CVE-2009-4167

    Unspecified vulnerability in the Automatic Base Tags for RealUrl (lt_basetag) extension 1.0.0 for TYPO3 allows remote a…

  • Unscored —
    CVE-2009-4156 Public exploit

    PHP remote file inclusion vulnerability in modules/pms/index.php in Ciamos CMS 0.9.5 and earlier allows remote attacker…

  • Unscored —
    CVE-2009-4155 Public exploit

    Multiple SQL injection vulnerabilities in Eshopbuilde CMS allow remote attackers to execute arbitrary SQL commands via …

  • Unscored —
    CVE-2009-4166

    SQL injection vulnerability in the Trips (mchtrips) extension 2.0.0 for TYPO3 allows remote attackers to execute arbitr…

  • Unscored —
    CVE-2009-4157 Public exploit

    Multiple cross-site scripting (XSS) vulnerabilities in index.php in the ProofReader (com_proofreader) component 1.0 RC9…

  • Unscored —
    CVE-2009-4162

    Unspecified vulnerability in the DB Integration (wfqbe) extension 1.3.1 and earlier for TYPO3 allows local users to exe…

  • Unscored —
    CVE-2009-4164

    Cross-site scripting (XSS) vulnerability in the simple Glossar (simple_glossar) extension 1.0.3 and earlier for TYPO3 a…

  • Unscored —
    CVE-2009-4026

    The mac80211 subsystem in the Linux kernel before 2.6.32-rc8-next-20091201 allows remote attackers to cause a denial of…

  • Unscored —
    CVE-2009-4152

    Cross-site scripting (XSS) vulnerability in the Collaboration component in IBM WebSphere Portal 6.1.x before 6.1.0.3 al…

  • Unscored —
    CVE-2009-4153

    Unspecified vulnerability in the XMLAccess component in IBM WebSphere Portal 6.1.x before 6.1.0.3 has unknown impact an…

  • Unscored —
    CVE-2009-4027

    Race condition in the mac80211 subsystem in the Linux kernel before 2.6.32-rc8-next-20091201 allows remote attackers to…

  • Unscored —
    CVE-2009-4151

    Session fixation vulnerability in html/Elements/SetupSessionCookie in Best Practical Solutions RT 3.0.0 through 3.6.9 a…

  • Unscored —
    CVE-2009-3585

    Session fixation vulnerability in html/Elements/SetupSessionCookie in Best Practical Solutions RT 3.0.0 through 3.6.9 a…

  • Unscored —
    CVE-2009-2686

    Unspecified vulnerability in HP NonStop G06.12.00 through G06.32.00, H06.08.00 through H06.18.01, and J06.04.00 through…

  • Unscored —
    CVE-2009-4055

    rtp.c in Asterisk Open Source 1.2.x before 1.2.37, 1.4.x before 1.4.27.1, 1.6.0.x before 1.6.0.19, and 1.6.1.x before 1…

    asterisk Debian
  • Unscored —
    CVE-2009-4150

    dasauto in IBM DB2 8 before FP18, 9.1 before FP8, 9.5 before FP4, and 9.7 before FP1 permits execution by unprivileged …

  • Unscored —
    CVE-2009-3672 Public exploit EPSS 72%

    Microsoft Internet Explorer 6 and 7 does not properly handle objects in memory that (1) were not properly initialized o…

  • Unscored —
    CVE-2009-2626 Public exploit

    The zend_restore_ini_entry_cb function in zend_ini.c in PHP 5.3.0, 5.2.10, and earlier versions allows context-specific…

  • Unscored —
    CVE-2009-4120 Public exploit

    Multiple cross-site request forgery (CSRF) vulnerabilities in Quick.Cart 3.4 allow remote attackers to hijack the authe…

  • Unscored —
    CVE-2009-4121

    Multiple cross-site request forgery (CSRF) vulnerabilities in Quick.CMS 2.4 and Quick.CMS.Lite 2.4 allow remote attacke…

  • Unscored —
    CVE-2009-4118 Public exploit

    The StartServiceCtrlDispatcher function in the cvpnd service (cvpnd.exe) in Cisco VPN client for Windows before 5.0.06.…

  • Unscored —
    CVE-2009-4128

    GNU GRand Unified Bootloader (GRUB) 2 1.97 only compares the submitted portion of a password with the actual password, …

    grub2 Debian
  • Unscored —
    CVE-2009-4117 Public exploit

    Multiple stack-based buffer overflows in pdf_shade4.c in MuPDF before commit 20091125231942, as used in SumatraPDF befo…

  • Unscored —
    CVE-2009-4119

    Cross-site scripting (XSS) vulnerability in Feed Element Mapper module 5.x before 5.x-1.3, 6.x before 6.x-1.3, and 6.x-…