CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In April 2009

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
51 CVE-2009-1415 255 DoS 2009-04-30 2017-08-17
4.3
None Remote Medium Not required None None Partial
lib/pk-libgcrypt.c in libgnutls in GnuTLS before 2.6.6 does not properly handle invalid DSA signatures, which allows remote attackers to cause a denial of service (application crash) and possibly have unspecified other impact via a malformed DSA key that triggers a (1) free of an uninitialized pointer or (2) double free.
52 CVE-2009-1414 264 XSS 2009-04-24 2017-08-17
4.3
None Remote Medium Not required None Partial None
Google Chrome 2.0.x lets modifications to the global object persist across a page transition, which makes it easier for attackers to conduct Universal XSS attacks via unspecified vectors.
53 CVE-2009-1413 264 Exec Code XSS 2009-04-24 2017-08-17
4.3
None Remote Medium Not required None Partial None
Google Chrome 1.0.x does not cancel timeouts upon a page transition, which makes it easier for attackers to conduct Universal XSS attacks by calling setTimeout to trigger future execution of JavaScript code, and then modifying document.location to arrange for JavaScript execution in the context of an arbitrary web site. NOTE: this can be leveraged for a remote attack by exploiting a chromehtml: argument-injection vulnerability.
54 CVE-2009-1412 200 XSS +Info 2009-04-24 2021-07-23
7.8
None Remote Low Not required Complete None None
Argument injection vulnerability in the chromehtml: protocol handler in Google Chrome before 1.0.154.59, when invoked by Internet Explorer, allows remote attackers to determine the existence of files, and open tabs for URLs that do not satisfy the IsWebSafeScheme restriction, via a web page that sets document.location to a chromehtml: value, as demonstrated by use of a (1) javascript: or (2) data: URL. NOTE: this can be leveraged for Universal XSS by exploiting certain behavior involving persistence across page transitions.
55 CVE-2009-1411 89 Exec Code Sql 2009-04-24 2017-09-29
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in events/inc/events.inc.php in the Events plugin for Seditio CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the c parameter to plug.php.
56 CVE-2009-1410 89 Exec Code Sql 2009-04-24 2017-09-29
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in index.php in Quick.Cms.Lite 0.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.
57 CVE-2009-1409 89 Exec Code Sql 2009-04-24 2017-09-29
5.1
None Remote High Not required Partial Partial Partial
SQL injection vulnerability in usersettings.php in e107 0.7.15 and earlier, when "Extended User Fields" is enabled and magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the hide parameter, a different vector than CVE-2005-4224 and CVE-2008-5320.
58 CVE-2009-1408 79 XSS 2009-04-24 2018-10-10
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in webSPELL 4.2.0c allows remote attackers to inject arbitrary web script or HTML allows remote attackers to inject arbitrary web script or HTML via Javascript events such as onmouseover in nested BBcode tags, as demonstrated using (1) email, (2) img, and (3) url tags.
59 CVE-2009-1407 22 Dir. Trav. 2009-04-24 2017-09-29
6.8
None Remote Medium Not required Partial Partial Partial
Directory traversal vulnerability in config.php in NotFTP 1.3.1 allows remote attackers to read arbitrary files via a .. (dot dot) in a certain languages[][file] parameter.
60 CVE-2009-1406 22 Dir. Trav. 2009-04-24 2017-09-29
6.8
None Remote Medium Not required Partial Partial Partial
Directory traversal vulnerability in cms_detect.php in TotalCalendar 2.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the include parameter.
61 CVE-2009-1405 22 Dir. Trav. 2009-04-24 2017-09-29
6.8
None Remote Medium Not required Partial Partial Partial
Directory traversal vulnerability in index.php in PastelCMS 0.8.0, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the set_lng parameter.
62 CVE-2009-1404 89 Exec Code Sql 2009-04-24 2017-09-29
6.8
None Remote Medium Not required Partial Partial Partial
SQL injection vulnerability in admin.php in PastelCMS 0.8.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the user (Username) parameter.
63 CVE-2009-1403 89 Exec Code Sql 2009-04-24 2017-09-29
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in product_info.php in CRE Loaded 6.2 allows remote attackers to execute arbitrary SQL commands via the products_id parameter.
64 CVE-2009-1372 119 DoS Exec Code Overflow 2009-04-23 2009-09-16
10.0
None Remote Low Not required Complete Complete Complete
Stack-based buffer overflow in the cli_url_canon function in libclamav/phishcheck.c in ClamAV before 0.95.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted URL.
65 CVE-2009-1371 20 DoS 2009-04-23 2009-09-16
5.0
None Remote Low Not required None None Partial
The CLI_ISCONTAINED macro in libclamav/others.h in ClamAV before 0.95.1 allows remote attackers to cause a denial of service (application crash) via a malformed file with UPack encoding.
66 CVE-2009-1370 119 DoS Exec Code Overflow 2009-04-22 2017-09-29
9.3
None Remote Medium Not required Complete Complete Complete
Stack-based buffer overflow in ape_plugin.plg in Xilisoft Video Converter 3.1.53.0704n and 5.1.23.0402 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in a .cue file.
67 CVE-2009-1369 20 +Info 2009-04-22 2017-09-29
5.0
None Remote Low Not required Partial None None
moziloCMS 1.11 allows remote attackers to obtain sensitive information via the (1) gal[] parameter to gallery.php, (2) page[] and (3) cat[] parameter to index.php, or (4) file[] parameter to download.php, which reveals the installation path in an error message.
68 CVE-2009-1368 22 Dir. Trav. 2009-04-22 2017-09-29
7.5
None Remote Low Not required Partial Partial Partial
Directory traversal vulnerability in index.php in moziloCMS 1.11 allows remote attackers to read arbitrary files via a .. (dot dot) in the page parameter. NOTE: this might be the same issue as CVE-2008-6126.2, which may have been fixed in 1.10.3.
69 CVE-2009-1367 79 XSS 2009-04-22 2017-09-29
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in index.php in moziloCMS 1.11 allows remote attackers to inject arbitrary web script or HTML via the query parameter in search action, a different issue than CVE-2008-6127.2a.
70 CVE-2009-1366 79 XSS 2009-04-22 2009-05-14
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Website\admin\Sales\paypalipn.aspx in DotNetNuke (DNN) before 4.9.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "name/value pairs" and "paypal IPN functionality."
71 CVE-2009-1362 89 Exec Code Sql 2009-04-22 2017-08-17
6.8
None Remote Medium Not required Partial Partial Partial
SQL injection vulnerability in administration/index.php in chCounter 3.1.3 allows remote attackers to execute arbitrary SQL commands via the login_name parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
72 CVE-2009-1361 20 Exec Code 2009-04-22 2009-04-23
10.0
None Remote Low Not required Complete Complete Complete
dig.php in GScripts.net DNS Tools allows remote attackers to execute arbitrary commands via shell metacharacters in the host parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
73 CVE-2009-1360 DoS 2009-04-22 2012-03-19
7.1
None Remote Medium Not required None None Complete
The __inet6_check_established function in net/ipv6/inet6_hashtables.c in the Linux kernel before 2.6.29, when Network Namespace Support (aka NET_NS) is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via vectors involving IPv6 packets.
74 CVE-2009-1359 DoS 2009-04-22 2009-05-14
4.9
None Local Low Not required None None Complete
Unspecified vulnerability in the SCTP sockets implementation in Sun OpenSolaris snv_106 through snv_107 allows local users to cause a denial of service (panic) via unknown vectors.
75 CVE-2009-1358 2009-04-21 2020-01-08
10.0
None Remote Low Not required Complete Complete Complete
apt-get in apt before 0.7.21 does not check for the correct error code from gpgv, which causes apt to treat a repository as valid even when it has been signed with a key that has been revoked or expired, which might allow remote attackers to trick apt into installing malicious repositories.
76 CVE-2009-1357 20 Http R.Spl. 2009-04-23 2018-10-10
6.8
None Remote Medium Not required Partial Partial Partial
CRLF injection vulnerability in da/DA/Login in Sun Java System Delegated Administrator 6.2 through 6.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the HELP_PAGE parameter.
77 CVE-2009-1356 119 Exec Code Overflow 2009-04-21 2017-09-29
9.3
None Remote Medium Not required Complete Complete Complete
Stack-based buffer overflow in Elecard AVC HD Player allows remote attackers to execute arbitrary code via a long MP3 filename in a playlist (.xpl) file.
78 CVE-2009-1355 119 Overflow +Priv 2009-04-21 2017-09-29
7.2
None Local Low Not required Complete Complete Complete
Stack-based buffer overflow in muxatmd in IBM AIX 5.2, 5.3, and 6.1 allows local users to gain privileges via a long filename.
79 CVE-2009-1354 22 Dir. Trav. 2009-04-21 2018-10-10
4.0
None Remote Low ??? Partial None None
Directory traversal vulnerability in Mongoose 2.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.
80 CVE-2009-1353 119 DoS Overflow 2009-04-21 2018-10-10
5.0
None Remote Low Not required None None Partial
Buffer overflow in the http_parse_hex function in libz/misc.c in Zervit Webserver 0.02 allows remote attackers to cause a denial of service (daemon crash) via a long URI, related to http.c.
81 CVE-2009-1352 119 DoS Exec Code Overflow 2009-04-21 2017-09-29
9.3
None Remote Medium Not required Complete Complete Complete
Stack-based buffer overflow in Dawningsoft PowerCHM 5.7 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an HTML file with a link to a long URL, as demonstrated by a .rar URL.
82 CVE-2009-1351 119 DoS Exec Code Overflow 2009-04-21 2017-09-29
9.3
None Remote Medium Not required Complete Complete Complete
Heap-based buffer overflow in Apollo 37zz allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long URI in a playlist (.m3u) file.
83 CVE-2009-1350 20 Exec Code 2009-04-21 2018-10-10
10.0
None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in xtagent.exe in Novell NetIdentity Client before 1.2.4 allows remote attackers to execute arbitrary code by establishing an IPC$ connection to the XTIERRPCPIPE named pipe, and sending RPC messages that trigger a dereference of an arbitrary pointer.
84 CVE-2009-1349 79 XSS 2009-04-21 2018-10-10
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in C2Net Stronghold 2.3 allows remote attackers to inject arbitrary web script or HTML via the URI.
85 CVE-2009-1348 20 Bypass 2009-04-30 2018-10-10
7.6
None Remote High Not required Complete Complete Complete
The AV engine before DAT 5600 in McAfee VirusScan, Total Protection, Internet Security, SecurityShield for Microsoft ISA Server, Security for Microsoft Sharepoint, Security for Email Servers, Email Gateway, and Active Virus Defense allows remote attackers to bypass virus detection via (1) an invalid Headflags field in a malformed RAR archive, (2) an invalid Packsize field in a malformed RAR archive, or (3) an invalid Filelength field in a malformed ZIP archive.
86 CVE-2009-1347 89 Exec Code Sql 2009-04-20 2017-09-29
6.8
None Remote Medium Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in stats/index.php in chCounter 3.1.3 allow remote attackers to execute arbitrary SQL commands via (1) the login_name parameter (aka the username field) or (2) the login_pw parameter (aka the password field).
87 CVE-2009-1346 89 Exec Code Sql 2009-04-20 2017-09-29
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in publico/ficha.php in NetHoteles 3.0 allows remote attackers to execute arbitrary SQL commands via the id_establecimiento parameter.
88 CVE-2009-1345 89 Exec Code Sql 2009-04-20 2017-09-29
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in document.php in cpCommerce 1.2.8 allows remote attackers to execute arbitrary SQL commands via the id_document parameter.
89 CVE-2009-1344 79 XSS 2009-04-20 2009-04-20
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the Localization client module 5.x before 5.x-1.2 and 6.x before 6.x-1.7, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via input to the translation functionality.
90 CVE-2009-1343 79 XSS 2009-04-20 2009-04-21
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the Print (aka Printer, e-mail and PDF versions) module 5.x before 5.x-4.5 and 6.x before 6.x-1.5, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via content titles.
91 CVE-2009-1342 79 XSS 2009-04-20 2009-04-20
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the CCK comment reference module 6.x before 6.x-1.2, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via certain comment titles associated with a node edit form.
92 CVE-2009-1341 200 DoS +Info 2009-04-30 2017-09-29
5.0
None Remote Low Not required None None Partial
Memory leak in the dequote_bytea function in quote.c in the DBD::Pg (aka DBD-Pg or libdbd-pg-perl) module before 2.0.0 for Perl allows context-dependent attackers to cause a denial of service (memory consumption) by fetching data with BYTEA columns.
93 CVE-2009-1339 352 CSRF 2009-04-30 2017-08-17
6.0
None Remote Medium ??? Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in TWiki before 4.3.1 allows remote authenticated users to hijack the authentication of arbitrary users for requests that update pages, as demonstrated by a URL for a save script in the SRC attribute of an IMG element, a related issue to CVE-2009-1434.
94 CVE-2009-1338 264 Bypass 2009-04-22 2018-10-10
4.6
None Local Low Not required Partial Partial Partial
The kill_something_info function in kernel/signal.c in the Linux kernel before 2.6.28 does not consider PID namespaces when processing signals directed to PID -1, which allows local users to bypass the intended namespace isolation, and send arbitrary signals to all processes in all namespaces, via a kill command.
95 CVE-2009-1337 264 2009-04-22 2018-10-10
4.4
None Local Medium Not required Partial Partial Partial
The exit_notify function in kernel/exit.c in the Linux kernel before 2.6.30-rc1 does not restrict exit signals when the CAP_KILL capability is held, which allows local users to send an arbitrary signal to a process by running a program that modifies the exit_signal field and then uses an exec system call to launch a setuid application.
96 CVE-2009-1336 20 DoS 2009-04-22 2018-10-10
4.9
None Local Low Not required None None Complete
fs/nfs/client.c in the Linux kernel before 2.6.23 does not properly initialize a certain structure member that stores the maximum NFS filename length, which allows local users to cause a denial of service (OOPS) via a long filename, related to the encode_lookup function.
97 CVE-2009-1335 DoS 2009-04-17 2021-07-23
4.3
None Remote Medium Not required None None Partial
Microsoft Internet Explorer 7 and 8 on Windows XP and Vista allows remote attackers to cause a denial of service (application hang) via a large document composed of unprintable characters, aka MSRC 9011jr.
98 CVE-2009-1334 79 XSS 2009-04-17 2017-08-17
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in login/FilepathLogin.html in IBM Tivoli Continuous Data Protection (CDP) for Files 3.1.4.0 allows remote attackers to inject arbitrary web script or HTML via the reason parameter.
99 CVE-2009-1333 79 XSS 2009-04-17 2018-10-10
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in refresh_rate.htm in the web interface on the HP Deskjet 6840 printer with firmware XF1M131A allows remote attackers to inject arbitrary web script or HTML via the POST request body.
100 CVE-2009-1332 2009-04-17 2009-04-28
5.0
None Remote Low Not required Partial None None
The Online Help feature in Sun Java System Directory Server 5.2 and Enterprise Edition 5 allows remote attackers to determine the existence of files and directories, and possibly obtain partial contents of files, via unspecified vectors.
Total number of vulnerabilities : 567   Page : 1 2 (This Page)3 4 5 6 7 8 9 10 11 12
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.