CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In October 2009

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
151 CVE-2009-3596 264 1 Bypass 2009-10-08 2017-09-19
7.5
None Remote Low Not required Partial Partial Partial
JoxTechnology Ajox Poll does not properly restrict access to admin/managepoll.php, which allows remote attackers to bypass authentication and gain administrative access via a direct request.
152 CVE-2009-3595 89 1 Exec Code Sql 2009-10-08 2017-09-19
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in results.php in VS PANEL 7.5.5 allows remote attackers to execute arbitrary SQL commands via the Cat_ID parameter, a different vector than CVE-2009-3590.
153 CVE-2009-3594 79 XSS 2009-10-08 2017-08-17
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in bpost.php in BLOB Blog System before 1.2 allows remote attackers to inject arbitrary web script or HTML via the postid parameter.
154 CVE-2009-3593 79 1 XSS 2009-10-08 2017-08-17
4.3
None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Freelancers 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to placebid.php and (2) jobid parameter to post_resume.php.
155 CVE-2009-3592 79 1 XSS 2009-10-08 2017-08-17
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in customer/home.php in Qualiteam X-Cart allows remote attackers to inject arbitrary web script or HTML via the email parameter in a subscribed action, a different vector than CVE-2005-1823.
156 CVE-2009-3591 20 DoS 2009-10-08 2018-10-10
5.0
None Remote Low Not required None None Partial
Dopewars 1.5.12 allows remote attackers to cause a denial of service (segmentation fault) via a REQUESTJET message with an invalid location.
157 CVE-2009-3590 89 1 Exec Code Sql 2009-10-08 2017-09-19
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in showcat.php in VS PANEL 7.3.6 allows remote attackers to execute arbitrary SQL commands via the Cat_ID parameter.
158 CVE-2009-3589 264 +Priv 2009-10-08 2009-10-08
4.6
None Local Low Not required Partial Partial Partial
incron 0.5.5 does not initialize supplementary groups when running a process from a user's incrontabs, which causes the process to be run with the incrond supplementary groups and allows local users to gain privileges via an incrontab table.
159 CVE-2009-3588 DoS 2009-10-13 2021-04-14
4.3
None Remote Medium Not required None None Partial
Unspecified vulnerability in the arclib component in the Anti-Virus engine in CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) 7.1 through r8.1; Anti-Virus 2007 (v8) through 2009; eTrust EZ Antivirus r7.1; Internet Security Suite 2007 (v3) through Plus 2009; and other CA products allows remote attackers to cause a denial of service via a crafted RAR archive file that triggers stack corruption, a different vulnerability than CVE-2009-3587.
160 CVE-2009-3587 DoS Exec Code 2009-10-13 2021-11-15
9.3
None Remote Medium Not required Complete Complete Complete
Unspecified vulnerability in the arclib component in the Anti-Virus engine in CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) 7.1 through r8.1; Anti-Virus 2007 (v8) through 2009; eTrust EZ Antivirus r7.1; Internet Security Suite 2007 (v3) through Plus 2009; and other CA products allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted RAR archive file that triggers heap corruption, a different vulnerability than CVE-2009-3588.
161 CVE-2009-3579 79 XSS 2009-10-07 2018-10-10
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the CookieDump.java sample application in Mort Bay Jetty 6.1.19 and 6.1.20 allows remote attackers to inject arbitrary web script or HTML via the Value parameter in a GET request to cookie/.
162 CVE-2009-3575 DoS Exec Code Overflow 2009-10-07 2009-12-31
10.0
None Remote Low Not required Complete Complete Complete
Buffer overflow in DHTRoutingTableDeserializer.cc in aria2 0.15.3, 1.2.0, and other versions allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors.
163 CVE-2009-3574 119 1 DoS Exec Code Overflow 2009-10-06 2017-09-19
9.3
None Remote Medium Not required Complete Complete Complete
Tuniac 090517c allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long File1 argument in a .pls playlist file, possibly a buffer overflow.
164 CVE-2009-3573 2009-10-06 2017-08-17
9.3
None Remote Medium Not required Complete Complete Complete
Multiple insecure method vulnerabilities in the PDIControl.PDI.1 ActiveX control (PDIControl.dll) 2.2.3160.0 in EMC Captiva PixTools Distributed Imaging 2.2 allow remote attackers to create or overwrite arbitrary files via the (1) SetLogFileName and (2) WriteToLog methods.
165 CVE-2009-3572 DoS 2009-10-06 2009-10-08
4.9
None Local Low Not required None None Complete
OpenBSD 4.4, 4.5, and 4.6, when running on an i386 kernel, does not properly handle XMM exceptions, which allows local users to cause a denial of service (kernel panic) via unspecified vectors.
166 CVE-2009-3571 119 Overflow 2009-10-06 2015-11-24
9.3
None Remote Medium Not required Complete Complete Complete
Unspecified vulnerability in OpenOffice.org (OOo) has unknown impact and client-side attack vector, as demonstrated by a certain module in VulnDisco Pack Professional 8.8, aka "Client-side exploit." NOTE: as of 20091005, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
167 CVE-2009-3570 2009-10-06 2015-11-24
10.0
None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in OpenOffice.org (OOo) has unspecified impact and remote attack vectors, as demonstrated by a certain module in VulnDisco Pack Professional 8.9. NOTE: as of 20091005, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
168 CVE-2009-3569 119 Exec Code Overflow 2009-10-06 2016-08-17
9.3
None Remote Medium Not required Complete Complete Complete
Stack-based buffer overflow in OpenOffice.org (OOo) allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by a certain module in VulnDisco Pack Professional 8.8, aka "Client-side stack overflow exploit." NOTE: as of 20091005, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
169 CVE-2009-3568 264 2009-10-06 2009-10-08
5.0
None Remote Low Not required Partial None None
Comment RSS 5.x before 5.x-2.2 and 6.x before 6.x-2.2, a module for Drupal, does not properly enforce permissions when a link is added to the RSS feed, which allows remote attackers to obtain the node title and possibly other sensitive content by reading the feed.
170 CVE-2009-3567 79 XSS 2009-10-06 2017-08-17
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in modules/tickets/functions_ticketsui.php in Kayako SupportSuite and eSupport 3.60.04 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in the staff control panel, a different vector than CVE-2007-1145.
171 CVE-2009-3564 264 2009-10-06 2017-12-09
4.7
None Local Medium Not required Complete None None
puppetmasterd in puppet 0.24.6 does not reset supplementary groups when it switches to a different user, which might allow local users to access restricted files.
172 CVE-2009-3562 79 1 XSS 2009-10-05 2017-09-19
2.6
None Remote High Not required None Partial None
Cross-site scripting (XSS) vulnerability in Xerver HTTP Server 4.32 allows remote attackers to inject arbitrary web script or HTML via the currentPath parameter in a chooseDirectory action.
173 CVE-2009-3561 22 1 Dir. Trav. 2009-10-05 2017-09-19
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in Xerver HTTP Server 4.32 allows remote attackers to read arbitrary files via a full pathname with a drive letter in the currentPath parameter in a chooseDirectory action.
174 CVE-2009-3551 189 DoS 2009-10-30 2017-09-19
5.0
None Remote Low Not required None None Partial
Off-by-one error in the dissect_negprot_response function in packet-smb.c in the SMB dissector in Wireshark 1.2.0 through 1.2.2 allows remote attackers to cause a denial of service (application crash) via a file that records a malformed packet trace. NOTE: some of these details are obtained from third party information.
175 CVE-2009-3550 DoS 2009-10-30 2017-09-19
4.3
None Remote Medium Not required None None Partial
The DCERPC/NT dissector in Wireshark 0.10.10 through 1.0.9 and 1.2.0 through 1.2.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a file that records a malformed packet trace. NOTE: some of these details are obtained from third party information.
176 CVE-2009-3549 20 DoS 2009-10-30 2017-09-19
5.0
None Remote Low Not required None None Partial
packet-paltalk.c in the Paltalk dissector in Wireshark 1.2.0 through 1.2.2, on SPARC and certain other platforms, allows remote attackers to cause a denial of service (application crash) via a file that records a malformed packet trace.
177 CVE-2009-3546 119 Overflow 2009-10-19 2017-09-19
9.3
None Remote Medium Not required Complete Complete Complete
The _gdGetColors function in gd_gd.c in PHP 5.2.11 and 5.3.x before 5.3.1, and the GD Graphics Library 2.x, does not properly verify a certain colorsTotal structure member, which might allow remote attackers to conduct buffer overflow or buffer over-read attacks via a crafted GD file, a different vulnerability than CVE-2009-3293. NOTE: some of these details are obtained from third party information.
178 CVE-2009-3545 20 1 DoS 2009-10-05 2017-09-19
4.0
None Remote Low ??? None None Partial
DataWizard Technologies FtpXQ FTP Server 3.0 allows remote authenticated users to cause a denial of service (crash) via a long ABOR command.
179 CVE-2009-3544 200 1 +Info 2009-10-05 2017-09-19
5.0
None Remote Low Not required Partial None None
Xerver HTTP Server 4.32 allows remote attackers to obtain the source code for a web page via an HTTP request with the addition of ::$DATA after the HTML file name.
180 CVE-2009-3543 89 1 Exec Code Sql 2009-10-02 2017-09-19
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in _phenotype/admin/login.php in Phenotype CMS before 2.9 allows remote attackers to execute arbitrary SQL commands via the user parameter (aka the login name).
181 CVE-2009-3542 22 1 Dir. Trav. File Inclusion 2009-10-02 2017-08-17
7.5
None Remote Low Not required Partial Partial Partial
Directory traversal vulnerability in ls.php in LittleSite (aka LS or LittleSite.php) 0.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the file parameter to index.php. NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC share pathname or an ftp, ftps, or ssh2.sftp URL.
182 CVE-2009-3541 94 1 Exec Code File Inclusion 2009-10-02 2017-09-19
7.5
None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in CoupleDB.php in PHPGenealogy 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the DataDirectory parameter.
183 CVE-2009-3540 79 XSS 2009-10-02 2009-10-05
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in listads.php in YourFreeWorld Ultra Classifieds Pro allows remote attackers to inject arbitrary web script or HTML via the cn parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
184 CVE-2009-3539 79 1 XSS 2009-10-02 2009-10-05
4.3
None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in YourFreeWorld Ultra Classifieds Pro allow remote attackers to inject arbitrary web script or HTML via the (1) cname parameter to subclass.php and the (2) sn parameter to listads.php.
185 CVE-2009-3538 22 Dir. Trav. 2009-10-02 2009-10-05
7.5
None Remote Low Not required Partial Partial Partial
Directory traversal vulnerability in thumb.php in Clear Content 1.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the url parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
186 CVE-2009-3537 119 1 DoS Exec Code Overflow 2009-10-02 2017-09-19
9.3
None Remote Medium Not required Complete Complete Complete
Multiple stack-based buffer overflows in EpicDJSoftware EpicDJ 1.3.9.1 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long string in a (1) .m3u or (2) .mpl playlist file.
187 CVE-2009-3536 119 1 DoS Exec Code Overflow 2009-10-02 2017-09-19
9.3
None Remote Medium Not required Complete Complete Complete
Multiple stack-based buffer overflows in EpicDJSoftware EpicVJ 1.2.8.0 and 1.3.1.2 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long string in a (1) .m3u or (2) .mpl playlist file.
188 CVE-2009-3535 22 2 Dir. Trav. File Inclusion 2009-10-02 2017-09-19
4.3
None Remote Medium Not required Partial None None
Directory traversal vulnerability in image.php in Clear Content 1.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the url parameter. NOTE: the researcher also suggests an analogous PHP remote file inclusion vulnerability, but this may be incorrect.
189 CVE-2009-3534 22 1 Dir. Trav. 2009-10-02 2017-09-19
6.8
None Remote Medium Not required Partial Partial Partial
Directory traversal vulnerability in index.php in LionWiki 3.0.3, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the page parameter.
190 CVE-2009-3533 89 Exec Code Sql 2009-10-02 2017-08-17
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in report.php in Meeting Room Booking System (MRBS) before 1.4.2 allows remote attackers to execute arbitrary SQL commands via the typematch parameter. NOTE: some of these details are obtained from third party information.
191 CVE-2009-3532 89 Exec Code Sql 2009-10-02 2018-10-10
7.5
None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in login.asp (aka the login screen) in LogRover 2.3 and 2.3.3 on Windows allow remote attackers to execute arbitrary SQL commands via the (1) uname and (2) pword parameters. NOTE: some of these details are obtained from third party information.
192 CVE-2009-3531 89 2 Exec Code Sql 2009-10-02 2017-09-19
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in vnews.php in Universe CMS 1.0.6 allows remote attackers to execute arbitrary SQL commands via the id parameter.
193 CVE-2009-3530 79 1 XSS 2009-10-02 2017-09-19
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in storefront.php in RadScripts RadBids Gold 4 allows remote attackers to inject arbitrary web script or HTML via the mode parameter.
194 CVE-2009-3529 89 1 Exec Code Sql 2009-10-02 2017-09-19
6.8
None Remote Medium Not required Partial Partial Partial
SQL injection vulnerability in index.php in RadScripts RadBids Gold 4 allows remote attackers to execute arbitrary SQL commands via the fid parameter in a view_forum action, a different vector than CVE-2005-1074.
195 CVE-2009-3528 89 1 Exec Code Sql 2009-10-02 2017-09-19
6.5
None Remote Low ??? Partial Partial Partial
SQL injection vulnerability in Profile.php in MyMsg 1.0.3 allows remote authenticated users to execute arbitrary SQL commands via the uid parameter in a show action.
196 CVE-2009-3527 362 DoS +Priv Mem. Corr. 2009-10-06 2009-10-07
6.9
None Local Medium Not required Complete Complete Complete
Race condition in the Pipe (IPC) close function in FreeBSD 6.3 and 6.4 allows local users to cause a denial of service (crash) or gain privileges via vectors related to kqueues, which triggers a use after free, leading to a NULL pointer dereference or memory corruption.
197 CVE-2009-3525 264 2009-10-05 2017-09-19
7.2
None Local Low Not required Complete Complete Complete
The pyGrub boot loader in Xen 3.0.3, 3.3.0, and Xen-3.3.1 does not support the password option in grub.conf for para-virtualized guests, which allows attackers with access to the para-virtualized guest console to boot the guest or modify the guest's kernel boot parameters without providing the expected password.
198 CVE-2009-3524 2009-10-01 2017-09-19
7.2
None Local Low Not required Complete Complete Complete
Unspecified vulnerability in ashWsFtr.dll in avast! Home and Professional for Windows before 4.8.1356 has unknown impact and local attack vectors.
199 CVE-2009-3523 20 +Priv Mem. Corr. 2009-10-01 2017-09-19
6.9
None Local Medium Not required Complete Complete Complete
aavmKer4.sys in avast! Home and Professional for Windows before 4.8.1356 does not properly validate input to IOCTLs (1) 0xb2d6000c and (2) 0xb2d60034, which allows local users to gain privileges via IOCTL requests using crafted kernel addresses that trigger memory corruption, a different vulnerability than CVE-2008-1625.
200 CVE-2009-3522 119 DoS Overflow +Priv 2009-10-01 2018-10-10
7.2
None Local Low Not required Complete Complete Complete
Stack-based buffer overflow in aswMon2.sys in avast! Home and Professional for Windows 4.8.1351, and possibly other versions before 4.8.1356, allows local users to cause a denial of service (system crash) and possibly gain privileges via a crafted IOCTL request to IOCTL 0xb2c80018.
Total number of vulnerabilities : 352   Page : 1 2 3 4 (This Page)5 6 7 8
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.