CVEs

385,453 total · page 6960 of 7,710

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2009-2464	Mozilla Corporation Firefox		0.04	—	0.13	Jul 22, 2009	The nsXULTemplateQueryProcessorRDF::CheckIsSeparator function in Mozilla Firefox before 3.0.12, SeaMonkey 2.0a1pre, and Thunderbird allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors…
CVE-2009-2463	Mozilla Corporation Firefox		0.01	—	0.06	Jul 22, 2009	Multiple integer overflows in the (1) PL_Base64Decode and (2) PL_Base64Encode functions in nsprpub/lib/libc/src/base64.c in Mozilla Firefox before 3.0.12, Thunderbird before 2.0.0.24, and SeaMonkey before 1.1.19 allow remote attackers to cause a denial of service (memory…
CVE-2009-2462	Mozilla Corporation Firefox		0.00	—	0.05	Jul 22, 2009	The browser engine in Mozilla Firefox before 3.0.12 and Thunderbird allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to (1) the frame chain and synchronous events, (2) a…
CVE-2009-2574	MiniTwitter MiniTwitter		0.03	—	0.02	Jul 22, 2009	index.php in MiniTwitter 0.2 beta allows remote authenticated users to modify certain options of arbitrary accounts via an opt action.
CVE-2009-2573	MiniTwitter MiniTwitter		0.03	—	0.01	Jul 22, 2009	Multiple SQL injection vulnerabilities in MiniTwitter 0.2 beta, when magic_quotes_gpc is disabled, allow remote authenticated users to execute arbitrary SQL commands via the (1) user parameter to (a) index.php and (b) rss.php.
CVE-2009-2572	Drupal Fivestar		0.00	—	0.01	Jul 22, 2009	Cross-site request forgery (CSRF) vulnerability in the Fivestar module 5.x-1.x before 5.x-1.14 and 6.x-1.x before 6.x-1.14, a module for Drupal, allows remote attackers to hijack the authentication of arbitrary users for requests that cast votes.
CVE-2009-2571	Verliadmin Verliadmin		0.03	—	0.01	Jul 22, 2009	Multiple cross-site scripting (XSS) vulnerabilities in index.php in VerliAdmin 0.3.7 and 0.3.8 allow remote attackers to inject arbitrary web script or HTML via (1) the URI, (2) the q parameter, (3) the nick parameter, or (4) the nick parameter in a bantest action.
CVE-2009-2570	Symantec Winfax Pro		0.04	—	0.12	Jul 22, 2009	Stack-based buffer overflow in the Symantec.FaxViewerControl.1 ActiveX control in WinFax\DCCFAXVW.DLL in Symantec WinFax Pro 10.03 allows remote attackers to execute arbitrary code via a long argument to the AppendFax method.
CVE-2009-2569	Verlihub Project Verlihub Control Panel		0.03	—	0.02	Jul 22, 2009	Multiple cross-site scripting (XSS) vulnerabilities in Verlihub Control Panel (VHCP) 1.7e allow remote attackers to inject arbitrary web script or HTML via (1) the nick parameter in a login action to index.php or (2) the URI in a news request to index.html.
CVE-2009-2568	Sorinara Streaming Audio Player		0.03	—	0.06	Jul 22, 2009	Stack-based buffer overflow in Sorinara Streaming Audio Player (SAP) 0.9 allows remote attackers to execute arbitrary code via a long string in a playlist (.m3u) file.
CVE-2009-2567	Almondsoft Almond Classifieds		0.03	—	0.01	Jul 22, 2009	SQL injection vulnerability in the Almond Classifieds (com_aclassf) component 5.6.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.
CVE-2009-2566	Tfm Mmplayer		0.05	—	0.31	Jul 21, 2009	Stack-based buffer overflow in TFM MMPlayer 2.0, and possibly 2.0.0.30, allows remote attackers to execute arbitrary code via a long string in a playlist (.m3u) file.
CVE-2009-2565	Shiromuku shiromuku(fs6)DIARY		0.00	—	0.01	Jul 21, 2009	Cross-site scripting (XSS) vulnerability in Perl CGI's By Mrs. Shiromuku shiromuku(fs6)DIARY 2.40 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2009-2564	NOS Microsystems getPlus Download Manager		0.03	—	0.06	Jul 21, 2009	NOS Microsystems getPlus Download Manager, as used in Adobe Reader 1.6.2.36 and possibly other versions, Corel getPlus Download Manager before 1.5.0.48, and possibly other products, installs NOS\bin\getPlus_HelperSvc.exe with insecure permissions (Everyone:Full Control), which…
CVE-2009-2563	Wireshark Wireshark		0.00	—	0.03	Jul 21, 2009	Unspecified vulnerability in the Infiniband dissector in Wireshark 1.0.6 through 1.2.0, when running on unspecified platforms, allows remote attackers to cause a denial of service (crash) via unknown vectors.
CVE-2009-2562	Wireshark Wireshark		0.00	—	0.03	Jul 21, 2009	Unspecified vulnerability in the AFS dissector in Wireshark 0.9.2 through 1.2.0 allows remote attackers to cause a denial of service (crash) via unknown vectors.
CVE-2009-2561	Wireshark Wireshark		0.00	—	0.02	Jul 21, 2009	Unspecified vulnerability in the sFlow dissector in Wireshark 1.2.0 allows remote attackers to cause a denial of service (CPU and memory consumption) via unspecified vectors.
CVE-2009-2560	Wireshark Wireshark		0.00	—	0.02	Jul 21, 2009	Multiple unspecified vulnerabilities in Wireshark 1.2.0 allow remote attackers to cause a denial of service (application crash) via a file that records a malformed packet trace and is processed by the (1) Bluetooth L2CAP, (2) RADIUS, or (3) MIOP dissector. NOTE: it was later…
CVE-2009-2559	Wireshark Wireshark		0.00	—	0.02	Jul 21, 2009	Buffer overflow in the IPMI dissector in Wireshark 1.2.0 allows remote attackers to cause a denial of service (crash) via unspecified vectors related to an array index error. NOTE: some of these details are obtained from third party information.
CVE-2009-2558	Adminnewstools Admin News Tools		0.03	—	0.02	Jul 21, 2009	system/message.php in Admin News Tools 2.5 does not properly restrict access, which allows remote attackers to post news messages via a direct request.
CVE-2009-2557	Adminnewstools Admin News Tools		0.04	—	0.07	Jul 21, 2009	Directory traversal vulnerability in system/download.php in Admin News Tools 2.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the fichier parameter.
CVE-2009-2556	Google Chrome		0.00	—	0.02	Jul 21, 2009	Google Chrome before 2.0.172.37 allows attackers to leverage renderer access to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors that trigger excessive memory allocation.
CVE-2009-2555	Google Chrome		0.00	—	0.03	Jul 21, 2009	Heap-based buffer overflow in src/jsregexp.cc in Google V8 before 1.1.10.14, as used in Google Chrome before 2.0.172.37, allows remote attackers to execute arbitrary code in the Chrome sandbox via a crafted JavaScript regular expression.
CVE-2009-2554	Joomla Jobline		0.03	—	0.01	Jul 20, 2009	SQL injection vulnerability in the search method in jobline.class.php in Jobline (com_jobline) 1.1.2.2, 1.3.1, and possibly earlier versions, a component for Joomla!, allows remote attackers to execute arbitrary SQL commands via the search parameter in a results action to…
CVE-2009-2553	Supersimple Super Simple Blog Script		0.03	—	0.02	Jul 20, 2009	Multiple SQL injection vulnerabilities in comments.php in Super Simple Blog Script 2.5.4, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the entry parameter.
CVE-2009-2552	Super Simple Blog Script Super Simple Blog Script		0.03	—	0.02	Jul 20, 2009	Multiple directory traversal vulnerabilities in comments.php in Super Simple Blog Script 2.5.4 allow remote attackers to overwrite, include, and execute arbitrary local files via the entry parameter.
CVE-2009-2551	Scriptsez Easy Image Downloader		0.03	—	0.02	Jul 20, 2009	Multiple cross-site scripting (XSS) vulnerabilities in ScriptsEz Easy Image Downloader allow remote attackers to inject arbitrary web script or HTML via the id parameter in a detail action to (1) main.php and possibly (2) demo_page.php.
CVE-2009-2550	Hamster Audio Player		0.04	—	0.09	Jul 20, 2009	Stack-based buffer overflow in Hamster Audio Player 0.3a allows remote attackers to execute arbitrary code via a long string in a (1) .m3u or (2) .hpl playlist file.
CVE-2009-2549	Armed Assault Armed Assault		0.00	—	0.02	Jul 20, 2009	Armed Assault (aka ArmA) 1.14 and earlier, and 1.16 beta, and Armed Assault II 1.02 and earlier allows remote attackers to cause a denial of service via a join packet with a final field whose value is (1) 0, which triggers a server crash related to memory allocation, or (2) 1,…
CVE-2009-2548	Bistudio Arma		0.00	—	0.04	Jul 20, 2009	Format string vulnerability in Armed Assault (aka ArmA) 1.14 and earlier, and 1.16 beta, and Armed Assault II 1.02 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in the (1) nickname and…
CVE-2009-2547	Bistudio Arma		0.00	—	0.01	Jul 20, 2009	Integer underflow in Armed Assault (aka ArmA) 1.14 and earlier, and 1.16 beta, and Armed Assault II 1.02 and earlier allows remote attackers to cause a denial of service (crash) via a VoIP over Network (VON) packet to port 2305 with a negative packet_size value, which triggers a…
CVE-2009-2546	Advanced Electron Forum AEF		0.00	—	0.01	Jul 20, 2009	Directory traversal vulnerability in Advanced Electron Forum (AEF) 1.x allows remote attackers to determine the existence of arbitrary files via the avatargalfile parameter when changing an avatar, which leaks the existence of the file in an error message. NOTE: the provenance…
CVE-2009-2545	Advanced Electron Forum Advanced Electron Forum		0.00	—	0.01	Jul 20, 2009	SQL injection vulnerability in Advanced Electron Forum (AEF) 1.x, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the filename in an uploaded attachment. NOTE: the provenance of this information is unknown; the details are…
CVE-2009-2544	Marcelo Costa Fileserver		0.03	—	0.03	Jul 20, 2009	Directory traversal vulnerability in the Marcelo Costa FileServer component 1.0 for Microsoft Windows Live Messenger and Messenger Plus! Live (MPL) allows remote authenticated users to list arbitrary directories and read arbitrary files via a .. (dot dot) in a pathname.
CVE-2009-2543	IBM Proventia engine		0.00	—	0.02	Jul 20, 2009	Multiple unspecified vulnerabilities in the IBM Proventia engine 4.9.0.0.44 20081231, as used in IBM Proventia Network Mail Security System, Network Mail Security System Virtual Appliance, Desktop Endpoint Security, Network Multi-Function Security (MFS), and possibly other…
CVE-2009-2542	Netscape Netscape		0.00	—	0.02	Jul 20, 2009	Netscape 6 and 8 allows remote attackers to cause a denial of service (memory consumption) via a large integer value for the length property of a Select object, a related issue to CVE-2009-1692.
CVE-2009-2541	Sony Playstation 3	Hig	0.49	7.5	0.03	Jul 20, 2009	The web browser on the Sony PLAYSTATION 3 (PS3) allows remote attackers to cause a denial of service (memory consumption and console hang) via a large integer value for the length property of a Select object, a related issue to CVE-2009-1692.
CVE-2009-2540	Opera Opera		0.00	—	0.03	Jul 20, 2009	Opera, possibly 9.64 and earlier, allows remote attackers to cause a denial of service (memory consumption) via a large integer value for the length property of a Select object, a related issue to CVE-2009-1692.
CVE-2009-2539	Aigo Aigo Md P8860		0.00	—	0.03	Jul 20, 2009	The Aigo P8860 allows remote attackers to cause a denial of service (memory consumption and browser hang) via a large integer value for the length property of a Select object, a related issue to CVE-2009-1692.
CVE-2009-2538	Nokia Symbian		0.00	—	0.03	Jul 20, 2009	The Nokia N95 running Symbian OS 9.2, N82, and N810 Internet Tablet allow remote attackers to cause a denial of service (memory consumption) via a large integer value for the length property of a Select object, a related issue to CVE-2009-1692.
CVE-2009-2537	KDE Konqueror		0.00	—	0.03	Jul 20, 2009	KDE Konqueror allows remote attackers to cause a denial of service (memory consumption) via a large integer value for the length property of a Select object, a related issue to CVE-2009-1692.
CVE-2009-2536	Microsoft Internet Explorer		0.02	—	0.19	Jul 20, 2009	Microsoft Internet Explorer 5 through 8 allows remote attackers to cause a denial of service (memory consumption and application crash) via a large integer value for the length property of a Select object, a related issue to CVE-2009-1692.
CVE-2009-2535	Mozilla Corporation Firefox		0.04	—	0.09	Jul 20, 2009	Mozilla Firefox before 2.0.0.19 and 3.x before 3.0.5, SeaMonkey, and Thunderbird allow remote attackers to cause a denial of service (memory consumption and application crash) via a large integer value for the length property of a Select object, a related issue to CVE-2009-1692.
CVE-2009-2534	RealNetworks Helix Mobile Server		0.04	—	0.09	Jul 20, 2009	RealNetworks Helix Server and Helix Mobile Server before 13.0.0 allow remote attackers to cause a denial of service (daemon crash) via an RTSP SETUP request that (1) specifies the / URI or (2) lacks a / character in the URI.
CVE-2009-2533	RealNetworks Helix Mobile Server		0.03	—	0.03	Jul 20, 2009	rmserver in RealNetworks Helix Server and Helix Mobile Server before 13.0.0 allows remote attackers to cause a denial of service (daemon exit) via multiple RTSP SET_PARAMETER requests with empty DataConvertBuffer headers.
CVE-2009-1897	Linux Kernel		0.03	—	0.02	Jul 20, 2009	The tun_chr_poll function in drivers/net/tun.c in the tun subsystem in the Linux kernel 2.6.30 and 2.6.30.1, when the -fno-delete-null-pointer-checks gcc option is omitted, allows local users to gain privileges via vectors involving a NULL pointer dereference and an mmap of…
CVE-2009-2492	Movabletype Movabletype		0.00	—	0.01	Jul 17, 2009	Cross-site scripting (XSS) vulnerability in mt-wizard.cgi in Six Apart Movable Type before 4.261 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2009-2480.
CVE-2009-2348	Google Android		0.00	—	0.00	Jul 17, 2009	Android 1.5 CRBxx allows local users to bypass the (1) Manifest.permission.CAMERA (aka android.permission.CAMERA) and (2) Manifest.permission.AUDIO_RECORD (aka android.permission.RECORD_AUDIO) configuration settings by installing and executing an application that does not make a…
CVE-2009-1894	Pulseaudio Pulseaudio		0.03	—	0.01	Jul 17, 2009	Race condition in PulseAudio 0.9.9, 0.9.10, and 0.9.14 allows local users to gain privileges via vectors involving creation of a hard link, related to the application setting LD_BIND_NOW to 1, and then calling execv on the target of the /proc/self/exe symlink.
CVE-2009-1893	Isc DHCP		0.00	—	0.01	Jul 17, 2009	The configtest function in the Red Hat dhcpd init script for DHCP 3.0.1 in Red Hat Enterprise Linux (RHEL) 3 allows local users to overwrite arbitrary files via a symlink attack on an unspecified temporary file, related to the "dhcpd -t" command.

CVE-2009-2464Jul 22, 2009
Mozilla Corporation
Firefox
risk 0.04cvss —epss 0.13
The nsXULTemplateQueryProcessorRDF::CheckIsSeparator function in Mozilla Firefox before 3.0.12, SeaMonkey 2.0a1pre, and Thunderbird allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors…
CVE-2009-2463Jul 22, 2009
Mozilla Corporation
Firefox
risk 0.01cvss —epss 0.06
Multiple integer overflows in the (1) PL_Base64Decode and (2) PL_Base64Encode functions in nsprpub/lib/libc/src/base64.c in Mozilla Firefox before 3.0.12, Thunderbird before 2.0.0.24, and SeaMonkey before 1.1.19 allow remote attackers to cause a denial of service (memory…
CVE-2009-2462Jul 22, 2009
Mozilla Corporation
Firefox
risk 0.00cvss —epss 0.05
The browser engine in Mozilla Firefox before 3.0.12 and Thunderbird allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to (1) the frame chain and synchronous events, (2) a…
CVE-2009-2574Jul 22, 2009
MiniTwitter
MiniTwitter
risk 0.03cvss —epss 0.02
index.php in MiniTwitter 0.2 beta allows remote authenticated users to modify certain options of arbitrary accounts via an opt action.
CVE-2009-2573Jul 22, 2009
MiniTwitter
MiniTwitter
risk 0.03cvss —epss 0.01
Multiple SQL injection vulnerabilities in MiniTwitter 0.2 beta, when magic_quotes_gpc is disabled, allow remote authenticated users to execute arbitrary SQL commands via the (1) user parameter to (a) index.php and (b) rss.php.
CVE-2009-2572Jul 22, 2009
Drupal
Fivestar
risk 0.00cvss —epss 0.01
Cross-site request forgery (CSRF) vulnerability in the Fivestar module 5.x-1.x before 5.x-1.14 and 6.x-1.x before 6.x-1.14, a module for Drupal, allows remote attackers to hijack the authentication of arbitrary users for requests that cast votes.
CVE-2009-2571Jul 22, 2009
Verliadmin
Verliadmin
risk 0.03cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in index.php in VerliAdmin 0.3.7 and 0.3.8 allow remote attackers to inject arbitrary web script or HTML via (1) the URI, (2) the q parameter, (3) the nick parameter, or (4) the nick parameter in a bantest action.
CVE-2009-2570Jul 22, 2009
Symantec
Winfax Pro
risk 0.04cvss —epss 0.12
Stack-based buffer overflow in the Symantec.FaxViewerControl.1 ActiveX control in WinFax\DCCFAXVW.DLL in Symantec WinFax Pro 10.03 allows remote attackers to execute arbitrary code via a long argument to the AppendFax method.
CVE-2009-2569Jul 22, 2009
Verlihub Project
Verlihub Control Panel
risk 0.03cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in Verlihub Control Panel (VHCP) 1.7e allow remote attackers to inject arbitrary web script or HTML via (1) the nick parameter in a login action to index.php or (2) the URI in a news request to index.html.
CVE-2009-2568Jul 22, 2009
Sorinara
Streaming Audio Player
risk 0.03cvss —epss 0.06
Stack-based buffer overflow in Sorinara Streaming Audio Player (SAP) 0.9 allows remote attackers to execute arbitrary code via a long string in a playlist (.m3u) file.
CVE-2009-2567Jul 22, 2009
Almondsoft
Almond Classifieds
risk 0.03cvss —epss 0.01
SQL injection vulnerability in the Almond Classifieds (com_aclassf) component 5.6.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.
CVE-2009-2566Jul 21, 2009
Tfm
Mmplayer
risk 0.05cvss —epss 0.31
Stack-based buffer overflow in TFM MMPlayer 2.0, and possibly 2.0.0.30, allows remote attackers to execute arbitrary code via a long string in a playlist (.m3u) file.
CVE-2009-2565Jul 21, 2009
Shiromuku
shiromuku(fs6)DIARY
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in Perl CGI's By Mrs. Shiromuku shiromuku(fs6)DIARY 2.40 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2009-2564Jul 21, 2009
NOS Microsystems
getPlus Download Manager
risk 0.03cvss —epss 0.06
NOS Microsystems getPlus Download Manager, as used in Adobe Reader 1.6.2.36 and possibly other versions, Corel getPlus Download Manager before 1.5.0.48, and possibly other products, installs NOS\bin\getPlus_HelperSvc.exe with insecure permissions (Everyone:Full Control), which…
CVE-2009-2563Jul 21, 2009
Wireshark
Wireshark
risk 0.00cvss —epss 0.03
Unspecified vulnerability in the Infiniband dissector in Wireshark 1.0.6 through 1.2.0, when running on unspecified platforms, allows remote attackers to cause a denial of service (crash) via unknown vectors.
CVE-2009-2562Jul 21, 2009
Wireshark
Wireshark
risk 0.00cvss —epss 0.03
Unspecified vulnerability in the AFS dissector in Wireshark 0.9.2 through 1.2.0 allows remote attackers to cause a denial of service (crash) via unknown vectors.
CVE-2009-2561Jul 21, 2009
Wireshark
Wireshark
risk 0.00cvss —epss 0.02
Unspecified vulnerability in the sFlow dissector in Wireshark 1.2.0 allows remote attackers to cause a denial of service (CPU and memory consumption) via unspecified vectors.
CVE-2009-2560Jul 21, 2009
Wireshark
Wireshark
risk 0.00cvss —epss 0.02
Multiple unspecified vulnerabilities in Wireshark 1.2.0 allow remote attackers to cause a denial of service (application crash) via a file that records a malformed packet trace and is processed by the (1) Bluetooth L2CAP, (2) RADIUS, or (3) MIOP dissector. NOTE: it was later…
CVE-2009-2559Jul 21, 2009
Wireshark
Wireshark
risk 0.00cvss —epss 0.02
Buffer overflow in the IPMI dissector in Wireshark 1.2.0 allows remote attackers to cause a denial of service (crash) via unspecified vectors related to an array index error. NOTE: some of these details are obtained from third party information.
CVE-2009-2558Jul 21, 2009
Adminnewstools
Admin News Tools
risk 0.03cvss —epss 0.02
system/message.php in Admin News Tools 2.5 does not properly restrict access, which allows remote attackers to post news messages via a direct request.
CVE-2009-2557Jul 21, 2009
Adminnewstools
Admin News Tools
risk 0.04cvss —epss 0.07
Directory traversal vulnerability in system/download.php in Admin News Tools 2.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the fichier parameter.
CVE-2009-2556Jul 21, 2009
Google
Chrome
risk 0.00cvss —epss 0.02
Google Chrome before 2.0.172.37 allows attackers to leverage renderer access to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors that trigger excessive memory allocation.
CVE-2009-2555Jul 21, 2009
Google
Chrome
risk 0.00cvss —epss 0.03
Heap-based buffer overflow in src/jsregexp.cc in Google V8 before 1.1.10.14, as used in Google Chrome before 2.0.172.37, allows remote attackers to execute arbitrary code in the Chrome sandbox via a crafted JavaScript regular expression.
CVE-2009-2554Jul 20, 2009
Joomla
Jobline
risk 0.03cvss —epss 0.01
SQL injection vulnerability in the search method in jobline.class.php in Jobline (com_jobline) 1.1.2.2, 1.3.1, and possibly earlier versions, a component for Joomla!, allows remote attackers to execute arbitrary SQL commands via the search parameter in a results action to…
CVE-2009-2553Jul 20, 2009
Supersimple
Super Simple Blog Script
risk 0.03cvss —epss 0.02
Multiple SQL injection vulnerabilities in comments.php in Super Simple Blog Script 2.5.4, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the entry parameter.
CVE-2009-2552Jul 20, 2009
Super Simple Blog Script
Super Simple Blog Script
risk 0.03cvss —epss 0.02
Multiple directory traversal vulnerabilities in comments.php in Super Simple Blog Script 2.5.4 allow remote attackers to overwrite, include, and execute arbitrary local files via the entry parameter.
CVE-2009-2551Jul 20, 2009
Scriptsez
Easy Image Downloader
risk 0.03cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in ScriptsEz Easy Image Downloader allow remote attackers to inject arbitrary web script or HTML via the id parameter in a detail action to (1) main.php and possibly (2) demo_page.php.
CVE-2009-2550Jul 20, 2009
Hamster
Audio Player
risk 0.04cvss —epss 0.09
Stack-based buffer overflow in Hamster Audio Player 0.3a allows remote attackers to execute arbitrary code via a long string in a (1) .m3u or (2) .hpl playlist file.
CVE-2009-2549Jul 20, 2009
Armed Assault
Armed Assault
risk 0.00cvss —epss 0.02
Armed Assault (aka ArmA) 1.14 and earlier, and 1.16 beta, and Armed Assault II 1.02 and earlier allows remote attackers to cause a denial of service via a join packet with a final field whose value is (1) 0, which triggers a server crash related to memory allocation, or (2) 1,…
CVE-2009-2548Jul 20, 2009
Bistudio
Arma
risk 0.00cvss —epss 0.04
Format string vulnerability in Armed Assault (aka ArmA) 1.14 and earlier, and 1.16 beta, and Armed Assault II 1.02 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in the (1) nickname and…
CVE-2009-2547Jul 20, 2009
Bistudio
Arma
risk 0.00cvss —epss 0.01
Integer underflow in Armed Assault (aka ArmA) 1.14 and earlier, and 1.16 beta, and Armed Assault II 1.02 and earlier allows remote attackers to cause a denial of service (crash) via a VoIP over Network (VON) packet to port 2305 with a negative packet_size value, which triggers a…
CVE-2009-2546Jul 20, 2009
Advanced Electron Forum
AEF
risk 0.00cvss —epss 0.01
Directory traversal vulnerability in Advanced Electron Forum (AEF) 1.x allows remote attackers to determine the existence of arbitrary files via the avatargalfile parameter when changing an avatar, which leaks the existence of the file in an error message. NOTE: the provenance…
CVE-2009-2545Jul 20, 2009
Advanced Electron Forum
Advanced Electron Forum
risk 0.00cvss —epss 0.01
SQL injection vulnerability in Advanced Electron Forum (AEF) 1.x, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the filename in an uploaded attachment. NOTE: the provenance of this information is unknown; the details are…
CVE-2009-2544Jul 20, 2009
Marcelo Costa
Fileserver
risk 0.03cvss —epss 0.03
Directory traversal vulnerability in the Marcelo Costa FileServer component 1.0 for Microsoft Windows Live Messenger and Messenger Plus! Live (MPL) allows remote authenticated users to list arbitrary directories and read arbitrary files via a .. (dot dot) in a pathname.
CVE-2009-2543Jul 20, 2009
IBM
Proventia engine
risk 0.00cvss —epss 0.02
Multiple unspecified vulnerabilities in the IBM Proventia engine 4.9.0.0.44 20081231, as used in IBM Proventia Network Mail Security System, Network Mail Security System Virtual Appliance, Desktop Endpoint Security, Network Multi-Function Security (MFS), and possibly other…
CVE-2009-2542Jul 20, 2009
Netscape
Netscape
risk 0.00cvss —epss 0.02
Netscape 6 and 8 allows remote attackers to cause a denial of service (memory consumption) via a large integer value for the length property of a Select object, a related issue to CVE-2009-1692.
CVE-2009-2541HigJul 20, 2009
Sony
Playstation 3
risk 0.49cvss 7.5epss 0.03
The web browser on the Sony PLAYSTATION 3 (PS3) allows remote attackers to cause a denial of service (memory consumption and console hang) via a large integer value for the length property of a Select object, a related issue to CVE-2009-1692.
CVE-2009-2540Jul 20, 2009
Opera
Opera
risk 0.00cvss —epss 0.03
Opera, possibly 9.64 and earlier, allows remote attackers to cause a denial of service (memory consumption) via a large integer value for the length property of a Select object, a related issue to CVE-2009-1692.
CVE-2009-2539Jul 20, 2009
Aigo
Aigo Md P8860
risk 0.00cvss —epss 0.03
The Aigo P8860 allows remote attackers to cause a denial of service (memory consumption and browser hang) via a large integer value for the length property of a Select object, a related issue to CVE-2009-1692.
CVE-2009-2538Jul 20, 2009
Nokia
Symbian
risk 0.00cvss —epss 0.03
The Nokia N95 running Symbian OS 9.2, N82, and N810 Internet Tablet allow remote attackers to cause a denial of service (memory consumption) via a large integer value for the length property of a Select object, a related issue to CVE-2009-1692.
CVE-2009-2537Jul 20, 2009
KDE
Konqueror
risk 0.00cvss —epss 0.03
KDE Konqueror allows remote attackers to cause a denial of service (memory consumption) via a large integer value for the length property of a Select object, a related issue to CVE-2009-1692.
CVE-2009-2536Jul 20, 2009
Microsoft
Internet Explorer
risk 0.02cvss —epss 0.19
Microsoft Internet Explorer 5 through 8 allows remote attackers to cause a denial of service (memory consumption and application crash) via a large integer value for the length property of a Select object, a related issue to CVE-2009-1692.
CVE-2009-2535Jul 20, 2009
Mozilla Corporation
Firefox
risk 0.04cvss —epss 0.09
Mozilla Firefox before 2.0.0.19 and 3.x before 3.0.5, SeaMonkey, and Thunderbird allow remote attackers to cause a denial of service (memory consumption and application crash) via a large integer value for the length property of a Select object, a related issue to CVE-2009-1692.
CVE-2009-2534Jul 20, 2009
RealNetworks
Helix Mobile Server
risk 0.04cvss —epss 0.09
RealNetworks Helix Server and Helix Mobile Server before 13.0.0 allow remote attackers to cause a denial of service (daemon crash) via an RTSP SETUP request that (1) specifies the / URI or (2) lacks a / character in the URI.
CVE-2009-2533Jul 20, 2009
RealNetworks
Helix Mobile Server
risk 0.03cvss —epss 0.03
rmserver in RealNetworks Helix Server and Helix Mobile Server before 13.0.0 allows remote attackers to cause a denial of service (daemon exit) via multiple RTSP SET_PARAMETER requests with empty DataConvertBuffer headers.
CVE-2009-1897Jul 20, 2009
Linux
Kernel
risk 0.03cvss —epss 0.02
The tun_chr_poll function in drivers/net/tun.c in the tun subsystem in the Linux kernel 2.6.30 and 2.6.30.1, when the -fno-delete-null-pointer-checks gcc option is omitted, allows local users to gain privileges via vectors involving a NULL pointer dereference and an mmap of…
CVE-2009-2492Jul 17, 2009
Movabletype
Movabletype
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in mt-wizard.cgi in Six Apart Movable Type before 4.261 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2009-2480.
CVE-2009-2348Jul 17, 2009
Google
Android
risk 0.00cvss —epss 0.00
Android 1.5 CRBxx allows local users to bypass the (1) Manifest.permission.CAMERA (aka android.permission.CAMERA) and (2) Manifest.permission.AUDIO_RECORD (aka android.permission.RECORD_AUDIO) configuration settings by installing and executing an application that does not make a…
CVE-2009-1894Jul 17, 2009
Pulseaudio
Pulseaudio
risk 0.03cvss —epss 0.01
Race condition in PulseAudio 0.9.9, 0.9.10, and 0.9.14 allows local users to gain privileges via vectors involving creation of a hard link, related to the application setting LD_BIND_NOW to 1, and then calling execv on the target of the /proc/self/exe symlink.
CVE-2009-1893Jul 17, 2009
Isc
DHCP
risk 0.00cvss —epss 0.01
The configtest function in the Red Hat dhcpd init script for DHCP 3.0.1 in Red Hat Enterprise Linux (RHEL) 3 allows local users to overwrite arbitrary files via a symlink attack on an unspecified temporary file, related to the "dhcpd -t" command.