CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In March 2009

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2003-1570 287 2009-03-31 2017-08-16
3.5
None Remote Medium Single system Partial None None
The server in IBM Tivoli Storage Manager (TSM) 5.1.x, 5.2.x before 5.2.1.2, and 6.x before 6.1 does not require credentials to observe the server console in some circumstances, which allows remote authenticated administrators to monitor server operations by establishing a console mode session, related to "session exposure."
2 CVE-2004-2762 DoS 2009-03-31 2017-08-16
4.3
None Remote Medium Not required None None Partial
The server in IBM Tivoli Storage Manager (TSM) 4.2.x on MVS, 5.1.9.x before 5.1.9.1, 5.1.x before 5.1.10, 5.2.2.x before 5.2.2.3, 5.2.x before 5.2.3, 5.3.x before 5.3.0, and 6.x before 6.1, when the HTTP communication method is enabled, allows remote attackers to cause a denial of service (daemon crash or hang) via unspecified HTTP traffic, as demonstrated by the IBM port scanner 1.3.1.
3 CVE-2005-4879 79 XSS 2009-03-31 2017-08-16
4.3
None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in jax_guestbook.php in Jax Guestbook 3.1 and 3.31 allow remote attackers to inject arbitrary web script or HTML via the (1) gmt_ofs and (2) language parameters. NOTE: the page parameter is already covered by CVE-2006-1913. NOTE: it was later reported that 3.50 is also affected.
4 CVE-2005-4880 264 +Info 2009-03-31 2009-03-31
5.0
None Remote Low Not required Partial None None
Jax Guestbook 3.1 and 3.31 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain IP addresses of users via a direct request to (1) guestbook, (2) guestbook_ips2block, (3) ips2block, and (4) formmailer/logfile.csv.
5 CVE-2006-7237 94 Exec Code File Inclusion 2009-03-31 2017-08-16
7.5
None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in mod/nc_phpmyadmin/core/libraries/Theme_Manager.class.php in Ixprim 2.0 allows remote attackers to execute arbitrary PHP code via a URL in an unspecified parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
6 CVE-2007-5542 119 1 Exec Code Overflow 2009-03-18 2009-03-18
9.3
None Remote Medium Not required Complete Complete Complete
Stack-based buffer overflow in Miranda IM 0.6.8 allows remote attackers to execute arbitrary code via a crafted Yahoo! Messenger packet. NOTE: this might overlap CVE-2007-5590.
7 CVE-2007-5543 119 1 Exec Code Overflow 2009-03-18 2009-03-18
9.3
None Remote Medium Not required Complete Complete Complete
Stack-based buffer overflow in Miranda IM 0.6.8 and 0.7.0 allows remote attackers to execute arbitrary code via a crafted Yahoo! Messenger packet. NOTE: this might overlap CVE-2007-5590.
8 CVE-2007-6721 2009-03-29 2012-11-15
10.0
None Remote Low Not required Complete Complete Complete
The Legion of the Bouncy Castle Java Cryptography API before release 1.38, as used in Crypto Provider Package before 1.36, has unknown impact and remote attack vectors related to "a Bleichenbacher vulnerability in simple RSA CMS signatures without signed attributes."
9 CVE-2007-6722 16 Bypass 2009-03-31 2017-08-16
5.0
None Remote Low Not required None Partial None
Vidalia bundle before 0.1.2.18, when running on Windows and Mac OS X, installs Privoxy with a configuration file (config.txt or config) that contains insecure (1) enable-remote-toggle and (2) enable-edit-actions settings, which allows remote attackers to bypass intended access restrictions and modify configuration.
10 CVE-2007-6723 16 Bypass 2009-03-31 2017-08-16
4.3
None Remote Medium Not required None Partial None
TorK before 0.22, when running on Windows and Mac OS X, installs Privoxy with a configuration file (config.txt or config) that contains insecure (1) enable-remote-toggle and (2) enable-edit-actions settings, which allows remote attackers to bypass intended access restrictions and modify configuration.
11 CVE-2007-6724 16 Bypass 2009-03-31 2017-08-16
5.0
None Remote Low Not required None Partial None
Vidalia bundle before 0.1.2.18, when running on Windows, installs Privoxy with a configuration file (config.txt or config) that contains an insecure enable-remote-http-toggle setting, which allows remote attackers to bypass intended access restrictions and modify configuration.
12 CVE-2008-3547 119 DoS Exec Code Overflow 2009-03-10 2017-08-07
9.0
Admin Remote Low Single system Complete Complete Complete
Buffer overflow in the server in OpenTTD 0.6.1 and earlier allows remote authenticated users to cause a denial of service (persistent game disruption) or possibly execute arbitrary code via vectors involving many long names for "companies and clients."
13 CVE-2008-4316 189 Exec Code Overflow 2009-03-14 2018-10-11
4.6
User Local Low Not required Partial Partial Partial
Multiple integer overflows in glib/gbase64.c in GLib before 2.20 allow context-dependent attackers to execute arbitrary code via a long string that is converted either (1) from or (2) to a base64 representation.
14 CVE-2008-4563 119 Exec Code Overflow 2009-03-11 2017-08-07
10.0
Admin Remote Low Not required Complete Complete Complete
Heap-based buffer overflow in adsmdll.dll 5.3.7.7296, as used by the daemon (dsmsvc.exe) in the backup server in IBM Tivoli Storage Manager (TSM) Express 5.3.7.3 and earlier and TSM 5.2, 5.3 before 5.3.6.0, and 5.4.0.0 through 5.4.4.0, allows remote attackers to execute arbitrary code via a crafted length value.
15 CVE-2008-4564 119 Exec Code Overflow 2009-03-18 2017-08-07
9.3
None Remote Medium Not required Complete Complete Complete
Stack-based buffer overflow in wp6sr.dll in the Autonomy KeyView SDK 10.4 and earlier, as used in IBM Lotus Notes, Symantec Mail Security (SMS) products, Symantec BrightMail Appliance products, and Symantec Data Loss Prevention (DLP) products, allows remote attackers to execute arbitrary code via a crafted Word Perfect Document (WPD) file.
16 CVE-2008-6347 94 Exec Code File Inclusion 2009-03-02 2017-09-28
7.5
User Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in lib/onguma.class.php in the Onguma Time Sheet (com_ongumatimesheet20) 2.0 4b component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
17 CVE-2008-6348 89 Exec Code Sql 2009-03-02 2017-09-28
7.5
User Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in DevelopItEasy Photo Gallery 1.2 allow remote attackers to execute arbitrary SQL commands via the (1) cat_id parameter to gallery_category.php, (2) photo_id parameter to gallery_photo.php, and the (3) user_name and (4) user_pass parameters to admin/index.php. NOTE: some of these details are obtained from third party information.
18 CVE-2008-6349 89 Exec Code Sql 2009-03-02 2017-09-28
7.5
User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in survey_results_text.php in TurnkeyForms Business Survey Pro 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
19 CVE-2008-6350 89 Exec Code Sql 2009-03-02 2017-09-28
7.5
User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in listtest.php in TurnkeyForms Local Classifieds allows remote attackers to execute arbitrary SQL commands via the r parameter.
20 CVE-2008-6351 79 XSS 2009-03-02 2017-09-28
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in listtest.php in TurnkeyForms Local Classifieds allows remote attackers to inject arbitrary web script or HTML via the r parameter.
21 CVE-2008-6352 89 Exec Code Sql 2009-03-02 2017-09-28
7.5
User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in home.html in Xpoze Pro 4.10 allows remote attackers to execute arbitrary SQL commands via the menu parameter.
22 CVE-2008-6353 89 Exec Code Sql 2009-03-02 2017-09-28
7.5
User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in index.asp in ASP-CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the cha parameter.
23 CVE-2008-6354 264 2009-03-02 2017-09-28
5.0
None Remote Low Not required Partial None None
The Net Guys ASPired2poll stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing the username and password via a direct request to ASPired2poll.mdb.
24 CVE-2008-6355 264 2009-03-02 2017-09-28
5.0
None Remote Low Not required Partial None None
The Net Guys ASPired2Protect stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing the username and password via a direct request to ASPired2Protect.mdb.
25 CVE-2008-6356 264 2009-03-02 2017-09-28
5.0
None Remote Low Not required Partial None None
evCal Events Calendar stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing the username and password via a direct request to (1) evcal.mdb and (2) evcal97.mdb.
26 CVE-2008-6357 264 2009-03-02 2017-09-28
5.0
None Remote Low Not required Partial None None
MyCal Personal Events Calendar stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing the username and password via a direct request to mycal.mdb.
27 CVE-2008-6358 89 Exec Code Sql 2009-03-02 2017-09-28
7.5
User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in group_index.php in Social Groupie allows remote attackers to execute arbitrary SQL commands via the id parameter.
28 CVE-2008-6359 79 2 XSS 2009-03-02 2018-10-11
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in index.php in Max's Guestbook allows remote attackers to inject arbitrary web script or HTML via the (1) name, (2) email, and (3) message parameters.
29 CVE-2008-6360 79 XSS 2009-03-02 2017-08-16
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the userranks feature in modules/system/admin.php in ImpressCMS 1.0.2 final allows remote attackers to inject arbitrary web script or HTML via the rank_title parameter. NOTE: some of these details are obtained from third party information.
30 CVE-2008-6361 22 Dir. Trav. 2009-03-02 2017-09-28
6.8
User Remote Medium Not required Partial Partial Partial
Directory traversal vulnerability in index.php in InSun Feed CMS 1.7.3 19Beta allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the lang parameter.
31 CVE-2008-6362 89 Exec Code Sql 2009-03-02 2017-09-28
7.5
User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in sitepage.php in Multiple Membership Script 2.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.
32 CVE-2008-6363 119 Exec Code Overflow 2009-03-02 2017-09-28
9.3
Admin Remote Medium Not required Complete Complete Complete
Stack-based buffer overflow in DesignWorks Professional 4.3.1 and 5.0.7 allows remote attackers to execute arbitrary code via a crafted .cct file. NOTE: some of these details are obtained from third party information.
33 CVE-2008-6364 89 Exec Code Sql 2009-03-02 2017-09-28
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in logon_process.jsp in Ad Server Solutions Banner Exchange Solution Java allows remote attackers to execute arbitrary SQL commands via the (1) username (uname parameter) and (2) password (pass parameter). NOTE: some of these details are obtained from third party information.
34 CVE-2008-6365 89 Exec Code Sql 2009-03-02 2017-09-28
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in logon.jsp in Ad Server Solutions Ad Management Software Java allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password, related to the uname or pass parameters to logon.jsp or logon_processing.jsp. NOTE: some of these details are obtained from third party information.
35 CVE-2008-6366 89 Exec Code Sql 2009-03-02 2017-09-28
7.5
User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in logon.jsp in Ad Server Solutions Affiliate Software Java 4.0 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password, possibly related to the uname and pass parameters to logon_process.jsp. NOTE: some of these details are obtained from third party information.
36 CVE-2008-6367 20 Exec Code 2009-03-02 2017-09-28
8.5
Admin Remote Medium Single system Complete Complete Complete
Unrestricted file upload vulnerability in Photos/create_album.php in Social Groupie allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in Member_images/.
37 CVE-2008-6368 89 Exec Code Sql 2009-03-02 2017-08-16
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in index.php in Chipmunk Guestbook 1.4m allows remote attackers to execute arbitrary SQL commands via the start parameter.
38 CVE-2008-6369 89 Exec Code Sql 2009-03-02 2017-09-28
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in default.asp in Ocean12 Contact Manager Pro 1.02 allows remote attackers to execute arbitrary SQL commands via the Sort parameter.
39 CVE-2008-6370 79 XSS 2009-03-02 2017-09-28
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in default.asp in Ocean12 Contact Manager Pro 1.02 allows remote attackers to inject arbitrary web script or HTML via the DisplayFormat parameter.
40 CVE-2008-6371 89 Exec Code Sql 2009-03-02 2017-09-28
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in login.asp in Ocean12 Membership Manager Pro allows remote attackers to execute arbitrary SQL commands via the username (Username parameter).
41 CVE-2008-6372 89 Exec Code Sql 2009-03-02 2017-09-28
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in default.asp in Ocean12 FAQ Manager Pro 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter in a Cat action. NOTE: some of these details are obtained from third party information.
42 CVE-2008-6373 94 2009-03-02 2017-08-16
5.0
None Remote Low Not required None Partial None
Unspecified vulnerability in Nagios before 3.0.6 has unspecified impact and remote attack vectors related to CGI programs, "adaptive external commands," and "writing newlines and submitting service comments."
43 CVE-2008-6374 264 +Info 2009-03-02 2017-09-28
5.0
None Remote Low Not required Partial None None
CodefixerSoftware MailingListPro Free Edition stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to db/MailingList.mdb.
44 CVE-2008-6375 264 1 2009-03-02 2017-08-16
5.0
None Remote Low Not required Partial None None
JBook stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request to userids.mdb.
45 CVE-2008-6376 89 1 Exec Code Sql 2009-03-02 2017-08-16
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in main.asp in Jbook allows remote attackers to execute arbitrary SQL commands via the password (pass parameter).
46 CVE-2008-6377 94 Exec Code File Inclusion 2009-03-02 2017-09-28
7.5
User Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in include/global.php in Multi SEO phpBB 1.1.0 allows remote attackers to execute arbitrary PHP code via a URL in the pfad parameter.
47 CVE-2008-6378 89 Exec Code Sql 2009-03-02 2017-09-28
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in calendar_Eventupdate.asp in Calendar Mx Professional 2.0.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.
48 CVE-2008-6379 89 Exec Code Sql 2009-03-02 2017-09-28
7.5
User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in pics_pre.asp in Gallery MX 2.0.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.
49 CVE-2008-6380 89 Exec Code Sql 2009-03-02 2017-09-28
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in default.aspx in Active Web Helpdesk 2.0 allows remote attackers to execute arbitrary SQL commands via the CategoryID parameter.
50 CVE-2008-6381 89 Exec Code Sql 2009-03-02 2017-09-28
4.6
User Remote High Single system Partial Partial Partial
SQL injection vulnerability in modules/adresses/viewcat.php in bcoos 1.0.13, and possibly earlier, allows remote authenticated users with Addresses module permissions to execute arbitrary SQL commands via the cid parameter.
Total number of vulnerabilities : 554   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.