# |
CVE ID
|
CWE ID
|
# of Exploits
|
Vulnerability Type(s)
|
Publish Date
|
Update Date
|
Score
|
Gained Access Level
|
Access
|
Complexity
|
Authentication
|
Conf.
|
Integ.
|
Avail.
|
56551 |
CVE-2009-5112 |
200 |
|
+Info |
2012-03-19 |
2017-12-28 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
wgarcmin.cgi in WebGlimpse 2.18.7 and earlier allows remote attackers to obtain the installation path via a crafted request. |
56552 |
CVE-2009-5111 |
399 |
|
DoS |
2011-12-27 |
2011-12-28 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
GoAhead WebServer allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris. |
56553 |
CVE-2009-5110 |
399 |
|
DoS |
2011-12-27 |
2011-12-28 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
dhttpd allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris. |
56554 |
CVE-2009-5103 |
79 |
1
|
XSS |
2011-10-21 |
2012-05-14 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Cross-site scripting (XSS) vulnerability in ATCOM Netvolution 1.0 ASP allows remote attackers to inject arbitrary web script or HTML via the email variable. |
56555 |
CVE-2009-5101 |
200 |
|
+Info |
2011-09-13 |
2018-10-10 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
Pentaho BI Server 1.7.0.1062 and earlier includes the session ID (JSESSIONID) in the URL, which allows attackers to obtain it from session history, referer headers, or sniffing of web traffic. |
56556 |
CVE-2009-5100 |
200 |
|
+Info |
2011-09-13 |
2018-10-10 |
2.1 |
None |
Local |
Low |
Not required |
Partial |
None |
None |
Pentaho BI Server 1.7.0.1062 and earlier does not set the autocomplete tag to off on web pages using a password field, which might allow physically proximate attackers to obtain the password. |
56557 |
CVE-2009-5099 |
79 |
|
XSS |
2011-09-13 |
2018-10-10 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Cross-site scripting (XSS) vulnerability in ViewAction in Pentaho BI Server 1.7.0.1062 and earlier allows remote attackers to inject arbitrary web script or HTML via the outputType parameter. |
56558 |
CVE-2009-5098 |
399 |
|
DoS |
2011-09-13 |
2018-10-10 |
5.4 |
None |
Remote |
High |
Not required |
None |
None |
Complete |
The LunaSysMgr process in Palm Pre WebOS 1.1 and earlier, when not viewing web pages in landscape mode, allows remote attackers to cause a denial of service (crash) via a web page containing a long string following a refresh tag, which triggers a floating point exception. |
56559 |
CVE-2009-5096 |
79 |
|
XSS |
2011-09-13 |
2017-08-28 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Cross-site scripting (XSS) vulnerability in the Flag Content module 5.x-2.x before 5.x-2.10 for Drupal allows remote attackers to inject arbitrary web script or HTML via the Reason parameter. |
56560 |
CVE-2009-5095 |
94 |
1
|
Exec Code File Inclusion |
2011-09-12 |
2017-09-18 |
6.8 |
None |
Remote |
Medium |
Not required |
Partial |
Partial |
Partial |
PHP remote file inclusion vulnerability in index_inc.php in ea gBook 0.1 and 0.1.4 allows remote attackers to execute arbitrary PHP code via a URL in the inc_ordner parameter. |
56561 |
CVE-2009-5093 |
22 |
1
|
Dir. Trav. |
2011-09-12 |
2019-10-10 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
Directory traversal vulnerability in gastbuch.php in G?stebuch (Gastebuch) 1.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the start parameter. |
56562 |
CVE-2009-5092 |
79 |
|
XSS |
2011-09-12 |
2017-08-28 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Cross-site scripting (XSS) vulnerability in the management interface in Microsoft FAST ESP 5.1.5 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
56563 |
CVE-2009-5090 |
89 |
1
|
Exec Code Sql |
2011-09-12 |
2017-09-18 |
6.8 |
None |
Remote |
Medium |
Not required |
Partial |
Partial |
Partial |
SQL injection vulnerability in editcomments.php in Bloggeruniverse Beta 2, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter and possibly other unspecified vectors. |
56564 |
CVE-2009-5089 |
22 |
1
|
Dir. Trav. |
2011-09-12 |
2017-09-18 |
4.3 |
None |
Remote |
Medium |
Not required |
Partial |
None |
None |
Directory traversal vulnerability in index.php in IdeaCart 0.02 and 0.02a allows remote attackers to read arbitrary files via a .. (dot dot) in the page parameter. |
56565 |
CVE-2009-5087 |
22 |
1
|
Dir. Trav. |
2011-09-12 |
2018-10-10 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
Directory traversal vulnerability in geohttpserver in Geovision Digital Video Surveillance System 8.2 allows remote attackers to read arbitrary files via a .. (dot dot) in a GET request. |
56566 |
CVE-2009-5086 |
79 |
|
XSS |
2011-09-02 |
2011-10-25 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Cross-site scripting (XSS) vulnerability in Appliance Configuration Manager (ACM) in Juniper IDP 4.1 before 4.1r3 and 4.2 before 4.2r1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
56567 |
CVE-2009-5085 |
264 |
|
Bypass |
2011-08-12 |
2012-04-25 |
2.6 |
None |
Remote |
High |
Not required |
None |
Partial |
None |
IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.2, when configured as an OpenID provider, does not delete the site information cookie in response to a user's deletion of a relying-party trust entry, which allows user-assisted remote attackers to bypass intended trust restrictions via vectors that trigger absence of the consent-to-authenticate page. |
56568 |
CVE-2009-5084 |
310 |
|
+Info |
2011-08-12 |
2012-04-25 |
1.9 |
None |
Local |
Medium |
Not required |
Partial |
None |
None |
IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.2, when com.tivoli.am.fim.infocard.delegates.InfoCardSTSDelegate tracing is enabled, creates a cleartext log entry containing a password, which might allow local users to obtain sensitive information by reading the log data. |
56569 |
CVE-2009-5083 |
287 |
|
Bypass |
2011-08-12 |
2011-08-12 |
6.8 |
None |
Remote |
Medium |
Not required |
Partial |
Partial |
Partial |
IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.2, when configured as an OpenID relying party, does not perform the expected login rejection upon receiving an OP-Identifier from an OpenID provider, which allows remote attackers to bypass authentication via unspecified vectors. |
56570 |
CVE-2009-5082 |
59 |
|
|
2011-06-30 |
2011-07-12 |
3.3 |
None |
Local |
Medium |
Not required |
None |
Partial |
Partial |
The (1) configure and (2) config.guess scripts in GNU troff (aka groff) 1.20.1 on Openwall GNU/*/Linux (aka Owl) improperly create temporary files upon a failure of the mktemp function, which makes it easier for local users to overwrite arbitrary files via a symlink attack on a temporary file. |
56571 |
CVE-2009-5081 |
59 |
|
|
2011-06-30 |
2013-12-12 |
3.3 |
None |
Local |
Medium |
Not required |
None |
Partial |
Partial |
The (1) config.guess, (2) contrib/groffer/perl/groffer.pl, and (3) contrib/groffer/perl/roff2.pl scripts in GNU troff (aka groff) 1.21 and earlier use an insufficient number of X characters in the template argument to the tempfile function, which makes it easier for local users to overwrite arbitrary files via a symlink attack on a temporary file, a different vulnerability than CVE-2004-0969. |
56572 |
CVE-2009-5080 |
59 |
|
|
2011-06-30 |
2013-12-12 |
3.3 |
None |
Local |
Medium |
Not required |
None |
Partial |
Partial |
The (1) contrib/eqn2graph/eqn2graph.sh, (2) contrib/grap2graph/grap2graph.sh, and (3) contrib/pic2graph/pic2graph.sh scripts in GNU troff (aka groff) 1.21 and earlier do not properly handle certain failed attempts to create temporary directories, which might allow local users to overwrite arbitrary files via a symlink attack on a file in a temporary directory, a different vulnerability than CVE-2004-1296. |
56573 |
CVE-2009-5079 |
59 |
|
|
2011-06-30 |
2013-12-12 |
3.3 |
None |
Local |
Medium |
Not required |
None |
Partial |
Partial |
The (1) gendef.sh, (2) doc/fixinfo.sh, and (3) contrib/gdiffmk/tests/runtests.in scripts in GNU troff (aka groff) 1.21 and earlier allow local users to overwrite arbitrary files via a symlink attack on a gro#####.tmp or /tmp/##### temporary file. |
56574 |
CVE-2009-5078 |
254 |
|
|
2011-06-30 |
2016-03-30 |
6.4 |
None |
Remote |
Low |
Not required |
None |
Partial |
Partial |
contrib/pdfmark/pdfroff.sh in GNU troff (aka groff) before 1.21 launches the Ghostscript program without the -dSAFER option, which allows remote attackers to create, overwrite, rename, or delete arbitrary files via a crafted document. |
56575 |
CVE-2009-5075 |
399 |
|
DoS |
2011-05-20 |
2011-05-24 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
Monkey's Audio before 4.02 allows remote attackers to cause a denial of service (application crash) via a malformed APE file. |
56576 |
CVE-2009-5073 |
399 |
|
DoS |
2011-04-21 |
2011-04-21 |
4.0 |
None |
Remote |
Low |
Single system |
None |
None |
Partial |
IBM Tivoli Directory Server (TDS) 6.0 before 6.0.0.59 (aka 6.0.0.8-TIV-ITDS-IF0001) allows remote authenticated users to cause a denial of service (infinite loop and daemon hang) by adding a nested group that contains the Distinguished Name (DN) of its parent entry. |
56577 |
CVE-2009-5072 |
399 |
|
DoS |
2011-04-21 |
2011-04-21 |
4.0 |
None |
Remote |
Low |
Single system |
None |
None |
Partial |
Memory leak in the ldap_explode_dn function in IBM Tivoli Directory Server (TDS) 6.0 before 6.0.0.61 (aka 6.0.0.8-TIV-ITDS-IF0003) allows remote authenticated users to cause a denial of service (memory consumption) via an empty string argument. |
56578 |
CVE-2009-5067 |
22 |
1
|
DoS Dir. Trav. |
2012-10-10 |
2013-01-30 |
4.3 |
None |
Remote |
Medium |
Not required |
Partial |
None |
None |
Directory traversal vulnerability in html2ps before 1.0b6 allows remote attackers to read arbitrary files via a .. (dot dot) in the "include file" SSI directive. NOTE: this issue only might be a vulnerability in limited scenarios, such as if html2ps is invoked by a web application, or if a user-assisted attacker provides filenames whose contents could cause a denial of service, such as certain devices. |
56579 |
CVE-2009-5066 |
255 |
|
|
2012-08-13 |
2015-01-17 |
2.1 |
None |
Local |
Low |
Not required |
Partial |
None |
None |
twiddle.sh in JBoss AS 5.0 and EAP 5.0 and earlier accepts credentials as command-line arguments, which allows local users to read the credentials by listing the process and its arguments. |
56580 |
CVE-2009-5065 |
79 |
|
XSS |
2011-04-11 |
2011-08-23 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) before 5.0 allows remote attackers to inject arbitrary web script or HTML via vectors involving nested CDATA stanzas. |
56581 |
CVE-2009-5064 |
264 |
|
+Priv |
2011-03-30 |
2012-01-18 |
6.9 |
None |
Local |
Medium |
Not required |
Complete |
Complete |
Complete |
** DISPUTED ** ldd in the GNU C Library (aka glibc or libc6) 2.13 and earlier allows local users to gain privileges via a Trojan horse executable file linked with a modified loader that omits certain LD_TRACE_LOADED_OBJECTS checks. NOTE: the GNU C Library vendor states "This is just nonsense. There are a gazillion other ways to introduce code if people are downloading arbitrary binaries and install them in appropriate directories or set LD_LIBRARY_PATH etc." |
56582 |
CVE-2009-5063 |
399 |
|
DoS |
2011-08-31 |
2012-07-23 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
Memory leak in the embedded_profile_len function in pngwutil.c in libpng before 1.2.39beta5 allows context-dependent attackers to cause a denial of service (memory leak or segmentation fault) via a JPEG image containing an iCCP chunk with a negative embedded profile length. NOTE: this is due to an incomplete fix for CVE-2006-7244. |
56583 |
CVE-2009-5062 |
399 |
|
DoS |
2011-03-22 |
2011-03-24 |
3.5 |
None |
Remote |
Medium |
Single system |
None |
None |
Partial |
IBM Lotus Quickr 8.1 before 8.1.0.15 services for Lotus Domino on AIX allows remote authenticated users to cause a denial of service (daemon crash) by subscribing to an Atom feed, aka SPR JRIE7VKMP9. |
56584 |
CVE-2009-5061 |
|
|
DoS |
2011-03-22 |
2011-03-24 |
2.1 |
None |
Remote |
High |
Single system |
None |
None |
Partial |
Unspecified vulnerability in IBM Lotus Quickr 8.1 before 8.1.0.14 services for Lotus Domino, when Domino Native Authentication is enabled, might allow remote authenticated users to cause a denial of service (daemon crash) by going offline, aka SPR MLZG7UPB9N. |
56585 |
CVE-2009-5060 |
|
|
DoS |
2011-03-22 |
2011-03-24 |
3.5 |
None |
Remote |
Medium |
Single system |
None |
None |
Partial |
Unspecified vulnerability in IBM Lotus Quickr 8.1 before 8.1.0.11 services for Lotus Domino might allow remote authenticated users to cause a denial of service (daemon crash) by accessing an entry in a calendar, aka SPR MZHA7SEBJX. |
56586 |
CVE-2009-5059 |
|
|
DoS |
2011-03-22 |
2011-03-24 |
3.5 |
None |
Remote |
Medium |
Single system |
None |
None |
Partial |
Unspecified vulnerability in IBM Lotus Quickr 8.1 before 8.1.0.10 services for Lotus Domino might allow remote authenticated users to cause a denial of service (daemon crash) by checking out a document that is accessed through a connector, aka SPR MMOI7PSR8J. |
56587 |
CVE-2009-5058 |
|
|
DoS |
2011-03-22 |
2011-03-24 |
3.5 |
None |
Remote |
Medium |
Single system |
None |
None |
Partial |
Unspecified vulnerability in IBM Lotus Quickr 8.1 before 8.1.0.5 services for Lotus Domino allows remote authenticated users to cause a denial of service (daemon crash) by deleting an item that is accessed through a connector, aka SPR RELS7LARKR. |
56588 |
CVE-2009-5057 |
310 |
|
|
2011-03-18 |
2011-03-22 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
The S/MIME feature in Open Ticket Request System (OTRS) before 2.3.4 does not configure the RANDFILE and HOME environment variables for OpenSSL, which might make it easier for remote attackers to decrypt e-mail messages that had lower than intended entropy available for cryptographic operations, related to inability to write to the seeding file. |
56589 |
CVE-2009-5056 |
20 |
|
Bypass |
2011-03-18 |
2011-03-22 |
2.1 |
None |
Remote |
High |
Single system |
Partial |
None |
None |
Open Ticket Request System (OTRS) before 2.4.0-beta2 does not properly enforce the move_into permission setting for a queue, which allows remote authenticated users to bypass intended access restrictions and read a ticket by watching this ticket, and then selecting the ticket from the watched-tickets list. |
56590 |
CVE-2009-5055 |
264 |
|
Bypass |
2011-03-18 |
2011-03-22 |
3.5 |
None |
Remote |
Medium |
Single system |
Partial |
None |
None |
Open Ticket Request System (OTRS) before 2.4.4 grants ticket access on the basis of single-digit substrings of the CustomerID value, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by visiting a ticket, as demonstrated by leveraging the CustomerID 12 account to read tickets that should be available only to CustomerID 1 or CustomerID 2. |
56591 |
CVE-2009-5051 |
16 |
|
|
2011-01-18 |
2017-08-16 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
Hastymail2 before RC 8 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. |
56592 |
CVE-2009-5044 |
59 |
|
|
2011-06-24 |
2016-03-30 |
3.3 |
None |
Local |
Medium |
Not required |
None |
Partial |
Partial |
contrib/pdfmark/pdfroff.sh in GNU troff (aka groff) before 1.21 allows local users to overwrite arbitrary files via a symlink attack on a pdf#####.tmp temporary file. |
56593 |
CVE-2009-5040 |
399 |
|
DoS |
2011-01-07 |
2017-08-16 |
6.8 |
None |
Remote |
Low |
Single system |
None |
None |
Complete |
CallManager Express (CME) on Cisco IOS before 15.0(1)XA allows remote authenticated users to cause a denial of service (device crash) by using an extension mobility (EM) phone to interact with the menu for SNR number changes, aka Bug ID CSCta63555. |
56594 |
CVE-2009-5037 |
399 |
|
DoS |
2011-01-07 |
2017-08-16 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
Cisco Adaptive Security Appliances (ASA) 5500 series devices with software before 8.2(3) allow remote attackers to cause a denial of service (ASDM syslog outage) via a long URL, aka Bug IDs CSCsm11264 and CSCtb92911. |
56595 |
CVE-2009-5036 |
|
|
DoS |
2010-12-16 |
2010-12-17 |
4.0 |
None |
Remote |
Low |
Single system |
None |
None |
Partial |
traveler.exe in IBM Lotus Notes Traveler before 8.0.1.3 CF1 allows remote authenticated users to cause a denial of service (daemon crash) via a malformed invitation document in a sync operation. |
56596 |
CVE-2009-5035 |
200 |
|
+Info |
2010-12-16 |
2010-12-17 |
4.3 |
None |
Remote |
Medium |
Not required |
Partial |
None |
None |
The Nokia client in IBM Lotus Notes Traveler before 8.5.0.2 does not properly handle multiple outgoing e-mail messages between sync operations, which might allow remote attackers to read communications intended for other recipients by examining appended messages. |
56597 |
CVE-2009-5034 |
399 |
|
DoS |
2010-12-16 |
2017-08-16 |
4.0 |
None |
Remote |
Low |
Single system |
None |
None |
Partial |
IBM Lotus Notes Traveler before 8.5.0.2 allows remote authenticated users to cause a denial of service (memory consumption and daemon crash) by syncing a large volume of data, related to the launch of a new process to handle the data while the previous process is still operating on the data. |
56598 |
CVE-2009-5033 |
200 |
|
+Info |
2010-12-16 |
2017-08-16 |
4.0 |
None |
Remote |
Low |
Single system |
Partial |
None |
None |
IBM Lotus Notes Traveler before 8.5.0.2 does not properly handle a "* *" argument sequence for a certain tell command, which allows remote authenticated users to obtain access to other users' data via a sync operation, related to storage of the data of multiple users within the same thread. |
56599 |
CVE-2009-5032 |
310 |
|
+Info |
2010-12-16 |
2017-08-16 |
5.8 |
None |
Remote |
Medium |
Not required |
Partial |
Partial |
None |
The encrypted e-mail feature in IBM Lotus Notes Traveler before 8.5.0.2 sends unencrypted messages when the feature is used without uploading a Notes ID file, which makes it easier for remote attackers to obtain sensitive information by sniffing the network. |
56600 |
CVE-2009-5031 |
20 |
|
XSS Bypass |
2012-07-22 |
2013-09-11 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
ModSecurity before 2.5.11 treats request parameter values containing single quotes as files, which allows remote attackers to bypass filtering rules and perform other attacks such as cross-site scripting (XSS) attacks via a single quote in a request parameter in the Content-Disposition field of a request with a multipart/form-data Content-Type header. |