Security Vulnerabilities (CVSS score between 5 and 5.99)

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	# of Exploits	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
15701	CVE-2009-2266	200		+Info	2009-09-09	2009-09-10	5.0	None	Remote	Low	Not required	Partial	None	None
OXID eShop 4.x before 4.1.4-21266, 3.x, and 2.x allows remote attackers to obtain sensitive information (session details and order history of other users) via a crafted cookie.
15702	CVE-2009-2260	200		+Info	2009-06-30	2010-06-13	5.0	None	Remote	Low	Not required	Partial	None	None
stardict 3.0.1, when Enable Net Dict is configured, sends the contents of the clipboard to a dictionary server, which allows remote attackers to obtain sensitive information by sniffing the network.
15703	CVE-2009-2229	22	1	Dir. Trav.	2009-06-26	2017-09-18	5.0	None	Remote	Low	Not required	Partial	None	None
Directory traversal vulnerability in engine.php in Kasseler CMS 1.3.5 lite allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter during a download action, a different vector than CVE-2008-3087. NOTE: some of these details are obtained from third party information.
15704	CVE-2009-2222	22		Dir. Trav.	2009-06-26	2009-07-07	5.0	None	Remote	Low	Not required	Partial	None	None
Directory traversal vulnerability in PHP-I-BOARD 1.2 and earlier allows remote attackers to read arbitrary files via directory traversal sequences in unspecified vectors, probably related to mail.
15705	CVE-2009-2220	22	1	Dir. Trav.	2009-06-26	2017-09-18	5.1	None	Remote	High	Not required	Partial	Partial	Partial
Multiple directory traversal vulnerabilities in Tribiq CMS 5.0.12c, when register_globals is enabled and magic_quotes_gpc is disabled, allow remote attackers to include and possibly execute arbitrary files via directory traversal sequences in the template_path parameter to (1) masthead.inc.php, (2) toppanel.inc.php, and (3) contact.inc.php in templates/mytribiqsite/tribiq-CL-9000/includes; and the use_template_family parameter to (4) templates/mytribiqsite/tribiq-CL-9000/includes/nlarlist_content.inc.php. NOTE: the tribal-GPL-1066/includes/header.inc.php vector is already covered by CVE-2008-4894.
15706	CVE-2009-2214	399		DoS	2009-06-25	2017-08-16	5.0	None	Remote	Low	Not required	None	None	Partial
The Secure Gateway service in Citrix Secure Gateway 3.1 and earlier allows remote attackers to cause a denial of service (CPU consumption) via an unspecified request.
15707	CVE-2009-2212				2009-06-25	2009-07-01	5.0	None	Remote	Low	Not required	Partial	None	None
The CQWeb server in IBM Rational ClearQuest 7.0.0 before 7.0.0.6 and 7.0.1 before 7.0.1.5 allows attackers to discover a (1) username or (2) password via unspecified vectors.
15708	CVE-2009-2199				2009-08-12	2012-03-30	5.8	None	Remote	Medium	Not required	None	Partial	Partial
Incomplete blacklist vulnerability in WebKit in Apple Safari before 4.0.3, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms, allows remote attackers to spoof domain names in URLs, and possibly conduct phishing attacks, via unspecified homoglyphs.
15709	CVE-2009-2196				2009-08-12	2009-08-18	5.0	None	Remote	Low	Not required	None	Partial	None
Unspecified vulnerability in Apple Safari 4 before 4.0.3 allows remote web servers to place an arbitrary web site in the Top Sites view, and possibly conduct phishing attacks, via unknown vectors.
15710	CVE-2009-2185	20		DoS	2009-06-24	2019-07-29	5.0	None	Remote	Low	Not required	None	None	Partial
The ASN.1 parser (pluto/asn1.c, libstrongswan/asn1/asn1.c, libstrongswan/asn1/asn1_parser.c) in (a) strongSwan 2.8 before 2.8.10, 4.2 before 4.2.16, and 4.3 before 4.3.2; and (b) openSwan 2.6 before 2.6.22 and 2.4 before 2.4.15 allows remote attackers to cause a denial of service (pluto IKE daemon crash) via an X.509 certificate with (1) crafted Relative Distinguished Names (RDNs), (2) a crafted UTCTIME string, or (3) a crafted GENERALIZEDTIME string.
15711	CVE-2009-2184	22		Dir. Trav.	2009-06-23	2017-09-28	5.0	None	Remote	Low	Not required	Partial	None	None
Absolute path traversal vulnerability in forcedownload.php in Gravy Media Photo Host 1.0.8 allows remote attackers to read arbitrary files via an encoded "/" (slash) in the file parameter.
15712	CVE-2009-2180	22		Dir. Trav.	2009-06-23	2017-09-28	5.0	None	Remote	Low	Not required	Partial	None	None
Multiple directory traversal vulnerabilities in upfiles/index.php in Pc4 Uploader 10.0 and earlier allow remote attackers to read arbitrary files via (1) a .. (dot dot) or (2) absolute path in the file parameter.
15713	CVE-2009-2174			DoS	2009-06-23	2009-06-24	5.0	None	Remote	Low	Not required	None	None	Partial
GUPnP 0.12.7 allows remote attackers to cause a denial of service (crash) via an empty (1) subscription or (2) control message.
15714	CVE-2009-2166	22		Dir. Trav.	2009-06-22	2018-10-10	5.0	None	Remote	Low	Not required	Partial	None	None
Absolute path traversal vulnerability in cvs.php in OCS Inventory NG before 1.02.1 on Unix allows remote attackers to read arbitrary files via a full pathname in the log parameter.
15715	CVE-2009-2161	22		Dir. Trav.	2009-06-22	2018-10-10	5.1	None	Remote	High	Not required	Partial	Partial	Partial
Directory traversal vulnerability in backend/admin-functions.php in TorrentTrader Classic 1.09, when used on a case-insensitive web site, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the ss_uri parameter, in conjunction with a modified component name.
15716	CVE-2009-2160	264		+Info	2009-06-22	2018-10-10	5.0	None	Remote	Low	Not required	Partial	None	None
TorrentTrader Classic 1.09 allows remote attackers to (1) obtain configuration information via a direct request to phpinfo.php, which calls the phpinfo function; and allows remote attackers to (2) obtain other potentially sensitive information via a direct request to check.php.
15717	CVE-2009-2151	22		Dir. Trav.	2009-06-22	2017-09-28	5.0	None	Remote	Low	Not required	Partial	None	None
Directory traversal vulnerability in index.php in AdaptWeb 0.9.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the newlang parameter.
15718	CVE-2009-2134	200		+Info	2009-06-19	2018-10-10	5.0	None	Remote	Low	Not required	Partial	None	None
pivot/tb.php in Pivot 1.40.4 and 1.40.7 allows remote attackers to obtain sensitive information via an invalid url parameter, which reveals the installation path in an error message.
15719	CVE-2009-2130	200		+Info	2009-06-19	2017-09-28	5.0	None	Remote	Low	Not required	Partial	None	None
Elvin 1.2.0 allows remote attackers to read the PHP source code of (1) login.ei, (2) jump_bug.ei, or (3) create_account.ei in inc/ via a direct request.
15720	CVE-2009-2109	22		Dir. Trav.	2009-06-18	2017-09-28	5.0	None	Remote	Low	Not required	Partial	None	None
Multiple directory traversal vulnerabilities in FretsWeb 1.2 allow remote attackers to read arbitrary files via directory traversal sequences in the (1) language parameter to charts.php and the (2) fretsweb_language cookie parameter to unspecified vectors, possibly related to admin/common.php.
15721	CVE-2009-2108	399		DoS	2009-06-18	2017-08-16	5.0	None	Remote	Low	Not required	None	None	Partial
git-daemon in git 1.4.4.5 through 1.6.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a request containing extra unrecognized arguments.
15722	CVE-2009-2100	22		Dir. Trav.	2009-06-17	2017-09-28	5.0	None	Remote	Low	Not required	Partial	None	None
Directory traversal vulnerability in the JoomlaPraise Projectfork (com_projectfork) component 2.0.10 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the section parameter to index.php.
15723	CVE-2009-2091	264		+Info	2009-08-13	2017-08-16	5.0	None	Remote	Low	Not required	Partial	None	None
The System Management/Repository component in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.5 on z/OS uses weak file permissions for new applications, which allows remote attackers to obtain sensitive information via unspecified vectors.
15724	CVE-2009-2090			DoS Bypass	2009-08-13	2017-08-16	5.0	None	Remote	Low	Not required	None	None	Partial
Unspecified vulnerability in wsadmin in the System Management/Repository component in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.5 allows remote attackers to bypass intended Java Management Extensions (JMX) Management Beans (aka MBeans) access restrictions, and cause a denial of service (daemon stop), via unknown vectors.
15725	CVE-2009-2072	287			2009-06-15	2009-06-23	5.4	None	Local Network	Medium	Not required	Partial	Partial	Partial
Apple Safari does not require a cached certificate before displaying a lock icon for an https web site, which allows man-in-the-middle attackers to spoof an arbitrary https site by sending the browser a crafted (1) 4xx or (2) 5xx CONNECT response page for an https request sent through a proxy server.
15726	CVE-2009-2069	287			2009-06-15	2009-06-23	5.8	None	Remote	Medium	Not required	Partial	Partial	None
Microsoft Internet Explorer before 8 displays a cached certificate for a (1) 4xx or (2) 5xx CONNECT response page returned by a proxy server, which allows man-in-the-middle attackers to spoof an arbitrary https site by letting a browser obtain a valid certificate from this site during one request, and then sending the browser a crafted 502 response page upon a subsequent request.
15727	CVE-2009-2068	287			2009-06-15	2017-08-16	5.8	None	Remote	Medium	Not required	Partial	Partial	None
Google Chrome detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying an http page to include an https iframe that references a script file on an http site, related to "HTTP-Intended-but-HTTPS-Loadable (HPIHSL) pages."
15728	CVE-2009-2060	287			2009-06-15	2017-08-16	5.8	None	Remote	Medium	Not required	Partial	Partial	None
src/net/http/http_transaction_winhttp.cc in Google Chrome before 1.0.154.53 uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" attack.
15729	CVE-2009-2057	287			2009-06-15	2009-06-25	5.8	None	Remote	Medium	Not required	Partial	Partial	None
Microsoft Internet Explorer before 8 uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" attack.
15730	CVE-2009-2049	16		DoS	2009-07-30	2017-09-28	5.4	None	Remote	High	Not required	None	None	Complete
Cisco IOS 12.0(32)S12 through 12.0(32)S13 and 12.0(33)S3 through 12.0(33)S4, 12.0(32)SY8 through 12.0(32)SY9, 12.2(33)SXI1 through 12.2(33)SXI2, 12.2XNC before 12.2(33)XNC2, 12.2XND before 12.2(33)XND1, and 12.4(24)T1; and IOS XE 2.3 through 2.3.1t and 2.4 through 2.4.0; when RFC4893 BGP routing is enabled, allows remote attackers to cause a denial of service (device reload) by using an RFC4271 peer to send a malformed update, aka Bug ID CSCta33973.
15731	CVE-2009-2029			DoS	2009-06-11	2017-09-28	5.0	None	Remote	Low	Not required	None	None	Partial
Unspecified vulnerability in rpc.nisd in Sun Solaris 8 through 10, and OpenSolaris before snv_104, allows remote authenticated users to cause a denial of service (NIS+ daemon hang) via unspecified vectors related to NIS+ callbacks.
15732	CVE-2009-2024	264		+Info	2009-06-09	2017-09-28	5.0	None	Remote	Low	Not required	Partial	None	None
Vlad Titarenko ASP VT Auth 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file and obtain usernames and passwords via a direct request for zHk8dEes3.txt.
15733	CVE-2009-2022	264		+Info	2009-06-09	2017-09-28	5.0	None	Remote	Low	Not required	Partial	None	None
fipsCMS Light 2.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file and obtain sensitive information via a direct request for _fipsdb/db.mdb.
15734	CVE-2009-2007	22		Dir. Trav.	2009-06-08	2017-08-16	5.0	None	Remote	Low	Not required	Partial	None	None
Multiple directory traversal vulnerabilities in Dokeos 1.8.5, and possibly earlier, allow remote attackers to (1) read portions of arbitrary files via a .. (dot dot) and a ..\ (dot dot backslash) in the lang parameter to main/exercice/hotspot_lang_conversion.php and (2) read arbitrary files via a .. (dot dot) in the doc_url parameter to main/exercice/Hpdownload.php.
15735	CVE-2009-2000				2009-10-22	2012-10-22	5.0	None	Remote	Low	Not required	Partial	None	None
Unspecified vulnerability in the Authentication component in Oracle Database 11.1.0.7 allows remote attackers to affect confidentiality via unknown vectors.
15736	CVE-2009-1997				2009-10-22	2012-10-22	5.0	None	Remote	Low	Not required	Partial	None	None
Unspecified vulnerability in the Authentication component in Oracle Database 10.2.0.3 and 11.1.0.7 allows remote attackers to affect confidentiality via unknown vectors.
15737	CVE-2009-1993				2009-10-22	2012-10-22	5.5	None	Remote	Low	Single system	Partial	Partial	None
Unspecified vulnerability in the Application Express component in Oracle Database 3.0.1 allows remote authenticated users to affect confidentiality and integrity, related to FLOWS_030000.WWV_EXECUTE_IMMEDIATE.
15738	CVE-2009-1989				2009-07-14	2017-08-16	5.5	None	Remote	Low	Single system	Partial	Partial	None
Unspecified vulnerability in the PeopleSoft Enterprise FMS component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.8 SP1, 8.9 Bundle 33, and 9.0 Bundle 24 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.
15739	CVE-2009-1987				2009-07-14	2017-08-16	5.0	None	Remote	Low	Not required	None	Partial	None
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools - Enterprise Portal component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.49.21 allows remote attackers to affect integrity via unknown vectors.
15740	CVE-2009-1973				2009-07-14	2017-08-16	5.5	None	Remote	Low	Single system	Partial	Partial	None
Unspecified vulnerability in the Virtual Private Database component in Oracle Database 10.1.0.5, 10.2.0.4, and 11.1.0.7 allows remote authenticated users to affect confidentiality and integrity, related to VPD policies.
15741	CVE-2009-1970				2009-07-14	2017-08-16	5.0	None	Remote	Low	Not required	None	None	Partial
Unspecified vulnerability in the Listener component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.4, and 11.1.0.7 allows remote attackers to affect availability via unknown vectors, a different vulnerability than CVE-2009-0991.
15742	CVE-2009-1967				2009-07-14	2017-08-16	5.5	None	Remote	Low	Single system	Partial	Partial	None
Unspecified vulnerability in the Config Management component in (1) Oracle Database 11.1.0.7 and (2) Oracle Enterprise Manager 10.2.0.4 allows remote authenticated users to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2009-1966.
15743	CVE-2009-1966				2009-07-14	2017-08-16	5.5	None	Remote	Low	Single system	Partial	Partial	None
Unspecified vulnerability in the Config Management component in (1) Oracle Database 11.1.0.7 and (2) Oracle Enterprise Manager 10.2.0.4 allows remote authenticated users to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2009-1967.
15744	CVE-2009-1965				2009-10-22	2012-10-22	5.4	None	Local Network	Medium	Not required	Partial	Partial	Partial
Unspecified vulnerability in the Net Foundation Layer component in Oracle Database 9.2.0.8 and 10.1.0.5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
15745	CVE-2009-1964				2009-10-22	2012-10-22	5.5	None	Remote	Low	Single system	Partial	Partial	None
Unspecified vulnerability in the Workspace Manager component in Oracle Database 10.2.0.4 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.
15746	CVE-2009-1959	189		DoS	2009-06-07	2017-08-16	5.0	None	Remote	Low	Not required	None	None	Partial
Off-by-one error in the event_wallops function in fe-common/irc/fe-events.c in irssi 0.8.13 allows remote IRC servers to cause a denial of service (crash) via an empty command, which triggers a one-byte buffer under-read and a one-byte buffer underflow.
15747	CVE-2009-1958	399		DoS	2009-06-07	2009-10-14	5.0	None	Remote	Low	Not required	None	None	Partial
charon/sa/tasks/child_create.c in the charon daemon in strongSWAN before 4.3.1 switches the NULL checks for TSi and TSr payloads, which allows remote attackers to cause a denial of service via an IKE_AUTH request without a (1) TSi or (2) TSr traffic selector.
15748	CVE-2009-1957	399		DoS	2009-06-07	2009-10-14	5.0	None	Remote	Low	Not required	None	None	Partial
charon/sa/ike_sa.c in the charon daemon in strongSWAN before 4.3.1 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an invalid IKE_SA_INIT request that triggers "an incomplete state," followed by a CREATE_CHILD_SA request.
15749	CVE-2009-1948	22		Dir. Trav.	2009-06-05	2017-09-28	5.1	None	Remote	High	Not required	Partial	Partial	Partial
Multiple directory traversal vulnerabilities in forum.php in Unclassified NewsBoard (UNB) 1.6.4, when register_globals is enabled and magic_quotes_gpc is disabled, allow remote attackers to (1) read arbitrary recently-modified files via a .. (dot dot) in the GLOBALS[filename] parameter or (2) include and execute arbitrary local files via a .. (dot dot) in the GLOBALS[UTE][__tplCollection][a][file] parameter.
15750	CVE-2009-1941	264		+Info	2009-06-05	2017-09-28	5.0	None	Remote	Low	Not required	Partial	None	None
PAD Site Scripts 3.6 stores sensitive information under the web document root with insufficient access control, which allows remote attackers to download the database and obtain sensitive information via a direct request for dbbackup.txt.

Total number of vulnerabilities : 22711 Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 (This Page)316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455