Security Vulnerabilities Published In 2009(Gain Information)

2009 : January February March April May June July August September October November December

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	# of Exploits	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2009-4535	200		+Info	2009-12-31	2010-01-04	5.0	None	Remote	Low	Not required	Partial	None	None
Mongoose 2.8.0 and earlier allows remote attackers to obtain the source code for a web page by appending a / (slash) character to the URI.
2	CVE-2009-4533	200		+Info	2009-12-31	2017-08-17	5.0	None	Remote	Low	Not required	Partial	None	None
The Webform module 5.x before 5.x-2.8 and 6.x before 6.x-2.8, a module for Drupal, does not prevent caching of a page that contains token placeholders for a default value, which allows remote attackers to read session variables via unspecified vectors.
3	CVE-2009-4531	200	1	+Info	2009-12-31	2017-08-17	5.0	None	Remote	Low	Not required	Partial	None	None
httpdx 1.4.4 and earlier allows remote attackers to obtain the source code for a web page by appending a . (dot) character to the URI.
4	CVE-2009-4530	200	1	+Info	2009-12-31	2010-01-04	5.0	None	Remote	Low	Not required	Partial	None	None
Mongoose 2.8.0 and earlier allows remote attackers to obtain the source code for a web page by appending ::$DATA to the URI.
5	CVE-2009-4529	200		+Info	2009-12-31	2017-08-17	5.0	None	Remote	Low	Not required	Partial	None	None
InterVations NaviCOPA Web Server 3.0.1.2 and earlier allows remote attackers to obtain the source code for a web page via a trailing encoded space character in a URI, as demonstrated by /index.html%20 and /index.php%20 URIs.
6	CVE-2009-4466	200	1	DoS +Info	2009-12-30	2017-08-17	5.0	None	Remote	Low	Not required	Partial	None	None
DeluxeBB 1.3 allows remote attackers to obtain sensitive information via a crafted page parameter to misc.php, which reveals the installation path in an error message. NOTE: this issue might be resultant from improperly controlled computation in tools.php that leads to a denial of service (CPU or memory consumption).
7	CVE-2009-4465	264	1	+Info	2009-12-30	2017-08-17	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
DeluxeBB 1.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain user and configuration information, log data, and gain administrative access via a direct request to scripts in (1) templates/ including (2) templates/deluxe/admincp/, (3) templates/corporate/admincp/, and (4) templates/blue/admincp/; (5) images/; (6) logs/ including (7) logs/cp.php; (8) wysiwyg/; (9) docs/; (10) classes/; (11) lang/; and (12) settings/.
8	CVE-2009-4389			+Info	2009-12-22	2009-12-23	5.0	None	Remote	Low	Not required	Partial	None	None
Unspecified vulnerability in the Watchdog (aba_watchdog) extension 2.0.2 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unknown attack vectors.
9	CVE-2009-4357	200		+Info	2009-12-18	2009-12-21	5.0	None	Remote	Low	Not required	Partial	None	None
CQWeb (aka the web interface) in IBM Rational ClearQuest before 7.1.1 does not properly handle use of legacy URLs for automatic login, which might allow attackers to discover the passwords for user accounts via unspecified vectors.
10	CVE-2009-4333	200		+Info	2009-12-16	2010-06-29	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The Relational Data Services component in IBM DB2 9.5 before FP5 allows attackers to obtain the password argument from the SET ENCRYPTION PASSWORD statement via vectors involving the GET SNAPSHOT FOR DYNAMIC SQL command.
11	CVE-2009-4326	200		+Info	2009-12-16	2010-06-29	4.3	None	Remote	Medium	Not required	Partial	None	None
The RAND scalar function in the Common Code Infrastructure component in IBM DB2 9.5 before FP5 and 9.7 before FP1, when the Database Partitioning Feature (DPF) is used, produces "repeating" return values, which might allow attackers to defeat protection mechanisms based on randomization by predicting a value.
12	CVE-2009-4323			+Info	2009-12-14	2009-12-15	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The installation for Zen Cart stores sensitive information and insecure programs under the (1) docs, (2) extras, and (3) zc_install folders, and (4) install.txt, which allows remote attackers to obtain sensitive information, delete the database, and conduct other attacks via a direct request, different vulnerabilities than CVE-2009-4321 and CVE-2009-4322.
13	CVE-2009-4322	200		+Info	2009-12-14	2018-10-10	5.0	None	Remote	Low	Not required	Partial	None	None
extras/ipn_test_return.php in Zen Cart allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message.
14	CVE-2009-4303	200		+Info	2009-12-16	2020-12-01	5.0	None	Remote	Low	Not required	Partial	None	None
Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 stores (1) password hashes and (2) unspecified "secrets" in backup files, which might allow attackers to obtain sensitive information.
15	CVE-2009-4300	200		+Info	2009-12-16	2020-12-01	5.0	None	Remote	Low	Not required	Partial	None	None
Multiple unspecified authentication plugins in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 store the MD5 hashes for passwords in the user table, even when the cached hashes are not used by the plugin, which might make it easier for attackers to obtain credentials via unspecified vectors.
16	CVE-2009-4298	200		+Info	2009-12-16	2020-12-01	5.0	None	Remote	Low	Not required	Partial	None	None
The LAMS module (mod/lams) for Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 stores the (1) username, (2) firstname, and (3) lastname fields within the user table, which allows attackers to obtain user account information via unknown vectors.
17	CVE-2009-4295	310		+Info	2009-12-11	2009-12-14	7.8	None	Remote	Low	Not required	Complete	None	None
Sun Ray Server Software 4.0 and 4.1 does not generate a unique DSA private key for the firmware on each Sun Ray 1, 1g, 100, and 150 DTU device, which makes it easier for remote attackers to obtain sensitive information by predicting a key and then using it to decrypt sniffed network traffic.
18	CVE-2009-4254	200		+Info	2009-12-10	2017-08-17	5.0	None	Remote	Low	Not required	Partial	None	None
PowerPhlogger 2.2.5 allows remote attackers to obtain sensitive information via a direct request to (1) edCss.inc.php, (2) foot.inc.php, (3) get_csscolors.inc.php, (4) head.inc.php, (5) head_stuff.inc.php, (6) loglist.inc.php, and (7) pphlogger_send.inc.php in include/, which reveals the installation path in an error message.
19	CVE-2009-4236	200		+Info	2009-12-08	2017-08-17	5.0	None	Remote	Low	Not required	Partial	None	None
The process function in data/class/pages/admin/customer/LC_Page_Admin_Customer_SearchCustomer.php in EC-CUBE Ver2 2.4.0 RC1 through 2.4.1, and Community Edition r18068 through r18428, allows remote attackers to obtain sensitive information (customer data) via unknown vectors related to sessions.
20	CVE-2009-4235	264		DoS +Info	2009-12-08	2017-08-17	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
acpid 1.0.4 sets an unrestrictive umask, which might allow local users to leverage weak permissions on /var/log/acpid, and obtain sensitive information by reading this file or cause a denial of service by overwriting this file, a different vulnerability than CVE-2009-4033.
21	CVE-2009-4175	200		+Info	2009-12-02	2018-10-10	5.0	None	Remote	Low	Not required	Partial	None	None
CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allows remote attackers to obtain sensitive information via an invalid date value in the from_date_day parameter to search.php, which reveals the installation path in an error message.
22	CVE-2009-4170	200		+Info	2009-12-02	2018-10-10	5.0	None	Remote	Low	Not required	Partial	None	None
WP-Cumulus Plug-in 1.20 for WordPress, and possibly other versions, allows remote attackers to obtain sensitive information via a crafted request to wp-cumulus.php, probably without parameters, which reveals the installation path in an error message.
23	CVE-2009-4160			+Info	2009-12-02	2009-12-03	5.0	None	Remote	Low	Not required	Partial	None	None
Unspecified vulnerability in the Simple download-system with counter and categories (kk_downloader) extension 1.2.1 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unknown attack vectors.
24	CVE-2009-4145	200		+Info	2009-12-23	2017-09-19	2.1	None	Local	Low	Not required	Partial	None	None
nm-connection-editor in NetworkManager (NM) 0.7.x exports connection objects over D-Bus upon actions in the connection editor GUI, which allows local users to obtain sensitive information by reading D-Bus signals, as demonstrated by using dbus-monitor to discover the password for the WiFi network.
25	CVE-2009-4144	310		DoS +Info	2009-12-23	2017-09-19	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
NetworkManager (NM) 0.7.2 does not ensure that the configured Certification Authority (CA) certificate file for a (1) WPA Enterprise or (2) 802.1x network remains present upon a connection attempt, which might allow remote attackers to obtain sensitive information or cause a denial of service (connectivity disruption) by spoofing the identity of a wireless network.
26	CVE-2009-4109	200		+Info	2009-11-29	2009-11-30	5.0	None	Remote	Low	Not required	Partial	None	None
The install wizard in DotNetNuke 4.0 through 5.1.4 does not prevent anonymous users from accessing functionality related to determination of the need for an upgrade, which allows remote attackers to access version information and possibly other sensitive information.
27	CVE-2009-4096	255	2	+Info	2009-11-29	2009-12-02	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
RADIO istek scripti 2.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain user credentials via a direct request for estafresgaftesantusyan.inc.
28	CVE-2009-4073	200		+Info	2009-11-24	2021-07-23	5.0	None	Remote	Low	Not required	Partial	None	None
The printing functionality in Microsoft Internet Explorer 8 allows remote attackers to discover a local pathname, and possibly a local username, by reading the dc:title element of a PDF document that was generated from a local web page.
29	CVE-2009-4071	16		XSS +Info	2009-11-24	2018-10-30	5.8	None	Remote	Medium	Not required	Partial	Partial	None
Opera before 10.10, when exception stacktraces are enabled, places scripting error messages from a web site into variables that can be read by a different web site, which allows remote attackers to obtain sensitive information or conduct cross-site scripting (XSS) attacks via unspecified vectors.
30	CVE-2009-4033	264		DoS +Priv +Info	2009-12-08	2017-09-19	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
A certain Red Hat patch for acpid 1.0.4 effectively triggers a call to the open function with insufficient arguments, which might allow local users to leverage weak permissions on /var/log/acpid, and obtain sensitive information by reading this file, cause a denial of service by overwriting this file, or gain privileges by executing this file.
31	CVE-2009-3987	200		+Info	2009-12-17	2017-09-19	7.8	None	Remote	Low	Not required	Complete	None	None
The GeckoActiveXObject function in Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, generates different exception messages depending on whether the referenced COM object is listed in the registry, which allows remote attackers to obtain potentially sensitive information about installed software by making multiple calls that specify the ProgID values of different COM objects.
32	CVE-2009-3951	200		+Info	2009-12-10	2018-10-30	7.1	None	Remote	Medium	Not required	Complete	None	None
Unspecified vulnerability in the Flash Player ActiveX control in Adobe Flash Player before 10.0.42.34 and Adobe AIR before 1.5.3 on Windows allows remote attackers to obtain the names of local files via unknown vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4820.
33	CVE-2009-3946	200		+Info	2009-11-16	2017-08-17	5.0	None	Remote	Low	Not required	Partial	None	None
Joomla! before 1.5.15 allows remote attackers to read an extension's XML file, and thereby obtain the extension's version number, via a direct request.
34	CVE-2009-3883	200		+Info	2009-11-09	2018-10-30	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Multiple unspecified vulnerabilities in the Windows Pluggable Look and Feel (PL&F) feature in the Swing implementation in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, have unknown impact and remote attack vectors, related to "information leaks in mutable variables," aka Bug Id 6657138.
35	CVE-2009-3882	200		+Info	2009-11-09	2018-10-30	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Multiple unspecified vulnerabilities in the Swing implementation in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, have unknown impact and remote attack vectors, related to "information leaks in mutable variables," aka Bug Id 6657026.
36	CVE-2009-3881	200		+Priv +Info	2009-11-09	2017-09-19	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, does not prevent the existence of children of a resurrected ClassLoader, which allows remote attackers to gain privileges via unspecified vectors, related to an "information leak vulnerability," aka Bug Id 6636650.
37	CVE-2009-3880	264		+Info	2009-11-09	2017-09-19	5.0	None	Remote	Low	Not required	Partial	None	None
The Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, does not properly restrict the objects that may be sent to loggers, which allows attackers to obtain sensitive information via vectors related to the implementation of Component, KeyboardFocusManager, and DefaultKeyboardFocusManager, aka Bug Id 6664512.
38	CVE-2009-3815	200		+Info	2009-10-27	2009-10-28	5.0	None	Remote	Low	Not required	Partial	None	None
RunCMS 2M1, when running with certain error_reporting levels, allows remote attackers to obtain sensitive information via (1) the op[] parameter to modules/contact/index.php or (2) uid[] parameter to userinfo.php, which leaks the installation path in an error message when these parameters are used in a call to the preg_match function.
39	CVE-2009-3802	20	1	+Info	2009-10-27	2017-08-17	5.0	None	Remote	Low	Not required	Partial	None	None
Amiro.CMS 5.4.0.0 and earlier allows remote attackers to obtain sensitive information via an invalid loginname ("%%%") to _admin/index.php, which reveals the installation path and other information in an error message.
40	CVE-2009-3782	200		+Info	2009-10-26	2017-08-17	3.5	None	Remote	Medium	???	Partial	None	None
Unspecified vulnerability in Userpoints 6.x before 6.x-1.1, a module for Drupal, allows remote authenticated users with "View own userpoints" permissions to read the userpoint data of arbitrary users via unknown attack vectors.
41	CVE-2009-3756	200	1	+Info	2009-10-22	2017-09-19	5.0	None	Remote	Low	Not required	Partial	None	None
phpBMS 0.96 allows remote attackers to obtain sensitive information via a direct request to (1) footer.php, (2) header.php, (3) the show action in advancedsearch.php, and (4) choicelist.php, which reveals the installation path in an error message.
42	CVE-2009-3746	16		+Info	2009-10-22	2017-09-19	1.9	None	Local	Medium	Not required	Partial	None	None
XScreenSaver in Sun Solaris 10, when the accessibility feature is enabled, allows physically proximate attackers to obtain sensitive information by reading popup windows, which are displayed even when the screen is locked, a different vulnerability than CVE-2009-1276 and CVE-2009-2711.
43	CVE-2009-3727	200		+Info	2009-11-10	2009-12-23	5.0	None	Remote	Low	Not required	Partial	None	None
Asterisk Open Source 1.2.x before 1.2.35, 1.4.x before 1.4.26.3, 1.6.0.x before 1.6.0.17, and 1.6.1.x before 1.6.1.9; Business Edition A.x.x, B.x.x before B.2.5.12, C.2.x.x before C.2.4.5, and C.3.x.x before C.3.2.2; AsteriskNOW 1.5; and s800i 1.3.x before 1.3.0.5 generate different error messages depending on whether a SIP username is valid, which allows remote attackers to enumerate valid usernames via multiple crafted REGISTER messages with inconsistent usernames in the URI in the To header and the Digest in the Authorization header.
44	CVE-2009-3646	200	1	+Info	2009-10-09	2017-09-19	5.0	None	Remote	Low	Not required	Partial	None	None
InterVations NaviCOPA Web Server 3.01 allows remote attackers to obtain the source code for a web page via an HTTP request with the addition of ::$DATA after the HTML file name.
45	CVE-2009-3628	200		+Info	2009-11-02	2017-08-17	4.0	None	Remote	Low	???	Partial	None	None
The Backend subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote authenticated users to determine an encryption key via crafted input to a tt_content form element.
46	CVE-2009-3612	200		+Info	2009-10-19	2023-02-13	2.1	None	Local	Low	Not required	Partial	None	None
The tcf_fill_node function in net/sched/cls_api.c in the netlink subsystem in the Linux kernel 2.6.x before 2.6.32-rc5, and 2.4.37.6 and earlier, does not initialize a certain tcm__pad2 structure member, which might allow local users to obtain sensitive information from kernel memory via unspecified vectors. NOTE: this issue exists because of an incomplete fix for CVE-2005-4881.
47	CVE-2009-3611	264		+Info	2009-10-26	2009-10-26	3.6	None	Local	Low	Not required	Partial	Partial	None
common/snapshots.py in Back In Time (aka backintime) 0.9.26 changes certain permissions to 0777 before deleting the files in an old backup snapshot, which allows local users to obtain sensitive information by reading these files, or interfere with backup integrity by modifying files that are shared across snapshots.
48	CVE-2009-3600	200	1	+Info	2009-10-08	2017-08-17	5.0	None	Remote	Low	Not required	Partial	None	None
HUBScript 1.0 allows remote attackers to obtain configuration information via a direct request to manage/phpinfo.php, which calls the phpinfo function.
49	CVE-2009-3554	200		+Info	2009-12-15	2017-08-17	2.1	None	Local	Low	Not required	Partial	None	None
Twiddle in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP08 and 4.3 before 4.3.0.CP07 writes the JMX password, and other command-line arguments, to the twiddle.log file, which allows local users to obtain sensitive information by reading this file.
50	CVE-2009-3544	200	1	+Info	2009-10-05	2017-09-19	5.0	None	Remote	Low	Not required	Partial	None	None
Xerver HTTP Server 4.32 allows remote attackers to obtain the source code for a web page via an HTTP request with the addition of ::$DATA after the HTML file name.

Total number of vulnerabilities : 302 Page : 1 (This Page)2 3 4 5 6 7