Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: January 2009

34 records · 0 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2008-5828
    24Monitor

    Microsoft Windows Live Messenger Client 8.5.1 and earlier, when MSN Protocol Version 15 (MSNP15) is used over a NAT session, allows remote a

    MediumCVSS 5.0No exploitEPSS 14%

    microsoft · windows live messengerJan 2, 2009

  • CVE-2004-2761
    42Plan

    The MD5 Message-Digest Algorithm is not collision resistant, which makes it easier for context-dependent attackers to conduct spoofing attac

    CriticalCVSS 9.8Proof of conceptEPSS 10%

    ietf · md5Jan 5, 2009

  • CVE-2009-0065
    45Plan

    Buffer overflow in net/sctp/sm_statefuns.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux kernel before 2.6.

    CriticalCVSS 10.0Proof of conceptEPSS 16%

    linux · linux kernelJan 7, 2009

  • CVE-2008-0067
    59Plan

    Multiple stack-based buffer overflows in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allow remote attackers to execute ar

    CriticalCVSS 10.0WeaponizedEPSS 63%

    hp · openview network node managerJan 8, 2009

  • CVE-2009-0043
    56Plan

    The smmsnmpd service in CA Service Metric Analysis r11.0 through r11.1 SP1 and Service Level Management 3.5 does not properly restrict acces

    CriticalCVSS 10.0Proof of conceptEPSS 53%

    ca · service level managementJan 8, 2009

  • CVE-2009-0103
    33Monitor

    Multiple PHP remote file inclusion vulnerabilities in playSMS 0.9.3 allow remote attackers to execute arbitrary PHP code via a URL in the (1

    HighCVSS 7.5Proof of conceptEPSS 10%

    playsms · playsmsJan 9, 2009

  • CVE-2008-5887
    23Monitor

    phplist before 2.10.8 allows remote attackers to include files via unknown vectors, related to a "local file include vulnerability."

    MediumCVSS 5.0No exploitEPSS 11%

    tincan · phplistJan 12, 2009

  • CVE-2008-5517
    34Monitor

    The web interface in git (gitweb) 1.5.x before 1.5.6 allows remote attackers to execute arbitrary commands via shell metacharacters related

    HighCVSS 7.5Proof of conceptEPSS 11%

    git · gitJan 13, 2009

  • CVE-2008-3979
    40Plan

    Unspecified vulnerability in the Oracle Spatial component in Oracle Database 10.1.0.5 and 10.2.0.2 allows remote authenticated users to affe

    MediumCVSS 5.5WeaponizedEPSS 32%

    oracle · database 10gJan 13, 2009

  • CVE-2008-5440
    34Monitor

    Unspecified vulnerability in the TimesTen Data Server component in Oracle Database 7.0.5.0.0 allows remote attackers to affect confidentiali

    HighCVSS 7.5No exploitEPSS 11%

    oracle · timesten in-memory databaseJan 13, 2009

  • CVE-2008-5444
    58Plan

    Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.2.0.2 allows remote attackers to affect confident

    CriticalCVSS 10.0WeaponizedEPSS 60%

    oracle · secure backupJan 13, 2009

  • CVE-2008-5448
    52Plan

    Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.2.0.2 allows remote attackers to affect confident

    CriticalCVSS 10.0WeaponizedEPSS 40%

    oracle · secure backupJan 13, 2009

  • CVE-2008-5457
    58Plan

    Unspecified vulnerability in the Oracle BEA WebLogic Server Plugins for Apache, Sun and IIS web servers component in BEA Product Suite 10.3,

    CriticalCVSS 10.0WeaponizedEPSS 61%

    oracle · bea product suiteJan 13, 2009

  • CVE-2008-4834
    54Plan

    Buffer overflow in SMB in the Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2 allows remote attack

    CriticalCVSS 10.0No exploitEPSS 45%

    microsoft · windows 2000Jan 14, 2009

  • CVE-2008-4835
    52Plan

    SMB in the Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows

    CriticalCVSS 9.8No exploitEPSS 44%

    microsoft · windows 2000Jan 14, 2009

  • CVE-2009-0119
    51Plan

    Buffer overflow in Microsoft Windows XP SP3 allows remote attackers to cause a denial of service (memory corruption and application crash) o

    CriticalCVSS 10.0Proof of conceptEPSS 36%

    microsoft · windows xpJan 14, 2009

  • CVE-2003-1566
    28Monitor

    Microsoft Internet Information Services (IIS) 5.0 does not log requests that use the TRACK method, which allows remote attackers to obtain s

    MediumCVSS 5.0Proof of conceptEPSS 28%

    microsoft · internet information servicesJan 14, 2009

  • CVE-2003-1567
    38Monitor

    The undocumented TRACK method in Microsoft Internet Information Services (IIS) 5.0 returns the content of the original request in the body o

    HighCVSS 7.5No exploitEPSS 25%

    microsoft · internet information servicesJan 14, 2009

  • CVE-1999-1593
    35Monitor

    Windows Internet Naming Service (WINS) allows remote attackers to cause a denial of service (connectivity loss) or steal credentials via a 1

    HighCVSS 7.6No exploitEPSS 18%

    microsoft · windows 2000Jan 14, 2009

  • CVE-2009-0133
    60This week

    Buffer overflow in Microsoft HTML Help Workshop 4.74 and earlier allows context-dependent attackers to execute arbitrary code via a .hhp fil

    CriticalCVSS 10.0WeaponizedEPSS 67%

    microsoft · html help workshopJan 15, 2009

  • CVE-2009-0174
    41Plan

    Stack-based buffer overflow in VUPlayer 2.49 allows remote attackers to execute arbitrary code via a long .asf URI in the HREF attribute of

    CriticalCVSS 9.3Proof of conceptEPSS 11%

    vuplayer · vuplayerJan 20, 2009

  • CVE-2008-4388
    48Plan

    The LaunchObj ActiveX control before 5.2.2.865 in launcher.dll in Symantec AppStream Client 5.2.x before 5.2.2 SP3 MP1 does not properly val

    CriticalCVSS 9.3WeaponizedEPSS 37%

    symantec · appstream clientJan 20, 2009

  • CVE-2009-0182
    60This week

    Buffer overflow in VUPlayer 2.49 and earlier allows user-assisted attackers to execute arbitrary code via a long URL in a File line in a .pl

    HighCVSS 8.8WeaponizedEPSS 48%

    vuplayer · vuplayerJan 20, 2009

  • CVE-2009-0026
    25Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in Apache Jackrabbit before 1.5.2 allow remote attackers to inject arbitrary web script

    MediumCVSS 4.3Proof of conceptEPSS 26%

    apache · jackrabbitJan 21, 2009

  • CVE-2009-0244
    44Plan

    Directory traversal vulnerability in the OBEX FTP Service in the Microsoft Bluetooth stack in Windows Mobile 6 Professional, and probably Wi

    HighCVSS 8.8No exploitEPSS 30%

    microsoft · windows mobileJan 21, 2009

  • CVE-2009-0255
    60This week

    The System extension Install tool in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 creates the encryption key with

    HighCVSS 7.5WeaponizedEPSS 9%

    typo3 · typo3Jan 22, 2009

  • CVE-2009-0261
    41Plan

    Stack-based buffer overflow in EffectMatrix Total Video Player 1.31 allows user-assisted attackers to execute arbitrary code via a Skins\Def

    CriticalCVSS 9.3WeaponizedEPSS 13%

    effectmatrix · total video playerJan 23, 2009

  • CVE-2009-0263
    45Plan

    Multiple buffer overflows in Winamp 5.541 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary cod

    CriticalCVSS 10.0Proof of conceptEPSS 16%

    nullsoft · winampJan 23, 2009

  • CVE-2007-2795
    43Plan

    Multiple buffer overflows in Ipswitch IMail before 2006.21 allow remote attackers or authenticated users to execute arbitrary code via (1) t

    CriticalCVSS 9.0Proof of conceptEPSS 24%

    ipswitch · imailJan 27, 2009

  • CVE-2009-0323
    59Plan

    Multiple stack-based buffer overflows in W3C Amaya Web Browser 10.0 and 11.0 allow remote attackers to execute arbitrary code via (1) a long

    CriticalCVSS 10.0WeaponizedEPSS 62%

    w3 · amayaJan 28, 2009

  • CVE-2009-0341
    42Plan

    The shell32 module in Microsoft Internet Explorer 7.0 on Windows XP SP3 might allow remote attackers to execute arbitrary code via a long VA

    CriticalCVSS 9.3Proof of conceptEPSS 16%

    microsoft · windows xpJan 29, 2009

  • CVE-2009-0347
    26Monitor

    Open redirect vulnerability in cs.html in the Autonomy (formerly Verity) Ultraseek search engine allows remote attackers to redirect users t

    MediumCVSS 5.8Proof of conceptEPSS 10%

    autonomy · ultraseekJan 29, 2009

  • CVE-2009-0350
    40Plan

    Stack-based buffer overflow in Merak Media Player 3.2 allows remote attackers to execute arbitrary code via a long string in a .m3u playlist

    CriticalCVSS 9.3Proof of conceptEPSS 10%

    merak · media playerJan 29, 2009

  • CVE-2009-0369
    20Monitor

    Microsoft Internet Explorer 7 allows remote attackers to trick a user into visiting an arbitrary URL via an onclick action that moves a craf

    MediumCVSS 4.3Proof of conceptEPSS 10%

    microsoft · internet explorerJan 30, 2009