Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: February 2009

41 records · 1 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2009-0183
    60This week

    Stack-based buffer overflow in Remote Control Server in Free Download Manager (FDM) 2.5 Build 758 and 3.0 Build 844 allows remote attackers

    CriticalCVSS 10.0WeaponizedEPSS 66%

    free download manager · free download managerFeb 3, 2009

  • CVE-2009-0184
    45Plan

    Multiple buffer overflows in the torrent parsing implementation in Free Download Manager (FDM) 2.5 Build 758 and 3.0 Build 844 allow remote

    CriticalCVSS 9.3WeaponizedEPSS 27%

    free download manager · free download managerFeb 3, 2009

  • CVE-2009-0388
    44Plan

    Multiple integer signedness errors in (1) UltraVNC 1.0.2 and 1.0.5 and (2) TightVnc 1.3.9 allow remote VNC servers to cause a denial of serv

    CriticalCVSS 10.0Proof of conceptEPSS 13%

    tightvnc · tightvncFeb 4, 2009

  • CVE-2009-0419
    25Monitor

    Microsoft XML Core Services, as used in Microsoft Expression Web, Office, Internet Explorer 6 and 7, and other products, does not properly r

    MediumCVSS 5.0No exploitEPSS 15%

    microsoft · xml core servicesFeb 4, 2009

  • CVE-2008-6063
    20Monitor

    Microsoft Word 2007, when the "Save as PDF" add-on is enabled, places an absolute pathname in the Subject field during an "Email as PDF" ope

    MediumCVSS 4.3No exploitEPSS 10%

    microsoft · wordFeb 4, 2009

  • CVE-2008-6080
    23Monitor

    Directory traversal vulnerability in download.php in the ionFiles (com_ionfiles) 4.4.2 component for Joomla! allows remote attackers to read

    MediumCVSS 5.0Proof of conceptEPSS 10%

    joomla · joomlaFeb 6, 2009

  • CVE-2008-6082
    40Plan

    Titan FTP Server 6.26 build 630 allows remote attackers to cause a denial of service (CPU consumption) via the SITE WHO command.

    MediumCVSS 5.0WeaponizedEPSS 44%

    southrivertech · titan ftp serverFeb 6, 2009

  • CVE-2009-0473
    31Monitor

    Open redirect vulnerability in the web interface in the Rockwell Automation ControlLogix 1756-ENBT/A EtherNet/IP Bridge Module allows remote

    MediumCVSS 6.8Proof of conceptEPSS 13%

    rockwellautomation · controllogix 1756-enbt\/a ethernet\/ ip bridgeFeb 6, 2009

  • CVE-2008-4559
    47Plan

    HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via shell metacharacters in

    CriticalCVSS 10.0No exploitEPSS 24%

    hp · openview network node managerFeb 8, 2009

  • CVE-2009-0476
    48Plan

    Stack-based buffer overflow in MultiMedia Soft AdjMmsEng.dll 7.11.1.0 and 7.11.2.7, as distributed in multiple MultiMedia Soft audio compone

    CriticalCVSS 9.3WeaponizedEPSS 37%

    multimediasoft · audio dj studio for .netFeb 8, 2009

  • CVE-2009-0478
    42Plan

    Squid 2.7 to 2.7.STABLE5, 3.0 to 3.0.STABLE12, and 3.1 to 3.1.0.4 allows remote attackers to cause a denial of service via an HTTP request w

    MediumCVSS 5.0Proof of conceptEPSS 71%

    squid · squidFeb 8, 2009

  • CVE-2009-0490
    42Plan

    Stack-based buffer overflow in the String_parse::get_nonspace_quoted function in lib-src/allegro/strparse.cpp in Audacity 1.2.6 and other ve

    CriticalCVSS 9.3Proof of conceptEPSS 16%

    audacityteam · audacityFeb 9, 2009

  • CVE-2009-0450
    40Plan

    Stack-based buffer overflow in BlazeVideo HDTV Player 3.5 and earlier allows remote attackers to execute arbitrary code via a long string in

    CriticalCVSS 9.3Proof of conceptEPSS 10%

    blazevideo · hdtv playerFeb 10, 2009

  • CVE-2009-0075
    63This week

    Microsoft Internet Explorer 7 does not properly handle errors during attempted access to deleted objects, which allows remote attackers to e

    CriticalCVSS 9.3WeaponizedEPSS 85%

    microsoft · internet explorerFeb 10, 2009

  • CVE-2009-0076
    47Plan

    Microsoft Internet Explorer 7, when XHTML strict mode is used, allows remote attackers to execute arbitrary code via the zoom style directiv

    CriticalCVSS 9.3Proof of conceptEPSS 33%

    microsoft · internet explorerFeb 10, 2009

  • CVE-2009-0095
    44Plan

    Microsoft Office Visio 2002 SP2, 2003 SP3, and 2007 SP1 does not properly validate object data in Visio files, which allows remote attackers

    CriticalCVSS 9.3No exploitEPSS 23%

    microsoft · visioFeb 10, 2009

  • CVE-2009-0096
    44Plan

    Microsoft Office Visio 2002 SP2, 2003 SP3, and 2007 SP1 does not properly perform memory copy operations for object data, which allows remot

    CriticalCVSS 9.3No exploitEPSS 22%

    microsoft · visioFeb 10, 2009

  • CVE-2009-0097
    44Plan

    Microsoft Office Visio 2002 SP2 and 2003 SP3 does not properly validate memory allocation for Visio files, which allows remote attackers to

    CriticalCVSS 9.3No exploitEPSS 22%

    microsoft · visioFeb 10, 2009

  • CVE-2009-0098
    44Plan

    Microsoft Exchange 2000 Server SP3, Exchange Server 2003 SP2, and Exchange Server 2007 SP1 do not properly interpret Transport Neutral Encap

    CriticalCVSS 9.3No exploitEPSS 24%

    microsoft · exchange serverFeb 10, 2009

  • CVE-2009-0099
    28Monitor

    The Electronic Messaging System Microsoft Data Base (EMSMDB32) provider in Microsoft Exchange 2000 Server SP3 and Exchange Server 2003 SP2,

    MediumCVSS 5.0No exploitEPSS 26%

    microsoft · exchange serverFeb 10, 2009

  • CVE-2009-0305
    43Plan

    Multiple stack-based buffer overflows in the Research in Motion RIM AxLoader ActiveX control in AxLoader.ocx and AxLoader.dll in BlackBerry

    CriticalCVSS 9.3No exploitEPSS 19%

    research in motion limited · blackberry application web loaderFeb 10, 2009

  • CVE-2009-0517
    55Plan

    Eval injection vulnerability in index.php in phpSlash 0.8.1.1 and earlier allows remote attackers to execute arbitrary PHP code via the fiel

    CriticalCVSS 10.0Proof of conceptEPSS 48%

    phpslash · phpslashFeb 10, 2009

  • CVE-2009-0542
    52Plan

    SQL injection vulnerability in ProFTPD Server 1.3.1 through 1.3.2rc2 allows remote attackers to execute arbitrary SQL commands via a "%" (pe

    HighCVSS 7.5Proof of conceptEPSS 73%

    proftpd project · proftpdFeb 12, 2009

  • CVE-2009-0543
    32Monitor

    ProFTPD Server 1.3.1, with NLS support enabled, allows remote attackers to bypass SQL injection protection mechanisms via invalid, encoded m

    MediumCVSS 6.8Proof of conceptEPSS 15%

    proftpd · proftpdFeb 12, 2009

  • CVE-2009-0544
    43Plan

    Buffer overflow in the PyCrypto ARC2 module 2.0.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code v

    CriticalCVSS 10.0Proof of conceptEPSS 11%

    pycrypto · arc2Feb 12, 2009

  • CVE-2009-0545
    67This week

    cgi-bin/kerbynet in ZeroShell 1.0beta11 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the ty

    CriticalCVSS 10.0WeaponizedEPSS 90%

    zeroshell · zeroshellFeb 12, 2009

  • CVE-2009-0546
    48Plan

    Stack-based buffer overflow in NewsGator FeedDemon 2.7 and earlier allows user-assisted remote attackers to execute arbitrary code via a lon

    CriticalCVSS 9.3WeaponizedEPSS 36%

    newsgator · feeddemonFeb 12, 2009

  • CVE-2008-6132
    40Plan

    Eval injection vulnerability in reserve.php in phpScheduleIt 1.2.10 and earlier, when magic_quotes_gpc is disabled, allows remote attackers

    MediumCVSS 6.8WeaponizedEPSS 26%

    brickhost · phpscheduleitFeb 13, 2009

  • CVE-2009-0592
    40Plan

    Multiple directory traversal vulnerabilities in PNphpBB2 1.2i and earlier allow remote attackers to include and execute arbitrary local file

    HighCVSS 7.5Proof of conceptEPSS 34%

    pnphpbb · pnphpbb2Feb 16, 2009

  • CVE-2009-0595
    30Monitor

    PHP remote file inclusion vulnerability in skysilver/login.tpl.php in phpSkelSite 1.4, when register_globals is enabled and magic_quotes_gpc

    MediumCVSS 5.1Proof of conceptEPSS 34%

    phpskelsite · phpskelsiteFeb 16, 2009

  • CVE-2008-6172
    31Monitor

    Directory traversal vulnerability in captcha/captcha_image.php in the RWCards (com_rwcards) 3.0.11 component for Joomla!, when magic_quotes_

    MediumCVSS 6.8Proof of conceptEPSS 12%

    joomla · joomlaFeb 19, 2009

  • CVE-2009-0647
    25Monitor

    msnmsgr.exe in Windows Live Messenger (WLM) 2009 build 14.0.8064.206, and other 14.0.8064.x builds, allows remote attackers to cause a denia

    MediumCVSS 5.0No exploitEPSS 17%

    microsoft · windows live messengerFeb 19, 2009

  • CVE-2008-6194
    34Monitor

    Memory leak in the DNS server in Microsoft Windows allows remote attackers to cause a denial of service (memory consumption) via DNS packets

    HighCVSS 7.8No exploitEPSS 11%

    microsoft · windowsFeb 19, 2009

  • CVE-2009-0650
    44Plan

    Stack-based buffer overflow in the GetStatsFromLine function in TPTEST 3.1.7 and earlier, and possibly 5.02, allows remote attackers to caus

    CriticalCVSS 10.0Proof of conceptEPSS 12%

    tptest · tptestFeb 20, 2009

  • CVE-2009-0658
    57Plan

    Buffer overflow in Adobe Reader 9.0 and earlier, and Acrobat 9.0 and earlier, allows remote attackers to execute arbitrary code via a crafte

    HighCVSS 7.8WeaponizedEPSS 87%

    adobe · acrobatFeb 20, 2009

  • CVE-2008-6221
    46Plan

    PHP remote file inclusion vulnerability in config.dadamail.php in the Dada Mail Manager (com_dadamail) component 2.6 for Joomla! allows remo

    HighCVSS 7.5Proof of conceptEPSS 53%

    joomla · joomlaFeb 20, 2009

  • CVE-2008-6222
    23Monitor

    Directory traversal vulnerability in the Pro Desk Support Center (com_pro_desk) component 1.0 and 1.2 for Joomla! allows remote attackers to

    MediumCVSS 5.0Proof of conceptEPSS 11%

    joomla · joomlaFeb 20, 2009

  • CVE-2009-0238
    78This week

    Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word

    HighCVSS 8.8KEVWeaponizedEPSS 42%

    microsoft · excelFeb 25, 2009

  • CVE-2009-0187
    49Plan

    Stack-based buffer overflow in Orbit Downloader 2.8.2 and 2.8.3, and possibly other versions before 2.8.5, allows remote attackers to execut

    CriticalCVSS 9.3WeaponizedEPSS 39%

    orbitdownloader · orbit downloaderFeb 26, 2009

  • CVE-2009-0519
    41Plan

    Unspecified vulnerability in Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 allows remote attackers to cause a denial of

    CriticalCVSS 9.3No exploitEPSS 14%

    adobe · airFeb 26, 2009

  • CVE-2009-0520
    46Plan

    Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 does not properly remove references to destroyed objects during Shockwave

    CriticalCVSS 9.3Proof of conceptEPSS 28%

    adobe · airFeb 26, 2009