Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: March 2009

42 records · 2 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2008-6347
    39Monitor

    PHP remote file inclusion vulnerability in lib/onguma.class.php in the Onguma Time Sheet (com_ongumatimesheet20) 2.0 4b component for Joomla

    HighCVSS 7.5Proof of conceptEPSS 31%

    joomla · joomlaMar 2, 2009

  • CVE-2009-0751
    23Monitor

    Yaws before 1.80 allows remote attackers to cause a denial of service (memory consumption and crash) via a request with a large number of he

    MediumCVSS 5.0Proof of conceptEPSS 10%

    yaws · yawsMar 2, 2009

  • CVE-2008-6393
    45Plan

    PSI Jabber client before 0.12.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a file

    CriticalCVSS 10.0Proof of conceptEPSS 18%

    jabber · jabber clientMar 3, 2009

  • CVE-2009-0755
    23Monitor

    The FormWidgetChoice::loadDefaults function in Poppler before 0.10.4 allows remote attackers to cause a denial of service (crash) via a PDF

    MediumCVSS 5.0Proof of conceptEPSS 10%

    poppler · popplerMar 3, 2009

  • CVE-2009-0756
    23Monitor

    The JBIG2Stream::readSymbolDictSeg function in Poppler before 0.10.4 allows remote attackers to cause a denial of service (crash) via a PDF

    MediumCVSS 5.0Proof of conceptEPSS 10%

    poppler · popplerMar 3, 2009

  • CVE-2009-0367
    40Plan

    The Python AI module in Wesnoth 1.4.x and 1.5 before 1.5.11 allows remote attackers to escape the sandbox and execute arbitrary code by usin

    CriticalCVSS 9.3Proof of conceptEPSS 10%

    wesnoth · wesnothMar 4, 2009

  • CVE-2009-0815
    40Plan

    The jumpUrl mechanism in class.tslib_fe.php in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1 before 4.1.10, 4.2 before 4.2.6, and 4.3alp

    MediumCVSS 5.0WeaponizedEPSS 42%

    typo3 · typo3Mar 4, 2009

  • CVE-2009-0819
    19Monitor

    sql/item_xmlfunc.cc in MySQL 5.1 before 5.1.32 and 6.0 before 6.0.10 allows remote authenticated users to cause a denial of service (crash)

    MediumCVSS 4.0Proof of conceptEPSS 10%

    mysql · mysqlMar 4, 2009

  • CVE-2009-0849
    35Monitor

    Stack-based buffer overflow in the DtbClsLogin function in NovaStor NovaNET 12 allows remote attackers to (1) execute arbitrary code on Linu

    HighCVSS 7.5Proof of conceptEPSS 16%

    novastor · novanetMar 9, 2009

  • CVE-2009-0850
    26Monitor

    Cross-site scripting (XSS) vulnerability in BitDefender Internet Security 2009 allows user-assisted remote attackers to inject arbitrary web

    MediumCVSS 4.3No exploitEPSS 29%

    bitdefender · internet securityMar 9, 2009

  • CVE-2009-0081
    47Plan

    The graphics device interface (GDI) implementation in the kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vis

    CriticalCVSS 9.3No exploitEPSS 32%

    microsoft · windows 2000Mar 10, 2009

  • CVE-2009-0085
    33Monitor

    The Secure Channel (aka SChannel) authentication component in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gol

    HighCVSS 7.1No exploitEPSS 15%

    microsoft · windows 2000Mar 10, 2009

  • CVE-2009-0836
    53Plan

    Foxit Reader 2.3 before Build 3902 and 3.0 before Build 1506, including 1120 and 1301, does not require user confirmation before performing

    CriticalCVSS 10.0WeaponizedEPSS 42%

    foxitsoftware · readerMar 10, 2009

  • CVE-2009-0837
    63This week

    Stack-based buffer overflow in Foxit Reader 3.0 before Build 1506, including 1120 and 1301, allows remote attackers to execute arbitrary cod

    CriticalCVSS 10.0WeaponizedEPSS 75%

    foxit · reader3.0Mar 10, 2009

  • CVE-2008-4563
    49Plan

    Heap-based buffer overflow in adsmdll.dll 5.3.7.7296, as used by the daemon (dsmsvc.exe) in the backup server in IBM Tivoli Storage Manager

    CriticalCVSS 10.0No exploitEPSS 28%

    ibm · tivoli storage managerMar 11, 2009

  • CVE-2009-0093
    19Monitor

    Windows DNS Server in Microsoft Windows 2000 SP4, Server 2003 SP1 and SP2, and Server 2008, when dynamic updates are enabled, does not restr

    LowCVSS 3.5No exploitEPSS 17%

    microsoft · windows 2000Mar 11, 2009

  • CVE-2009-0094
    29Monitor

    The WINS server in Microsoft Windows 2000 SP4 and Server 2003 SP1 and SP2 does not restrict registration of the (1) "wpad" and (2) "isatap"

    MediumCVSS 5.5No exploitEPSS 23%

    microsoft · windows 2000Mar 11, 2009

  • CVE-2009-0233
    31Monitor

    The DNS Resolver Cache Service (aka DNSCache) in Windows DNS Server in Microsoft Windows 2000 SP4, Server 2003 SP1 and SP2, and Server 2008,

    MediumCVSS 5.8No exploitEPSS 27%

    microsoft · windows 2000Mar 11, 2009

  • CVE-2009-0234
    35Monitor

    The DNS Resolver Cache Service (aka DNSCache) in Windows DNS Server in Microsoft Windows 2000 SP4, Server 2003 SP1 and SP2, and Server 2008

    MediumCVSS 6.4No exploitEPSS 34%

    microsoft · windows 2000Mar 11, 2009

  • CVE-2009-0880
    40Plan

    Directory traversal vulnerability in the CIM server in IBM Director before 5.20.3 Service Update 2 on Windows allows remote attackers to loa

    MediumCVSS 6.8WeaponizedEPSS 31%

    ibm · directorMar 12, 2009

  • CVE-2009-0922
    19Monitor

    PostgreSQL before 8.3.7, 8.2.13, 8.1.17, 8.0.21, and 7.4.25 allows remote authenticated users to cause a denial of service (stack consumptio

    MediumCVSS 4.0Proof of conceptEPSS 10%

    postgresql · postgresqlMar 17, 2009

  • CVE-2009-0932
    39Monitor

    Directory traversal vulnerability in framework/Image/Image.php in Horde before 3.2.4 and 3.3.3 and Horde Groupware before 1.1.5 allows remot

    MediumCVSS 6.4Proof of conceptEPSS 45%

    debian · hordeMar 17, 2009

  • CVE-2008-6482
    34Monitor

    PHP remote file inclusion vulnerability in admin.treeg.php in the Flash Tree Gallery (com_treeg) component 1.0 for Joomla!, when register_gl

    MediumCVSS 6.8Proof of conceptEPSS 22%

    joomla · joomlaMar 18, 2009

  • CVE-2008-6483
    38Monitor

    PHP remote file inclusion vulnerability in admin.googlebase.php in the Ecom Solutions VirtueMart Google Base (aka com_googlebase or Froogle)

    HighCVSS 7.5Proof of conceptEPSS 25%

    virtuemart-solutions · com googlebaseMar 18, 2009

  • CVE-2009-0927
    94Now

    Stack-based buffer overflow in Adobe Reader and Adobe Acrobat 9 before 9.1, 8 before 8.1.3 , and 7 before 7.1.1 allows remote attackers to e

    HighCVSS 8.8KEVWeaponizedEPSS 96%

    adobe · acrobat readerMar 19, 2009

  • CVE-2009-1025
    42Plan

    PHP remote file inclusion vulnerability in linkadmin.php in Beerwin PHPLinkAdmin 1.0 allows remote attackers to execute arbitrary PHP code v

    HighCVSS 7.5Proof of conceptEPSS 40%

    beerwin · phplinkadminMar 19, 2009

  • CVE-2009-1028
    47Plan

    Stack-based buffer overflow in ediSys eZip Wizard 3.0 allows remote attackers to execute arbitrary code via a crafted .zip file.

    CriticalCVSS 9.3WeaponizedEPSS 33%

    edisys · ezip wizardMar 19, 2009

  • CVE-2009-1029
    47Plan

    Stack-based buffer overflow in POP Peeper 3.4.0.0 and earlier allows remote POP3 servers to execute arbitrary code via a long Date header, r

    CriticalCVSS 9.3WeaponizedEPSS 31%

    poppeeper · pop peeperMar 19, 2009

  • CVE-2009-1031
    34Monitor

    Directory traversal vulnerability in the FTP server in Rhino Software Serv-U File Server 7.0.0.1 through 7.4.0.1 allows remote attackers to

    HighCVSS 7.8Proof of conceptEPSS 11%

    solarwinds · serv-u file serverMar 19, 2009

  • CVE-2008-6504
    31Monitor

    ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not

    MediumCVSS 5.0Proof of conceptEPSS 36%

    opensymphony · xworkMar 23, 2009

  • CVE-2008-6505
    42Plan

    Multiple directory traversal vulnerabilities in Apache Struts 2.0.x before 2.0.12 and 2.1.x before 2.1.3 allow remote attackers to read arbi

    MediumCVSS 5.0Proof of conceptEPSS 72%

    apache · strutsMar 23, 2009

  • CVE-2009-1043
    49Plan

    Unspecified vulnerability in Microsoft Internet Explorer 8 on Windows 7 allows remote attackers to execute arbitrary code via unknown vector

    CriticalCVSS 10.0No exploitEPSS 30%

    microsoft · internet explorerMar 23, 2009

  • CVE-2008-6508
    55Plan

    Directory traversal vulnerability in the AuthCheck filter in the Admin Console in Openfire 3.6.0a and earlier allows remote attackers to byp

    HighCVSS 7.5WeaponizedEPSS 83%

    igniterealtime · openfireMar 23, 2009

  • CVE-2009-0920
    52Plan

    Stack-based buffer overflow in OvCgi/Toolbar.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers t

    HighCVSS 7.5WeaponizedEPSS 74%

    hp · network node managerMar 24, 2009

  • CVE-2009-0921
    44Plan

    Multiple heap-based buffer overflows in OvCgi/Toolbar.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allow remote att

    CriticalCVSS 10.0No exploitEPSS 13%

    hp · network node managerMar 24, 2009

  • CVE-2009-0928
    43Plan

    Heap-based buffer overflow in Adobe Acrobat Reader and Acrobat Professional 7.1.0, 8.1.3, 9.0.0, and other versions allows remote attackers

    CriticalCVSS 10.0No exploitEPSS 10%

    adobe · acrobatMar 24, 2009

  • CVE-2009-1061
    40Plan

    Unspecified vulnerability in Adobe Acrobat Reader 9 before 9.1, 8 before 8.1.4, and 7 before 7.1.1 might allow remote attackers to execute a

    CriticalCVSS 9.3No exploitEPSS 11%

    adobe · acrobat readerMar 24, 2009

  • CVE-2009-0215
    48Plan

    Stack-based buffer overflow in the GetXMLValue method in the IBM Access Support ActiveX control in IbmEgath.dll, as distributed on IBM and L

    CriticalCVSS 9.3WeaponizedEPSS 36%

    ibm · access support activex controlMar 25, 2009

  • CVE-2009-1088
    40Plan

    Hannon Hill Cascade Server 5.7 and other versions allows remote authenticated users to execute arbitrary programs or Java code via a crafted

    CriticalCVSS 9.0Proof of conceptEPSS 11%

    hannonhill · cascadeMar 25, 2009

  • CVE-2009-1068
    41Plan

    Stack-based buffer overflow in BS.Player (bsplayer) 2.32 Build 975 Free and 2.34 Build 980 PRO and earlier allows remote attackers to cause

    CriticalCVSS 9.3Proof of conceptEPSS 14%

    bsplayer · bs.playerMar 26, 2009

  • CVE-2009-1151
    98Now

    Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inje

    CriticalCVSS 9.8KEVWeaponizedEPSS 96%

    phpmyadmin · phpmyadminMar 26, 2009

  • CVE-2009-1169
    40Plan

    The txMozillaXSLTProcessor::TransformToDoc function in Mozilla Firefox before 3.0.8 and SeaMonkey before 1.1.16 allows remote attackers to c

    CriticalCVSS 9.3Proof of conceptEPSS 10%

    mozilla · firefoxMar 26, 2009