Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: May 2009

42 records · 1 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2009-1511
    35Monitor

    GDI+ in Microsoft Windows XP SP3 allows remote attackers to cause a denial of service (infinite loop) via a PNG file that contains a certain

    HighCVSS 7.8Proof of conceptEPSS 14%

    microsoft · windows xpMay 1, 2009

  • CVE-2008-4828
    61This week

    Multiple stack-based buffer overflows in dsmagent.exe in the Remote Agent Service in the IBM Tivoli Storage Manager (TSM) client 5.1.0.0 thr

    CriticalCVSS 10.0WeaponizedEPSS 71%

    ibm · tivoli storage manager clientMay 5, 2009

  • CVE-2009-0720
    43Plan

    Unspecified vulnerability in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary cod

    CriticalCVSS 10.0No exploitEPSS 10%

    hp · openview network node managerMay 5, 2009

  • CVE-2009-1523
    28Monitor

    Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x through 7.0.0.M2 allows remote att

    MediumCVSS 5.0Proof of conceptEPSS 25%

    mortbay · jettyMay 5, 2009

  • CVE-2009-1490
    24Monitor

    Heap-based buffer overflow in Sendmail before 8.13.2 allows remote attackers to cause a denial of service (daemon crash) and possibly execut

    MediumCVSS 5.0Proof of conceptEPSS 12%

    sendmail · sendmailMay 5, 2009

  • CVE-2009-1551
    41Plan

    Multiple PHP remote file inclusion vulnerabilities in Qt quickteam 2 allow remote attackers to execute arbitrary PHP code via a URL in the (

    HighCVSS 7.5Proof of conceptEPSS 36%

    qt-cute · quickteamMay 6, 2009

  • CVE-2009-1558
    40Plan

    Directory traversal vulnerability in adm/file.cgi on the Cisco Linksys WVC54GCA wireless video camera with firmware 1.00R22 and 1.00R24 allo

    HighCVSS 7.8Proof of conceptEPSS 29%

    cisco · wvc54gcaMay 6, 2009

  • CVE-2009-1574
    23Monitor

    racoon/isakmp_frag.c in ipsec-tools before 0.7.2 allows remote attackers to cause a denial of service (crash) via crafted fragmented packets

    MediumCVSS 5.0Proof of conceptEPSS 11%

    ipsec-tools · ipsec-toolsMay 6, 2009

  • CVE-2009-1608
    40Plan

    Multiple buffer overflows in Microchip MPLAB IDE 8.30 and possibly earlier versions allow user-assisted remote attackers to execute arbitrar

    CriticalCVSS 9.3Proof of conceptEPSS 11%

    microchip · mplab ideMay 11, 2009

  • CVE-2009-1612
    47Plan

    Stack-based buffer overflow in the MPS.StormPlayer.1 ActiveX control in mps.dll 3.9.4.27 in Baofeng Storm allows remote attackers to execute

    CriticalCVSS 9.3WeaponizedEPSS 33%

    baofeng · stormMay 11, 2009

  • CVE-2009-0220
    48Plan

    Multiple stack-based buffer overflows in the PowerPoint 4.0 importer (PP4X32.DLL) in Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 200

    CriticalCVSS 9.3No exploitEPSS 37%

    microsoft · office powerpointMay 12, 2009

  • CVE-2009-0221
    48Plan

    Integer overflow in Microsoft Office PowerPoint 2002 SP3 and 2003 SP3 allows remote attackers to execute arbitrary code via a PowerPoint fil

    CriticalCVSS 9.3No exploitEPSS 37%

    microsoft · office powerpointMay 12, 2009

  • CVE-2009-0222
    46Plan

    Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3 allows remote attackers to execute arbitrary code via crafted sound data in a f

    CriticalCVSS 9.3No exploitEPSS 31%

    microsoft · office powerpointMay 12, 2009

  • CVE-2009-0223
    45Plan

    Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3 allows remote attackers to execute arbitrary code via crafted sound data in a f

    CriticalCVSS 9.3No exploitEPSS 27%

    microsoft · office powerpointMay 12, 2009

  • CVE-2009-0224
    46Plan

    Microsoft Office PowerPoint 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; PowerPoint Viewer 2003 and 2007 SP1 and SP2; PowerPoint in M

    CriticalCVSS 9.3No exploitEPSS 30%

    microsoft · compatibility pack word excel powerpointMay 12, 2009

  • CVE-2009-0225
    46Plan

    Microsoft Office PowerPoint 2002 SP3 allows remote attackers to execute arbitrary code via crafted sound data in a file that uses a PowerPoi

    CriticalCVSS 9.3No exploitEPSS 31%

    microsoft · office powerpointMay 12, 2009

  • CVE-2009-0226
    47Plan

    Stack-based buffer overflow in the PowerPoint 4.2 conversion filter in Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3 allows r

    CriticalCVSS 9.3No exploitEPSS 34%

    microsoft · office powerpointMay 12, 2009

  • CVE-2009-0227
    48Plan

    Stack-based buffer overflow in the PowerPoint 4.2 conversion filter (PP4X32.DLL) in Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003

    CriticalCVSS 9.3No exploitEPSS 35%

    microsoft · office powerpointMay 12, 2009

  • CVE-2009-1128
    45Plan

    Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3 allows remote attackers to execute arbitrary code via crafted sound data in a f

    CriticalCVSS 9.3No exploitEPSS 27%

    microsoft · office powerpointMay 12, 2009

  • CVE-2009-1129
    48Plan

    Multiple stack-based buffer overflows in the PowerPoint 95 importer (PP7X32.DLL) in Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003

    CriticalCVSS 9.3No exploitEPSS 35%

    microsoft · office powerpointMay 12, 2009

  • CVE-2009-1130
    49Plan

    Heap-based buffer overflow in Microsoft Office PowerPoint 2002 SP3 and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows rem

    CriticalCVSS 9.3No exploitEPSS 39%

    microsoft · officeMay 12, 2009

  • CVE-2009-1131
    48Plan

    Multiple stack-based buffer overflows in Microsoft Office PowerPoint 2000 SP3 allow remote attackers to execute arbitrary code via a large a

    CriticalCVSS 9.3No exploitEPSS 35%

    microsoft · office powerpointMay 12, 2009

  • CVE-2009-1137
    46Plan

    Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3 allows remote attackers to execute arbitrary code via crafted sound data in a f

    CriticalCVSS 9.3No exploitEPSS 31%

    microsoft · office powerpointMay 12, 2009

  • CVE-2009-0714
    43Plan

    Unspecified vulnerability in the dpwinsup module (dpwinsup.dll) for dpwingad (dpwingad.exe) in HP Data Protector Express and Express SSE 3.x

    HighCVSS 7.2Proof of conceptEPSS 51%

    hp · data protector expressMay 14, 2009

  • CVE-2009-1641
    46Plan

    Multiple stack-based buffer overflows in Mini-stream Ripper 3.0.1.1 allow remote attackers to execute arbitrary code via (1) a long rtsp URL

    CriticalCVSS 9.3WeaponizedEPSS 30%

    mini-stream · ripperMay 15, 2009

  • CVE-2009-1667
    45Plan

    Stack-based buffer overflow in Mini-stream CastRipper 2.50.70 allows remote attackers to execute arbitrary code via a long entry in a .m3u f

    CriticalCVSS 9.3Proof of conceptEPSS 27%

    mini-stream · castripperMay 18, 2009

  • CVE-2009-1669
    44Plan

    The smarty_function_math function in libs/plugins/function.math.php in Smarty 2.6.22 allows context-dependent attackers to execute arbitrary

    CriticalCVSS 10.0Proof of conceptEPSS 14%

    smarty · smartyMay 18, 2009

  • CVE-2009-1671
    40Plan

    Multiple buffer overflows in the Deployment Toolkit ActiveX control in deploytk.dll 6.0.130.3 in Sun Java SE Runtime Environment (aka JRE) 6

    CriticalCVSS 9.3Proof of conceptEPSS 10%

    sun · jreMay 18, 2009

  • CVE-2009-1675
    41Plan

    Stack-based buffer overflow in ElectraSoft 32bit FTP 09.04.24 allows remote FTP servers to execute arbitrary code via a long 227 reply to a

    CriticalCVSS 9.3WeaponizedEPSS 13%

    electrasoft · 32bit ftpMay 18, 2009

  • CVE-2009-1252
    33Monitor

    Stack-based buffer overflow in the crypto_recv function in ntp_crypto.c in ntpd in NTP before 4.2.4p7 and 4.2.5 before 4.2.5p74, when OpenSS

    MediumCVSS 6.8No exploitEPSS 21%

    ntp · ntpMay 19, 2009

  • CVE-2009-1377
    23Monitor

    The dtls1_buffer_record function in ssl/d1_pkt.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allows remote attackers to cause a denial of s

    MediumCVSS 5.0No exploitEPSS 11%

    openssl · opensslMay 19, 2009

  • CVE-2009-1378
    24Monitor

    Multiple memory leaks in the dtls1_process_out_of_seq_message function in ssl/d1_both.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allow r

    MediumCVSS 5.0No exploitEPSS 12%

    openssl · opensslMay 19, 2009

  • CVE-2009-1379
    25Monitor

    Use-after-free vulnerability in the dtls1_retrieve_buffered_fragment function in ssl/d1_both.c in OpenSSL 1.0.0 Beta 2 allows remote attacke

    MediumCVSS 5.0Proof of conceptEPSS 18%

    openssl · opensslMay 19, 2009

  • CVE-2009-1730
    56Plan

    Multiple directory traversal vulnerabilities in NetMechanica NetDecision TFTP Server 4.2 allow remote attackers to read or modify arbitrary

    CriticalCVSS 10.0WeaponizedEPSS 54%

    netmechanica · netdecision tftp serverMay 20, 2009

  • CVE-2009-1161
    44Plan

    Directory traversal vulnerability in the TFTP service in Cisco CiscoWorks Common Services (CWCS) 3.0.x through 3.2.x on Windows, as used in

    CriticalCVSS 10.0No exploitEPSS 12%

    cisco · ciscoworks common servicesMay 21, 2009

  • CVE-2009-1759
    41Plan

    Stack-based buffer overflow in the btFiles::BuildFromMI function (trunk/btfiles.cpp) in Enhanced CTorrent (aka dTorrent) 3.3.2 and probably

    CriticalCVSS 9.3Proof of conceptEPSS 13%

    rahul · dtorrentMay 22, 2009

  • CVE-2009-1765
    32Monitor

    Multiple directory traversal vulnerabilities in pluck 4.6.2, when register_globals is enabled, allow remote attackers to include and execute

    MediumCVSS 6.8Proof of conceptEPSS 15%

    pluck-cms · pluckMay 22, 2009

  • CVE-2009-1774
    42Plan

    Directory traversal vulnerability in plugins/ddb/foot.php in Strawberry 1.1.1 allows remote attackers to include and execute arbitrary local

    CriticalCVSS 9.3Proof of conceptEPSS 17%

    strawberry · strawberryMay 22, 2009

  • CVE-2009-1376
    41Plan

    Multiple integer overflows in the msn_slplink_process_msg functions in the MSN protocol handler in (1) libpurple/protocols/msn/slplink.c and

    CriticalCVSS 9.3Proof of conceptEPSS 13%

    pidgin · pidginMay 26, 2009

  • CVE-2009-1800
    33Monitor

    Stack-based buffer overflow in the Chinagames CGAgent ActiveX control 1.x in CGAgent.dll, as distributed in Chinagames iGame 2009, allows re

    HighCVSS 7.5Proof of conceptEPSS 10%

    chinagames · igameMay 28, 2009

  • CVE-2009-1537
    80Now

    Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows

    HighCVSS 8.8KEVWeaponizedEPSS 51%

    microsoft · directxMay 29, 2009

  • CVE-2009-1831
    48Plan

    The Nullsoft Modern Skins Support module (gen_ff.dll) in Nullsoft Winamp before 5.552 allows remote attackers to execute arbitrary code via

    CriticalCVSS 9.3WeaponizedEPSS 36%

    nullsoft · winampMay 29, 2009