By publication date

Exploited and new serious CVEs: June 2009

64 records · 3 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
46Plan	CVE-2009-0950Weaponized	Stack-based buffer overflow in Apple iTunes before 8.2 allows remote attackers to execute arbitrary code or cause a denial of service (appliapple · itunes · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	28.8%	Jun 2, 2009
24Monitor	CVE-2009-1902Proof of concept	The multipart processor in ModSecurity before 2.5.9 allows remote attackers to cause a denial of service (crash) via a multipart form datapotrustwave · modsecurity · CWE-476 Pre-auth Memory safety Denial of service	Medium5.0	—	13.7%	Jun 3, 2009
41Plan	CVE-2009-1385No exploit	Integer underflow in the e1000_clean_rx_irq function in drivers/net/e1000/e1000_main.c in the e1000 driver in the Linux kernel before 2.6.30linux · kernel · CWE-189 Pre-auth Denial of service	High7.8	—	33.7%	Jun 4, 2009
44Plan	CVE-2009-1386Weaponized	ssl/s3_pkt.c in OpenSSL before 0.9.8i allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via aopenssl · openssl · CWE-476 Pre-auth Memory safety Denial of service	Medium5.0	—	80.1%	Jun 4, 2009
23Monitor	CVE-2009-1387No exploit	The dtls1_retrieve_buffered_fragment function in ssl/d1_both.c in OpenSSL before 1.0.0 Beta 2 allows remote attackers to cause a denial of sopenssl · openssl · CWE-476 Pre-auth Memory safety Denial of service	Medium5.0	—	10.2%	Jun 4, 2009
43Plan	CVE-2009-1916Proof of concept	dig.php in GScripts.net DNS Tools allows remote attackers to execute arbitrary commands via shell metacharacters in the ns parameter.gscripts · dns tools · CWE-78 pre-auth RCE Command injection	Critical10.0	—	10.3%	Jun 4, 2009
23Monitor	CVE-2009-0033No exploit	Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing arapache · tomcat · CWE-20 Pre-auth Denial of service	Medium5.0	—	10.0%	Jun 5, 2009
45Plan	CVE-2009-0580Weaponized	Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackerapache · tomcat · CWE-200 Pre-auth Info leak	Medium4.3	—	94.4%	Jun 5, 2009
52Plan	CVE-2009-1936Proof of concept	_functions.php in cpCommerce 1.2.x, possibly including 1.2.9, sends a redirect but does not exit when it is called directly, which allows recpcommerce project · cpcommerce · CWE-22 pre-auth RCE Path traversal	Critical9.8	—	42.2%	Jun 5, 2009
40Plan	CVE-2008-6825Weaponized	Directory traversal vulnerability in user/index.php in Fonality trixbox CE 2.6.1 and earlier allows remote attackers to include and execute trixbox · trixbox · CWE-22 pre-auth RCE Path traversal	Medium6.8	—	20.2%	Jun 5, 2009
62This week	CVE-2009-1943Weaponized	Stack-based buffer overflow in the IKE service (ireIke.exe) in SafeNet SoftRemote before 10.8.6 allows remote attackers to execute arbitrarysafenet-inc · softremote · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	72.2%	Jun 5, 2009
40Plan	CVE-2009-1944Proof of concept	Stack-based buffer overflow in AIMP 2.51 build 330 allows remote attackers to execute arbitrary code via an MP3 file with a long ID3 tag.aimp · aimp · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	10.4%	Jun 5, 2009
46Plan	CVE-2009-1955Proof of concept	The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modapache · apr-util · CWE-776 Pre-auth Denial of service	High7.5	—	52.9%	Jun 7, 2009
29Monitor	CVE-2009-1956No exploit	Off-by-one error in the apr_brigade_vprintf function in Apache APR-util before 1.3.5 on big-endian platforms allows remote attackers to obtaapache · apr-util · CWE-189 Pre-auth	Medium6.4	—	12.0%	Jun 7, 2009
44Plan	CVE-2009-1960Proof of concept	inc/init.php in DokuWiki 2009-02-14, rc2009-02-06, and rc2009-01-30, when register_globals is enabled, allows remote attackers to include andokuwiki · dokuwiki · CWE-94 pre-auth RCE	Critical9.3	—	23.1%	Jun 7, 2009
40Plan	CVE-2008-6829Weaponized	VicFTPS 5.0 allows remote attackers to cause a denial of service (crash) via a LIST command that starts with a "/\/" (forward slash, backwarvicftps · vicftps · CWE-20 Pre-auth Denial of service	Medium5.0	—	37.6%	Jun 8, 2009
36Monitor	CVE-2009-0949Proof of concept	The ippReadIO function in cups/ipp.c in cupsd in CUPS before 1.3.10 does not properly initialize memory for IPP request packets, which allowapple · cups · CWE-908 Pre-auth Memory safety Denial of service	High7.5	—	19.6%	Jun 9, 2009
59Plan	CVE-2009-1535Weaponized	The WebDAV extension in Microsoft Internet Information Services (IIS) 5.1 and 6.0 allows remote attackers to bypass URI-based protection mecmicrosoft · internet information services · CWE-287 Pre-auth Auth bypass	High7.5	—	98.1%	Jun 10, 2009
46Plan	CVE-2009-0228No exploit	Stack-based buffer overflow in the EnumeratePrintShares function in Windows Print Spooler Service (win32spl.dll) in Microsoft Windows 2000 Smicrosoft · windows 2000 · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	20.5%	Jun 10, 2009
46Plan	CVE-2009-0230No exploit	The Windows Print Spooler in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 allomicrosoft · windows 2000 · CWE-264	Critical9.0	—	34.8%	Jun 10, 2009
27Monitor	CVE-2009-0239No exploit	Cross-site scripting (XSS) vulnerability in Windows Search 4.0 for Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows user-assistedmicrosoft · windows server 2003 · CWE-79 Pre-auth XSS	Medium4.3	—	32.5%	Jun 10, 2009
79This week	CVE-2009-0563Weaponized	Stack-based buffer overflow in Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Microsoft Office for Mac 2004 and 2008; Open microsoft · office · CWE-787 RCE Memory safety	High7.8	KEV	59.6%	Jun 10, 2009
49Plan	CVE-2009-0565Proof of concept	Buffer overflow in Microsoft Office Word 2000 SP3, 2002 SP3, and 2007 SP1 and SP2; Microsoft Office for Mac 2004 and 2008; Open XML File Formicrosoft · office · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	40.5%	Jun 10, 2009
50Plan	CVE-2009-0568No exploit	The RPC Marshalling Engine (aka NDR) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 20microsoft · windows 2000 · CWE-264 Pre-auth	Critical10.0	—	32.3%	Jun 10, 2009
52Plan	CVE-2009-1138No exploit	The LDAP service in Active Directory on Microsoft Windows 2000 SP4 does not properly free memory for LDAP and LDAPS requests, which allows rmicrosoft · windows 2000 · CWE-399 pre-auth RCE	Critical10.0	—	39.4%	Jun 10, 2009
43Plan	CVE-2009-1139No exploit	Memory leak in the LDAP service in Active Directory on Microsoft Windows 2000 SP4 and Server 2003 SP2, and Active Directory Application Modemicrosoft · adam · CWE-399 Pre-auth Denial of service	High7.8	—	39.1%	Jun 10, 2009
48Plan	CVE-2009-1533No exploit	Buffer overflow in the Works for Windows document converters in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, Office 2007 SP1, microsoft · office · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	35.6%	Jun 10, 2009
39Monitor	CVE-2009-1699Proof of concept	The XSL stylesheet implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 througapple · safari · CWE-611 Pre-auth XXE	High7.5	—	29.0%	Jun 10, 2009
46Plan	CVE-2009-0549No exploit	Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Open XML File Format Converter for Macmicrosoft · office · CWE-94 pre-auth RCE	Critical9.3	—	28.4%	Jun 10, 2009
77This week	CVE-2009-0557Weaponized	Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Excel in 2007 Microsoft Office System microsoft · office · CWE-94 RCE	High7.8	KEV	52.8%	Jun 10, 2009
46Plan	CVE-2009-0558No exploit	Array index error in Excel in Microsoft Office 2000 SP3 and Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac, allowsmicrosoft · office · CWE-94 pre-auth RCE	Critical9.3	—	31.0%	Jun 10, 2009
46Plan	CVE-2009-0559No exploit	Stack-based buffer overflow in Excel in Microsoft Office 2000 SP3 and Office XP SP3 allows remote attackers to execute arbitrary code via a microsoft · office · CWE-94 pre-auth RCE	Critical9.3	—	29.4%	Jun 10, 2009
45Plan	CVE-2009-0560No exploit	Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Excel in 2007 Microsoft Office System microsoft · office · CWE-399 pre-auth RCE	Critical9.3	—	27.9%	Jun 10, 2009
48Plan	CVE-2009-0561No exploit	Integer overflow in Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Excel in 2007 Micrmicrosoft · office · CWE-189 pre-auth RCE	Critical9.3	—	36.8%	Jun 10, 2009
60This week	CVE-2009-1122Weaponized	The WebDAV extension in Microsoft Internet Information Services (IIS) 5.0 on Windows 2000 SP4 does not properly decode URLs, which allows remicrosoft · internet information services · CWE-287 Pre-auth Auth bypass	High7.5	—	98.4%	Jun 10, 2009
62This week	CVE-2009-1123Weaponized	The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 does not properly vmicrosoft · windows 2000 Local privilege escalation	High7.8	KEV	4.8%	Jun 10, 2009
48Plan	CVE-2009-1134No exploit	Excel in 2007 Microsoft Office System SP1 and SP2; Microsoft Office Excel Viewer; and Microsoft Office Compatibility Pack for Word, Excel, amicrosoft · office · CWE-94 pre-auth RCE	Critical9.3	—	35.6%	Jun 10, 2009
35Monitor	CVE-2009-1140Proof of concept	Microsoft Internet Explorer 5.01 SP4; 6 SP1; 6 and 7 for Windows XP SP2 and SP3; 6 and 7 for Server 2003 SP2; 7 for Vista Gold, SP1, and SP2microsoft · internet explorer · CWE-200 Pre-auth Info leak	High7.1	—	24.7%	Jun 10, 2009
45Plan	CVE-2009-1141No exploit	Microsoft Internet Explorer 6 for Windows XP SP2 and SP3 and Server 2003 SP2 allows remote attackers to execute arbitrary code via unspecifimicrosoft · internet explorer · CWE-399 pre-auth RCE	Critical9.3	—	27.6%	Jun 10, 2009
48Plan	CVE-2009-1528No exploit	Microsoft Internet Explorer 6 and 7 for Windows XP SP2 and SP3; 6 and 7 for Server 2003 SP2; 7 for Vista Gold, SP1, and SP2; and 7 for Servemicrosoft · internet explorer · CWE-399 pre-auth RCE	Critical9.3	—	35.2%	Jun 10, 2009
41Plan	CVE-2009-1529No exploit	Microsoft Internet Explorer 7 for Windows XP SP2 and SP3; 7 for Server 2003 SP2; 7 for Vista Gold, SP1, and SP2; and 7 for Server 2008 SP2 dmicrosoft · internet explorer · CWE-399 pre-auth RCE	High8.1	—	28.7%	Jun 10, 2009
47Plan	CVE-2009-1530No exploit	Use-after-free vulnerability in Microsoft Internet Explorer 7 for Windows XP SP2 and SP3; 7 for Server 2003 SP2; 7 for Vista Gold, SP1, and microsoft · internet explorer · CWE-399 pre-auth RCE	Critical9.3	—	33.9%	Jun 10, 2009
48Plan	CVE-2009-1531No exploit	Microsoft Internet Explorer 7 for Windows XP SP2 and SP3; 7 for Server 2003 SP2; 7 for Vista Gold, SP1, and SP2; and 7 for Server 2008 SP2 amicrosoft · internet explorer · CWE-399 pre-auth RCE	Critical9.3	—	35.0%	Jun 10, 2009
46Plan	CVE-2009-1532No exploit	Microsoft Internet Explorer 8 for Windows XP SP2 and SP3; 8 for Server 2003 SP2; 8 for Vista Gold, SP1, and SP2; and 8 for Server 2008 SP2 dmicrosoft · internet explorer · CWE-787 pre-auth RCE Memory safety	High8.8	—	36.7%	Jun 10, 2009
40Plan	CVE-2009-0510No exploit	Heap-based buffer overflow in the JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and adobe · acrobat · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	10.9%	Jun 11, 2009
40Plan	CVE-2009-0511No exploit	Heap-based buffer overflow in the JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and adobe · acrobat · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	10.9%	Jun 11, 2009
40Plan	CVE-2009-0512No exploit	Heap-based buffer overflow in the JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and adobe · acrobat · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	10.9%	Jun 11, 2009
40Plan	CVE-2009-0888No exploit	Heap-based buffer overflow in the JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and adobe · acrobat · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	10.5%	Jun 11, 2009
40Plan	CVE-2009-0889No exploit	Heap-based buffer overflow in the JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and adobe · acrobat · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	10.5%	Jun 11, 2009
44Plan	CVE-2009-1420No exploit	Stack-based buffer overflow in rping in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53, when used with SNMP (aka HPOvNNM.HPOVSNMP) hp · openview network node manager pre-auth RCE	Critical10.0	—	13.4%	Jun 11, 2009
41Plan	CVE-2009-1855No exploit	Stack-based buffer overflow in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and adobe · acrobat · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	12.4%	Jun 11, 2009
41Plan	CVE-2009-1856No exploit	Integer overflow in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 badobe · acrobat · CWE-189 pre-auth RCE	Critical9.3	—	13.8%	Jun 11, 2009
44Plan	CVE-2009-0202No exploit	Array index error in FL21WIN.DLL in the PowerPoint Freelance Windows 2.1 Translator in Microsoft PowerPoint 2000 and 2002 allows remote attamicrosoft · office powerpoint · CWE-94 pre-auth RCE	Critical9.3	—	23.5%	Jun 11, 2009
24Monitor	CVE-2009-1904Proof of concept	The BigDecimal library in Ruby 1.8.6 before p369 and 1.8.7 before p173 allows context-dependent attackers to cause a denial of service (applruby-lang · ruby · CWE-189 Pre-auth Denial of service	Medium5.0	—	12.7%	Jun 11, 2009
26Monitor	CVE-2008-5515No exploit	Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathnameapache · tomcat · CWE-22 Pre-auth Path traversal	Medium5.0	—	18.6%	Jun 16, 2009
49Plan	CVE-2009-2011Weaponized	Worldweaver DX Studio Player 3.0.29.0, 3.0.22.0, 3.0.12.0, and probably other versions before 3.0.29.1, when used as a plug-in for Firefox, dxstudio · dx studio player · CWE-78 pre-auth RCE Command injection	Critical9.3	—	40.1%	Jun 16, 2009
30Monitor	CVE-2009-2146Proof of concept	Unrestricted file upload vulnerability in the Compose Email feature in the Emails module in Sugar Community Edition (aka SugarCRM) before 5.sugarcrm · sugarcrm RCE File upload	Medium6.0	—	21.3%	Jun 22, 2009
43Plan	CVE-2009-2168Proof of concept	cpanel/login.php in EgyPlus 7ammel (aka 7ml) 1.0.1 and earlier sends a redirect to the web browser but does not exit when the supplied credeegyplus · 7ammel · CWE-287 Pre-auth Auth bypass	Critical9.8	—	11.7%	Jun 22, 2009
41Plan	CVE-2009-1886Proof of concept	Multiple format string vulnerabilities in client/client.c in smbclient in Samba 3.2.0 through 3.2.12 might allow context-dependent attackerssamba · samba · CWE-134 pre-auth RCE	Critical9.3	—	12.2%	Jun 24, 2009
47Plan	CVE-2009-1394Weaponized	Stack-based buffer overflow in Motorola Timbuktu Pro 8.6.5 on Windows allows remote attackers to execute arbitrary code by sending a long mamotorola · timbuktu pro · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	33.2%	Jun 26, 2009
61This week	CVE-2009-2227Weaponized	Stack-based buffer overflow in B Labs Bopup Communication Server 3.2.26.5460 allows remote attackers to execute arbitrary code via a craftedblabsoft · bopup communication server · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	68.5%	Jun 26, 2009
33Monitor	CVE-2009-2254Proof of concept	Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/sqlpatch.php, which allows remote attackers to zen-cart · zen cart · CWE-89 pre-auth RCE SQL injection	High7.5	—	10.8%	Jun 30, 2009
36Monitor	CVE-2009-2255Proof of concept	Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/record_company.php, which allows remote attackezen-cart · zen cart · CWE-287 pre-auth RCE Auth bypass	Medium6.8	—	30.9%	Jun 30, 2009
49Plan	CVE-2009-2261Weaponized	PeaZIP 2.6.1, 2.5.1, and earlier on Windows allows user-assisted remote attackers to execute arbitrary commands via a .zip archive with a .tgiorgio tani · peazip · CWE-20 pre-auth RCE	Critical9.3	—	41.4%	Jun 30, 2009

CVE-2009-0950
46Plan
Stack-based buffer overflow in Apple iTunes before 8.2 allows remote attackers to execute arbitrary code or cause a denial of service (appli
CriticalCVSS 9.3WeaponizedEPSS 28%
- pre-auth RCE
- Memory safety
apple · itunesJun 2, 2009
CVE-2009-1902
24Monitor
The multipart processor in ModSecurity before 2.5.9 allows remote attackers to cause a denial of service (crash) via a multipart form datapo
MediumCVSS 5.0Proof of conceptEPSS 13%
- Pre-auth
- Memory safety
- Denial of service
trustwave · modsecurityJun 3, 2009
CVE-2009-1385
41Plan
Integer underflow in the e1000_clean_rx_irq function in drivers/net/e1000/e1000_main.c in the e1000 driver in the Linux kernel before 2.6.30
HighCVSS 7.8No exploitEPSS 33%
- Pre-auth
- Denial of service
linux · kernelJun 4, 2009
CVE-2009-1386
44Plan
ssl/s3_pkt.c in OpenSSL before 0.9.8i allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a
MediumCVSS 5.0WeaponizedEPSS 80%
- Pre-auth
- Memory safety
- Denial of service
openssl · opensslJun 4, 2009
CVE-2009-1387
23Monitor
The dtls1_retrieve_buffered_fragment function in ssl/d1_both.c in OpenSSL before 1.0.0 Beta 2 allows remote attackers to cause a denial of s
MediumCVSS 5.0No exploitEPSS 10%
- Pre-auth
- Memory safety
- Denial of service
openssl · opensslJun 4, 2009
CVE-2009-1916
43Plan
dig.php in GScripts.net DNS Tools allows remote attackers to execute arbitrary commands via shell metacharacters in the ns parameter.
CriticalCVSS 10.0Proof of conceptEPSS 10%
- pre-auth RCE
- Command injection
gscripts · dns toolsJun 4, 2009
CVE-2009-0033
23Monitor
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing ar
MediumCVSS 5.0No exploitEPSS 10%
- Pre-auth
- Denial of service
apache · tomcatJun 5, 2009
CVE-2009-0580
45Plan
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attacker
MediumCVSS 4.3WeaponizedEPSS 94%
- Pre-auth
- Info leak
apache · tomcatJun 5, 2009
CVE-2009-1936
52Plan
_functions.php in cpCommerce 1.2.x, possibly including 1.2.9, sends a redirect but does not exit when it is called directly, which allows re
CriticalCVSS 9.8Proof of conceptEPSS 42%
- pre-auth RCE
- Path traversal
cpcommerce project · cpcommerceJun 5, 2009
CVE-2008-6825
40Plan
Directory traversal vulnerability in user/index.php in Fonality trixbox CE 2.6.1 and earlier allows remote attackers to include and execute
MediumCVSS 6.8WeaponizedEPSS 20%
- pre-auth RCE
- Path traversal
trixbox · trixboxJun 5, 2009
CVE-2009-1943
62This week
Stack-based buffer overflow in the IKE service (ireIke.exe) in SafeNet SoftRemote before 10.8.6 allows remote attackers to execute arbitrary
CriticalCVSS 10.0WeaponizedEPSS 72%
- pre-auth RCE
- Memory safety
safenet-inc · softremoteJun 5, 2009
CVE-2009-1944
40Plan
Stack-based buffer overflow in AIMP 2.51 build 330 allows remote attackers to execute arbitrary code via an MP3 file with a long ID3 tag.
CriticalCVSS 9.3Proof of conceptEPSS 10%
- pre-auth RCE
- Memory safety
aimp · aimpJun 5, 2009
CVE-2009-1955
46Plan
The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn mod
HighCVSS 7.5Proof of conceptEPSS 52%
- Pre-auth
- Denial of service
apache · apr-utilJun 7, 2009
CVE-2009-1956
29Monitor
Off-by-one error in the apr_brigade_vprintf function in Apache APR-util before 1.3.5 on big-endian platforms allows remote attackers to obta
MediumCVSS 6.4No exploitEPSS 12%
- Pre-auth
apache · apr-utilJun 7, 2009
CVE-2009-1960
44Plan
inc/init.php in DokuWiki 2009-02-14, rc2009-02-06, and rc2009-01-30, when register_globals is enabled, allows remote attackers to include an
CriticalCVSS 9.3Proof of conceptEPSS 23%
- pre-auth RCE
dokuwiki · dokuwikiJun 7, 2009
CVE-2008-6829
40Plan
VicFTPS 5.0 allows remote attackers to cause a denial of service (crash) via a LIST command that starts with a "/\/" (forward slash, backwar
MediumCVSS 5.0WeaponizedEPSS 37%
- Pre-auth
- Denial of service
vicftps · vicftpsJun 8, 2009
CVE-2009-0949
36Monitor
The ippReadIO function in cups/ipp.c in cupsd in CUPS before 1.3.10 does not properly initialize memory for IPP request packets, which allow
HighCVSS 7.5Proof of conceptEPSS 19%
- Pre-auth
- Memory safety
- Denial of service
apple · cupsJun 9, 2009
CVE-2009-1535
59Plan
The WebDAV extension in Microsoft Internet Information Services (IIS) 5.1 and 6.0 allows remote attackers to bypass URI-based protection mec
HighCVSS 7.5WeaponizedEPSS 98%
- Pre-auth
- Auth bypass
microsoft · internet information servicesJun 10, 2009
CVE-2009-0228
46Plan
Stack-based buffer overflow in the EnumeratePrintShares function in Windows Print Spooler Service (win32spl.dll) in Microsoft Windows 2000 S
CriticalCVSS 10.0No exploitEPSS 20%
- pre-auth RCE
- Memory safety
microsoft · windows 2000Jun 10, 2009
CVE-2009-0230
46Plan
The Windows Print Spooler in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 allo
CriticalCVSS 9.0No exploitEPSS 34%
microsoft · windows 2000Jun 10, 2009
CVE-2009-0239
27Monitor
Cross-site scripting (XSS) vulnerability in Windows Search 4.0 for Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows user-assisted
MediumCVSS 4.3No exploitEPSS 32%
- Pre-auth
- XSS
microsoft · windows server 2003Jun 10, 2009
CVE-2009-0563
79This week
Stack-based buffer overflow in Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Microsoft Office for Mac 2004 and 2008; Open
HighCVSS 7.8KEVWeaponizedEPSS 59%
- RCE
- Memory safety
microsoft · officeJun 10, 2009
CVE-2009-0565
49Plan
Buffer overflow in Microsoft Office Word 2000 SP3, 2002 SP3, and 2007 SP1 and SP2; Microsoft Office for Mac 2004 and 2008; Open XML File For
CriticalCVSS 9.3Proof of conceptEPSS 40%
- pre-auth RCE
- Memory safety
microsoft · officeJun 10, 2009
CVE-2009-0568
50Plan
The RPC Marshalling Engine (aka NDR) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 20
CriticalCVSS 10.0No exploitEPSS 32%
- Pre-auth
microsoft · windows 2000Jun 10, 2009
CVE-2009-1138
52Plan
The LDAP service in Active Directory on Microsoft Windows 2000 SP4 does not properly free memory for LDAP and LDAPS requests, which allows r
CriticalCVSS 10.0No exploitEPSS 39%
- pre-auth RCE
microsoft · windows 2000Jun 10, 2009
CVE-2009-1139
43Plan
Memory leak in the LDAP service in Active Directory on Microsoft Windows 2000 SP4 and Server 2003 SP2, and Active Directory Application Mode
HighCVSS 7.8No exploitEPSS 39%
- Pre-auth
- Denial of service
microsoft · adamJun 10, 2009
CVE-2009-1533
48Plan
Buffer overflow in the Works for Windows document converters in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, Office 2007 SP1,
CriticalCVSS 9.3No exploitEPSS 35%
- pre-auth RCE
- Memory safety
microsoft · officeJun 10, 2009
CVE-2009-1699
39Monitor
The XSL stylesheet implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 throug
HighCVSS 7.5Proof of conceptEPSS 29%
- Pre-auth
- XXE
apple · safariJun 10, 2009
CVE-2009-0549
46Plan
Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac
CriticalCVSS 9.3No exploitEPSS 28%
- pre-auth RCE
microsoft · officeJun 10, 2009
CVE-2009-0557
77This week
Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Excel in 2007 Microsoft Office System
HighCVSS 7.8KEVWeaponizedEPSS 52%
- RCE
microsoft · officeJun 10, 2009
CVE-2009-0558
46Plan
Array index error in Excel in Microsoft Office 2000 SP3 and Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac, allows
CriticalCVSS 9.3No exploitEPSS 31%
- pre-auth RCE
microsoft · officeJun 10, 2009
CVE-2009-0559
46Plan
Stack-based buffer overflow in Excel in Microsoft Office 2000 SP3 and Office XP SP3 allows remote attackers to execute arbitrary code via a
CriticalCVSS 9.3No exploitEPSS 29%
- pre-auth RCE
microsoft · officeJun 10, 2009
CVE-2009-0560
45Plan
Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Excel in 2007 Microsoft Office System
CriticalCVSS 9.3No exploitEPSS 27%
- pre-auth RCE
microsoft · officeJun 10, 2009
CVE-2009-0561
48Plan
Integer overflow in Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Excel in 2007 Micr
CriticalCVSS 9.3No exploitEPSS 36%
- pre-auth RCE
microsoft · officeJun 10, 2009
CVE-2009-1122
60This week
The WebDAV extension in Microsoft Internet Information Services (IIS) 5.0 on Windows 2000 SP4 does not properly decode URLs, which allows re
HighCVSS 7.5WeaponizedEPSS 98%
- Pre-auth
- Auth bypass
microsoft · internet information servicesJun 10, 2009
CVE-2009-1123
62This week
The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 does not properly v
HighCVSS 7.8KEVWeaponizedEPSS 4%
- Local privilege escalation
microsoft · windows 2000Jun 10, 2009
CVE-2009-1134
48Plan
Excel in 2007 Microsoft Office System SP1 and SP2; Microsoft Office Excel Viewer; and Microsoft Office Compatibility Pack for Word, Excel, a
CriticalCVSS 9.3No exploitEPSS 35%
- pre-auth RCE
microsoft · officeJun 10, 2009
CVE-2009-1140
35Monitor
Microsoft Internet Explorer 5.01 SP4; 6 SP1; 6 and 7 for Windows XP SP2 and SP3; 6 and 7 for Server 2003 SP2; 7 for Vista Gold, SP1, and SP2
HighCVSS 7.1Proof of conceptEPSS 24%
- Pre-auth
- Info leak
microsoft · internet explorerJun 10, 2009
CVE-2009-1141
45Plan
Microsoft Internet Explorer 6 for Windows XP SP2 and SP3 and Server 2003 SP2 allows remote attackers to execute arbitrary code via unspecifi
CriticalCVSS 9.3No exploitEPSS 27%
- pre-auth RCE
microsoft · internet explorerJun 10, 2009
CVE-2009-1528
48Plan
Microsoft Internet Explorer 6 and 7 for Windows XP SP2 and SP3; 6 and 7 for Server 2003 SP2; 7 for Vista Gold, SP1, and SP2; and 7 for Serve
CriticalCVSS 9.3No exploitEPSS 35%
- pre-auth RCE
microsoft · internet explorerJun 10, 2009
CVE-2009-1529
41Plan
Microsoft Internet Explorer 7 for Windows XP SP2 and SP3; 7 for Server 2003 SP2; 7 for Vista Gold, SP1, and SP2; and 7 for Server 2008 SP2 d
HighCVSS 8.1No exploitEPSS 28%
- pre-auth RCE
microsoft · internet explorerJun 10, 2009
CVE-2009-1530
47Plan
Use-after-free vulnerability in Microsoft Internet Explorer 7 for Windows XP SP2 and SP3; 7 for Server 2003 SP2; 7 for Vista Gold, SP1, and
CriticalCVSS 9.3No exploitEPSS 33%
- pre-auth RCE
microsoft · internet explorerJun 10, 2009
CVE-2009-1531
48Plan
Microsoft Internet Explorer 7 for Windows XP SP2 and SP3; 7 for Server 2003 SP2; 7 for Vista Gold, SP1, and SP2; and 7 for Server 2008 SP2 a
CriticalCVSS 9.3No exploitEPSS 35%
- pre-auth RCE
microsoft · internet explorerJun 10, 2009
CVE-2009-1532
46Plan
Microsoft Internet Explorer 8 for Windows XP SP2 and SP3; 8 for Server 2003 SP2; 8 for Vista Gold, SP1, and SP2; and 8 for Server 2008 SP2 d
HighCVSS 8.8No exploitEPSS 36%
- pre-auth RCE
- Memory safety
microsoft · internet explorerJun 10, 2009
CVE-2009-0510
40Plan
Heap-based buffer overflow in the JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and
CriticalCVSS 9.3No exploitEPSS 10%
- pre-auth RCE
- Memory safety
adobe · acrobatJun 11, 2009
CVE-2009-0511
40Plan
Heap-based buffer overflow in the JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and
CriticalCVSS 9.3No exploitEPSS 10%
- pre-auth RCE
- Memory safety
adobe · acrobatJun 11, 2009
CVE-2009-0512
40Plan
Heap-based buffer overflow in the JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and
CriticalCVSS 9.3No exploitEPSS 10%
- pre-auth RCE
- Memory safety
adobe · acrobatJun 11, 2009
CVE-2009-0888
40Plan
Heap-based buffer overflow in the JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and
CriticalCVSS 9.3No exploitEPSS 10%
- pre-auth RCE
- Memory safety
adobe · acrobatJun 11, 2009
CVE-2009-0889
40Plan
Heap-based buffer overflow in the JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and
CriticalCVSS 9.3No exploitEPSS 10%
- pre-auth RCE
- Memory safety
adobe · acrobatJun 11, 2009
CVE-2009-1420
44Plan
Stack-based buffer overflow in rping in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53, when used with SNMP (aka HPOvNNM.HPOVSNMP)
CriticalCVSS 10.0No exploitEPSS 13%
- pre-auth RCE
hp · openview network node managerJun 11, 2009
CVE-2009-1855
41Plan
Stack-based buffer overflow in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and
CriticalCVSS 9.3No exploitEPSS 12%
- pre-auth RCE
- Memory safety
adobe · acrobatJun 11, 2009
CVE-2009-1856
41Plan
Integer overflow in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 b
CriticalCVSS 9.3No exploitEPSS 13%
- pre-auth RCE
adobe · acrobatJun 11, 2009
CVE-2009-0202
44Plan
Array index error in FL21WIN.DLL in the PowerPoint Freelance Windows 2.1 Translator in Microsoft PowerPoint 2000 and 2002 allows remote atta
CriticalCVSS 9.3No exploitEPSS 23%
- pre-auth RCE
microsoft · office powerpointJun 11, 2009
CVE-2009-1904
24Monitor
The BigDecimal library in Ruby 1.8.6 before p369 and 1.8.7 before p173 allows context-dependent attackers to cause a denial of service (appl
MediumCVSS 5.0Proof of conceptEPSS 12%
- Pre-auth
- Denial of service
ruby-lang · rubyJun 11, 2009
CVE-2008-5515
26Monitor
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname
MediumCVSS 5.0No exploitEPSS 18%
- Pre-auth
- Path traversal
apache · tomcatJun 16, 2009
CVE-2009-2011
49Plan
Worldweaver DX Studio Player 3.0.29.0, 3.0.22.0, 3.0.12.0, and probably other versions before 3.0.29.1, when used as a plug-in for Firefox,
CriticalCVSS 9.3WeaponizedEPSS 40%
- pre-auth RCE
- Command injection
dxstudio · dx studio playerJun 16, 2009
CVE-2009-2146
30Monitor
Unrestricted file upload vulnerability in the Compose Email feature in the Emails module in Sugar Community Edition (aka SugarCRM) before 5.
MediumCVSS 6.0Proof of conceptEPSS 21%
- RCE
- File upload
sugarcrm · sugarcrmJun 22, 2009
CVE-2009-2168
43Plan
cpanel/login.php in EgyPlus 7ammel (aka 7ml) 1.0.1 and earlier sends a redirect to the web browser but does not exit when the supplied crede
CriticalCVSS 9.8Proof of conceptEPSS 11%
- Pre-auth
- Auth bypass
egyplus · 7ammelJun 22, 2009
CVE-2009-1886
41Plan
Multiple format string vulnerabilities in client/client.c in smbclient in Samba 3.2.0 through 3.2.12 might allow context-dependent attackers
CriticalCVSS 9.3Proof of conceptEPSS 12%
- pre-auth RCE
samba · sambaJun 24, 2009
CVE-2009-1394
47Plan
Stack-based buffer overflow in Motorola Timbuktu Pro 8.6.5 on Windows allows remote attackers to execute arbitrary code by sending a long ma
CriticalCVSS 9.3WeaponizedEPSS 33%
- pre-auth RCE
- Memory safety
motorola · timbuktu proJun 26, 2009
CVE-2009-2227
61This week
Stack-based buffer overflow in B Labs Bopup Communication Server 3.2.26.5460 allows remote attackers to execute arbitrary code via a crafted
CriticalCVSS 10.0WeaponizedEPSS 68%
- pre-auth RCE
- Memory safety
blabsoft · bopup communication serverJun 26, 2009
CVE-2009-2254
33Monitor
Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/sqlpatch.php, which allows remote attackers to
HighCVSS 7.5Proof of conceptEPSS 10%
- pre-auth RCE
- SQL injection
zen-cart · zen cartJun 30, 2009
CVE-2009-2255
36Monitor
Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/record_company.php, which allows remote attacke
MediumCVSS 6.8Proof of conceptEPSS 30%
- pre-auth RCE
- Auth bypass
zen-cart · zen cartJun 30, 2009
CVE-2009-2261
49Plan
PeaZIP 2.6.1, 2.5.1, and earlier on Windows allows user-assisted remote attackers to execute arbitrary commands via a .zip archive with a .t
CriticalCVSS 9.3WeaponizedEPSS 41%
- pre-auth RCE
giorgio tani · peazipJun 30, 2009