Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: July 2009

50 records · 2 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2009-0689
    35Monitor

    Array index error in the (1) dtoa implementation in dtoa.c (aka pdtoa.c) and the (2) gdtoa (aka new dtoa) implementation in gdtoa/misc.c in

    MediumCVSS 6.8Proof of conceptEPSS 28%

    k-meleon project · k-meleonJul 1, 2009

  • CVE-2009-2288
    55Plan

    statuswml.cgi in Nagios before 3.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) ping or (2) T

    HighCVSS 7.5WeaponizedEPSS 83%

    nagios · nagiosJul 1, 2009

  • CVE-2009-1890
    33Monitor

    The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is c

    HighCVSS 7.1No exploitEPSS 16%

    apache · http serverJul 5, 2009

  • CVE-2009-2265
    55Plan

    Multiple directory traversal vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to create executable files in arbitrary dire

    HighCVSS 7.5WeaponizedEPSS 83%

    fckeditor · fckeditorJul 5, 2009

  • CVE-2008-0015
    88Now

    Stack-based buffer overflow in the CComVariant::ReadFromStream function in the Active Template Library (ATL), as used in the MPEG2TuneReques

    HighCVSS 8.8KEVWeaponizedEPSS 76%

    microsoft · windows 2003 serverJul 7, 2009

  • CVE-2008-0020
    46Plan

    Unspecified vulnerability in the Load method in the IPersistStreamInit interface in the Active Template Library (ATL), as used in the Micros

    CriticalCVSS 9.3No exploitEPSS 30%

    microsoft · windows 2003 serverJul 7, 2009

  • CVE-2009-2350
    21Monitor

    Microsoft Internet Explorer 6.0.2900.2180 and earlier does not block javascript: URIs in Refresh headers in HTTP responses, which allows rem

    MediumCVSS 4.3Proof of conceptEPSS 14%

    microsoft · internet explorerJul 7, 2009

  • CVE-2009-2364
    40Plan

    Stack-based buffer overflow in Mp3-Nator 2.0 allows remote attackers to execute arbitrary code via (1) a long string in a .plf file and (2)

    CriticalCVSS 9.3Proof of conceptEPSS 10%

    mp3-nator · mp3-natorJul 8, 2009

  • CVE-2009-2367
    60This week

    cgi-bin/makecgi-pro in Iomega StorCenter Pro generates predictable session IDs, which allows remote attackers to hijack active sessions and

    CriticalCVSS 9.8WeaponizedEPSS 23%

    iomega · storcenter pro firmwareJul 8, 2009

  • CVE-2009-1891
    33Monitor

    The mod_deflate module in Apache httpd 2.2.11 and earlier compresses large files until completion even after the associated network connecti

    HighCVSS 7.1No exploitEPSS 17%

    apache · http serverJul 10, 2009

  • CVE-2009-2335
    46Plan

    WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists,

    MediumCVSS 5.0WeaponizedEPSS 85%

    wordpress · wordpressJul 10, 2009

  • CVE-2009-2433
    23Monitor

    Stack-based buffer overflow in the AddFavorite method in Microsoft Internet Explorer allows remote attackers to cause a denial of service (a

    MediumCVSS 4.3Proof of conceptEPSS 18%

    microsoft · ieJul 10, 2009

  • CVE-2009-2446
    37Monitor

    Multiple format string vulnerabilities in the dispatch_command function in libmysqld/sql_parse.cc in mysqld in MySQL 4.0.0 through 5.0.83 al

    HighCVSS 8.5Proof of conceptEPSS 10%

    mysql · mysqlJul 13, 2009

  • CVE-2009-0192
    24Monitor

    Off-by-one error in the iMonitor component in Novell eDirectory 8.8 SP3, 8.8 SP3 FTF3, and possibly other versions allows remote attackers t

    MediumCVSS 5.0Proof of conceptEPSS 12%

    novell · edirectoryJul 14, 2009

  • CVE-2009-0692
    48Plan

    Stack-based buffer overflow in the script_write_params method in client/dhclient.c in ISC DHCP dhclient 4.1 before 4.1.0p1, 4.0 before 4.0.1

    CriticalCVSS 10.0Proof of conceptEPSS 25%

    isc · dhcpJul 14, 2009

  • CVE-2009-1019
    33Monitor

    Unspecified vulnerability in the Network Authentication component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.4, and 11.1.0.7 al

    HighCVSS 7.5Proof of conceptEPSS 10%

    oracle · database serverJul 14, 2009

  • CVE-2009-1020
    39Monitor

    Unspecified vulnerability in the Network Foundation component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.4, and 11.1.0.7 allows

    CriticalCVSS 9.0Proof of conceptEPSS 10%

    oracle · database serverJul 14, 2009

  • CVE-2009-1968
    29Monitor

    Unspecified vulnerability in the Secure Enterprise Search component in Oracle Database 10.1.8.3 allows remote attackers to affect integrity

    MediumCVSS 4.3Proof of conceptEPSS 40%

    oracle · database serverJul 14, 2009

  • CVE-2009-1970
    24Monitor

    Unspecified vulnerability in the Listener component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.4, and 11.1.0.7 allows remote at

    MediumCVSS 5.0Proof of conceptEPSS 12%

    oracle · database serverJul 14, 2009

  • CVE-2009-1977
    62This week

    Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.2.0.3 allows remote attackers to affect confident

    CriticalCVSS 10.0WeaponizedEPSS 72%

    oracle · secure backupJul 14, 2009

  • CVE-2009-1978
    55Plan

    Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.2.0.3 allows remote attackers to affect confident

    CriticalCVSS 9.0WeaponizedEPSS 64%

    oracle · secure backupJul 14, 2009

  • CVE-2009-0231
    46Plan

    The Embedded OpenType (EOT) Font Engine (T2EMBED.DLL) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and S

    HighCVSS 8.8No exploitEPSS 37%

    microsoft · windows 2000Jul 15, 2009

  • CVE-2009-0232
    45Plan

    Integer overflow in the Embedded OpenType (EOT) Font Engine in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1,

    CriticalCVSS 9.3No exploitEPSS 25%

    microsoft · windows 2000Jul 15, 2009

  • CVE-2009-0566
    46Plan

    Microsoft Office Publisher 2007 SP1 does not properly calculate object handler data for Publisher files, which allows remote attackers to ex

    CriticalCVSS 9.3No exploitEPSS 28%

    microsoft · office publisherJul 15, 2009

  • CVE-2009-1135
    44Plan

    Microsoft Internet Security and Acceleration (ISA) Server 2006 Gold and SP1, when Radius OTP is enabled, uses the HTTP-Basic authentication

    CriticalCVSS 9.0No exploitEPSS 26%

    microsoft · isa serverJul 15, 2009

  • CVE-2009-1136
    56Plan

    The Microsoft Office Web Components Spreadsheet ActiveX control (aka OWC10 or OWC11), as distributed in Office XP SP3 and Office 2003 SP3, O

    CriticalCVSS 9.3WeaponizedEPSS 62%

    microsoft · isa serverJul 15, 2009

  • CVE-2009-1538
    45Plan

    The QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and

    CriticalCVSS 9.3No exploitEPSS 26%

    microsoft · directxJul 15, 2009

  • CVE-2009-1539
    45Plan

    The QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and

    CriticalCVSS 9.3No exploitEPSS 25%

    microsoft · directxJul 15, 2009

  • CVE-2009-2477
    50Plan

    js/src/jstracer.cpp in the Just-in-time (JIT) JavaScript compiler (aka TraceMonkey) in Mozilla Firefox 3.5 before 3.5.1 allows remote attack

    CriticalCVSS 9.3WeaponizedEPSS 42%

    mozilla · firefoxJul 15, 2009

  • CVE-2009-2479
    35Monitor

    Mozilla Firefox 3.0.x, 3.5, and 3.5.1 on Windows allows remote attackers to cause a denial of service (uncaught exception and application cr

    HighCVSS 7.8Proof of conceptEPSS 12%

    mozilla · firefoxJul 16, 2009

  • CVE-2009-2484
    48Plan

    Stack-based buffer overflow in the Win32AddConnection function in modules/access/smb.c in VideoLAN VLC media player 0.9.9, when running on M

    CriticalCVSS 9.3WeaponizedEPSS 35%

    videolan · vlc media playerJul 16, 2009

  • CVE-2009-2485
    54Plan

    Stack-based buffer overflow in HT-MP3Player 1.0 allows remote attackers to execute arbitrary code via a long string in a .ht3 file.

    CriticalCVSS 9.3WeaponizedEPSS 58%

    tingan · ht-mp3playerJul 16, 2009

  • CVE-2009-2536
    23Monitor

    Microsoft Internet Explorer 5 through 8 allows remote attackers to cause a denial of service (memory consumption and application crash) via

    MediumCVSS 4.3No exploitEPSS 19%

    microsoft · internet explorerJul 20, 2009

  • CVE-2009-2566
    46Plan

    Stack-based buffer overflow in TFM MMPlayer 2.0, and possibly 2.0.0.30, allows remote attackers to execute arbitrary code via a long string

    CriticalCVSS 9.3WeaponizedEPSS 31%

    tfm · mmplayerJul 21, 2009

  • CVE-2009-2570
    41Plan

    Stack-based buffer overflow in the Symantec.FaxViewerControl.1 ActiveX control in WinFax\DCCFAXVW.DLL in Symantec WinFax Pro 10.03 allows re

    CriticalCVSS 9.3Proof of conceptEPSS 11%

    symantec · winfax proJul 22, 2009

  • CVE-2009-2464
    44Plan

    The nsXULTemplateQueryProcessorRDF::CheckIsSeparator function in Mozilla Firefox before 3.0.12, SeaMonkey 2.0a1pre, and Thunderbird allows r

    CriticalCVSS 10.0Proof of conceptEPSS 13%

    mozilla · firefoxJul 22, 2009

  • CVE-2009-2576
    24Monitor

    Microsoft Internet Explorer 6.0.2900.2180 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via

    MediumCVSS 5.0No exploitEPSS 14%

    microsoft · ieJul 22, 2009

  • CVE-2009-1862
    67This week

    Unspecified vulnerability in Adobe Reader and Acrobat 9.x through 9.1.2, and Adobe Flash Player 9.x through 9.0.159.0 and 10.x through 10.0.

    HighCVSS 7.8KEVWeaponizedEPSS 21%

    adobe · acrobatJul 23, 2009

  • CVE-2009-2621
    27Monitor

    Squid 3.0 through 3.0.STABLE16 and 3.1 through 3.1.0.11 does not properly enforce "buffer limits and related bound checks," which allows rem

    MediumCVSS 5.0No exploitEPSS 23%

    squid-cache · squidJul 28, 2009

  • CVE-2009-2622
    37Monitor

    Squid 3.0 through 3.0.STABLE16 and 3.1 through 3.1.0.11 allows remote attackers to cause a denial of service via malformed requests includin

    MediumCVSS 5.0No exploitEPSS 56%

    squid-cache · squidJul 28, 2009

  • CVE-2009-0696
    21Monitor

    The dns_db_findrdataset function in db.c in named in ISC BIND 9.4 before 9.4.3-P3, 9.5 before 9.5.1-P3, and 9.6 before 9.6.1-P1, when config

    MediumCVSS 4.3Proof of conceptEPSS 12%

    isc · bindJul 29, 2009

  • CVE-2009-0901
    46Plan

    The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold, and Visual C++ 2005 SP1 an

    HighCVSS 8.8No exploitEPSS 36%

    microsoft · visual c\+\+Jul 29, 2009

  • CVE-2009-1917
    45Plan

    Microsoft Internet Explorer 6 SP1; Internet Explorer 6 for Windows XP SP2 and SP3 and Server 2003 SP2; and Internet Explorer 7 and 8 for Win

    CriticalCVSS 9.3No exploitEPSS 27%

    microsoft · internet explorerJul 29, 2009

  • CVE-2009-1918
    53Plan

    Microsoft Internet Explorer 5.01 SP4 and 6 SP1; Internet Explorer 6 for Windows XP SP2 and SP3 and Server 2003 SP2; and Internet Explorer 7

    CriticalCVSS 10.0No exploitEPSS 43%

    microsoft · internet explorerJul 29, 2009

  • CVE-2009-1919
    47Plan

    Microsoft Internet Explorer 5.01 SP4 and 6 SP1; Internet Explorer 6 for Windows XP SP2 and SP3 and Server 2003 SP2; and Internet Explorer 7

    CriticalCVSS 9.3No exploitEPSS 34%

    microsoft · internet explorerJul 29, 2009

  • CVE-2009-2493
    46Plan

    The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 200

    HighCVSS 8.8No exploitEPSS 37%

    microsoft · visual c\+\+Jul 29, 2009

  • CVE-2009-2495
    36Monitor

    The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 200

    MediumCVSS 6.5No exploitEPSS 34%

    microsoft · visual c\+\+Jul 29, 2009

  • CVE-2009-2650
    46Plan

    Heap-based buffer overflow in Sorcerer Software MultiMedia Jukebox 4.0 Build 020124 allows remote attackers to cause a denial of service (ap

    CriticalCVSS 9.3WeaponizedEPSS 30%

    sorcerersoftware · multimedia jukeboxJul 30, 2009

  • CVE-2009-1868
    43Plan

    Heap-based buffer overflow in Adobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.18, and Adobe AIR before 1.5.2, allows attackers t

    CriticalCVSS 9.3Proof of conceptEPSS 21%

    adobe · airJul 31, 2009

  • CVE-2009-1869
    43Plan

    Integer overflow in the ActionScript Virtual Machine 2 (AVM2) abcFile parser in Adobe Flash Player before 9.0.246.0 and 10.x before 10.0.32.

    CriticalCVSS 9.3Proof of conceptEPSS 19%

    adobe · airJul 31, 2009