Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: August 2009

37 records · 1 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2009-2655
    24Monitor

    mshtml.dll in Microsoft Internet Explorer 7 and 8 on Windows XP SP3 allows remote attackers to cause a denial of service (application crash)

    MediumCVSS 4.3Proof of conceptEPSS 22%

    microsoft · internet explorerAug 3, 2009

  • CVE-2009-2668
    35Monitor

    Microsoft Internet Explorer 6 through 6.0.2900.2180 and 7 through 7.0.6000.16473 allows remote attackers to cause a denial of service (CPU c

    HighCVSS 7.8No exploitEPSS 14%

    microsoft · internet explorerAug 5, 2009

  • CVE-2008-6898
    47Plan

    Buffer overflow in the XHTTP Module 4.1.0.0 in the ActiveX control for SaschArt SasCam Webcam Server 2.6.5 allows remote attackers to cause

    CriticalCVSS 9.3WeaponizedEPSS 31%

    saschart · sascam webcam serverAug 5, 2009

  • CVE-2008-6904
    43Plan

    Multiple unspecified vulnerabilities in Sophos SAVScan 4.33.0 for Linux, and possibly other products and versions, allow remote attackers to

    CriticalCVSS 10.0No exploitEPSS 10%

    sophos · anti-virusAug 5, 2009

  • CVE-2009-2412
    44Plan

    Multiple integer overflows in the Apache Portable Runtime (APR) library and the Apache Portable Utility library (aka APR-util) 0.9.x and 1.3

    CriticalCVSS 10.0No exploitEPSS 13%

    apache · apr-utilAug 6, 2009

  • CVE-2009-2625
    29Monitor

    XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0

    MediumCVSS 5.0No exploitEPSS 30%

    apache · xerces2 javaAug 6, 2009

  • CVE-2009-2727
    45Plan

    Stack-based buffer overflow in the _tt_internal_realpath function in the ToolTalk library (libtt.a) in IBM AIX 5.2.0, 5.3.0, 5.3.7 through 5

    CriticalCVSS 9.3WeaponizedEPSS 26%

    ibm · aixAug 10, 2009

  • CVE-2008-6938
    25Monitor

    Pi3Web 2.0.3 before PL2, when installed on Windows as a desktop application and without using the Pi3Web/Conf/Intenet.pi3, allows remote att

    MediumCVSS 4.3WeaponizedEPSS 26%

    holger zimmermann · pi3webAug 11, 2009

  • CVE-2009-0562
    45Plan

    The Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2003 SP3, Office XP Web Components SP3, Office 2003 Web Compone

    CriticalCVSS 9.3No exploitEPSS 25%

    microsoft · isa serverAug 12, 2009

  • CVE-2009-1133
    46Plan

    Heap-based buffer overflow in Microsoft Remote Desktop Connection (formerly Terminal Services Client) running RDP 5.0 through 6.1 on Windows

    CriticalCVSS 9.3No exploitEPSS 30%

    microsoft · windows 2000Aug 12, 2009

  • CVE-2009-1534
    52Plan

    Buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2000 Web Components SP3, Office XP Web Compo

    CriticalCVSS 9.3WeaponizedEPSS 51%

    microsoft · biztalk serverAug 12, 2009

  • CVE-2009-1536
    25Monitor

    ASP.NET in Microsoft .NET Framework 2.0 SP1 and SP2 and 3.5 Gold and SP1, when ASP 2.0 is used in integrated mode on IIS 7.0, does not prope

    LowCVSS 2.6No exploitEPSS 51%

    microsoft · .net frameworkAug 12, 2009

  • CVE-2009-1544
    41Plan

    Double free vulnerability in the Workstation service in Microsoft Windows allows remote authenticated users to gain privileges via a crafted

    HighCVSS 8.8No exploitEPSS 20%

    microsoft · windows 2003 serverAug 12, 2009

  • CVE-2009-1545
    46Plan

    Unspecified vulnerability in Avifil32.dll in the Windows Media file handling functionality in Microsoft Windows 2000 SP4, XP SP2 and SP3, Se

    CriticalCVSS 9.3No exploitEPSS 28%

    microsoft · windows 2003 serverAug 12, 2009

  • CVE-2009-1546
    41Plan

    Integer overflow in Avifil32.dll in the Windows Media file handling functionality in Microsoft Windows allows remote attackers to execute ar

    HighCVSS 8.5No exploitEPSS 22%

    microsoft · windows 2003 serverAug 12, 2009

  • CVE-2009-1923
    44Plan

    Heap-based buffer overflow in the Windows Internet Name Service (WINS) component for Microsoft Windows 2000 SP4 and Server 2003 SP2 allows r

    CriticalCVSS 9.3No exploitEPSS 24%

    microsoft · windows 2000Aug 12, 2009

  • CVE-2009-1929
    47Plan

    Heap-based buffer overflow in the Microsoft Terminal Services Client ActiveX control running RDP 6.1 on Windows XP SP2, Vista SP1 or SP2, or

    CriticalCVSS 9.3No exploitEPSS 34%

    microsoft · windows 2003 serverAug 12, 2009

  • CVE-2009-1930
    52Plan

    The Telnet service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 al

    CriticalCVSS 10.0No exploitEPSS 41%

    microsoft · windows 2000Aug 12, 2009

  • CVE-2009-2494
    52Plan

    The Active Template Library (ATL) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008

    CriticalCVSS 9.8No exploitEPSS 42%

    microsoft · windows 2000Aug 12, 2009

  • CVE-2009-2496
    46Plan

    Heap-based buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2003 SP3, Office XP Web Component

    CriticalCVSS 9.3No exploitEPSS 29%

    microsoft · biztalk serverAug 12, 2009

  • CVE-2009-2195
    41Plan

    Buffer overflow in WebKit in Apple Safari before 4.0.3 allows remote attackers to execute arbitrary code or cause a denial of service (appli

    CriticalCVSS 9.3Proof of conceptEPSS 13%

    apple · mac os xAug 12, 2009

  • CVE-2009-2762
    36Monitor

    wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the database, possibly t

    HighCVSS 7.5Proof of conceptEPSS 19%

    wordpress · wordpressAug 13, 2009

  • CVE-2009-2692
    35Monitor

    The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socket operations in prot

    HighCVSS 7.8WeaponizedEPSS 14%

    linux · linux kernelAug 14, 2009

  • CVE-2009-2764
    23Monitor

    Microsoft Internet Explorer 8.0.7100.0 on Windows 7 RC on the x64 platform allows remote attackers to cause a denial of service (application

    MediumCVSS 5.0Proof of conceptEPSS 11%

    microsoft · internet explorerAug 14, 2009

  • CVE-2009-2765
    58Plan

    httpd.c in httpd in the management GUI in DD-WRT 24 sp1, and other versions before build 12533, allows remote attackers to execute arbitrary

    HighCVSS 8.3WeaponizedEPSS 82%

    dd-wrt · dd-wrtAug 14, 2009

  • CVE-2009-2855
    30Monitor

    The strListGetItem function in src/HttpHeaderTools.c in Squid 2.7 allows remote attackers to cause a denial of service via a crafted auth he

    MediumCVSS 5.0No exploitEPSS 34%

    squid-cache · squidAug 18, 2009

  • CVE-2009-1872
    22Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in Adobe ColdFusion Server 8.0.1, 8, and earlier allow remote attackers to inject arbitr

    MediumCVSS 4.3Proof of conceptEPSS 16%

    adobe · coldfusionAug 18, 2009

  • CVE-2008-6994
    40Plan

    Stack-based buffer overflow in the SaveAs feature (SaveFileAsWithFilter function) in win_util.cc in Google Chrome 0.2.149.27 allows user-ass

    CriticalCVSS 9.3Proof of conceptEPSS 10%

    google · chromeAug 19, 2009

  • CVE-2009-2055
    54Plan

    Cisco IOS XR 3.4.0 through 3.8.1 allows remote attackers to cause a denial of service (session reset) via a BGP UPDATE message with an inval

    MediumCVSS 5.9KEVWeaponizedEPSS 3%

    cisco · ios xrAug 19, 2009

  • CVE-2009-2694
    46Plan

    The msn_slplink_process_msg function in libpurple/protocols/msn/slplink.c in libpurple, as used in Pidgin (formerly Gaim) before 2.5.9 and A

    CriticalCVSS 10.0Proof of conceptEPSS 20%

    pidgin · pidginAug 21, 2009

  • CVE-2009-2934
    40Plan

    Multiple stack-based buffer overflows in xaudio.dll in Programmed Integration PIPL 2.5.0 and 2.5.0D allow remote attackers to execute arbitr

    CriticalCVSS 9.3Proof of conceptEPSS 10%

    programmedintegration · piplAug 21, 2009

  • CVE-2009-2954
    24Monitor

    Microsoft Internet Explorer 6.0.2900.2180 and earlier allows remote attackers to cause a denial of service (CPU consumption and application

    MediumCVSS 5.0No exploitEPSS 13%

    microsoft · internet explorerAug 24, 2009

  • CVE-2009-3003
    20Monitor

    Microsoft Internet Explorer 6 through 8 allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an ar

    MediumCVSS 4.3No exploitEPSS 10%

    microsoft · internet explorerAug 28, 2009

  • CVE-2008-7126
    43Plan

    Integer overflow in osagent.exe in Borland VisiBroker Smart Agent 08.00.00.C1.03 and earlier allows remote attackers to cause a denial of se

    CriticalCVSS 10.0Proof of conceptEPSS 10%

    microfocus · visibrokerAug 31, 2009

  • CVE-2009-3019
    25Monitor

    Microsoft Internet Explorer 6 on Windows XP SP2 and SP3, and Internet Explorer 7 on Vista, allows remote attackers to cause a denial of serv

    MediumCVSS 5.0Proof of conceptEPSS 17%

    microsoft · internet explorerAug 31, 2009

  • CVE-2009-3020
    33Monitor

    win32k.sys in Microsoft Windows Server 2003 SP2 allows remote attackers to cause a denial of service (system crash) by referencing a crafted

    HighCVSS 7.1Proof of conceptEPSS 16%

    microsoft · windows server 2003Aug 31, 2009

  • CVE-2009-3023
    63This week

    Buffer overflow in the FTP Service in Microsoft Internet Information Services (IIS) 5.0 through 6.0 allows remote authenticated users to exe

    CriticalCVSS 9.0WeaponizedEPSS 90%

    microsoft · internet information serverAug 31, 2009