Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: September 2009

28 records · 0 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2009-2957
    31Monitor

    Heap-based buffer overflow in the tftp_request function in tftp.c in dnsmasq before 2.50, when --enable-tftp is used, might allow remote att

    MediumCVSS 6.8Proof of conceptEPSS 12%

    thekelleys · dnsmasqSep 2, 2009

  • CVE-2009-2958
    20Monitor

    The tftp_request function in tftp.c in dnsmasq before 2.50, when --enable-tftp is used, allows remote attackers to cause a denial of service

    MediumCVSS 4.3Proof of conceptEPSS 10%

    thekelleys · dnsmasqSep 2, 2009

  • CVE-2009-2521
    45Plan

    Stack consumption vulnerability in the FTP Service in Microsoft Internet Information Services (IIS) 5.0 through 7.0 allows remote authentica

    MediumCVSS 5.0WeaponizedEPSS 82%

    microsoft · internet information servicesSep 4, 2009

  • CVE-2009-3068
    60This week

    Unrestricted file upload vulnerability in the RoboHelpServer Servlet (robohelp/server) in Adobe RoboHelp Server 8 allows remote attackers to

    CriticalCVSS 9.3WeaponizedEPSS 78%

    adobe · robohelp serverSep 4, 2009

  • CVE-2008-7182
    23Monitor

    Buffer overflow in the IMAP service in NetWin Surgemail 3.9e, and possibly other versions before 3.9g2, allows remote authenticated users to

    MediumCVSS 4.0Proof of conceptEPSS 24%

    netwin · surgemailSep 8, 2009

  • CVE-2009-3095
    24Monitor

    The mod_proxy_ftp module in the Apache HTTP Server allows remote attackers to bypass intended access restrictions and send arbitrary command

    MediumCVSS 5.0No exploitEPSS 13%

    apache · http serverSep 8, 2009

  • CVE-2009-1132
    45Plan

    Heap-based buffer overflow in the Wireless LAN AutoConfig Service (aka Wlansvc) in Microsoft Windows Vista Gold, SP1, and SP2 and Server 200

    CriticalCVSS 9.3No exploitEPSS 27%

    microsoft · windows server 2008Sep 8, 2009

  • CVE-2009-1920
    43Plan

    The JScript scripting engine 5.1, 5.6, 5.7, and 5.8 in JScript.dll in Microsoft Windows, as used in Internet Explorer, does not properly loa

    CriticalCVSS 9.3No exploitEPSS 21%

    microsoft · windows 2000Sep 8, 2009

  • CVE-2009-1925
    48Plan

    The TCP/IP implementation in Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2 does not properly manage state informat

    CriticalCVSS 10.0No exploitEPSS 27%

    microsoft · windows 2000Sep 8, 2009

  • CVE-2009-1926
    42Plan

    Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allow remote attackers t

    HighCVSS 7.8No exploitEPSS 35%

    microsoft · windows 2000Sep 8, 2009

  • CVE-2009-2498
    43Plan

    Microsoft Windows Media Format Runtime 9.0, 9.5, and 11 and Windows Media Services 9.1 and 2008 do not properly parse malformed headers in A

    CriticalCVSS 9.3No exploitEPSS 21%

    microsoft · windows media format runtimeSep 8, 2009

  • CVE-2009-2499
    39Monitor

    Microsoft Windows Media Format Runtime 9.0, 9.5, and 11; and Microsoft Media Foundation on Windows Vista Gold, SP1, and SP2 and Server 2008;

    HighCVSS 8.5No exploitEPSS 15%

    microsoft · windows media format runtimeSep 8, 2009

  • CVE-2009-2519
    45Plan

    The DHTML Editing Component ActiveX control in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 does not properly format HTML

    CriticalCVSS 9.3No exploitEPSS 25%

    microsoft · windows 2000Sep 8, 2009

  • CVE-2009-3103
    68This week

    Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold a

    CriticalCVSS 10.0WeaponizedEPSS 92%

    microsoft · windows server 2008Sep 8, 2009

  • CVE-2009-3111
    23Monitor

    The rad_decode function in FreeRADIUS before 1.1.8 allows remote attackers to cause a denial of service (radiusd crash) via zero-length Tunn

    MediumCVSS 5.0Proof of conceptEPSS 11%

    freeradius · freeradiusSep 9, 2009

  • CVE-2009-3115
    23Monitor

    SolarWinds TFTP Server 9.2.0.111 and earlier allows remote attackers to cause a denial of service (service stop) via a crafted Option Acknow

    MediumCVSS 5.0Proof of conceptEPSS 10%

    solarwinds · tftp serverSep 9, 2009

  • CVE-2009-3170
    42Plan

    Stack-based buffer overflow in AIMP2 Audio Converter 2.53 (build 330) and earlier allows remote attackers to cause a denial of service (cras

    CriticalCVSS 9.3Proof of conceptEPSS 15%

    aimp · aimp2 audio converterSep 11, 2009

  • CVE-2007-6731
    44Plan

    Extended Module Player (XMP) 2.5.1 and earlier allow remote attackers to execute arbitrary code via an OXM file with a negative value, which

    CriticalCVSS 10.0Proof of conceptEPSS 14%

    claudio matsuoka · extended module playerSep 13, 2009

  • CVE-2008-7220
    34Monitor

    Unspecified vulnerability in Prototype JavaScript framework (prototypejs) before 1.6.0.2 allows attackers to make "cross-site ajax requests"

    HighCVSS 7.5Proof of conceptEPSS 13%

    prototypejs · prototypeSep 13, 2009

  • CVE-2008-7232
    47Plan

    Buffer overflow in the report function in xtacacsd 4.1.2 and earlier allows remote attackers to execute arbitrary code via a crafted CONNECT

    CriticalCVSS 10.0WeaponizedEPSS 24%

    netplex-tech · xtacacsdSep 14, 2009

  • CVE-2009-2629
    53Plan

    Buffer underflow in src/http/ngx_http_parse.c in nginx 0.1.0 through 0.5.37, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.

    HighCVSS 7.5Proof of conceptEPSS 75%

    f5 · nginxSep 15, 2009

  • CVE-2009-3214
    46Plan

    Multiple stack-based buffer overflows in Photodex ProShow Gold 4.0.2549 allow remote attackers to execute arbitrary code via a crafted Slide

    CriticalCVSS 9.3WeaponizedEPSS 30%

    photodex · proshow goldSep 16, 2009

  • CVE-2009-3244
    43Plan

    Heap-based buffer overflow in the SwDir.dll ActiveX control in Adobe Shockwave Player 11.5.1.601 and earlier allows remote attackers to caus

    CriticalCVSS 9.3Proof of conceptEPSS 20%

    adobe · shockwave playerSep 18, 2009

  • CVE-2009-3250
    39Monitor

    The saveForwardAttachments procedure in the Compose Mail functionality in vtiger CRM 5.0.4 allows remote authenticated users to execute arbi

    CriticalCVSS 9.0Proof of conceptEPSS 10%

    vtiger · vtiger crmSep 18, 2009

  • CVE-2009-3267
    25Monitor

    Microsoft Internet Explorer 6 through 6.0.2900.2180, and 7.0.6000.16711, allows remote attackers to cause a denial of service (CPU consumpti

    MediumCVSS 5.0No exploitEPSS 15%

    microsoft · internet explorerSep 18, 2009

  • CVE-2009-3270
    28Monitor

    Microsoft Internet Explorer 7 through 7.0.6000.16711 allows remote attackers to cause a denial of service (unusable browser) by calling the

    MediumCVSS 5.0Proof of conceptEPSS 28%

    microsoft · internet explorerSep 18, 2009

  • CVE-2009-3429
    48Plan

    Stack-based buffer overflow in Pirate Radio Destiny Media Player 1.61 allows remote attackers to execute arbitrary code via a long string in

    CriticalCVSS 9.3WeaponizedEPSS 35%

    pirateradio · destiny media playerSep 25, 2009

  • CVE-2009-3431
    27Monitor

    Stack consumption vulnerability in Adobe Reader and Acrobat 9.1.3, 9.1.2, 9.1.1, and earlier 9.x versions; 8.1.6 and earlier 8.x versions; a

    MediumCVSS 5.0Proof of conceptEPSS 21%

    adobe · acrobatSep 25, 2009