By publication date

Exploited and new serious CVEs: October 2009

45 records · 1 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
40Plan	CVE-2009-3591Weaponized	Dopewars 1.5.12 allows remote attackers to cause a denial of service (segmentation fault) via a REQUESTJET message with an invalid location.ben webb · dopewars · CWE-20 Pre-auth Denial of service	Medium5.0	—	52.8%	Oct 8, 2009
44Plan	CVE-2009-3663Proof of concept	Format string vulnerability in the h_readrequest function in http.c in httpdx Web Server 1.4 allows remote attackers to cause a denial of sejasper · httpdx · CWE-134 pre-auth RCE	Critical10.0	—	14.6%	Oct 11, 2009
34Monitor	CVE-2009-2699No exploit	The Solaris pollset feature in the Event Port backend in poll/unix/port.c in the Apache Portable Runtime (APR) library before 1.3.9, as usedapache · http server · CWE-667 Pre-auth Denial of service	High7.5	—	14.1%	Oct 13, 2009
91Now	CVE-2009-3459Weaponized	Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to exeadobe · acrobat · CWE-119 pre-auth RCE Memory safety	High8.8	KEV	86.6%	Oct 13, 2009
49Plan	CVE-2009-3693Weaponized	Directory traversal vulnerability in the Persits.XUpload.2 ActiveX control (XUpload.ocx) in HP LoadRunner 9.5 allows remote attackers to crepersits · xupload · CWE-22 Pre-auth Path traversal	Critical9.3	—	41.5%	Oct 13, 2009
43Plan	CVE-2009-0090No exploit	Microsoft .NET Framework 1.0 SP3, 1.1 SP1, and 2.0 SP1 does not properly validate .NET verifiable code, which allows remote attackers to obtmicrosoft · windows 2000 · CWE-264 pre-auth RCE	Critical9.3	—	20.9%	Oct 14, 2009
45Plan	CVE-2009-0091No exploit	Microsoft .NET Framework 2.0, 2.0 SP1, and 3.5 does not properly enforce a certain type-equality constraint in .NET verifiable code, which amicrosoft · windows 2000 · CWE-94 pre-auth RCE	Critical9.3	—	25.8%	Oct 14, 2009
45Plan	CVE-2009-0555No exploit	Microsoft Windows Media Runtime, as used in DirectShow WMA Voice Codec, Windows Media Audio Voice Decoder, and Audio Compression Manager (ACmicrosoft · windows 2000 · CWE-94 pre-auth RCE	Critical9.3	—	27.0%	Oct 14, 2009
46Plan	CVE-2009-1547Proof of concept	Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via a cmicrosoft · internet explorer · CWE-94 pre-auth RCE	High8.8	—	37.4%	Oct 14, 2009
44Plan	CVE-2009-2497No exploit	The Common Language Runtime (CLR) in Microsoft .NET Framework 2.0, 2.0 SP1, 2.0 SP2, 3.5, and 3.5 SP1, and Silverlight 2, does not properly microsoft · windows 2000 · CWE-94 pre-auth RCE	Critical9.3	—	23.2%	Oct 14, 2009
44Plan	CVE-2009-2500No exploit	Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Officemicrosoft · windows 2003 server · CWE-189 pre-auth RCE	Critical9.3	—	23.6%	Oct 14, 2009
45Plan	CVE-2009-2501No exploit	Heap-based buffer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsmicrosoft · windows 2003 server · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	26.7%	Oct 14, 2009
39Monitor	CVE-2009-2502No exploit	Buffer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office microsoft · windows 2003 server · CWE-119 pre-auth RCE Memory safety	High8.1	—	22.0%	Oct 14, 2009
44Plan	CVE-2009-2503No exploit	GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Windows Server 2003 SP2, Office XP SP3, Office 2003 SP3, 2007 Microsoft Omicrosoft · windows 2003 server · CWE-94 pre-auth RCE	Critical9.3	—	22.2%	Oct 14, 2009
43Plan	CVE-2009-2504No exploit	Multiple integer overflows in unspecified APIs in GDI+ in Microsoft .NET Framework 1.1 SP1, .NET Framework 2.0 SP1 and SP2, Windows XP SP2 amicrosoft · windows 2003 server · CWE-189 Pre-auth	Critical9.3	—	20.9%	Oct 14, 2009
43Plan	CVE-2009-2507No exploit	A certain ActiveX control in the Indexing Service in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 does not properly procemicrosoft · windows 2000 pre-auth RCE	Critical9.3	—	19.2%	Oct 14, 2009
34Monitor	CVE-2009-2511Proof of concept	Integer overflow in the CryptoAPI component in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gomicrosoft · windows 2000 · CWE-189 Pre-auth	High7.5	—	12.9%	Oct 14, 2009
44Plan	CVE-2009-2518No exploit	Integer overflow in GDI+ in Microsoft Office XP SP3 allows remote attackers to execute arbitrary code via an Office document with a bitmap (microsoft · office · CWE-189 pre-auth RCE	Critical9.3	—	22.6%	Oct 14, 2009
39Monitor	CVE-2009-2524No exploit	Integer underflow in the NTLM authentication feature in the Local Security Authority Subsystem Service (LSASS) in Microsoft Windows XP SP2 amicrosoft · windows 2003 server · CWE-189 Pre-auth Denial of service	High7.8	—	28.2%	Oct 14, 2009
44Plan	CVE-2009-2525No exploit	Microsoft Windows Media Runtime, as used in DirectShow WMA Voice Codec, Windows Media Audio Voice Decoder, and Audio Compression Manager (ACmicrosoft · windows 2000 · CWE-94 pre-auth RCE	Critical9.3	—	23.3%	Oct 14, 2009
56Plan	CVE-2009-2526Proof of concept	Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2 do not properly validate fields in SMBv2 packets, which allows remotmicrosoft · windows server 2008 · CWE-399 Pre-auth Denial of service	High7.8	—	81.8%	Oct 14, 2009
45Plan	CVE-2009-2527No exploit	Heap-based buffer overflow in Microsoft Windows Media Player 6.4 allows remote attackers to execute arbitrary code via (1) a crafted ASF filmicrosoft · windows 2000 · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	26.9%	Oct 14, 2009
43Plan	CVE-2009-2528No exploit	GDI+ in Microsoft Office XP SP3 does not properly handle malformed objects in Office Art Property Tables, which allows remote attackers to emicrosoft · windows 2003 server · CWE-94 pre-auth RCE	Critical9.3	—	20.4%	Oct 14, 2009
38Monitor	CVE-2009-2529No exploit	Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, 7, and 8 does not properly handle argument validation for unspecified variables, which allowmicrosoft · internet explorer · CWE-94 pre-auth RCE	High8.1	—	19.5%	Oct 14, 2009
44Plan	CVE-2009-2530No exploit	Microsoft Internet Explorer 6, 6 SP1, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrarmicrosoft · internet explorer · CWE-94 pre-auth RCE	Critical9.3	—	22.9%	Oct 14, 2009
44Plan	CVE-2009-2531No exploit	Microsoft Internet Explorer 6, 6 SP1, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrarmicrosoft · internet explorer · CWE-94 pre-auth RCE	Critical9.3	—	22.9%	Oct 14, 2009
59Plan	CVE-2009-2532Proof of concept	Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold and SP2, and Windows 7 RC do not properly process the command value in microsoft · windows server 2008 · CWE-94 pre-auth RCE	Critical10.0	—	62.1%	Oct 14, 2009
44Plan	CVE-2009-3126No exploit	Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Officemicrosoft · windows 2003 server · CWE-189 pre-auth RCE	Critical9.3	—	23.4%	Oct 14, 2009
59Plan	CVE-2009-3699Weaponized	Stack-based buffer overflow in libcsa.a (aka the calendar daemon library) in IBM AIX 5.x through 5.3.10 and 6.x through 6.1.3, and VIOS 2.1 ibm · vios · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	62.3%	Oct 15, 2009
23Monitor	CVE-2009-3707Proof of concept	VMware Authentication Daemon 1.0 in vmware-authd.exe in the VMware Authorization Service in VMware Workstation 7.0 before 7.0.1 build 227600vmware · ace · CWE-134 Pre-auth Denial of service	Medium5.0	—	11.1%	Oct 16, 2009
59Plan	CVE-2009-3711Weaponized	Stack-based buffer overflow in the h_handlepeer function in http.cpp in httpdx 1.4, and possibly 1.4.3, allows remote attackers to cause a djasper · httpdx · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	63.9%	Oct 16, 2009
40Plan	CVE-2009-3546No exploit	The _gdGetColors function in gd_gd.c in PHP 5.2.11 and 5.3.x before 5.3.1, and the GD Graphics Library 2.x, does not properly verify a certaphp · php · CWE-119 Pre-auth Memory safety	Critical9.3	—	10.2%	Oct 19, 2009
35Monitor	CVE-2009-3613Proof of concept	The swiotlb functionality in the r8169 driver in drivers/net/r8169.c in the Linux kernel before 2.6.27.22 allows remote attackers to cause alinux · linux kernel · CWE-399 Pre-auth Denial of service	High7.8	—	12.4%	Oct 19, 2009
41Plan	CVE-2009-2983Proof of concept	Adobe Reader and Acrobat 9.x before 9.2, 8.x before 8.1.7, and possibly 7.x through 7.1.4 allow attackers to cause a denial of service (memoadobe · acrobat · CWE-399 pre-auth RCE	Critical9.3	—	12.1%	Oct 19, 2009
58Plan	CVE-2009-2990Weaponized	Array index error in Adobe Reader and Acrobat 9.x before 9.2, 8.x before 8.1.7, and possibly 7.x through 7.1.4 might allow attackers to execadobe · acrobat · CWE-189 pre-auth RCE	Critical9.3	—	68.5%	Oct 19, 2009
43Plan	CVE-2009-2994Proof of concept	Buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 might allow attackers to execute arbitraradobe · acrobat · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	18.4%	Oct 19, 2009
40Plan	CVE-2009-2998No exploit	Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 do not properly validate input, which might allow attackers adobe · acrobat · CWE-20 pre-auth RCE	Critical9.3	—	10.3%	Oct 19, 2009
40Plan	CVE-2009-3458No exploit	Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 do not properly validate input, which might allow attackers adobe · acrobat · CWE-20 pre-auth RCE	Critical9.3	—	10.3%	Oct 19, 2009
40Plan	CVE-2009-3608No exploit	Integer overflow in the ObjectStream::ObjectStream function in XRef.cc in Xpdf 3.x before 3.02pl4 and Poppler before 0.12.1, as used in GPdfpoppler · poppler · CWE-189 pre-auth RCE	Critical9.3	—	10.2%	Oct 21, 2009
44Plan	CVE-2008-3685No exploit	Directory traversal vulnerability in aws_tmxn.exe in the Admin Agent service in the server in EMC Documentum ApplicationXtender Workflow, poemc · documentum applicationxtender workflow manager · CWE-22 pre-auth RCE Path traversal	Critical10.0	—	12.8%	Oct 22, 2009
63This week	CVE-2009-1979Weaponized	Unspecified vulnerability in the Network Authentication component in Oracle Database 10.1.0.5 and 10.2.0.4 allows remote attackers to affectoracle · database server pre-auth RCE	Critical10.0	—	76.3%	Oct 22, 2009
29Monitor	CVE-2009-3641Proof of concept	Snort before 2.8.5.1, when the -v option is enabled, allows remote attackers to cause a denial of service (application crash) via a crafted snort · snort Pre-auth Denial of service	Medium4.3	—	38.7%	Oct 28, 2009
45Plan	CVE-2009-3373Proof of concept	Heap-based buffer overflow in the GIF image parser in Mozilla Firefox before 3.0.15 and 3.5.x before 3.5.4, and SeaMonkey before 2.0, allowsmozilla · firefox · CWE-119 pre-auth RCE Memory safety	Critical10.0	—	15.5%	Oct 29, 2009
43Plan	CVE-2009-3382Proof of concept	layout/base/nsCSSFrameConstructor.cpp in the browser engine in Mozilla Firefox 3.0.x before 3.0.15 does not properly handle first-letter framozilla · firefox pre-auth RCE	Critical10.0	—	10.8%	Oct 29, 2009
30Monitor	CVE-2009-3830Proof of concept	The download functionality in Team Services in Microsoft Office SharePoint Server 2007 12.0.0.4518 and 12.0.0.6219 allows remote attackers tmicrosoft · sharepoint server · CWE-20 Pre-auth	Medium5.0	—	32.6%	Oct 30, 2009

CVE-2009-3591
40Plan
Dopewars 1.5.12 allows remote attackers to cause a denial of service (segmentation fault) via a REQUESTJET message with an invalid location.
MediumCVSS 5.0WeaponizedEPSS 52%
- Pre-auth
- Denial of service
ben webb · dopewarsOct 8, 2009
CVE-2009-3663
44Plan
Format string vulnerability in the h_readrequest function in http.c in httpdx Web Server 1.4 allows remote attackers to cause a denial of se
CriticalCVSS 10.0Proof of conceptEPSS 14%
- pre-auth RCE
jasper · httpdxOct 11, 2009
CVE-2009-2699
34Monitor
The Solaris pollset feature in the Event Port backend in poll/unix/port.c in the Apache Portable Runtime (APR) library before 1.3.9, as used
HighCVSS 7.5No exploitEPSS 14%
- Pre-auth
- Denial of service
apache · http serverOct 13, 2009
CVE-2009-3459
91Now
Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to exe
HighCVSS 8.8KEVWeaponizedEPSS 86%
- pre-auth RCE
- Memory safety
adobe · acrobatOct 13, 2009
CVE-2009-3693
49Plan
Directory traversal vulnerability in the Persits.XUpload.2 ActiveX control (XUpload.ocx) in HP LoadRunner 9.5 allows remote attackers to cre
CriticalCVSS 9.3WeaponizedEPSS 41%
- Pre-auth
- Path traversal
persits · xuploadOct 13, 2009
CVE-2009-0090
43Plan
Microsoft .NET Framework 1.0 SP3, 1.1 SP1, and 2.0 SP1 does not properly validate .NET verifiable code, which allows remote attackers to obt
CriticalCVSS 9.3No exploitEPSS 20%
- pre-auth RCE
microsoft · windows 2000Oct 14, 2009
CVE-2009-0091
45Plan
Microsoft .NET Framework 2.0, 2.0 SP1, and 3.5 does not properly enforce a certain type-equality constraint in .NET verifiable code, which a
CriticalCVSS 9.3No exploitEPSS 25%
- pre-auth RCE
microsoft · windows 2000Oct 14, 2009
CVE-2009-0555
45Plan
Microsoft Windows Media Runtime, as used in DirectShow WMA Voice Codec, Windows Media Audio Voice Decoder, and Audio Compression Manager (AC
CriticalCVSS 9.3No exploitEPSS 27%
- pre-auth RCE
microsoft · windows 2000Oct 14, 2009
CVE-2009-1547
46Plan
Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via a c
HighCVSS 8.8Proof of conceptEPSS 37%
- pre-auth RCE
microsoft · internet explorerOct 14, 2009
CVE-2009-2497
44Plan
The Common Language Runtime (CLR) in Microsoft .NET Framework 2.0, 2.0 SP1, 2.0 SP2, 3.5, and 3.5 SP1, and Silverlight 2, does not properly
CriticalCVSS 9.3No exploitEPSS 23%
- pre-auth RCE
microsoft · windows 2000Oct 14, 2009
CVE-2009-2500
44Plan
Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office
CriticalCVSS 9.3No exploitEPSS 23%
- pre-auth RCE
microsoft · windows 2003 serverOct 14, 2009
CVE-2009-2501
45Plan
Heap-based buffer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Micros
CriticalCVSS 9.3No exploitEPSS 26%
- pre-auth RCE
- Memory safety
microsoft · windows 2003 serverOct 14, 2009
CVE-2009-2502
39Monitor
Buffer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office
HighCVSS 8.1No exploitEPSS 22%
- pre-auth RCE
- Memory safety
microsoft · windows 2003 serverOct 14, 2009
CVE-2009-2503
44Plan
GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Windows Server 2003 SP2, Office XP SP3, Office 2003 SP3, 2007 Microsoft O
CriticalCVSS 9.3No exploitEPSS 22%
- pre-auth RCE
microsoft · windows 2003 serverOct 14, 2009
CVE-2009-2504
43Plan
Multiple integer overflows in unspecified APIs in GDI+ in Microsoft .NET Framework 1.1 SP1, .NET Framework 2.0 SP1 and SP2, Windows XP SP2 a
CriticalCVSS 9.3No exploitEPSS 20%
- Pre-auth
microsoft · windows 2003 serverOct 14, 2009
CVE-2009-2507
43Plan
A certain ActiveX control in the Indexing Service in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 does not properly proce
CriticalCVSS 9.3No exploitEPSS 19%
- pre-auth RCE
microsoft · windows 2000Oct 14, 2009
CVE-2009-2511
34Monitor
Integer overflow in the CryptoAPI component in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Go
HighCVSS 7.5Proof of conceptEPSS 12%
- Pre-auth
microsoft · windows 2000Oct 14, 2009
CVE-2009-2518
44Plan
Integer overflow in GDI+ in Microsoft Office XP SP3 allows remote attackers to execute arbitrary code via an Office document with a bitmap (
CriticalCVSS 9.3No exploitEPSS 22%
- pre-auth RCE
microsoft · officeOct 14, 2009
CVE-2009-2524
39Monitor
Integer underflow in the NTLM authentication feature in the Local Security Authority Subsystem Service (LSASS) in Microsoft Windows XP SP2 a
HighCVSS 7.8No exploitEPSS 28%
- Pre-auth
- Denial of service
microsoft · windows 2003 serverOct 14, 2009
CVE-2009-2525
44Plan
Microsoft Windows Media Runtime, as used in DirectShow WMA Voice Codec, Windows Media Audio Voice Decoder, and Audio Compression Manager (AC
CriticalCVSS 9.3No exploitEPSS 23%
- pre-auth RCE
microsoft · windows 2000Oct 14, 2009
CVE-2009-2526
56Plan
Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2 do not properly validate fields in SMBv2 packets, which allows remot
HighCVSS 7.8Proof of conceptEPSS 81%
- Pre-auth
- Denial of service
microsoft · windows server 2008Oct 14, 2009
CVE-2009-2527
45Plan
Heap-based buffer overflow in Microsoft Windows Media Player 6.4 allows remote attackers to execute arbitrary code via (1) a crafted ASF fil
CriticalCVSS 9.3No exploitEPSS 26%
- pre-auth RCE
- Memory safety
microsoft · windows 2000Oct 14, 2009
CVE-2009-2528
43Plan
GDI+ in Microsoft Office XP SP3 does not properly handle malformed objects in Office Art Property Tables, which allows remote attackers to e
CriticalCVSS 9.3No exploitEPSS 20%
- pre-auth RCE
microsoft · windows 2003 serverOct 14, 2009
CVE-2009-2529
38Monitor
Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, 7, and 8 does not properly handle argument validation for unspecified variables, which allow
HighCVSS 8.1No exploitEPSS 19%
- pre-auth RCE
microsoft · internet explorerOct 14, 2009
CVE-2009-2530
44Plan
Microsoft Internet Explorer 6, 6 SP1, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrar
CriticalCVSS 9.3No exploitEPSS 22%
- pre-auth RCE
microsoft · internet explorerOct 14, 2009
CVE-2009-2531
44Plan
Microsoft Internet Explorer 6, 6 SP1, 7, and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrar
CriticalCVSS 9.3No exploitEPSS 22%
- pre-auth RCE
microsoft · internet explorerOct 14, 2009
CVE-2009-2532
59Plan
Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold and SP2, and Windows 7 RC do not properly process the command value in
CriticalCVSS 10.0Proof of conceptEPSS 62%
- pre-auth RCE
microsoft · windows server 2008Oct 14, 2009
CVE-2009-3126
44Plan
Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office
CriticalCVSS 9.3No exploitEPSS 23%
- pre-auth RCE
microsoft · windows 2003 serverOct 14, 2009
CVE-2009-3699
59Plan
Stack-based buffer overflow in libcsa.a (aka the calendar daemon library) in IBM AIX 5.x through 5.3.10 and 6.x through 6.1.3, and VIOS 2.1
CriticalCVSS 10.0WeaponizedEPSS 62%
- pre-auth RCE
- Memory safety
ibm · viosOct 15, 2009
CVE-2009-3707
23Monitor
VMware Authentication Daemon 1.0 in vmware-authd.exe in the VMware Authorization Service in VMware Workstation 7.0 before 7.0.1 build 227600
MediumCVSS 5.0Proof of conceptEPSS 11%
- Pre-auth
- Denial of service
vmware · aceOct 16, 2009
CVE-2009-3711
59Plan
Stack-based buffer overflow in the h_handlepeer function in http.cpp in httpdx 1.4, and possibly 1.4.3, allows remote attackers to cause a d
CriticalCVSS 10.0WeaponizedEPSS 63%
- pre-auth RCE
- Memory safety
jasper · httpdxOct 16, 2009
CVE-2009-3546
40Plan
The _gdGetColors function in gd_gd.c in PHP 5.2.11 and 5.3.x before 5.3.1, and the GD Graphics Library 2.x, does not properly verify a certa
CriticalCVSS 9.3No exploitEPSS 10%
- Pre-auth
- Memory safety
php · phpOct 19, 2009
CVE-2009-3613
35Monitor
The swiotlb functionality in the r8169 driver in drivers/net/r8169.c in the Linux kernel before 2.6.27.22 allows remote attackers to cause a
HighCVSS 7.8Proof of conceptEPSS 12%
- Pre-auth
- Denial of service
linux · linux kernelOct 19, 2009
CVE-2009-2983
41Plan
Adobe Reader and Acrobat 9.x before 9.2, 8.x before 8.1.7, and possibly 7.x through 7.1.4 allow attackers to cause a denial of service (memo
CriticalCVSS 9.3Proof of conceptEPSS 12%
- pre-auth RCE
adobe · acrobatOct 19, 2009
CVE-2009-2990
58Plan
Array index error in Adobe Reader and Acrobat 9.x before 9.2, 8.x before 8.1.7, and possibly 7.x through 7.1.4 might allow attackers to exec
CriticalCVSS 9.3WeaponizedEPSS 68%
- pre-auth RCE
adobe · acrobatOct 19, 2009
CVE-2009-2994
43Plan
Buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 might allow attackers to execute arbitrar
CriticalCVSS 9.3Proof of conceptEPSS 18%
- pre-auth RCE
- Memory safety
adobe · acrobatOct 19, 2009
CVE-2009-2998
40Plan
Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 do not properly validate input, which might allow attackers
CriticalCVSS 9.3No exploitEPSS 10%
- pre-auth RCE
adobe · acrobatOct 19, 2009
CVE-2009-3458
40Plan
Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 do not properly validate input, which might allow attackers
CriticalCVSS 9.3No exploitEPSS 10%
- pre-auth RCE
adobe · acrobatOct 19, 2009
CVE-2009-3608
40Plan
Integer overflow in the ObjectStream::ObjectStream function in XRef.cc in Xpdf 3.x before 3.02pl4 and Poppler before 0.12.1, as used in GPdf
CriticalCVSS 9.3No exploitEPSS 10%
- pre-auth RCE
poppler · popplerOct 21, 2009
CVE-2008-3685
44Plan
Directory traversal vulnerability in aws_tmxn.exe in the Admin Agent service in the server in EMC Documentum ApplicationXtender Workflow, po
CriticalCVSS 10.0No exploitEPSS 12%
- pre-auth RCE
- Path traversal
emc · documentum applicationxtender workflow managerOct 22, 2009
CVE-2009-1979
63This week
Unspecified vulnerability in the Network Authentication component in Oracle Database 10.1.0.5 and 10.2.0.4 allows remote attackers to affect
CriticalCVSS 10.0WeaponizedEPSS 76%
- pre-auth RCE
oracle · database serverOct 22, 2009
CVE-2009-3641
29Monitor
Snort before 2.8.5.1, when the -v option is enabled, allows remote attackers to cause a denial of service (application crash) via a crafted
MediumCVSS 4.3Proof of conceptEPSS 38%
- Pre-auth
- Denial of service
snort · snortOct 28, 2009
CVE-2009-3373
45Plan
Heap-based buffer overflow in the GIF image parser in Mozilla Firefox before 3.0.15 and 3.5.x before 3.5.4, and SeaMonkey before 2.0, allows
CriticalCVSS 10.0Proof of conceptEPSS 15%
- pre-auth RCE
- Memory safety
mozilla · firefoxOct 29, 2009
CVE-2009-3382
43Plan
layout/base/nsCSSFrameConstructor.cpp in the browser engine in Mozilla Firefox 3.0.x before 3.0.15 does not properly handle first-letter fra
CriticalCVSS 10.0Proof of conceptEPSS 10%
- pre-auth RCE
mozilla · firefoxOct 29, 2009
CVE-2009-3830
30Monitor
The download functionality in Team Services in Microsoft Office SharePoint Server 2007 12.0.0.4518 and 12.0.0.6219 allows remote attackers t
MediumCVSS 5.0Proof of conceptEPSS 32%
- Pre-auth
microsoft · sharepoint serverOct 30, 2009