Uncategorized CVEs — 2009 (Page 15/15)

CVEs without a recognized CWE (not present in the CWE map or marked as N/A).

CVSS ≥ 0.0

2009-01-15

Medium

CVE-2009-0122

hplip.postinst in HP Linux Imaging and Printing (HPLIP) 2.7.7 and 2.8.2 on Ubuntu allows local users to change the ownership of arbitrary files via unspecified manipulations in advance of an HPLIP in…

CVSS: 6.9CWE: CWE-264

Medium

CVE-2008-5907

The png_check_keyword function in pngwutil.c in libpng before 1.0.42, and 1.2.x before 1.2.34, might allow context-dependent attackers to set the value of an arbitrary memory location to zero via vec…

CVSS: 5.0CWE: N/A

Medium

CVE-2008-5905

The web interface plugin in KTorrent before 3.1.4 allows remote attackers to bypass intended access restrictions and upload arbitrary torrent files, and trigger the start of downloads and seeding, vi…

CVSS: 4.3CWE: CWE-264

High

CVE-2008-5903

Array index error in the xrdp_bitmap_def_proc function in xrdp/funcs.c in xrdp 0.4.1 and earlier allows remote attackers to execute arbitrary code via vectors that manipulate the value of the edit_po…

CVSS: 7.5CWE: CWE-189

Medium

CVE-2003-1566

Microsoft Internet Information Services (IIS) 5.0 does not log requests that use the TRACK method, which allows remote attackers to obtain sensitive information without detection.

CVSS: 5.0CWE: CWE-16

2009-01-14

Medium

CVE-2008-5463

Unspecified vulnerability in the PeopleSoft Enterprise Campus Solutions component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.9.18 and 9.0.8 allows remote authenticated users to af…

CVSS: 4.9CWE: N/A

Medium

CVE-2008-5462

Unspecified vulnerability in the WebLogic Portal component in BEA Product Suite 10.3, 10.2, 10.0 MP1, 9.2 MP3, and 8.1 SP6 allows remote attackers to affect confidentiality, integrity, and availabili…

CVSS: 6.8CWE: CWE-264

Medium

CVE-2008-5459

Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 10.3 allows remote attackers to affect confidentiality via unknown vectors.

CVSS: 5.0CWE: CWE-264

Medium

CVE-2008-5458

Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10 and CU2 allows remote authenticated users to affect confidentiality and integrity via u…

CVSS: 5.5CWE: N/A

Critical

CVE-2008-5457

Unspecified vulnerability in the Oracle BEA WebLogic Server Plugins for Apache, Sun and IIS web servers component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP6, and 7.0 SP7 allows r…

CVSS: 10.0CWE: N/A

Medium

CVE-2008-5456

Unspecified vulnerability in the PeopleSoft Enterprise HRMS component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.9.18 and 9.0.8 allows remote authenticated users to affect confide…

CVSS: 4.9CWE: N/A

Medium

CVE-2008-5455

Unspecified vulnerability in the PeopleSoft Enterprise HRMS - ePerformance component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.9.18 allows remote authenticated users to affect co…

CVSS: 4.9CWE: N/A

Medium

CVE-2008-5454

Unspecified vulnerability in the iProcurement component in Oracle E-Business Suite 11.5.10 CU2 and 12.0.6 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.

CVSS: 4.9CWE: N/A

Medium

CVE-2008-5452

Unspecified vulnerability in the PeopleSoft Enterprise HRMS component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.9.18 allows remote authenticated users to affect confidentiality a…

CVSS: 5.5CWE: N/A

Medium

CVE-2008-5451

Unspecified vulnerability in the JD Edwards Tools component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.97.2.5 allows remote authenticated users to affect confidentiality via unkno…

CVSS: 4.0CWE: N/A

Low

CVE-2008-5450

Unspecified vulnerability in the Oracle Applications Platform Engineering component in Oracle E-Business Suite 11.5.10 CU2 and 12.0.6 allows local users to affect confidentiality via unknown vectors.

CVSS: 1.2CWE: N/A

Medium

CVE-2008-5447

Unspecified vulnerability in the Oracle Enterprise Manager component in Oracle Enterprise Manager 10.2.0.4 allows remote authenticated users to affect confidentiality and integrity via unknown vector…

CVSS: 5.5CWE: N/A

Low

CVE-2008-5446

Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10 CU2 and 12.0.6 allows remote authenticated users to affect confidentiality via unknown vect…

CVSS: 3.5CWE: N/A

Medium

CVE-2008-5445

Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.2.0.2 allows remote attackers to affect availability via unknown vectors. NOTE: the previous information wa…

CVSS: 5.0CWE: N/A

Medium

CVE-2008-5443

Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.2.0.2 allows remote attackers to affect availability via unknown vectors, a different vulnerability than CVE…

CVSS: 5.0CWE: N/A

Medium

CVE-2008-5438

Unspecified vulnerability in the Oracle Portal component in Oracle Application Server 10.1.2.3 and 10.1.4.2 allows remote attackers to affect integrity via unknown vectors.

CVSS: 4.3CWE: N/A

Medium

CVE-2008-4017

Unspecified vulnerability in the OC4J component in Oracle Application Server 10.1.2.3 allows remote attackers to affect confidentiality via unknown vectors.

CVSS: 5.0CWE: N/A

Medium

CVE-2008-4016

Unspecified vulnerability in the Collaborative Workspaces component in Oracle Collaboration Suite 10.1.2 allows remote authenticated users to affect confidentiality via unknown vectors.

CVSS: 4.0CWE: N/A

Medium

CVE-2008-4014

Unspecified vulnerability in the Oracle BPEL Process Manager component in Oracle Application Server allows remote authenticated users to affect confidentiality and integrity via unknown vectors.

CVSS: 5.5CWE: N/A

Medium

CVE-2008-4007

Unspecified vulnerability in the PeopleSoft Enterprise Components component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.9.18 allows remote authenticated users to affect confidentia…

CVSS: 6.5CWE: N/A

Low

CVE-2008-2623

Unspecified vulnerability in the Oracle JDeveloper component in Oracle Application Server 10.1.2.3 allows local users to affect confidentiality via unknown vectors.

CVSS: 2.1CWE: N/A

Critical

CVE-2008-5449

Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.2.0.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a…

CVSS: 10.0CWE: N/A

Critical

CVE-2008-5448

CVSS: 10.0CWE: N/A

Critical

CVE-2008-5444

CVSS: 10.0CWE: N/A

Medium

CVE-2008-5442

CVSS: 5.0CWE: N/A

Medium

CVE-2008-5441

CVSS: 5.0CWE: N/A

High

CVE-2008-5440

Unspecified vulnerability in the TimesTen Data Server component in Oracle Database 7.0.5.0.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE:…

CVSS: 7.5CWE: N/A

Medium

CVE-2008-5439

Unspecified vulnerability in the SQL*Plus Windows GUI component in Oracle Database 10.2.0.4 allows remote authenticated users to affect confidentiality via unknown vectors.

CVSS: 4.0CWE: N/A

Medium

CVE-2008-5437

Unspecified vulnerability in the Job Queue component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.4, and 11.1.0.6 allows remote authenticated users to affect confidentiality and integrity,…

CVSS: 5.5CWE: N/A

Medium

CVE-2008-5436

Unspecified vulnerability in the Oracle OLAP component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.4 allows remote authenticated users to affect integrity and availability via unknown…

CVSS: 5.5CWE: N/A

Medium

CVE-2008-4015

Unspecified vulnerability in the Oracle Streams component in Oracle Database 10.1.0.5 allows remote authenticated users to affect confidentiality and integrity, related to SYS.DBMS_STREAMS_AUTH.

CVSS: 5.5CWE: N/A

Critical

CVE-2008-4006

Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.1.0.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.

CVSS: 10.0CWE: N/A

Medium

CVE-2008-3999

Unspecified vulnerability in the Oracle OLAP component in Oracle Database 9.2.0.8, 9.2.0.8DV, and 10.1.0.5 allows remote authenticated users to affect availability, related to SYS.OLAPIMPL_T.

CVSS: 4.0CWE: N/A

Medium

CVE-2008-3997

Unspecified vulnerability in the Oracle OLAP component in Oracle Database 10.1.0.5 and 10.2.0.3 allows remote authenticated users to affect availability, related to SYS.DBMS_XSOQ_ODBO.

CVSS: 4.0CWE: N/A

Medium

CVE-2008-3981

Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.1.0.1 allows remote attackers to affect confidentiality via unknown vectors.

CVSS: 5.0CWE: N/A

Medium

CVE-2008-3979

Unspecified vulnerability in the Oracle Spatial component in Oracle Database 10.1.0.5 and 10.2.0.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors. NOTE…

CVSS: 5.5CWE: N/A

Medium

CVE-2008-3978

Unspecified vulnerability in the Oracle Spatial component in Oracle Database 10.1.0.5 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.

CVSS: 5.5CWE: N/A

Medium

CVE-2008-3974

Unspecified vulnerability in the Oracle OLAP component in Oracle Database 9.0.2.8 and 9.2.0.8DV allows remote authenticated users to affect availability, related to SYS.OLAPIMPL_T.

CVSS: 4.0CWE: N/A

Low

CVE-2008-3973

Unspecified vulnerability in the SQL*Plus Windows GUI component in Oracle Database allows local users to affect confidentiality via unknown vectors.

CVSS: 1.7CWE: N/A

2009-01-13

High

CVE-2009-0024

The sys_remap_file_pages function in mm/fremap.c in the Linux kernel before 2.6.24.1 allows local users to cause a denial of service or gain privileges via unspecified vectors, related to the vm_file…

CVSS: 7.2CWE: CWE-264

2009-01-12

High

CVE-2008-5901

iyzi Forum 1.0 beta 3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing a password via a direct…

CVSS: 7.5CWE: CWE-264

High

CVE-2008-5900

CodeAvalanche Articles stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing the administrator passw…

CVSS: 7.5CWE: CWE-264

High

CVE-2008-5899

CodeAvalanche FreeForAll stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing the administrator pas…

CVSS: 7.5CWE: CWE-264

High

CVE-2008-5898

CodeAvalanche Directory stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing the administrator pass…

CVSS: 7.5CWE: CWE-264

High

CVE-2008-5897

CodeAvalanche FreeWallpaper stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing the administrator…

CVSS: 7.5CWE: CWE-264

High

CVE-2008-5896

CodeAvalanche RateMySite stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing the administrator pas…

CVSS: 7.5CWE: CWE-264

Medium

CVE-2008-5886

TAKempis Discussion Web 4.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing a password via a d…

CVSS: 5.0CWE: CWE-264

Medium

CVE-2008-5885

The Net Guys ASPired2Quote stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing usernames and passw…

CVSS: 5.0CWE: CWE-264

Medium

CVE-2008-5884

AyeView 2.20 allows user-assisted attackers to cause a denial of service (application crash) via a GIF file with a malformed header.

CVSS: 4.3CWE: N/A

2009-01-09

High

CVE-2009-0108

PHPAuctions (aka PHPAuctionSystem) allows remote attackers to bypass authentication and gain administrative access via modified (1) PHPAUCTION_RM_ID, (2) PHPAUCTION_RM_NAME, (3) PHPAUCTION_RM_USERNAM…

CVSS: 7.5CWE: CWE-264

2009-01-08

Medium

CVE-2009-0072

Microsoft Internet Explorer 6.0 through 8.0 beta2 allows remote attackers to cause a denial of service (application crash) via an onload=screen[""] attribute value in a BODY element.

CVSS: 4.3CWE: N/A

Low

CVE-2009-0071

Mozilla Firefox 3.0.5 and earlier 3.0.x versions, when designMode is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a certain (a) r…

CVSS: 2.6CWE: CWE-399

Critical

CVE-2009-0070

Integer signedness error in Apple Safari allows remote attackers to read the contents of arbitrary memory locations, cause a denial of service (application crash), and probably have unspecified other…

CVSS: 9.3CWE: CWE-189

Critical

CVE-2009-0043

The smmsnmpd service in CA Service Metric Analysis r11.0 through r11.1 SP1 and Service Level Management 3.5 does not properly restrict access, which allows remote attackers to execute arbitrary comma…

CVSS: 10.0CWE: CWE-264

Medium

CVE-2008-3819

dnsserver in Cisco Application Control Engine Global Site Selector (GSS) before 3.0(1) allows remote attackers to cause a denial of service (daemon crash) via a series of crafted DNS requests, aka Bu…

CVSS: 5.0CWE: N/A

High

CVE-2008-5873

Yerba SACphp 6.3 and earlier allows remote attackers to bypass authentication and gain administrative access via a galleta[sesion] cookie that has a value beginning with 1:1: followed by a username.

CVSS: 7.5CWE: CWE-264

Medium

CVE-2008-5871

Nortel Multimedia Communication Server (MSC) 5100 3.0.13 does not verify credentials during call placement, which allows remote attackers to spoof and redirect VoIP calls, possibly related to the sno…

CVSS: 6.4CWE: CWE-255

2009-01-07

Medium

CVE-2009-0069

Unspecified vulnerability in the nfs4rename_persistent_fh function in the NFS 4 (aka NFSv4) client in the kernel in Sun Solaris 10 and OpenSolaris before snv_102 allows local users to cause a denial…

CVSS: 4.9CWE: CWE-399

High

CVE-2009-0066

Multiple unspecified vulnerabilities in Intel system software for Trusted Execution Technology (TXT) allow attackers to bypass intended loader integrity protections, as demonstrated by exploitation o…

CVSS: 7.6CWE: N/A

2009-01-06

Medium

CVE-2008-5857

The DropDocuments plugin in KnowledgeTree before 3.5.4a allows remote authenticated users to gain administrative privileges via a certain sequence of "browse documents" and dashboard requests.

CVSS: 6.5CWE: N/A

Medium

CVE-2008-5855

myPHPscripts Login Session 2.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to discover usernames, e-mail addresses, and password ha…

CVSS: 5.0CWE: CWE-264

Medium

CVE-2008-5853

Chilek Content Management System (aka ChiCoMaS) 2.0.4 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to (1) obtain databas…

CVSS: 5.0CWE: CWE-264

Medium

CVE-2008-5852

Emefa Guestbook 3.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for guestbook.md…

CVSS: 5.0CWE: CWE-264

Critical

CVE-2008-5848

The Advantech ADAM-6000 module has 00000000 as its default password, which makes it easier for remote attackers to obtain access through an HTTP session, and (1) monitor or (2) control the module's M…

CVSS: 10.0CWE: CWE-255

2009-01-05

Low

CVE-2008-5847

Constructr CMS 3.02.5 and earlier stores passwords in cleartext in a MySQL database, which allows context-dependent attackers to obtain sensitive information by reading the hash column.

CVSS: 2.6CWE: CWE-255

Medium

CVE-2008-5846

Six Apart Movable Type (MT) before 4.23 allows remote authenticated users with create permission for posts to bypass intended access restrictions and publish posts via a "system-wide entry listing sc…

CVSS: 4.0CWE: CWE-264

High

CVE-2008-5844

PHP 5.2.7 contains an incorrect change to the FILTER_UNSAFE_RAW functionality, and unintentionally disables magic_quotes_gpc regardless of the actual magic_quotes_gpc setting, which might make it eas…

CVSS: 7.5CWE: CWE-16

Medium

CVE-2008-5843

Multiple untrusted search path vulnerabilities in pdfjam allow local users to gain privileges via a Trojan horse program in (1) the current working directory or (2) /var/tmp, related to the (a) pdf90…

CVSS: 4.6CWE: N/A

Medium

CVE-2004-2761

The MD5 Message-Digest Algorithm is not collision resistant, which makes it easier for context-dependent attackers to conduct spoofing attacks, as demonstrated by attacks on the use of MD5 in the sig…

CVSS: 5.0CWE: CWE-310

High

CVE-2008-5840

PHP iCalendar 2.24 and earlier allows remote attackers to bypass authentication by setting the phpicalendar and phpicalendar_login cookies to 1.

CVSS: 7.5CWE: CWE-264

2009-01-02

High

CVE-2008-5827

The Nokia 6131 Near Field Communication (NFC) phone with 05.12 firmware automatically installs software upon completing the download of a JAR file, which makes it easier for remote attackers to execu…

CVSS: 7.5CWE: CWE-16

Medium

CVE-2008-5823

An ActiveX control in prtstb06.dll in Microsoft Money 2006, when used with WScript in Windows Script Host (WSH) on Windows Vista, allows remote attackers to cause a denial of service (access violatio…

CVSS: 4.3CWE: CWE-189

Medium

CVE-2008-5822

Memory leak in Libxul, as used in Mozilla Firefox 3.0.5 and other products, allows remote attackers to cause a denial of service (memory consumption and browser hang) via a long CLASS attribute in an…

CVSS: 5.0CWE: CWE-399

Medium

CVE-2008-5821

Memory leak in WebKit.dll in WebKit, as used by Apple Safari 3.2 on Windows Vista SP1, allows remote attackers to cause a denial of service (memory consumption and browser crash) via a long ALINK att…

CVSS: 5.0CWE: CWE-399

Critical

CVE-2008-5812

Multiple unspecified vulnerabilities in SPIP 1.8 before 1.8.3b, 1.9 before 1.9.2g, and 2.0 before 2.0.2 have unknown impact and attack vectors.

CVSS: 10.0CWE: N/A

Critical

CVE-2006-7236

The default configuration of xterm on Debian GNU/Linux sid and possibly Ubuntu enables the allowWindowOps resource, which allows user-assisted attackers to execute arbitrary code or have unspecified…

CVSS: 9.3CWE: CWE-16