CVE-2009-2076

Cross-site scripting XSS vulnerability in Views 6.x before 6.x-2.6, a module for Drupal, allows remote authenticated users to inject arbitrary web script or HTML via 1 exposed filters in the Views UI administrative interface and in the 2 view name parameter in the define custom views feature. NOT...

CVE-2009-3125

SQL injection vulnerability in the Bug.search WebService function in Bugzilla 3.3.2 through 3.4.1, and 3.5, allows remote attackers to execute arbitrary SQL commands via unspecified parameters...

CVE-2009-3120

Cross-site scripting XSS vulnerability in public/index.php in BIGACE Web CMS 2.6 allows remote attackers to inject arbitrary web script or HTML via the id parameter. NOTE: some of these details are obtained from third party information...

CVE-2009-5025

A backdoor aka BMSA-2009-07 was found in PyForum v1.0.3 where an attacker who knows a valid user email could force a password reset on behalf of that user...

CVE-2009-5015

The URL dispatch mechanism in TurboGears2 aka tg2 before 2.0.2 exposes controller methods even when an @expose decoration is not used, which has unspecified impact and attack vectors...

CVE-2009-2059

Opera, possibly before 9.25, uses the HTTP Host header to determine the context of a document provided in a 1 4xx or 2 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" atta...

CVE-2009-2057

Microsoft Internet Explorer before 8 uses the HTTP Host header to determine the context of a document provided in a 1 4xx or 2 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL...

CVE-2009-3112

Unspecified vulnerability in OXID eShop Professional, Enterprise, and Community Edition before 4.1.0 allows remote attackers to gain administrator privileges and access the shop backend via a crafted parameter...

CVE-2009-5001

The Workplace aka WP component in IBM FileNet P8 Application Engine P8AE 4.0.2.x before 4.0.2.2-P8AE-FP002 grants a document's Creator-Owner full control over an annotation object, even if the default instance security has changed, which might allow remote authenticated users to bypass intended...

CVE-2009-4980

Multiple cross-site scripting XSS vulnerabilities in Photokorn Gallery 1.81 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 where parameter to search.php and 2 qc parameter to admin.php...

CVE-2009-4953

Cross-site scripting XSS vulnerability in the Userdata Create/Edit sguserdata extension before 0.91.0 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-3101

xscreensaver aka Gnome-XScreenSaver in Sun Solaris 10, and OpenSolaris snv109 through snv122, does not properly handle Trusted Extensions, which allows local users to cause a denial of service CPU consumption and console hang by locking the screen, related to a regression in certain Solaris and...

CVE-2009-3100

xscreensaver aka Gnome-XScreenSaver in Sun Solaris 9 and 10, OpenSolaris snv109 through snv122, and X11 6.4.1 on Solaris 8 does not properly handle Accessibility support, which allows local users to cause a denial of service system hang by locking the screen and then attempting to launch an...

CVE-2009-1942

Cross-site scripting XSS vulnerability in the Quiz module 5.x, 6.x-2.x before 6.x-2.2, and 6.x-3.x before 6.x-3.0, a module for Drupal, allows remote authenticated users, with create quizzes or quiz questions access, to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-4926

Multiple cross-site scripting XSS vulnerabilities in Online Contact Manager formerly EContact PRO 3.0 allow remote attackers to inject arbitrary web script or HTML via the 1 showGroup parameter to a index.php and the 2 id parameter to b view.php, c email.php, d edit.php, and e delete.php...

CVE-2009-4790

Multiple directory traversal vulnerabilities in Sysax Multi Server 4.5 allow remote authenticated users to read or modify arbitrary files via crafted FTP commands. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2009-4711

SQL injection vulnerability in the CoolURI cooluri extension before 1.0.16 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2008-6686...

CVE-2009-4709

SQL injection vulnerability in the datamints Newsticker datamintsnewsticker extension before 0.7.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2009-4702

SQL injection vulnerability in the Tour Extension pmtour extension before 0.0.13 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2009-0128

plugins/crypto/openssl/cryptoopenssl.c in Simple Linux Utility for Resource Management aka SLURM or slurm-llnl does not properly check the return value from the OpenSSL EVPVerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS...