Search
Total
86024 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2009-4728 | 1 Questions Answered | 1 Questions Answered | 2017-09-19 | 7.5 HIGH | N/A |
| SQL injection vulnerability in the administrative interface in Questions Answered 1.3 allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: some of these details are obtained from third party information. | |||||
| CVE-2009-4729 | 1 X10media | 1 Adult Script | 2017-09-19 | 4.3 MEDIUM | N/A |
| Multiple cross-site scripting (XSS) vulnerabilities in x10 Adult Media Script 1.7 allow remote attackers to inject arbitrary web script or HTML via the (1) pic_id parameter to includes/video_ad.php, (2) category parameter to linkvideos_listing.php, (3) id parameter to templates/header1.php, and (4) key parameter to video_listing.php. | |||||
| CVE-2009-4730 | 1 X10media | 1 Adult Script | 2017-09-19 | 7.5 HIGH | N/A |
| SQL injection vulnerability in report.php in x10 Adult Media Script 1.7 allows remote attackers to execute arbitrary SQL commands via the id parameter. | |||||
| CVE-2009-4732 | 1 Technotoad | 1 Tt Web Site Manager | 2017-09-19 | 6.8 MEDIUM | N/A |
| SQL injection vulnerability in tt/index.php in TT Web Site Manager 0.5, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the tt_name parameter. NOTE: some of these details are obtained from third party information. | |||||
| CVE-2009-4733 | 1 Supercrackmunkey | 1 Simpleloginsys | 2017-09-19 | 6.8 MEDIUM | N/A |
| SQL injection vulnerability in checkuser.php in SimpleLoginSys 0.5, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: some of these details are obtained from third party information. | |||||
| CVE-2009-4734 | 1 Allomani | 1 Movies Library | 2017-09-19 | 7.5 HIGH | N/A |
| SQL injection vulnerability in login.php in Allomani Movies Library (Movies & Clips) 2.7.0 allows remote attackers to execute arbitrary SQL commands via the username parameter in a login action. | |||||
| CVE-2009-4735 | 1 Allomani | 1 Audio \& Video Library | 2017-09-19 | 7.5 HIGH | N/A |
| SQL injection vulnerability in login.php in Allomani Audio & Video Library (Songs & Clips version) 2.7.0 allows remote attackers to execute arbitrary SQL commands via the username parameter in a login action. | |||||
| CVE-2009-4739 | 1 Skadate | 1 Skadate Online Dating Software | 2017-09-19 | 6.8 MEDIUM | N/A |
| PHP remote file inclusion vulnerability in index.php in SkaDate Dating allows remote attackers to execute arbitrary PHP code via a URL in the language_id parameter. NOTE: this can also be leveraged to include and execute arbitrary local files via directory traversal sequences. | |||||
| CVE-2009-4748 | 2 Andrew Charlton, Wordpress | 2 My Category Order, Wordpress | 2017-09-19 | 7.5 HIGH | N/A |
| SQL injection vulnerability in mycategoryorder.php in the My Category Order plugin 2.8 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the parentID parameter in an act_OrderCategories action to wp-admin/post-new.php. | |||||
| CVE-2009-4749 | 1 Phplivesupport | 1 Php Live\! | 2017-09-19 | 7.5 HIGH | N/A |
| Multiple SQL injection vulnerabilities in PHP Live! 3.2.1 and 3.2.2 allow remote attackers to execute arbitrary SQL commands via the x parameter to (1) message_box.php and (2) request.php. | |||||
| CVE-2009-4754 | 1 Mercuryaudio | 1 Audio Player | 2017-09-19 | 9.3 HIGH | N/A |
| Stack-based buffer overflow in Mercury Audio Player 1.21 allows remote attackers to execute arbitrary code via a long string in a malformed playlist (.m3u) file. | |||||
| CVE-2009-4755 | 1 Mercuryaudio | 1 Audio Player | 2017-09-19 | 9.3 HIGH | N/A |
| Multiple stack-based buffer overflows in Mercury Audio Player 1.21 allow remote attackers to execute arbitrary code via a long string in a malformed (1) .b4s or (2) .pls playlist file. | |||||
| CVE-2009-4756 | 1 Beatport | 1 Beatport Player | 2017-09-19 | 9.3 HIGH | N/A |
| Stack-based buffer overflow in TraktorBeatport.exe 1.0.0.283 in Beatport Player 1.0.0.0 allows remote attackers to execute arbitrary code via a long string in a malformed playlist (.m3u) file. | |||||
| CVE-2009-4757 | 1 Evils-world | 1 Ew-musicplayer | 2017-09-19 | 9.3 HIGH | N/A |
| Stack-based buffer overflow in BrotherSoft EW-MusicPlayer 0.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long string in a malformed playlist (.m3u) file. NOTE: some of these details are obtained from third party information. | |||||
| CVE-2009-4758 | 1 Dicas | 1 Mpegable Player | 2017-09-19 | 9.3 HIGH | N/A |
| Stack-based buffer overflow in dicas Mpegable Player 2.12 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long string in a .YUV file. | |||||
| CVE-2009-4759 | 1 Joric | 1 Bmxplay | 2017-09-19 | 9.3 HIGH | N/A |
| Buffer overflow in BrotherSoft BMXPlay 0.4.4b allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long string in a .BMX file. | |||||
| CVE-2009-4760 | 1 Winn | 1 Asp Guestbook | 2017-09-19 | 5.0 MEDIUM | N/A |
| Winn ASP Guestbook 1.01 Beta stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for data/guestbook.mdb. | |||||
| CVE-2009-4761 | 1 Mini-stream | 1 Rm Downloader | 2017-09-19 | 9.3 HIGH | N/A |
| Stack-based buffer overflow in Mini-stream RM Downloader allows remote attackers to execute arbitrary code via a long string in a .smi file. | |||||
| CVE-2009-4764 | 2 Adobe, Microsoft | 2 Acrobat Reader, Windows | 2017-09-19 | 9.3 HIGH | N/A |
| Adobe Reader 8.x and 9.x on Windows is able to execute EXE files that are embedded in a PDF document, which makes it easier for remote attackers to trick users into executing arbitrary code via a crafted document. | |||||
| CVE-2009-4775 | 1 Ipswitch | 1 Ws Ftp | 2017-09-19 | 4.3 MEDIUM | N/A |
| Format string vulnerability in Ipswitch WS_FTP Professional 12 before 12.2 allows remote attackers to cause a denial of service (crash) via format string specifiers in the status code portion of an HTTP response. | |||||
| CVE-2009-4792 | 1 Karl Core | 1 Bandsite Cms | 2017-09-19 | 7.5 HIGH | N/A |
| SQL injection vulnerability in includes/content/member_content.php in BandSite CMS 1.1.4 allows remote attackers to execute arbitrary SQL commands via the memid parameter to members.php. | |||||
| CVE-2009-4793 | 1 Karl Core | 1 Bandsite Cms | 2017-09-19 | 6.0 MEDIUM | N/A |
| Unrestricted file upload vulnerability in adminpanel/scripts/addphotos.php in BandSite CMS 1.1.4 allows remote authenticated administrators to execute arbitrary PHP code by uploading a file with an executable extension via an addphotos action to adminpanel/index.php, and then accessing the file via a direct request with an images/gallery/ directory name. NOTE: some of these details are obtained from third party information. | |||||
| CVE-2009-4797 | 1 Jobhut.spranger | 1 Jobhut | 2017-09-19 | 7.5 HIGH | N/A |
| SQL injection vulnerability in browse.php in JobHut 1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the pk parameter. | |||||
| CVE-2009-4798 | 1 Diskos | 1 Diskos Cms | 2017-09-19 | 7.5 HIGH | N/A |
| Multiple SQL injection vulnerabilities in Diskos CMS 6.x allow remote attackers to execute arbitrary SQL commands via the (1) kat parameter to side.asp, and the (2) brugerid and (3) password fields to the administration login feature. | |||||
| CVE-2009-4799 | 1 Diskos | 1 Diskos Cms | 2017-09-19 | 5.0 MEDIUM | N/A |
| Diskos CMS 6.x stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for (1) artikler_prod.mdb or (2) medlemmer.mdb. | |||||
| CVE-2009-4800 | 1 Sysax | 1 Multi Server | 2017-09-19 | 4.0 MEDIUM | N/A |
| Directory traversal vulnerability in Sysax Multi Server 4.3 and 4.5 allows remote authenticated users to delete arbitrary files via a ..// (dot dot slash slash) in a DELE command. | |||||
| CVE-2009-4806 | 1 Digitalinterchange | 1 Digital Interchange Document Library | 2017-09-19 | 7.5 HIGH | N/A |
| admin/save_user.asp in Digital Interchange Document Library 1.0.1 does not require administrative authentication, which allows remote attackers to read or modify the administrator's credentials via unspecified vectors. NOTE: some of these details are obtained from third party information. | |||||
| CVE-2009-4807 | 1 Graugon | 1 Php Article Publisher | 2017-09-19 | 7.5 HIGH | N/A |
| Multiple SQL injection vulnerabilities in Graugon PHP Article Publisher 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) c parameter to index.php and the (2) id parameter to view.php. | |||||
| CVE-2009-4808 | 1 Graugon | 1 Php Article Publisher | 2017-09-19 | 7.5 HIGH | N/A |
| admin.php in Graugon PHP Article Publisher 1.0 allows remote attackers to bypass authentication and obtain administrative access by setting the g_admin cookie to 1. | |||||
| CVE-2009-4809 | 1 Sharing-file | 1 Easy File Sharing Web Server | 2017-09-19 | 5.0 MEDIUM | N/A |
| Directory traversal vulnerability in thumbnail.ghp in Easy File Sharing (EFS) Web Server 4.8 allows remote attackers to read arbitrary files via a .. (dot dot) in the vfolder parameter. | |||||
| CVE-2009-4832 | 1 Deslock | 1 Deslock\+ | 2017-09-19 | 7.2 HIGH | N/A |
| The dlpcrypt.sys kernel driver 0.1.1.27 in DESlock+ 4.0.2 allows local users to gain privileges via a crafted IOCTL 0x80012010 request to the DLPCryptCore device. | |||||
| CVE-2009-4834 | 1 Xpressengine | 1 Zeroboard | 2017-09-19 | 6.8 MEDIUM | N/A |
| lib.php in Zeroboard 4.1 pl7 allows remote attackers to execute arbitrary PHP code via a crafted parameter name, possibly related to now_connect.php. | |||||
| CVE-2009-4836 | 1 Moviephp | 1 Movie Php Script | 2017-09-19 | 7.5 HIGH | N/A |
| Eval injection vulnerability in system/services/init.php in Movie PHP Script 2.0 allows remote attackers to execute arbitrary PHP code via the anticode parameter. | |||||
| CVE-2009-4840 | 1 Roxio | 1 Cineplayer | 2017-09-19 | 9.3 HIGH | N/A |
| Heap-based buffer overflow in the IAManager ActiveX control in IAManager.dll in Roxio CinePlayer 3.2 allows remote attackers to execute arbitrary code via a long argument to the SetIAPlayerName method. | |||||
| CVE-2009-4841 | 1 Roxio | 1 Cineplayer | 2017-09-19 | 9.3 HIGH | N/A |
| Heap-based buffer overflow in the SonicMediaPlayer ActiveX control in SonicMediaPlayer.dll in Roxio CinePlayer 3.2 allows remote attackers to execute arbitrary code via a long argument to the DiskType method. NOTE: this might overlap CVE-2007-1559. | |||||
| CVE-2009-4854 | 1 Scripts.oldguy | 1 Talkback | 2017-09-19 | 7.5 HIGH | N/A |
| addons/import.php in TalkBack 2.3.14 allows remote attackers to execute arbitrary commands via the result parameter. | |||||
| CVE-2009-4855 | 1 Typo3 | 1 Typo3 | 2017-09-19 | 7.5 HIGH | N/A |
| ** DISPUTED ** SQL injection vulnerability in index.php in TYPO3 4.0 allows remote attackers to execute arbitrary SQL commands via the showUid parameter. NOTE: the TYPO3 Security Team disputes this report, stating that "there is no such vulnerability... The showUid parameter is generally used in third-party TYPO3 extensions - not in TYPO3 Core." | |||||
| CVE-2009-4860 | 1 Demarque | 1 Typing Pal | 2017-09-19 | 7.5 HIGH | N/A |
| SQL injection vulnerability in demo.php in Typing Pal 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the idTableProduit parameter. | |||||
| CVE-2009-4862 | 1 Abushhab | 1 Alwasel | 2017-09-19 | 7.5 HIGH | N/A |
| Multiple SQL injection vulnerabilities in Alwasel 1.5 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) show.php and (2) xml.php. | |||||
| CVE-2009-4863 | 1 Ultraplayer | 1 Ultraplayer Media Player | 2017-09-19 | 9.3 HIGH | N/A |
| Stack-based buffer overflow in UltraPlayer Media Player 2.112 allows remote attackers to execute arbitrary code via a long string in a .usk file. | |||||
| CVE-2009-4867 | 1 Tony Million | 1 Tuniac | 2017-09-19 | 4.3 MEDIUM | N/A |
| Buffer overflow in Tuniac 090517c allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long URL in a .m3u playlist file. | |||||
| CVE-2009-4870 | 1 Phpcityportal | 1 Phpcityportal | 2017-09-19 | 7.5 HIGH | N/A |
| Multiple SQL injection vulnerabilities in login.php in PHPCityPortal allow remote attackers to execute arbitrary SQL commands via the (1) req_username (aka Username) and (2) req_password (aka Password) parameters. NOTE: some of these details are obtained from third party information. | |||||
| CVE-2009-4871 | 1 Logoshows | 1 Logoshows Bbs | 2017-09-19 | 7.5 HIGH | N/A |
| SQL injection vulnerability in globepersonnel_forum.asp in Logoshows BBS 2.0 allows remote attackers to execute arbitrary SQL commands via the forumid parameter. | |||||
| CVE-2009-4872 | 1 Logoshows | 1 Logoshows Bbs | 2017-09-19 | 7.5 HIGH | N/A |
| Multiple SQL injection vulnerabilities in globepersonnel_login.asp in Logoshows BBS 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password fields. | |||||
| CVE-2009-4874 | 1 Scripts.oldguy | 1 Talkback | 2017-09-19 | 6.4 MEDIUM | N/A |
| TalkBack 2.3.14 does not properly restrict access to the edit comment feature (comments.php), which allows remote attackers to modify comments. | |||||
| CVE-2009-4876 | 1 Netrix | 1 Netrix Cms | 2017-09-19 | 5.0 MEDIUM | N/A |
| admin/cikkform.php in Netrix CMS 1.0 allows remote attackers to modify arbitrary pages via a direct request using the cid parameter. | |||||
| CVE-2009-4883 | 1 Todd Rogers | 1 Phprecipebook | 2017-09-19 | 7.5 HIGH | N/A |
| SQL injection vulnerability in index.php in PHPRecipeBook 2.24 and 2.39 allows remote attackers to execute arbitrary SQL commands via the (1) base_id or (2) course_id parameter in a search action. | |||||
| CVE-2009-4887 | 1 Sbuilder | 1 Cms S.builder | 2017-09-19 | 6.8 MEDIUM | N/A |
| PHP remote file inclusion vulnerability in index.php in CMS S.Builder 3.7 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in a binn_include_path cookie. NOTE: this can also be leveraged to include and execute arbitrary local files. | |||||
| CVE-2009-4889 | 2 Basti2web, Php-fusion | 2 Book Panel, Php-fusion | 2017-09-19 | 7.5 HIGH | N/A |
| SQL injection vulnerability in books.php in the Book Panel (book_panel) module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the bookid parameter. | |||||
| CVE-2009-4891 | 1 Cs-cart | 1 Cs-cart | 2017-09-19 | 7.5 HIGH | N/A |
| SQL injection vulnerability in index.php in CS-Cart 2.0.0 Beta 3 allows remote attackers to execute arbitrary SQL commands via the product_id parameter in a products.view action. | |||||