Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-30 03:45Z
2009-11-09
2009-11-09 17:30Z
CRIT

CVE-2009-3555 — Apache Http_server: The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2009-3555

The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HT CVSSv3.1 9.8 (CRITICAL) · EPSS 84th percentile

CWECWE 295CWECWE 300VNDGnuVNDApacheVNDMozillaVNDOpensslTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2009-11-03
2009-11-03 16:30Z
INFO

CVE-2009-3720 — Libexpat_project Libexpat: The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2009-3720

The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted UTF-8 sequences that trigger a buffer over-read, a different vulnerability than CVE-2009-2625. EPSS 98th percentile

VNDApacheVNDLibexpat ProjectTYPVulnerability
58
Edit Score
2009-10-13
2009-10-13 10:30Z
HIGH

CVE-2009-3459 — Adobe Acrobat: Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2009-3459

Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption, as exploited in the wild in October 2009. NOTE: some of these details are obtained from third party information. CVSSv3.1 8.8 (HIGH) · EPSS 99th percentile

CWECWE 122CWECWE 119VNDAdobeVNDHeapTYPVulnerability
8.8
CVSS v3.1
100
Edit Score
2009-07-29
2009-07-29 17:30Z
MED

CVE-2009-2495 — Microsoft Visual_c\+\+: The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2009-2495

The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1 does not properly enforce string termination, which allows remote attackers to obtain sensitive information via a crafted HTML document with an ATL (1) component or (2) control that triggers a buffer over-read, related to ATL headers and buffer allocation, aka "ATL Null String Vulnerability." CVSSv3.1 6.5 (MEDIUM) · EPSS 99th percentile

CWECWE 200CWECWE 126VNDMicrosoftVNDActiveTYPVulnerability
6.5
CVSS v3.1
100
Edit Score
2009-07-29
2009-07-29 17:30Z
HIGH

CVE-2009-2493 — Microsoft Visual_c\+\+: The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2009-2493

The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2; does not properly restrict use of OleLoadFromStream in instantiating objects from data streams, which allows remote attackers to execute arbitrary code via a crafted HTML document with an ATL (1) comp CVSSv3.1 8.8 (HIGH) · EPSS 98th percentile

CWECWE 94CWECWE 264VNDMicrosoftVNDActiveTYPVulnerability
8.8
CVSS v3.1
100
Edit Score
2009-07-29
2009-07-29 17:30Z
HIGH

CVE-2009-0901 — Microsoft Visual_c\+\+: The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2009-0901

The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2; does not prevent VariantClear calls on an uninitialized VARIANT, which allows remote attackers to execute arbitrary code via a malformed stream to an ATL (1) component or (2) control, related to ATL headers a CVSSv3.1 8.8 (HIGH) · EPSS 99th percentile

CWECWE 94CWECWE 457VNDMicrosoftVNDActiveTYPVulnerability
8.8
CVSS v3.1
100
Edit Score
2009-05-29
2009-05-29 18:30Z
HIGH

CVE-2009-1537 — Microsoft Directx: Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2009-1537

Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2 allows remote attackers to execute arbitrary code via a crafted QuickTime media file, as exploited in the wild in May 2009, aka "DirectX NULL Byte Overwrite Vulnerability." CVSSv3.1 8.8 (HIGH) · EPSS 99th percentile

CWECWE 158VNDMicrosoftVNDUnspecifiedTYPVulnerability
8.8
CVSS v3.1
100
Edit Score
728 × 90 / responsive · programmatic ad slot
2009-02-25
2009-02-25 16:30Z
HIGH

CVE-2009-0238 — Microsoft Excel: Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2009-0238in the wild

Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1; and Excel in Microsoft Office 2004 and 2008 for Mac allow remote attackers to execute arbitrary code via a crafted Excel document that triggers an access attempt on an invalid object, as exploited in the wild in February 2009 by Trojan.Mdropper.AC. CVSSv3.1 8.8 (HIGH) · EPSS 99th percentile

CWECWE 94VNDMicrosoftTYPVulnerabilitySTAitw exploited
8.8
CVSS v3.1
100
Edit Score
2009-01-15
2009-01-15 00:30Z
HIGH

CVE-2003-1567 — Microsoft Internet_information_services: The undocumented TRACK method in Microsoft Internet Information Services (IIS) 5.0 returns the content

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2003-1567

The undocumented TRACK method in Microsoft Internet Information Services (IIS) 5.0 returns the content of the original request in the body of the response, which makes it easier for remote attackers to steal cookies and authentication credentials, or bypass the HttpOnly protection mechanism, by using TRACK to read the contents of the HTTP headers that are returned in the response, a technique that is similar to cross-site tracing (XST) using HTTP TRACE. CVSSv3.1 7.5 (HIGH) · EPSS 99th percentile

CWECWE 200VNDMicrosoftVNDTrackTYPVulnerability
7.5
CVSS v3.1
100
Edit Score
2009-01-05
2009-01-05 20:30Z
CRIT

CVE-2004-2761 — Ietf Md5: The MD5 Message-Digest Algorithm is not collision resistant, which makes it easier for context-dependent

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2004-2761

The MD5 Message-Digest Algorithm is not collision resistant, which makes it easier for context-dependent attackers to conduct spoofing attacks, as demonstrated by attacks on the use of MD5 in the signature algorithm of an X.509 certificate. CVSSv3.1 9.8 (CRITICAL) · EPSS 91th percentile

CWECWE 310CWECWE 328VNDIetfVNDMd5TYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2008-10-23
2008-10-23 22:00Z
CRIT

CVE-2008-4250 — Microsoft Windows_2000: The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2008-4250

The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary code via a crafted RPC request that triggers the overflow during path canonicalization, as exploited in the wild by Gimmiv.A in October 2008, aka "Server Service Vulnerability." CVSSv3.1 9.8 (CRITICAL) · EPSS 100th percentile

CWECWE 94CWECWE 119VNDMicrosoftTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2008-09-18
2008-09-18 20:00Z
MED

CVE-2008-4128 — Cisco Ios: Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2008-4128

Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router allow remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /level/15/exec/- URI, and (2) a certain "alias exec" command to the /level/15/exec/-/configure/http URI. NOTE: some of these details are obtained from third party information. CVSSv3.1 4.3 (MEDIUM) · EPSS 96th percentile

CWECWE 352VNDCiscoVNDCsrfTYPVulnerability
4.3
CVSS v3.1
75
Edit Score
2007-11-20
2007-11-20 02:46Z
HIGH

CVE-2007-6033 — Wonderware Intouch: Invensys Wonderware InTouch 8.0 creates a NetDDE share with insecure permissions (Everyone/Full Control), which

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2007-6033

Invensys Wonderware InTouch 8.0 creates a NetDDE share with insecure permissions (Everyone/Full Control), which allows remote authenticated attackers, and possibly anonymous users, to execute arbitrary programs. CVSSv3.1 8.8 (HIGH)

CWECWE 732VNDWonderwareVNDInvensysTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2007-11-19
2007-11-19 21:46Z
CRIT

CVE-2007-6013 — Wordpress Wordpress: 1.5 through 2.3.1 uses cookie values based on the MD5 hash of a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2007-6013

Wordpress 1.5 through 2.3.1 uses cookie values based on the MD5 hash of a password MD5 hash, which allows attackers to bypass authentication by obtaining the MD5 hash from the user database, then generating the authentication cookie from that hash. CVSSv3.1 9.8 (CRITICAL)

CWECWE 327VNDWordpressVNDFedoraprojectTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2007-11-10
2007-11-10 02:46Z
HIGH

CVE-2007-5927 — Openbase_international_ltd Openbase: Directory traversal vulnerability in OpenBase 10.0.5 and earlier allows remote authenticated users to create

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2007-5927

Directory traversal vulnerability in OpenBase 10.0.5 and earlier allows remote authenticated users to create files with arbitrary contents via a .. (dot dot) in the first argument to the GlobalLog stored procedure. NOTE: this can be leveraged to execute arbitrary code using CVE-2007-5926. CVSSv3.1 8.1 (HIGH)

CWECWE 22VNDOpenbase International LtdTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2007-11-10
2007-11-10 02:46Z
HIGH

CVE-2007-5928 — Openbase_international_ltd Openbase: 10.0.5 and earlier allows remote authenticated users to trigger a free of an

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2007-5928

OpenBase 10.0.5 and earlier allows remote authenticated users to trigger a free of an arbitrary memory location via long strings in a SELECT statement. NOTE: this might be a buffer overflow, but it is not clear. CVSSv3.1 8.1 (HIGH)

CWECWE 20CWECWE 119VNDOpenbase International LtdVNDOpenbaseTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2007-11-01
2007-11-01 16:46Z
CRIT

CVE-2007-5775 — Bitdefender Antivirus: Unspecified vulnerability in BitDefender allows attackers to execute arbitrary code via unspecified vectors, aka

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2007-5775

Unspecified vulnerability in BitDefender allows attackers to execute arbitrary code via unspecified vectors, aka EEYEB-20071024. NOTE: as of 20071029, the only disclosure is a vague pre-advisory with no actionable information. However, since it is from a well-known researcher, it is being assigned a CVE identifier for tracking purposes. CVSSv3.1 9.8 (CRITICAL)

CWECWE 94VNDBitdefenderVNDUnspecifiedTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2007-10-18
2007-10-18 21:17Z
CRIT

CVE-2007-5565 — Phpscms Phpscms: PHP remote file inclusion vulnerability in includes/functions.php in phpSCMS 0.0.1-Alpha1 allows remote attackers to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2007-5565

PHP remote file inclusion vulnerability in includes/functions.php in phpSCMS 0.0.1-Alpha1 allows remote attackers to execute arbitrary PHP code via a URL in the dir parameter. NOTE: this issue is disputed by CVE because the identified code is in a function that is not accessible via direct request CVSSv3.1 9.8 (CRITICAL)

CWECWE 94VNDPhpscmsTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2007-09-26
2007-09-26 22:17Z
CRIT

CVE-2007-5097 — Online_fantasy_football_league Offl: PHP remote file inclusion vulnerability in lib/classes/offl_nflteam.php in Online Fantasy Football League (OFFL) 0.2.6

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2007-5097

PHP remote file inclusion vulnerability in lib/classes/offl_nflteam.php in Online Fantasy Football League (OFFL) 0.2.6 allows remote attackers to execute arbitrary PHP code via a URL in the DOC_ROOT parameter. NOTE: this issue is disputed by CVE because a __FILE__ test protects offl_nflteam.php against direct requests CVSSv3.1 9.8 (CRITICAL)

CWECWE 94VNDOnline Fantasy Football LeagueTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2007-08-28
2007-08-28 01:17Z
CRIT

CVE-2007-4559 — Python Python: Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2007-4559

Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267. CVSSv3.1 9.8 (CRITICAL)

CWECWE 22TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2007-08-09
2007-08-09 21:17Z
CRIT

CVE-2007-4290 — Stadtaus Guestbook_script: Multiple PHP remote file inclusion vulnerabilities in Guestbook Script 1.9 allow remote attackers to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2007-4290

Multiple PHP remote file inclusion vulnerabilities in Guestbook Script 1.9 allow remote attackers to execute arbitrary PHP code via a URL in the script_root parameter to (1) delete.php, (2) edit.php, or (3) inc/common.inc.php; or (4) database.php, (5) entries.php, (6) index.php, (7) logout.php, or (8) settings.php in admin/. NOTE: a third party disputes this vulnerability, noting that these scripts defend against direct requests CVSSv3.1 9.8 (CRITICAL)

CWECWE 94VNDStadtausTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2007-07-27
2007-07-27 22:30Z
CRIT

CVE-2007-4039 — Mozilla Mozilla: Argument injection vulnerability involving Mozilla, when certain URIs are registered, allows remote attackers to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2007-4039

Argument injection vulnerability involving Mozilla, when certain URIs are registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in an unspecified URI, which are inserted into the command line when invoking the handling process, a similar issue to CVE-2007-3670. CVSSv3.1 9.8 (CRITICAL)

CWECWE 79VNDMozillaVNDArgumentTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2007-07-27
2007-07-27 22:30Z
HIGH

CVE-2007-4040 — Microsoft Outlook: Argument injection vulnerability involving Microsoft Outlook and Outlook Express, when certain URIs are registered

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2007-4040

Argument injection vulnerability involving Microsoft Outlook and Outlook Express, when certain URIs are registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in an unspecified URI, which are inserted into the command line when invoking the handling process, a similar issue to CVE-2007-3670. CVSSv3.1 8.8 (HIGH)

CWECWE 79VNDMicrosoftVNDArgumentTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2007-07-27
2007-07-27 22:30Z
CRIT

CVE-2007-4043 — Securecomputing Securityreporter: file.cgi in Secure Computing SecurityReporter (aka Network Security Analyzer) before 4.6.3 allows remote attackers

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2007-4043

file.cgi in Secure Computing SecurityReporter (aka Network Security Analyzer) before 4.6.3 allows remote attackers to bypass authentication via a name parameter ending with a "%00.gif" sequence. NOTE: a separate traversal vulnerability could be leveraged to download arbitrary files. CVSSv3.1 9.8 (CRITICAL)

CWECWE 287VNDSecurecomputingVNDSecureTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2007-07-16
2007-07-16 22:30Z
CRIT

CVE-2007-3798 — Tcpdump Tcpdump: Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2007-3798

Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows remote attackers to execute arbitrary code via crafted TLVs in a BGP packet, related to an unchecked return value. CVSSv3.1 9.8 (CRITICAL)

CWECWE 252VNDCanonicalVNDTcpdumpTYPVulnerability
9.8
CVSS v3.1
99
Edit Score