CVE-2009-1594

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Armorlogic Profense Web Application Firewall before 2.2.22, and 2.4.x before 2.4.4, does not properly implement the "positive model," which allows remote attackers to bypass certain protection mechanisms via a %0A (encoded newline), as demonstrated by a %0A in a cross-site scripting (XSS) attack URL.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-264

Affected software

No affected versions have been published.

Timeline

Published: May 21, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-15954.0The jabber:iq:auth implementation in IQAuthHandler.java in Ignite Realtime Openfire before 3.6.4 allows remote authenticated users to change CVE-2009-15966.5Ignite Realtime Openfire before 3.6.5 does not properly implement the register.password (aka canChangePassword) console configuration settin CVE-2009-15979.3Mozilla Firefox executes DOM calls in response to a javascript: URI in the target attribute of a submit element within a form contained in a CVE-2009-15989.3Google Chrome executes DOM calls in response to a javascript: URI in the target attribute of a submit element within a form contained in an CVE-2009-15999.3Opera executes DOM calls in response to a javascript: URI in the target attribute of a submit element within a form contained in an inline P CVE-2009-16009.3Apple Safari executes DOM calls in response to a javascript: URI in the target attribute of a submit element within a form contained in an i CVE-2009-16016.8The Ubuntu clamav-milter.init script in clamav-milter before 0.95.1+dfsg-1ubuntu1.2 in Ubuntu 9.04 sets the ownership of the current working CVE-2009-16025.0Pablo Software Solutions Quick 'n Easy Mail Server 3.3 allows remote attackers to cause a denial of service (daemon outage or CPU consumptio CVE-2009-16037.5src/tools/pkcs11-tool.c in pkcs11-tool in OpenSC 0.11.7, when used with unspecified third-party PKCS#11 modules, generates RSA keys with inc CVE-2009-16047.5Unspecified vulnerability in LimeSurvey before 1.82 allows remote attackers to execute commands and obtain sensitive data via unknown attack CVE-2009-16055.4Heap-based buffer overflow in the loadexponentialfunc function in mupdf/pdf_function.c in MuPDF in the mupdf-20090223-win32 package, as used CVE-2009-16069.3Multiple stack-based and heap-based buffer overflows in Dafolo DafoloControl ActiveX control (DafoloFFControl.dll) 1.108.6.195 allow remote