CVE-2009-1594

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Armorlogic Profense Web Application Firewall before 2.2.22, and 2.4.x before 2.4.4, does not properly implement the "positive model," which allows remote attackers to bypass certain protection mechanisms via a %0A (encoded newline), as demonstrated by a %0A in a cross-site scripting (XSS) attack URL.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-264

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
May 21, 2009
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2009

CVE-2009-15954.0The jabber:iq:auth implementation in IQAuthHandler.java in Ignite Realtime Openfire before 3.6.4 allows remote authenticated users to changeCVE-2009-15966.5Ignite Realtime Openfire before 3.6.5 does not properly implement the register.password (aka canChangePassword) console configuration settinCVE-2009-15979.3Mozilla Firefox executes DOM calls in response to a javascript: URI in the target attribute of a submit element within a form contained in aCVE-2009-15989.3Google Chrome executes DOM calls in response to a javascript: URI in the target attribute of a submit element within a form contained in an CVE-2009-15999.3Opera executes DOM calls in response to a javascript: URI in the target attribute of a submit element within a form contained in an inline PCVE-2009-16009.3Apple Safari executes DOM calls in response to a javascript: URI in the target attribute of a submit element within a form contained in an iCVE-2009-16016.8The Ubuntu clamav-milter.init script in clamav-milter before 0.95.1+dfsg-1ubuntu1.2 in Ubuntu 9.04 sets the ownership of the current workingCVE-2009-16025.0Pablo Software Solutions Quick 'n Easy Mail Server 3.3 allows remote attackers to cause a denial of service (daemon outage or CPU consumptioCVE-2009-16037.5src/tools/pkcs11-tool.c in pkcs11-tool in OpenSC 0.11.7, when used with unspecified third-party PKCS#11 modules, generates RSA keys with incCVE-2009-16047.5Unspecified vulnerability in LimeSurvey before 1.82 allows remote attackers to execute commands and obtain sensitive data via unknown attackCVE-2009-16055.4Heap-based buffer overflow in the loadexponentialfunc function in mupdf/pdf_function.c in MuPDF in the mupdf-20090223-win32 package, as usedCVE-2009-16069.3Multiple stack-based and heap-based buffer overflows in Dafolo DafoloControl ActiveX control (DafoloFFControl.dll) 1.108.6.195 allow remote
CVE-2009-1594: High severity, CVSS 7.5 | Vulnix