Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2009-1080
Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Identity Manager (IdM) 7.0 through 8.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID 19033.
Affected Products: n/a
References: [{'name': '253267', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-66-253267-1'}, {'name': '1021881', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1021881'}, {'name': '34191', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34191'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://blogs.sun.com/security/entry/sun_alert_253267_sun_java'}, {'name': 'ADV-2009-0797', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0797'}, {'name': '34380', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34380'}]
CVE State: PUBLISHED
Explain CVE-2009-1081
Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Identity Manager (IdM) 7.0 through 8.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug IDs 19595 and 19661.
Affected Products: n/a
References: [{'name': '253267', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-66-253267-1'}, {'name': '1021881', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1021881'}, {'name': '34191', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34191'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://blogs.sun.com/security/entry/sun_alert_253267_sun_java'}, {'name': 'ADV-2009-0797', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0797'}, {'name': '34380', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34380'}]
CVE State: PUBLISHED
Explain CVE-2009-1082
Sun Java System Identity Manager (IdM) 7.0 through 8.0 allows remote authenticated users to gain privileges by submitting crafted commands to the Admin Console, as demonstrated by privileges for account creation and other administrative capabilities, related to the saveNoValidate action and saveNoValidateAllowedFormsAndWorkflows IDs.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-21-140936-01-1'}, {'name': '253267', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-66-253267-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-21-137621-11-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-21-139010-06-1'}, {'name': '1021881', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1021881'}, {'name': '34191', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34191'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://blogs.sun.com/security/entry/sun_alert_253267_sun_java'}, {'name': 'ADV-2009-0797', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0797'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-21-140935-01-1'}, {'name': '34380', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34380'}]
CVE State: PUBLISHED
Explain CVE-2009-1083
Sun Java System Identity Manager (IdM) 7.0 through 8.0 on Linux, AIX, Solaris, and HP-UX permits "control characters" in the passwords of user accounts, which allows remote attackers to execute arbitrary commands via vectors involving "resource adapters."
Affected Products: n/a
References: [{'name': '253267', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-66-253267-1'}, {'name': '1021881', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1021881'}, {'name': '34191', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34191'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://blogs.sun.com/security/entry/sun_alert_253267_sun_java'}, {'name': 'ADV-2009-0797', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0797'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-21-140935-01-1'}, {'name': '34380', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34380'}]
CVE State: PUBLISHED
Explain CVE-2009-1084
Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not properly restrict access to the System Configuration object, which allows remote authenticated administrators and possibly remote attackers to have an unspecified impact by modifying this object.
Affected Products: n/a
References: [{'name': '253267', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-66-253267-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-21-139010-06-1'}, {'name': '1021881', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1021881'}, {'name': '34191', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34191'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://blogs.sun.com/security/entry/sun_alert_253267_sun_java'}, {'name': 'ADV-2009-0797', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0797'}, {'name': 'jsim-sco-unspecified(49607)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49607'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-21-140935-01-1'}, {'name': '34380', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34380'}]
CVE State: PUBLISHED
Explain CVE-2009-1085
Piwik 0.2.32 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the API key and other sensitive information via a direct request for misc/cron/archive.sh.
Affected Products: n/a
References: [{'name': '[oss-security] 20090323 CVE request: API key disclosure in piwik', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2009/03/23/2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://dev.piwik.org/trac/ticket/599'}, {'tags': ['x_refsource_MISC'], 'url': 'http://marco-ziesing.de/archives/35-Schluesselloch-in-Piwik.html'}]
CVE State: PUBLISHED
Explain CVE-2009-1086
Heap-based buffer overflow in the ldns_rr_new_frm_str_internal function in ldns 1.4.x allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via a DNS resource record (RR) with a long (1) class field (clas variable) and possibly (2) TTL field.
Affected Products: n/a
References: [{'name': '35013', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35013'}, {'name': '[oss-security] 20090324 CVE id request: ldns', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2009/03/24/4'}, {'name': '34233', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34233'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.nlnetlabs.nl/svn/ldns/tags/release-1.5.0/Changelog'}, {'name': '35065', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35065'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.nlnetlabs.nl/bugs/show_bug.cgi?id=232'}, {'name': 'SUSE-SR:2009:010', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html'}, {'name': 'DSA-1795', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2009/dsa-1795'}]
CVE State: PUBLISHED
Explain CVE-2009-1087
Multiple argument injection vulnerabilities in PPLive.exe in PPLive 1.9.21 and earlier allow remote attackers to execute arbitrary code via a UNC share pathname in the LoadModule argument to the (1) synacast, (2) Play, (3) pplsv, or (4) ppvod URI handler.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': 'ADV-2009-0739', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0739'}, {'name': 'pplive-uri-code-execution(49263)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49263'}, {'name': '34327', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34327'}, {'name': '8215', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8215'}]
CVE State: PUBLISHED
Explain CVE-2009-1088
Hannon Hill Cascade Server 5.7 and other versions allows remote authenticated users to execute arbitrary programs or Java code via a crafted XSLT stylesheet with "extension elements and extension functions" that trigger code execution by Xalan-Java, as demonstrated using xalan://java.lang.Runtime.
Affected Products: n/a
References: [{'name': '8247', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8247'}, {'tags': ['x_refsource_MISC'], 'url': 'http://support.hannonhill.com/browse/CSCD-4753'}, {'name': '20090319 Command Execution in Hannon Hill Cascade Server', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/501981/100/0/threaded'}, {'name': '34186', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34186'}, {'name': 'cascadeserver-xlst-command-execution(49332)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49332'}]
CVE State: PUBLISHED
Explain CVE-2009-1089
Absolute path traversal vulnerability in upload.php in Rapidleech rev.36 and earlier allows remote attackers to read arbitrary files via a base64-encoded absolute path in the filename parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://security.bkis.vn/?p=345'}, {'name': 'rapidleech-filename-info-disclosure(49253)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49253'}, {'name': '34300', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34300'}, {'name': '34119', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34119'}, {'name': '20090314 [Bkis-03-2009] Multiple Vulnerabilities found in Rapidleech rev.36', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/501854/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2009-1090
Directory traversal vulnerability in upload.php in Rapidleech rev.36 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the uploaded parameter.
Affected Products: n/a
References: [{'name': 'rapidleech-uploaded-file-include(49256)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49256'}, {'name': '52753', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52753'}, {'tags': ['x_refsource_MISC'], 'url': 'http://security.bkis.vn/?p=345'}, {'name': '34300', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34300'}, {'name': '34119', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34119'}, {'name': '20090314 [Bkis-03-2009] Multiple Vulnerabilities found in Rapidleech rev.36', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/501854/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2009-1091
Cross-site scripting (XSS) vulnerability in upload.php in Rapidleech rev.36 and earlier allows remote attackers to inject arbitrary web script or HTML via the uploaded parameter.
Affected Products: n/a
References: [{'name': '52754', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52754'}, {'tags': ['x_refsource_MISC'], 'url': 'http://security.bkis.vn/?p=345'}, {'name': '34300', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34300'}, {'name': '34119', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34119'}, {'name': '20090314 [Bkis-03-2009] Multiple Vulnerabilities found in Rapidleech rev.36', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/501854/100/0/threaded'}, {'name': 'rapidleech-upload-xss(49257)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49257'}]
CVE State: PUBLISHED
Explain CVE-2009-1092
Use-after-free vulnerability in the LIVEAUDIO.LiveAudioCtrl.1 ActiveX control in LIVEAU~1.OCX 7.0 for GeoVision DVR systems allows remote attackers to execute arbitrary code by calling the GetAudioPlayingTime method with certain arguments.
Affected Products: n/a
References: [{'name': 'geovision-liveaudio-activex-dos(49238)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49238'}, {'name': '34115', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34115'}, {'tags': ['x_refsource_MISC'], 'url': 'http://retrogod.altervista.org/9sg_geovision_liveaudio_freedmem.html'}, {'name': '8206', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8206'}, {'name': '20090313 GeoVision LiveAudio ActiveX Control GetAudioPlayingTime() remote freed-memory access exploit', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/501773/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2009-1119
Multiple heap-based buffer overflows in EMC RepliStor 6.2 before SP5 and 6.3 before SP2 allow remote attackers to execute arbitrary code via a crafted message to (1) ctrlservice.exe or (2) rep_srv.exe, possibly related to an integer overflow.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.fortiguardcenter.com/advisory/FGA-2009-13.html'}, {'name': '34449', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34449'}, {'name': 'ADV-2009-1018', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1018'}, {'name': '1022026', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1022026'}, {'name': '20090409 FGA-2009-003:EMC RepliStor Buffer Overflow Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/502575/100/0/threaded'}, {'name': '34699', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34699'}]
CVE State: PUBLISHED
Explain CVE-2009-1120
EMC RepliStor Server Service before ESA-09-003 has a DoASOCommand Remote Code Execution Vulnerability. The flaw exists within the DoRcvRpcCall RPC function -exposed via the rep_srv.exe process- where the vulnerability is caused by an error when the rep_srv.exe handles a specially crafted packet sent by an unauthenticated attacker.
Affected Products: RepliStor
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.zerodayinitiative.com/advisories/ZDI-09-068/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://fortiguard.com/encyclopedia/ips/17967/emc-replistor-server-service-doasocommand-code-execution'}]
CVE State: PUBLISHED
Explain CVE-2009-1122
The WebDAV extension in Microsoft Internet Information Services (IIS) 5.0 on Windows 2000 SP4 does not properly decode URLs, which allows remote attackers to bypass authentication, and possibly read or create files, via a crafted HTTP request, aka "IIS 5.0 WebDAV Authentication Bypass Vulnerability," a different vulnerability than CVE-2009-1535.
Affected Products: n/a
References: [{'name': 'oval:org.mitre.oval:def:5861', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5861'}, {'name': '1022358', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1022358'}, {'name': 'MS09-020', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-020'}, {'name': '35232', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35232'}, {'name': 'TA09-160A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA09-160A.html'}, {'name': 'ADV-2009-1539', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1539'}, {'name': '20090616 IIS WebDav Vulnerability CVE ID', 'tags': ['mailing-list', 'x_refsource_VIM'], 'url': 'http://www.attrition.org/pipermail/vim/2009-June/002192.html'}]
CVE State: PUBLISHED
Explain CVE-2009-1123
The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 does not properly validate changes to unspecified kernel objects, which allows local users to gain privileges via a crafted application, aka "Windows Kernel Desktop Vulnerability."
Affected Products: n/a
References: [{'name': '35372', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35372'}, {'name': '54940', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/54940'}, {'name': 'ADV-2009-1544', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1544'}, {'name': 'MS09-025', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-025'}, {'name': '1022359', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1022359'}, {'name': 'oval:org.mitre.oval:def:6206', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6206'}, {'name': 'TA09-160A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA09-160A.html'}]
CVE State: PUBLISHED
Explain CVE-2009-1124
The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 does not properly validate user-mode pointers in unspecified error conditions, which allows local users to gain privileges via a crafted application, aka "Windows Kernel Pointer Validation Vulnerability."
Affected Products: n/a
References: [{'name': '35372', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35372'}, {'name': '35238', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35238'}, {'name': 'ADV-2009-1544', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1544'}, {'name': 'MS09-025', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-025'}, {'name': '1022359', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1022359'}, {'name': 'TA09-160A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA09-160A.html'}, {'name': '54941', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/54941'}, {'name': 'oval:org.mitre.oval:def:6231', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6231'}]
CVE State: PUBLISHED
Explain CVE-2009-1125
The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 does not properly validate an argument to an unspecified system call, which allows local users to gain privileges via a crafted application, aka "Windows Driver Class Registration Vulnerability."
Affected Products: n/a
References: [{'name': '35372', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35372'}, {'name': '35240', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35240'}, {'name': 'ADV-2009-1544', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1544'}, {'name': 'MS09-025', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-025'}, {'name': '1022359', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1022359'}, {'name': 'oval:org.mitre.oval:def:5912', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5912'}, {'name': 'TA09-160A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA09-160A.html'}, {'name': '54942', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/54942'}]
CVE State: PUBLISHED
Explain CVE-2009-1126
The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 does not properly validate the user-mode input associated with the editing of an unspecified desktop parameter, which allows local users to gain privileges via a crafted application, aka "Windows Desktop Parameter Edit Vulnerability."
Affected Products: n/a
References: [{'name': '35372', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35372'}, {'name': 'oval:org.mitre.oval:def:6016', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6016'}, {'name': 'ADV-2009-1544', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1544'}, {'name': '54943', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/54943'}, {'name': 'MS09-025', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-025'}, {'name': '1022359', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1022359'}, {'name': 'TA09-160A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA09-160A.html'}]
CVE State: PUBLISHED
Explain CVE-2009-1127
win32k.sys in the kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 does not correctly validate an argument to an unspecified system call, which allows local users to gain privileges via a crafted application that triggers a NULL pointer dereference, aka "Win32k NULL Pointer Dereferencing Vulnerability."
Affected Products: n/a
References: [{'name': 'oval:org.mitre.oval:def:5588', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5588'}, {'name': 'MS09-065', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-065'}, {'name': 'TA09-314A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA09-314A.html'}]
CVE State: PUBLISHED
Explain CVE-2009-1128
Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3 allows remote attackers to execute arbitrary code via crafted sound data in a file that uses a PowerPoint 95 native file format, leading to memory corruption, aka "PP7 Memory Corruption Vulnerability," a different vulnerability than CVE-2009-1129.
Affected Products: n/a
References: [{'name': '32428', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/32428'}, {'name': 'ADV-2009-1290', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1290'}, {'name': 'MS09-017', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-017'}, {'name': '1022205', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1022205'}, {'name': 'TA09-132A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA09-132A.html'}, {'name': '34837', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34837'}, {'name': 'oval:org.mitre.oval:def:5416', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5416'}]
CVE State: PUBLISHED
Explain CVE-2009-1129
Multiple stack-based buffer overflows in the PowerPoint 95 importer (PP7X32.DLL) in Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3 allow remote attackers to execute arbitrary code via an inconsistent record length in sound data in a file that uses a PowerPoint 95 (PPT95) native file format, aka "PP7 Memory Corruption Vulnerability," a different vulnerability than CVE-2009-1128.
Affected Products: n/a
References: [{'name': '20090512 Microsoft PowerPoint PPT95 Import Multiple Stack Buffer Overflow Vulnerabilities', 'tags': ['third-party-advisory', 'x_refsource_IDEFENSE'], 'url': 'http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=791'}, {'name': 'oval:org.mitre.oval:def:6176', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6176'}, {'name': '32428', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/32428'}, {'name': 'ADV-2009-1290', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1290'}, {'name': 'MS09-017', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-017'}, {'name': '1022205', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1022205'}, {'name': 'TA09-132A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA09-132A.html'}, {'name': '34839', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34839'}, {'name': '54387', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/54387'}]
CVE State: PUBLISHED
Explain CVE-2009-1130
Heap-based buffer overflow in Microsoft Office PowerPoint 2002 SP3 and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows remote attackers to execute arbitrary code via a crafted structure in a Notes container in a PowerPoint file that causes PowerPoint to read more data than was allocated when creating a C++ object, leading to an overwrite of a function pointer, aka "Heap Corruption Vulnerability."
Affected Products: n/a
References: [{'name': 'oval:org.mitre.oval:def:5961', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5961'}, {'name': '32428', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/32428'}, {'name': 'ADV-2009-1290', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1290'}, {'name': '20090512 ZDI-09-020: Microsoft Office PowerPoint Notes Container Heap Overflow Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/503454'}, {'name': 'MS09-017', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-017'}, {'name': '20090512 Microsoft PowerPoint Notes Container Heap Corruption Vulnerability', 'tags': ['third-party-advisory', 'x_refsource_IDEFENSE'], 'url': 'http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=794'}, {'name': '1022205', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1022205'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.zerodayinitiative.com/advisories/ZDI-09-020/'}, {'name': 'TA09-132A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA09-132A.html'}, {'name': '34840', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34840'}]
CVE State: PUBLISHED
Explain CVE-2009-1131
Multiple stack-based buffer overflows in Microsoft Office PowerPoint 2000 SP3 allow remote attackers to execute arbitrary code via a large amount of data associated with unspecified atoms in a PowerPoint file that triggers memory corruption, aka "Data Out of Bounds Vulnerability."
Affected Products: n/a
References: [{'name': '32428', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/32428'}, {'name': 'ADV-2009-1290', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1290'}, {'name': 'MS09-017', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-017'}, {'name': 'oval:org.mitre.oval:def:5351', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5351'}, {'name': '1022205', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1022205'}, {'tags': ['x_refsource_MISC'], 'url': 'http://secunia.com/secunia_research/2008-46/'}, {'name': 'TA09-132A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA09-132A.html'}, {'name': '54393', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/54393'}, {'name': '20090512 Secunia Research: Microsoft PowerPoint Atom Parsing Buffer Overflows', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/503451'}, {'name': '34841', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34841'}]
CVE State: PUBLISHED
Explain CVE-2009-1132
Heap-based buffer overflow in the Wireless LAN AutoConfig Service (aka Wlansvc) in Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via a malformed wireless frame, aka "Wireless Frame Parsing Remote Code Execution Vulnerability."
Affected Products: n/a
References: [{'name': 'oval:org.mitre.oval:def:6389', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6389'}, {'name': 'TA09-251A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA09-251A.html'}, {'name': 'MS09-049', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-049'}]
CVE State: PUBLISHED
Explain CVE-2009-1133
Heap-based buffer overflow in Microsoft Remote Desktop Connection (formerly Terminal Services Client) running RDP 5.0 through 6.1 on Windows, and Remote Desktop Connection Client for Mac 2.0, allows remote attackers to execute arbitrary code via unspecified parameters, aka "Remote Desktop Connection Heap Overflow Vulnerability."
Affected Products: n/a
References: [{'name': '1022709', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1022709'}, {'name': 'TA09-223A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA09-223A.html'}, {'name': 'oval:org.mitre.oval:def:5693', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5693'}, {'name': 'ADV-2009-2238', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/2238'}, {'name': '36229', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/36229'}, {'name': 'MS09-044', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-044'}]
CVE State: PUBLISHED
Explain CVE-2009-1134
Excel in 2007 Microsoft Office System SP1 and SP2; Microsoft Office Excel Viewer; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allow remote attackers to execute arbitrary code via a BIFF file with a malformed Qsir (0x806) record object, aka "Record Pointer Corruption Vulnerability."
Affected Products: n/a
References: [{'name': '35246', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35246'}, {'name': '20090610 ZDI-09-040: Microsoft Office Excel QSIR Record Pointer Corruption Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/504213/100/0/threaded'}, {'name': 'ADV-2009-1540', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1540'}, {'name': '1022351', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1022351'}, {'name': 'MS09-021', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-021'}, {'name': '54958', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/54958'}, {'name': 'TA09-160A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA09-160A.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.zerodayinitiative.com/advisories/ZDI-09-040/'}, {'name': 'oval:org.mitre.oval:def:5922', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5922'}]
CVE State: PUBLISHED
Explain CVE-2009-1135
Microsoft Internet Security and Acceleration (ISA) Server 2006 Gold and SP1, when Radius OTP is enabled, uses the HTTP-Basic authentication method, which allows remote attackers to gain the privileges of an arbitrary account, and access published web pages, via vectors involving attempted access to a network resource behind the ISA Server, aka "Radius OTP Bypass Vulnerability."
Affected Products: n/a
References: [{'name': '1022547', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1022547'}, {'name': 'oval:org.mitre.oval:def:5649', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5649'}, {'name': 'MS09-031', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-031'}, {'name': 'ADV-2009-1889', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1889'}, {'name': 'TA09-195A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA09-195A.html'}, {'name': '35784', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35784'}]
CVE State: PUBLISHED
Explain CVE-2009-1136
The Microsoft Office Web Components Spreadsheet ActiveX control (aka OWC10 or OWC11), as distributed in Office XP SP3 and Office 2003 SP3, Office XP Web Components SP3, Office 2003 Web Components SP3, Office 2003 Web Components SP1 for the 2007 Microsoft Office System, Internet Security and Acceleration (ISA) Server 2004 SP3 and 2006 Gold and SP1, and Office Small Business Accounting 2006, when used in Internet Explorer, allows remote attackers to execute arbitrary code via a crafted call to the msDataSourceObject method, as exploited in the wild in July and August 2009, aka "Office Web Components HTML Script Vulnerability."
Affected Products: n/a
References: [{'name': 'oval:org.mitre.oval:def:5809', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5809'}, {'tags': ['x_refsource_MISC'], 'url': 'http://isc.sans.org/diary.html?storyid=6778'}, {'name': 'TA09-223A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA09-223A.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.microsoft.com/technet/security/advisory/973472.mspx'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://blogs.technet.com/srd/archive/2009/07/13/more-information-about-the-office-web-components-activex-vulnerability.aspx'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://blogs.technet.com/msrc/archive/2009/07/13/microsoft-security-advisory-973472-released.aspx'}, {'tags': ['x_refsource_MISC'], 'url': 'http://xeye.us/blog/2009/07/one-0day/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://trac.metasploit.com/browser/framework3/trunk/modules/exploits/windows/browser/owc_spreadsheet_msdso.rb'}, {'name': 'MS09-043', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-043'}]
CVE State: PUBLISHED
Explain CVE-2009-1137
Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3 allows remote attackers to execute arbitrary code via crafted sound data in a file that uses a PowerPoint 4.0 native file format, leading to memory corruption, aka "Legacy File Format Vulnerability," a different vulnerability than CVE-2009-0222, CVE-2009-0223, CVE-2009-0226, and CVE-2009-0227.
Affected Products: n/a
References: [{'name': '32428', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/32428'}, {'name': 'ADV-2009-1290', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1290'}, {'name': 'MS09-017', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-017'}, {'name': '34876', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34876'}, {'name': '54381', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/54381'}, {'name': '1022205', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1022205'}, {'name': 'TA09-132A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA09-132A.html'}, {'name': 'oval:org.mitre.oval:def:5946', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5946'}, {'name': 'powerpoint-sounddata-code-execution(50425)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/50425'}]
CVE State: PUBLISHED
Explain CVE-2009-1138
The LDAP service in Active Directory on Microsoft Windows 2000 SP4 does not properly free memory for LDAP and LDAPS requests, which allows remote attackers to execute arbitrary code via a request that uses hexadecimal encoding, whose associated memory is not released, related to a "DN AttributeValue," aka "Active Directory Invalid Free Vulnerability."  NOTE: this issue is probably a memory leak.
Affected Products: n/a
References: [{'name': '35226', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35226'}, {'name': '20090611 Microsoft Active Directory Hexdecimal DN AttributeValue Invalid Free Vulnerability', 'tags': ['third-party-advisory', 'x_refsource_IDEFENSE'], 'url': 'http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=804'}, {'name': 'oval:org.mitre.oval:def:6180', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6180'}, {'name': 'MS09-018', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-018'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.avaya.com/elmodocs2/security/ASA-2009-214.htm'}, {'name': '1022349', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1022349'}, {'name': 'ADV-2009-1537', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1537'}, {'name': 'TA09-160A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA09-160A.html'}, {'name': '35355', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35355'}, {'name': '54937', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/54937'}]
CVE State: PUBLISHED
Explain CVE-2009-1139
Memory leak in the LDAP service in Active Directory on Microsoft Windows 2000 SP4 and Server 2003 SP2, and Active Directory Application Mode (ADAM) on Windows XP SP2 and SP3 and Server 2003 SP2, allows remote attackers to cause a denial of service (memory consumption and service outage) via (1) LDAP or (2) LDAPS requests with unspecified OID filters, aka "Active Directory Memory Leak Vulnerability."
Affected Products: n/a
References: [{'name': '54938', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/54938'}, {'name': 'MS09-018', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-018'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.avaya.com/elmodocs2/security/ASA-2009-214.htm'}, {'name': '1022349', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1022349'}, {'name': 'ADV-2009-1537', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1537'}, {'name': 'TA09-160A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA09-160A.html'}, {'name': 'oval:org.mitre.oval:def:6253', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6253'}, {'name': '35225', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35225'}, {'name': '35355', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35355'}]
CVE State: PUBLISHED
Explain CVE-2009-1140
Microsoft Internet Explorer 5.01 SP4; 6 SP1; 6 and 7 for Windows XP SP2 and SP3; 6 and 7 for Server 2003 SP2; 7 for Vista Gold, SP1, and SP2; and 7 for Server 2008 SP2 does not prevent HTML rendering of cached content, which allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Cross-Domain Information Disclosure Vulnerability."
Affected Products: n/a
References: [{'name': 'ADV-2009-1538', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1538'}, {'name': 'MS09-019', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-019'}, {'name': 'oval:org.mitre.oval:def:6278', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6278'}, {'name': 'TA09-160A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA09-160A.html'}, {'name': '1022350', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1022350'}]
CVE State: PUBLISHED
Explain CVE-2009-1141
Microsoft Internet Explorer 6 for Windows XP SP2 and SP3 and Server 2003 SP2 allows remote attackers to execute arbitrary code via unspecified DHTML function calls related to a tr element and the "insertion, deletion and attributes of a table cell," which trigger memory corruption when the window is destroyed, aka "DHTML Object Memory Corruption Vulnerability."
Affected Products: n/a
References: [{'name': 'ADV-2009-1538', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1538'}, {'name': 'MS09-019', 'tags': ['vendor-advisory', 'x_refsource_MS'], 'url': 'https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-019'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.fortiguardcenter.com/advisory/FGA-2009-22.html'}, {'name': '20090610 FortiGuard Advisory: Microsoft Internet Explorer DHTML Handling Remote Memory Corruption Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/504207/100/0/threaded'}, {'name': 'oval:org.mitre.oval:def:5554', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5554'}, {'name': 'TA09-160A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA09-160A.html'}, {'name': '1022350', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1022350'}]
CVE State: PUBLISHED
Explain CVE-2009-1142
An issue was discovered in open-vm-tools 2009.03.18-154848. Local users can gain privileges via a symlink attack on /tmp files if vmware-user-suid-wrapper is setuid root and the ChmodChownDirectory function is enabled.
Affected Products: n/a
References: [{'url': 'https://bugs.gentoo.org/264577'}, {'url': 'https://github.com/vmware/open-vm-tools/releases/tag/2009.03.18-154848'}]
CVE State: PUBLISHED
Explain CVE-2009-1143
An issue was discovered in open-vm-tools 2009.03.18-154848. Local users can bypass intended access restrictions on mounting shares via a symlink attack that leverages a realpath race condition in mount.vmhgfs (aka hgfsmounter).
Affected Products: n/a
References: [{'url': 'https://bugs.gentoo.org/264577'}, {'url': 'https://github.com/vmware/open-vm-tools/releases/tag/2009.03.18-154848'}]
CVE State: PUBLISHED
Explain CVE-2009-1144
Untrusted search path vulnerability in the Gentoo package of Xpdf before 3.02-r2 allows local users to gain privileges via a Trojan horse xpdfrc file in the current working directory, related to an unset SYSTEM_XPDFRC macro in a Gentoo build process that uses the poppler library.
Affected Products: n/a
References: [{'name': '34610', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34610'}, {'name': 'GLSA-200904-07', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200904-07.xml'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.gentoo.org/show_bug.cgi?id=200023'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.gentoo.org/show_bug.cgi?id=242930'}, {'name': '34401', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34401'}, {'name': '53529', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/53529'}]
CVE State: PUBLISHED