Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2009-1034
SQL injection vulnerability in the Tasklist module 5.x-1.x before 5.x-1.3 and 5.x-2.x before 5.x-2.0-alpha1, a module for Drupal, allows remote attackers to execute arbitrary SQL commands via values in the URI.
Affected Products: n/a
References: [{'name': 'tasklist-unspecifed-sql-injection(49320)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49320'}, {'name': '34171', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34171'}, {'name': '52781', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/52781'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/406316'}, {'name': '34376', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34376'}]
CVE State: PUBLISHED
Explain CVE-2009-1035
Cross-site scripting (XSS) vulnerability in the Tasklist module 5.x-1.x before 5.x-1.3 and 5.x-2.x before 5.x-2.0-alpha1, a module for Drupal, allows remote authenticated users to inject arbitrary web script or HTML via Cascading Style Sheets (CSS).
Affected Products: n/a
References: [{'name': '52782', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52782'}, {'name': 'tasklist-css-xss(49319)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49319'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/406316'}, {'name': '34376', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34376'}, {'name': '34170', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34170'}]
CVE State: PUBLISHED
Explain CVE-2009-1036
Cross-site request forgery (CSRF) vulnerability in the Plus 1 module before 6.x-2.6, a module for Drupal, allows remote attackers to cast votes for content via unspecified aspects of the URI.
Affected Products: n/a
References: [{'name': '52786', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52786'}, {'name': '34168', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34168'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/405672'}, {'name': 'plus1-unspecified-csrf(49310)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49310'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/406314'}, {'name': '34378', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34378'}]
CVE State: PUBLISHED
Explain CVE-2009-1037
Unspecified vulnerability in the Send by e-mail module in the "Printer, e-mail and PDF versions" module 5.x before 5.x-4.4 and 6.x before 6.x-1.4, a module for Drupal, allows remote attackers to send unlimited spam messages via unknown vectors related to the flood control API.
Affected Products: n/a
References: [{'name': '34173', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34173'}, {'name': '34374', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34374'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/406516'}, {'name': '52785', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52785'}]
CVE State: PUBLISHED
Explain CVE-2009-1038
Multiple SQL injection vulnerabilities in YAP Blog 1.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) image_id parameter to comments.php, and remote authenticated administrators to execute arbitrary SQL commands via the (2) user parameter in a modif action to admin/index.php.
Affected Products: n/a
References: [{'name': '8217', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8217'}, {'name': '52762', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52762'}, {'name': '52761', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52761'}, {'name': '34274', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34274'}]
CVE State: PUBLISHED
Explain CVE-2009-1039
Buffer overflow in CDex 1.70b2 allows remote attackers to execute arbitrary code via a crafted Info header in an Ogg Vorbis (.ogg) file.
Affected Products: n/a
References: [{'name': '34164', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34164'}, {'name': '8231', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8231'}, {'tags': ['x_refsource_MISC'], 'url': 'http://retrogod.altervista.org/9sg_cdex_ogg.html'}, {'name': '20090317 CDex v1.70b2 (.ogg) local buffer overflow exploit poc', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/501928/100/0/threaded'}, {'name': 'cdex-ogg-bo(49304)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49304'}, {'name': '52812', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52812'}]
CVE State: PUBLISHED
Explain CVE-2009-1040
Buffer overflow in WinAsm Studio 5.1.5.0 allows user-assisted remote attackers to execute arbitrary code via a crafted project (.wap) file.
Affected Products: n/a
References: [{'name': 'winasmstudio-wap-bo(49266)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49266'}, {'name': '34132', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34132'}, {'name': '8224', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8224'}, {'name': '52776', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52776'}, {'name': '34309', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34309'}]
CVE State: PUBLISHED
Explain CVE-2009-1041
The ktimer feature (sys/kern/kern_time.c) in FreeBSD 7.0, 7.1, and 7.2 allows local users to overwrite arbitrary kernel memory via an out-of-bounds timer value.
Affected Products: n/a
References: [{'name': 'FreeBSD-SA-09:06', 'tags': ['vendor-advisory', 'x_refsource_FREEBSD'], 'url': 'http://security.freebsd.org/advisories/FreeBSD-SA-09:06.ktimer.asc'}, {'name': '8261', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8261'}, {'name': '1021882', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021882'}, {'name': 'freebsd-ktimer-memory-overwrite(49362)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49362'}, {'name': '34196', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34196'}]
CVE State: PUBLISHED
Explain CVE-2009-1042
Unspecified vulnerability in Apple Safari on Mac OS X 10.5.6 allows remote attackers to execute arbitrary code via unknown vectors triggered by clicking on a link, as demonstrated by Nils during a PWN2OWN competition at CanSecWest 2009.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://dvlabs.tippingpoint.com/blog/2009/03/18/pwn2own-2009-day-1---safari-internet-explorer-and-firefox-taken-down-by-four-zero-day-exploits'}, {'name': 'apple-safari-unspecified-code-execution(49388)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49388'}, {'name': '34183', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34183'}, {'tags': ['x_refsource_MISC'], 'url': 'http://cansecwest.com/index.html'}, {'name': '52888', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52888'}, {'name': '1021879', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021879'}, {'tags': ['x_refsource_MISC'], 'url': 'http://twitter.com/tippingpoint1/status/1351485521'}, {'tags': ['x_refsource_MISC'], 'url': 'http://news.cnet.com/8301-1009_3-10199652-83.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://blogs.zdnet.com/security/?p=2934'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.h-online.com/security/Pwn2Own-2009-Safari-IE-8-and-Firefox-exploited--/news/112889'}, {'tags': ['x_refsource_MISC'], 'url': 'http://dvlabs.tippingpoint.com/blog/2009/02/25/pwn2own-2009'}]
CVE State: PUBLISHED
Explain CVE-2009-1043
Unspecified vulnerability in Microsoft Internet Explorer 8 on Windows 7 allows remote attackers to execute arbitrary code via unknown vectors triggered by clicking on a link, as demonstrated by Nils during a PWN2OWN competition at CanSecWest 2009.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://dvlabs.tippingpoint.com/blog/2009/03/18/pwn2own-2009-day-1---safari-internet-explorer-and-firefox-taken-down-by-four-zero-day-exploits'}, {'name': '1021880', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021880'}, {'tags': ['x_refsource_MISC'], 'url': 'http://dvlabs.tippingpoint.com/blog/2009/03/20/pwn2own-day-2'}, {'tags': ['x_refsource_MISC'], 'url': 'http://cansecwest.com/index.html'}, {'name': '34182', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34182'}, {'tags': ['x_refsource_MISC'], 'url': 'http://news.cnet.com/8301-1009_3-10199652-83.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://blogs.zdnet.com/security/?p=2934'}, {'name': 'microsoft-ie-unspecified-code-execution(49389)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49389'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.h-online.com/security/Pwn2Own-2009-Safari-IE-8-and-Firefox-exploited--/news/112889'}, {'tags': ['x_refsource_MISC'], 'url': 'http://dvlabs.tippingpoint.com/blog/2009/02/25/pwn2own-2009'}, {'name': '52892', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52892'}]
CVE State: PUBLISHED
Explain CVE-2009-1045
requests/status.xml in VLC 0.9.8a allows remote attackers to cause a denial of service (stack consumption and crash) via a long input argument in an in_play action.
Affected Products: n/a
References: [{'name': 'vlcmediaplayer-web-status-bo(49249)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49249'}, {'name': '8213', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8213'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugs.gentoo.org/show_bug.cgi?id=262708'}, {'name': 'oval:org.mitre.oval:def:14357', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14357'}, {'name': '[oss-security] 20090317 CVE request -- firefox, vlc, WeeChat', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2009/03/17/4'}, {'name': '34126', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34126'}]
CVE State: PUBLISHED
Explain CVE-2009-1046
The console selection feature in the Linux kernel 2.6.28 before 2.6.28.4, 2.6.25, and possibly earlier versions, when the UTF-8 console is used, allows physically proximate attackers to cause a denial of service (memory corruption) by selecting a small number of 3-byte UTF-8 characters, which triggers an "off-by-two memory error." NOTE: it is not clear whether this issue crosses privilege boundaries.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.28.4'}, {'name': '[oss-security] 20090212 http://www.securityfocus.com/bid/33672/info kernel issue', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2009/02/12/9'}, {'name': '[oss-security] 20090212 Re: http://www.securityfocus.com/bid/33672/info kernel', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2009/02/12/10'}, {'name': '33672', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33672'}, {'name': 'USN-751-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/usn-751-1'}, {'name': '[linux-kernel] 20090202 Re: [PATCH] Fix memory corruption in console selection', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.openwall.net/linux-kernel/2009/02/02/364'}, {'name': '34981', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34981'}, {'name': 'DSA-1800', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2009/dsa-1800'}, {'name': '[oss-security] 20090212 Re: http://www.securityfocus.com/bid/33672/info kernel issue', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2009/02/12/11'}, {'name': '34917', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34917'}, {'name': 'DSA-1787', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2009/dsa-1787'}, {'name': 'RHSA-2009:0451', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2009-0451.html'}, {'name': '[linux-kernel] 20090130 [PATCH] Fix memory corruption in console selection', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.openwall.net/linux-kernel/2009/01/30/333'}, {'name': '35121', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35121'}]
CVE State: PUBLISHED
Explain CVE-2009-1047
Cross-site scripting (XSS) vulnerability in the Send by e-mail module in the "Printer, e-mail and PDF versions" module 5.x before 5.x-4.4 and 6.x before 6.x-1.4, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via vectors involving outbound HTML e-mail.
Affected Products: n/a
References: [{'name': '52852', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52852'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/406516'}]
CVE State: PUBLISHED
Explain CVE-2009-1048
The web interface on the snom VoIP phones snom 300, snom 320, snom 360, snom 370, and snom 820 with firmware 6.5 before 6.5.20, 7.1 before 7.1.39, and 7.3 before 7.3.14 allows remote attackers to bypass authentication, and reconfigure the phone or make arbitrary use of the phone, via a (1) http or (2) https request with 127.0.0.1 in the Host header.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.csnc.ch/misc/files/advisories/cve-2009-1048.txt'}, {'name': '36293', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/36293'}, {'name': '20090812 Authentication Bypass of Snom Phone Web Interface', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/505723/100/0/threaded'}, {'name': 'snom-httphost-security-bypass(52424)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/52424'}]
CVE State: PUBLISHED
Explain CVE-2009-1049
SQL injection vulnerability in articleCall.php in Bloginator 1A allows remote attackers to execute arbitrary SQL commands via the id parameter.
Affected Products: n/a
References: [{'name': '8244', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8244'}, {'name': '34395', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34395'}, {'name': 'bloginator-articlecall-sql-injection(49325)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49325'}, {'name': '34187', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34187'}, {'name': '8243', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8243'}, {'name': '52839', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52839'}]
CVE State: PUBLISHED
Explain CVE-2009-1050
Bloginator 1A allows remote attackers to bypass authentication and gain administrative access by setting the identifyYourself cookie.
Affected Products: n/a
References: [{'name': '52838', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52838'}, {'name': '34395', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34395'}, {'name': 'bloginator-cookie-security-bypass(49324)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49324'}, {'name': '34187', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34187'}, {'name': '8243', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8243'}]
CVE State: PUBLISHED
Explain CVE-2009-1051
FubarForum 1.6 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing user credentials via a direct request for user.tsv.
Affected Products: n/a
References: [{'name': '20090317 [ECHO_ADV_107$2009] FubarForum <= 1.6 Critical File Disclosure Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/501902/100/0/threaded'}, {'name': '34358', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34358'}, {'tags': ['x_refsource_MISC'], 'url': 'http://e-rdc.org/v1/news.php?readmore=131'}]
CVE State: PUBLISHED
Explain CVE-2009-1052
FireAnt 1.3 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing user credentials via a direct request for user.tsv.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://e-rdc.org/v1/news.php?readmore=130'}, {'name': '34359', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34359'}, {'name': '20090317 [ECHO_ADV_106$2009] FireAnt <= 1.3 Critical File Disclosure Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/501905/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2009-1053
chaozzDB 1.2 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing user credentials via a direct request for user.tsv.
Affected Products: n/a
References: [{'name': '20090317 [ECHO_ADV_105$2009] chaozzDB <= 1.2 Critical File Disclosure Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/501901/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://e-rdc.org/v1/news.php?readmore=129'}]
CVE State: PUBLISHED
Explain CVE-2009-1054
Unspecified vulnerability in JustSystems Ichitaro 13, 2004 through 2008, Lite2, and Ichitaro viewer 5.1.5.0 and earlier allows remote attackers to execute arbitrary code via a crafted file, as exploited in the wild by Trojan.Tarodrop.H in March 2009.
Affected Products: n/a
References: [{'name': '34138', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34138'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.symantec.com/business/security_response/writeup.jsp?docid=2009-031608-2424-99'}, {'name': 'ichitaro-webpuraguinbyua-code-execution(49280)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49280'}, {'name': 'ADV-2009-0769', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0769'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.justsystems.com/jp/info/js09001.html'}, {'name': '34405', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34405'}]
CVE State: PUBLISHED
Explain CVE-2009-1055
Unspecified vulnerability in the web service in Sitecore CMS 5.3.1 rev. 071114 allows remote authenticated users to gain access to security databases, and obtain administrative and user credentials, via unknown vectors related to SOAP and XML requests.
Affected Products: n/a
References: [{'name': '20090317 Sitecore .NET 5.3.x - web service information disclosure', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/501929/100/0/threaded'}, {'name': 'ADV-2009-0753', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0753'}, {'name': 'sitecore-web-service-info-disclosure(49298)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49298'}, {'name': '34162', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34162'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sdn5.sitecore.net/Products/Sitecore%20V5/Sitecore%20CMS%205%2C-d-%2C3/ReleaseNotes/V5%2C-d-%2C3%2C-d-%2C2/ChangeLog.aspx'}, {'name': '34356', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34356'}]
CVE State: PUBLISHED
Explain CVE-2009-1056
IBM Rational AppScan Enterprise before 5.5 FP1 allows remote attackers to read arbitrary exported reports by "forcefully browsing."
Affected Products: n/a
References: [{'name': '34349', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34349'}, {'name': '1021863', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021863'}, {'name': '52764', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52764'}, {'name': 'PK79991', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1PK79991'}, {'name': '34163', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34163'}, {'name': 'ADV-2009-0768', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0768'}]
CVE State: PUBLISHED
Explain CVE-2009-1057
MicroSmarts Enterprise ZipItFast! 3.0 allows remote attackers to execute arbitrary code via a crafted .zip file that triggers memory corruption, related to a "format string buffer overflow." NOTE: CVE has not investigated whether the specified file.zip file can be used for exploitation of this product.
Affected Products: n/a
References: [{'name': '52550', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52550'}, {'name': '34223', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34223'}, {'name': 'zipitfast-zip-bo(49491)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49491'}, {'name': '8180', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8180'}]
CVE State: PUBLISHED
Explain CVE-2009-1058
Stack-based buffer overflow in ZipGenius might allow remote attackers to execute arbitrary code via a crafted .zip file that triggers an SEH overwrite.  NOTE: it is possible that this overlaps CVE-2005-3317. NOTE: CVE has not investigated whether the specified file.zip file can be used for exploitation of this product.
Affected Products: n/a
References: [{'name': 'zipgenius-zip-bo(49490)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49490'}, {'name': '8180', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8180'}]
CVE State: PUBLISHED
Explain CVE-2009-1059
Stack-based buffer overflow in Trident PowerZip 7.2 might allow remote attackers to execute arbitrary code via a crafted .zip file.  NOTE: CVE has not investigated whether the specified file.zip file can be used for exploitation of this product.
Affected Products: n/a
References: [{'name': '8180', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8180'}, {'name': 'powerzip-zip-bo(49492)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49492'}]
CVE State: PUBLISHED
Explain CVE-2009-1060
Unspecified vulnerability in Apple Safari on Mac OS X 10.5.6 allows remote attackers to execute arbitrary code via unknown vectors triggered by clicking on a link, as demonstrated by Charlie Miller during a PWN2OWN competition at CanSecWest 2009.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://dvlabs.tippingpoint.com/blog/2009/03/18/pwn2own-2009-day-1---safari-internet-explorer-and-firefox-taken-down-by-four-zero-day-exploits'}, {'tags': ['x_refsource_MISC'], 'url': 'http://cansecwest.com/index.html'}, {'name': '34179', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34179'}, {'name': '52888', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52888'}, {'name': '1021879', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021879'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9129978'}, {'name': 'apple-safari-unspecified-code-execution1(49463)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49463'}, {'tags': ['x_refsource_MISC'], 'url': 'http://news.cnet.com/8301-1009_3-10199652-83.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://dvlabs.tippingpoint.com/blog/2009/02/25/pwn2own-2009'}]
CVE State: PUBLISHED
Explain CVE-2009-1061
Unspecified vulnerability in Adobe Acrobat Reader 9 before 9.1, 8 before 8.1.4, and 7 before 7.1.1 might allow remote attackers to execute arbitrary code via unknown attack vectors related to JBIG2 and "input validation," a different vulnerability than CVE-2009-0193 and CVE-2009-1062.
Affected Products: n/a
References: [{'name': '34790', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34790'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.adobe.com/support/security/bulletins/apsb09-04.html'}, {'name': '34229', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34229'}, {'name': '34490', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34490'}, {'name': '1021892', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021892'}, {'name': 'RHSA-2009:0376', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2009-0376.html'}, {'name': '34392', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34392'}, {'name': 'SUSE-SA:2009:014', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00005.html'}, {'name': '34706', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34706'}, {'name': '256788', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-66-256788-1'}, {'name': 'GLSA-200904-17', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200904-17.xml'}, {'name': 'SUSE-SR:2009:009', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html'}, {'name': 'ADV-2009-1019', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1019'}]
CVE State: PUBLISHED
Explain CVE-2009-1062
Adobe Acrobat Reader 9 before 9.1, 8 before 8.1.4, and 7 before 7.1.1 might allow remote attackers to trigger memory corruption and possibly execute arbitrary code via unknown attack vectors related to JBIG2, a different vulnerability than CVE-2009-0193 and CVE-2009-1061.
Affected Products: n/a
References: [{'name': '34790', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34790'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.adobe.com/support/security/bulletins/apsb09-04.html'}, {'name': '34229', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34229'}, {'name': '34490', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34490'}, {'name': '1021892', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021892'}, {'name': 'RHSA-2009:0376', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2009-0376.html'}, {'name': '34392', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34392'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.ivizsecurity.com/security-advisory-iviz-sr-09001.html'}, {'name': 'SUSE-SA:2009:014', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00005.html'}, {'name': '34706', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34706'}, {'name': '256788', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-66-256788-1'}, {'name': 'GLSA-200904-17', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200904-17.xml'}, {'name': 'SUSE-SR:2009:009', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html'}, {'name': 'ADV-2009-1019', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1019'}]
CVE State: PUBLISHED
Explain CVE-2009-1063
Buffer overflow in eXeScope 6.50 allows user-assisted remote attackers to execute arbitrary code via a crafted executable (.exe) file.
Affected Products: n/a
References: [{'name': '52868', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52868'}, {'name': 'ADV-2009-0821', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0821'}, {'name': '34413', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34413'}, {'name': 'exescope-exe-bo(49379)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49379'}, {'name': '34219', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34219'}, {'name': '8270', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8270'}]
CVE State: PUBLISHED
Explain CVE-2009-1064
Argument injection vulnerability in orbitmxt.dll 2.1.0.2 in the Orbit Downloader 2.8.7 and earlier ActiveX control allows remote attackers to overwrite arbitrary files via whitespace and a command-line switch, followed by a full pathname, in the third argument to the download method.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.waraxe.us/advisory-73.html'}, {'name': '34200', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34200'}, {'name': '8257', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8257'}, {'name': 'orbitdownloader-activex-file-deletion(49353)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49353'}]
CVE State: PUBLISHED
Explain CVE-2009-1065
SQL injection vulnerability in index.php in Pixie CMS 1.01a allows remote attackers to execute arbitrary SQL commands via the x parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': '52834', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52834'}, {'name': '34364', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34364'}, {'name': 'pixiecms-index-sql-injection(49334)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49334'}]
CVE State: PUBLISHED
Explain CVE-2009-1066
SQL injection vulnerability in the referral function in admin/lib/lib_logs.php in Pixie CMS 1.01a allows remote attackers to execute arbitrary SQL commands via the Referer HTTP header in a request.
Affected Products: n/a
References: [{'name': '34189', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34189'}, {'name': '52833', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52833'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lampsecurity.org/Pixie-CMS-Multiple-Vulnerabilities'}, {'name': '8252', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8252'}, {'name': '20090319 Pixie CMS Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2009-03/0324.html'}, {'name': 'pixiecms-referral-sql-injection(49335)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49335'}, {'name': '34364', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34364'}]
CVE State: PUBLISHED
Explain CVE-2009-1067
Cross-site scripting (XSS) vulnerability in index.php in Pixie CMS 1.01a allows remote attackers to inject arbitrary web script or HTML via the x parameter.
Affected Products: n/a
References: [{'name': '34189', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34189'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lampsecurity.org/Pixie-CMS-Multiple-Vulnerabilities'}, {'name': '52832', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52832'}, {'name': 'pixiecms-index-xss(49333)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49333'}, {'name': '8252', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8252'}, {'name': '20090319 Pixie CMS Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2009-03/0324.html'}, {'name': '34364', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34364'}]
CVE State: PUBLISHED
Explain CVE-2009-1068
Stack-based buffer overflow in BS.Player (bsplayer) 2.32 Build 975 Free and 2.34 Build 980 PRO and earlier allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a long hostname in a .bsl playlist file.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://retrogod.altervista.org/9sg_bsplayer_seh.html'}, {'name': 'bsplayer-bsl-bo(49342)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49342'}, {'name': '34412', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34412'}, {'name': '8251', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8251'}, {'name': 'ADV-2009-0800', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0800'}, {'name': '20090320 Bs.Player <= 2.34 Build 980 (.bsl) local buffer overflow 0day exploit (seh)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/502016/100/0/threaded'}, {'name': '8249', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8249'}, {'name': '52841', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52841'}, {'name': '34190', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34190'}]
CVE State: PUBLISHED
Explain CVE-2009-1069
Multiple cross-site scripting (XSS) vulnerabilities in the node edit form feature in Drupal Content Construction Kit (CCK) 6.x before 6.x-2.2, a module for Drupal, allow remote attackers to inject arbitrary web script or HTML via the (1) titles of candidate referenced nodes in the Node reference sub-module and the (2) names of candidate referenced users in the User reference sub-module.
Affected Products: n/a
References: [{'name': '34172', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34172'}, {'name': '52784', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52784'}, {'name': 'cck-node-user-xss(49317)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49317'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/406520'}, {'name': '52783', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52783'}, {'name': '34370', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34370'}]
CVE State: PUBLISHED
Explain CVE-2009-1070
Cross-site scripting (XSS) vulnerability in system/index.php in ExpressionEngine 1.6.4 through 1.6.6, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via the avatar parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.ngenuity.org/wordpress/2009/01/28/ngenuity-2009-003-expressionengine-persistent-cross-site-scripting/'}, {'name': '20090322 ExpressionEngine Persistent Cross-Site Scripting', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/502045/100/0/threaded'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://expressionengine.com/docs/changelog.html#v167'}, {'name': '34379', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34379'}, {'name': 'expressionengine-avatar-xss(49359)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49359'}, {'name': '34193', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34193'}]
CVE State: PUBLISHED
Explain CVE-2009-1071
Stack-based buffer overflow in Icarus 2.0 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted Portable Game Notation (.pgn) file.
Affected Products: n/a
References: [{'name': 'icarus-pgn-bo(49309)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49309'}, {'name': '34167', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34167'}, {'name': '8236', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8236'}, {'name': '52780', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52780'}, {'name': '34368', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34368'}]
CVE State: PUBLISHED
Explain CVE-2009-1073
nss-ldapd before 0.6.8 uses world-readable permissions for the /etc/nss-ldapd.conf file, which allows local users to obtain a cleartext password for the LDAP server by reading the bindpw field.
Affected Products: n/a
References: [{'name': '[oss-security] 20090324 Re: CVE request -- ucd-snmp / net-snmp, libnss-ldapd / nss_ldap', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2009/03/25/4'}, {'name': '[oss-security] 20090323 CVE request -- ucd-snmp / net-snmp, libnss-ldapd / nss_ldap', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2009/03/23/3'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=520476'}, {'name': '34211', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34211'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://arthurenhella.demon.nl/viewvc/nss-ldapd/nss-ldapd/debian/libnss-ldapd.postinst?r1=795&r2=813'}, {'name': '[oss-security] 20090324 Re: CVE request -- ucd-snmp / net-snmp, libnss-ldapd / nss_ldap', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2009/03/24/2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://arthurenhella.demon.nl/viewvc/nss-ldapd/nss-ldapd/man/nss-ldapd.conf.5.xml?r1=805&r2=806'}, {'name': '[oss-security] 20090324 Re: CVE request -- ucd-snmp / net-snmp, libnss-ldapd / nss_ldap', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2009/03/25/3'}, {'name': '34523', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34523'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ch.tudelft.nl/~arthur/nss-ldapd/news.html#20090322'}, {'tags': ['x_refsource_MISC'], 'url': 'http://launchpad.net/bugs/cve/2009-1073'}, {'name': 'DSA-1758', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2009/dsa-1758'}]
CVE State: PUBLISHED
Explain CVE-2009-1074
Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not use SSL in all expected circumstances, which makes it easier for remote attackers to obtain sensitive information by sniffing the network, related to "ssl termination devices" and lack of support for relative URLs.
Affected Products: n/a
References: [{'name': '253267', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-66-253267-1'}, {'name': '1021881', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1021881'}, {'name': '34191', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34191'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://blogs.sun.com/security/entry/sun_alert_253267_sun_java'}, {'name': 'ADV-2009-0797', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0797'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-21-140935-01-1'}, {'name': '34380', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34380'}]
CVE State: PUBLISHED
Explain CVE-2009-1075
Sun Java System Identity Manager (IdM) 7.0 through 8.0 responds differently to failed use of the Forgot Password feature depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-21-140936-01-1'}, {'name': '253267', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-66-253267-1'}, {'name': '1021881', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1021881'}, {'name': '34191', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34191'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://blogs.sun.com/security/entry/sun_alert_253267_sun_java'}, {'name': 'ADV-2009-0797', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0797'}, {'name': '34380', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34380'}]
CVE State: PUBLISHED
Explain CVE-2009-1076
Sun Java System Identity Manager (IdM) 7.0 through 8.0 responds differently to failed use of the end-user question-based login feature depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-21-140936-01-1'}, {'name': '253267', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-66-253267-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-21-137621-11-1'}, {'name': '1021881', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1021881'}, {'name': '34191', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34191'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://blogs.sun.com/security/entry/sun_alert_253267_sun_java'}, {'name': 'ADV-2009-0797', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0797'}, {'name': '34380', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34380'}]
CVE State: PUBLISHED
Explain CVE-2009-1077
The Change My Password implementation in the admin interface in Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not enforce the RequiresChallenge property setting, which allows remote authenticated users to change the passwords of other users, as demonstrated by changing the administrator's password.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-21-140936-01-1'}, {'name': '253267', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-66-253267-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-21-137621-11-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-21-139010-06-1'}, {'name': '1021881', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1021881'}, {'name': '34191', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34191'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://blogs.sun.com/security/entry/sun_alert_253267_sun_java'}, {'name': 'ADV-2009-0797', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0797'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-21-140935-01-1'}, {'name': '34380', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34380'}]
CVE State: PUBLISHED
Explain CVE-2009-1078
Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not enforce the expected privilege requirements for (1) deleting audit policies and (2) modifying workflows, which allows remote authenticated users to have an unspecified impact.
Affected Products: n/a
References: [{'name': '253267', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-66-253267-1'}, {'name': '1021881', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1021881'}, {'name': '34191', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34191'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://blogs.sun.com/security/entry/sun_alert_253267_sun_java'}, {'name': 'ADV-2009-0797', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0797'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-21-140935-01-1'}, {'name': '34380', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34380'}]
CVE State: PUBLISHED
Explain CVE-2009-1079
Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Identity Manager (IdM) 7.0 through 8.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug IDs 19659, 19660, and 19683.
Affected Products: n/a
References: [{'name': '253267', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-66-253267-1'}, {'name': '1021881', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1021881'}, {'name': '34191', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34191'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://blogs.sun.com/security/entry/sun_alert_253267_sun_java'}, {'name': 'ADV-2009-0797', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0797'}, {'name': '34380', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34380'}]
CVE State: PUBLISHED