Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2009-0813
Insecure method vulnerability in the ImeraIEPlugin ActiveX control (ImeraIEPlugin.dll 1.0.2.54) in Imera TeamLinks Client allows remote attackers to force the download and execution of arbitrary URLs via modified DownloadProtocol, DownloadHost, DownloadPort, and DownloadURI parameters.
Affected Products: n/a
References: [{'name': '8144', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8144'}, {'name': 'imera-imeraieplugin-code-execution(49028)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49028'}, {'name': '34103', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34103'}, {'name': 'ADV-2009-0591', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0591'}]
CVE State: PUBLISHED
Explain CVE-2009-0814
Cross-site scripting (XSS) vulnerability in Widgets.aspx in Blogsa 1.0 Beta 3 and earlier allows remote attackers to inject arbitrary web script or HTML via the searchText parameter.
Affected Products: n/a
References: [{'name': '20090302 Blogsa <= 1.0 Beta 3 XSS Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/501382/100/0/threaded'}, {'name': 'blogsa-widgets-xss(49024)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49024'}, {'name': '33957', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33957'}]
CVE State: PUBLISHED
Explain CVE-2009-0815
The jumpUrl mechanism in class.tslib_fe.php in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1 before 4.1.10, 4.2 before 4.2.6, and 4.3alpha1 leaks a hash secret (juHash) in an error message, which allows remote attackers to read arbitrary files by including the hash in a request.
Affected Products: n/a
References: [{'name': '[oss-security] 20090210 CVE request: typo3 xss (typo3-sa-2009-002)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2009/02/10/6'}, {'name': 'DSA-1720', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2009/dsa-1720'}, {'name': '1021710', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021710'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-002/'}]
CVE State: PUBLISHED
Explain CVE-2009-0816
Multiple cross-site scripting (XSS) vulnerabilities in the backend user interface in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1 before 4.1.10, 4.2 before 4.2.6, and 4.3alpha1 allow remote attackers to inject arbitrary web script or HTML via unspecified fields.
Affected Products: n/a
References: [{'name': '[oss-security] 20090210 CVE request: typo3 xss (typo3-sa-2009-002)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2009/02/10/6'}, {'name': 'DSA-1720', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2009/dsa-1720'}, {'name': '1021709', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021709'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-002/'}]
CVE State: PUBLISHED
Explain CVE-2009-0817
Cross-site scripting (XSS) vulnerability in the Protected Node module 5.x before 5.x-1.4 and 6.x before 6.x-1.5, a module for Drupal, allows remote authenticated users with "administer site configuration" permissions to inject arbitrary web script or HTML via the Password page info field, which is not properly handled by the protected_node_enterpassword function in protected_node.module.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/385950'}, {'name': '34060', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34060'}, {'name': 'protectednode-passwordpage-xss(48980)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48980'}, {'name': 'ADV-2009-0572', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0572'}, {'name': '52300', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52300'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lampsecurity.org/node/28'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/386606'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/386604'}]
CVE State: PUBLISHED
Explain CVE-2009-0818
Cross-site scripting (XSS) vulnerability in the taxonomy_theme_admin_table_builder function (taxonomy_theme_admin.inc) in Taxonomy Theme module before 5.x-1.2, a module for Drupal, allows remote authenticated users with the "administer taxonomy" permission, or the ability to create pages when tagging is enabled, to inject arbitrary web script or HTML via the Vocabulary name (name parameter) to index.php.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': '52285', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52285'}, {'name': '34080', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34080'}, {'name': 'drupal-taxonomy-name-xss(48979)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48979'}, {'name': '33923', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33923'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/386940'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/386942'}]
CVE State: PUBLISHED
Explain CVE-2009-0819
sql/item_xmlfunc.cc in MySQL 5.1 before 5.1.32 and 6.0 before 6.0.10 allows remote authenticated users to cause a denial of service (crash) via "an XPath expression employing a scalar expression as a FilterExpr with ExtractValue() or UpdateXML()," which triggers an assertion failure.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://dev.mysql.com/doc/refman/5.1/en/news-5-1-32.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://dev.mysql.com/doc/refman/6.0/en/news-6-0-10.html'}, {'name': 'mysql-xpath-dos(49050)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49050'}, {'name': '34115', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34115'}, {'name': 'ADV-2009-0594', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0594'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.mysql.com/bug.php?id=42495'}, {'name': '33972', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33972'}, {'name': '1021786', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021786'}, {'name': 'oval:org.mitre.oval:def:7544', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7544'}]
CVE State: PUBLISHED
Explain CVE-2009-0820
Multiple eval injection vulnerabilities in phpScheduleIt before 1.2.11 allow remote attackers to execute arbitrary code via (1) the end_date parameter to reserve.php and (2) the start_date and end_date parameters to check.php.  NOTE: the start_date/reserve.php vector is already covered by CVE-2008-6132.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://phpscheduleit.svn.sourceforge.net/viewvc/phpscheduleit/1.2.11/reserve.php?r1=318&r2=328'}, {'name': 'ADV-2009-0491', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0491'}, {'name': '33991', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33991'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://phpscheduleit.svn.sourceforge.net/viewvc/phpscheduleit/1.2.11/check.php?r1=318&r2=332'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/project/shownotes.php?release_id=662749'}]
CVE State: PUBLISHED
Explain CVE-2009-0821
Mozilla Firefox 2.0.0.20 and earlier allows remote attackers to cause a denial of service (application crash) via nested calls to the window.print function, as demonstrated by a window.print(window.print()) in the onclick attribute of an INPUT element.
Affected Products: n/a
References: [{'name': '33969', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33969'}, {'tags': ['x_refsource_MISC'], 'url': 'http://downloads.securityfocus.com/vulnerabilities/exploits/33969.html'}]
CVE State: PUBLISHED
Explain CVE-2009-0824
Elaborate Bytes ElbyCDIO.sys 6.0.2.0 and earlier, as distributed in SlySoft AnyDVD before 6.5.2.6, Virtual CloneDrive 5.4.2.3 and earlier, CloneDVD 2.9.2.0 and earlier, and CloneCD 5.3.1.3 and earlier, uses the METHOD_NEITHER communication method for IOCTLs and does not properly validate a buffer associated with the Irp object, which allows local users to cause a denial of service (system crash) via a crafted IOCTL call.
Affected Products: n/a
References: [{'name': '34288', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34288'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.slysoft.com/download/changes_clonedvd.txt'}, {'name': 'slysoft-elbycdio-dos(49232)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49232'}, {'name': '34289', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34289'}, {'name': '34269', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34269'}, {'name': '34287', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34287'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.slysoft.com/download/changes_anydvd.txt'}, {'tags': ['x_refsource_MISC'], 'url': 'http://en.securitylab.ru/lab/PT-2009-11'}, {'name': '34103', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34103'}, {'name': '52679', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52679'}, {'name': '20090312 [Suspected Spam][PT-2009-11] SlySoft Multiple Products ElbyCDIO.sys Denial of Service', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/501713/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2009-0825
SQL injection vulnerability in system/rss.php in TinX/cms 3.x before 3.5.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/project/showfiles.php?group_id=133415'}, {'name': '20090306 [Positive Technologies SA:2009-13] TinX CMS 3.x SQL Injection Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/501547/100/0/threaded'}, {'name': '34021', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34021'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/project/shownotes.php?group_id=133415&release_id=658540'}, {'tags': ['x_refsource_MISC'], 'url': 'http://en.securitylab.ru/lab/PT-2009-13'}, {'name': 'tinxcms-rss-sql-injection(49115)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49115'}, {'name': '34178', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34178'}]
CVE State: PUBLISHED
Explain CVE-2009-0826
BlogHelper stores common_db.inc under the web root with insufficient access control, which allows remote attackers to download the database file containing user credentials via a direct request.
Affected Products: n/a
References: [{'name': '7689', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/7689'}, {'name': '33384', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33384'}, {'name': 'bloghelper-commondb-info-disclosure(47799)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/47799'}]
CVE State: PUBLISHED
Explain CVE-2009-0827
PollHelper stores poll.inc under the web root with insufficient access control, which allows remote attackers to download the database file containing user credentials via a direct request.
Affected Products: n/a
References: [{'name': '33378', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33378'}, {'name': '51185', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/51185'}, {'name': '7690', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/7690'}, {'name': 'pollhelper-poll-info-disclosure(47797)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/47797'}]
CVE State: PUBLISHED
Explain CVE-2009-0828
QuoteBook stores quotes.inc under the web root with insufficient access control, which allows remote attackers to obtain sensitive database information, including user credentials, via a direct request.
Affected Products: n/a
References: [{'name': '7699', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/7699'}, {'name': '33166', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33166'}, {'name': '33420', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33420'}]
CVE State: PUBLISHED
Explain CVE-2009-0829
Multiple SQL injection vulnerabilities in QuoteBook allow remote attackers to execute arbitrary SQL commands via the (1) MyBox and (2) selectFavorites parameters to (a) quotes.php and the (3) QuoteName and (4) QuoteText parameters to (b) quotesadd.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': '33166', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33166'}, {'name': '33420', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33420'}]
CVE State: PUBLISHED
Explain CVE-2009-0830
Cross-site scripting (XSS) vulnerability in QuoteBook allows remote attackers to inject arbitrary web script or HTML via the (1) QuoteName and (2) QuoteText parameters to quotesadd.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': '33166', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33166'}, {'name': '33420', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33420'}]
CVE State: PUBLISHED
Explain CVE-2009-0831
SQL injection vulnerability in members.php in the Members CV (job) module 1.0 for PHP-Fusion, when magic_quotes_gpc is disabled, allows remote authenticated users to execute arbitrary SQL commands via the sortby parameter.
Affected Products: n/a
References: [{'name': '33424', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33424'}, {'name': '7697', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/7697'}, {'name': '33156', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33156'}]
CVE State: PUBLISHED
Explain CVE-2009-0832
SQL injection vulnerability in items.php in the E-Cart module 1.3 for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the CA parameter.
Affected Products: n/a
References: [{'name': '7698', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/7698'}, {'name': '33155', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33155'}, {'name': '20090107 PHP-Fusion Mod E-Cart Sql Injection', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/499835/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2009-0833
Heap-based buffer overflow in gen_msn.dll in the gen_msn plugin 0.31 for Winamp 5.541 allows remote attackers to execute arbitrary code via a playlist (.pls) file with a long URL in the File1 field.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': '7696', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/7696'}, {'name': '33159', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33159'}, {'name': '33425', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33425'}, {'name': 'oval:org.mitre.oval:def:15659', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15659'}]
CVE State: PUBLISHED
Explain CVE-2009-0836
Foxit Reader 2.3 before Build 3902 and 3.0 before Build 1506, including 1120 and 1301, does not require user confirmation before performing dangerous actions defined in a PDF file, which allows remote attackers to execute arbitrary programs and have unspecified other impact via a crafted file, as demonstrated by the "Open/Execute a file" action.
Affected Products: n/a
References: [{'name': '20090309 Foxit Reader Multiple Vulnerabilities (CORE-2009-0218)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/501623/100/0/threaded'}, {'name': '34036', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34036'}, {'name': '[dailydave] 20100402 0day, it may not be', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.immunitysec.com/pipermail/dailydave/2010-April/006079.html'}, {'name': 'ADV-2009-0634', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0634'}, {'name': '1021824', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021824'}, {'name': '34035', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34035'}, {'tags': ['x_refsource_MISC'], 'url': 'http://blog.zoller.lu/2009/03/remote-code-execution-in-pdf-still.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.coresecurity.com/content/foxit-reader-vulnerabilities'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.foxitsoftware.com/pdf/reader/security.htm#bypass'}]
CVE State: PUBLISHED
Explain CVE-2009-0837
Stack-based buffer overflow in Foxit Reader 3.0 before Build 1506, including 1120 and 1301, allows remote attackers to execute arbitrary code via a long (1) relative path or (2) absolute path in the filename argument in an action, as demonstrated by the "Open/Execute a file" action.
Affected Products: n/a
References: [{'name': '20090309 Foxit Reader Multiple Vulnerabilities (CORE-2009-0218)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/501623/100/0/threaded'}, {'name': '34036', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34036'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.foxitsoftware.com/pdf/reader/security.htm#Stackbased'}, {'name': 'ADV-2009-0634', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0634'}, {'name': '1021824', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021824'}, {'name': '34035', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34035'}, {'name': 'foxitreader-pdf-bo(49136)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49136'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.coresecurity.com/content/foxit-reader-vulnerabilities'}]
CVE State: PUBLISHED
Explain CVE-2009-0838
The crypto pseudo device driver in Sun Solaris 10, and OpenSolaris snv_88 through snv_102, does not properly free memory, which allows local users to cause a denial of service (panic) via unspecified vectors, related to the vmem_hash_delete function.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-21-139498-04-1'}, {'name': '1021810', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1021810'}, {'name': '34000', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34000'}, {'name': 'ADV-2009-0606', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0606'}, {'name': 'sun-solaris-cryptodriver-dos(49105)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49105'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.avaya.com/elmodocs2/security/ASA-2009-097.htm'}, {'name': 'ADV-2009-0815', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0815'}, {'name': '254088', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-66-254088-1'}, {'name': 'oval:org.mitre.oval:def:5641', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5641'}, {'name': '34149', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34149'}, {'name': '34455', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34455'}]
CVE State: PUBLISHED
Explain CVE-2009-0839
Stack-based buffer overflow in mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2, when the server has a map with a long IMAGEPATH or NAME attribute, allows remote attackers to execute arbitrary code via a crafted id parameter in a query action.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.positronsecurity.com/advisories/2009-000.html'}, {'name': '1021952', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021952'}, {'name': '20090330 Positron Security Advisory #2009-000: Multiple Vulnerabilities in MapServer v5.2.1 and v4.10.3', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/502271/100/0/threaded'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://trac.osgeo.org/mapserver/ticket/2944'}, {'name': '34603', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34603'}, {'name': 'FEDORA-2009-3383', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00170.html'}, {'name': '34306', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34306'}, {'name': '34520', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34520'}, {'name': 'DSA-1914', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2009/dsa-1914'}, {'name': 'FEDORA-2009-3357', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00147.html'}, {'name': '[mapserver-users] 20090326 MapServer 5.2.2 and 4.10.4 released with security fixes', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.html'}]
CVE State: PUBLISHED
Explain CVE-2009-0840
Heap-based buffer underflow in the readPostBody function in cgiutil.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to have an unknown impact via a negative value in the Content-Length HTTP header.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.positronsecurity.com/advisories/2009-000.html'}, {'name': '1021952', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021952'}, {'name': '20090330 Positron Security Advisory #2009-000: Multiple Vulnerabilities in MapServer v5.2.1 and v4.10.3', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/502271/100/0/threaded'}, {'name': '34603', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34603'}, {'name': 'FEDORA-2009-3383', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00170.html'}, {'name': '34306', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34306'}, {'name': '34520', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34520'}, {'name': 'DSA-1914', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2009/dsa-1914'}, {'name': 'mapserver-contentlength-bo(49545)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49545'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://trac.osgeo.org/mapserver/ticket/2943'}, {'name': 'FEDORA-2009-3357', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00147.html'}, {'name': '[mapserver-users] 20090326 MapServer 5.2.2 and 4.10.4 released with security fixes', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.html'}]
CVE State: PUBLISHED
Explain CVE-2009-0841
Directory traversal vulnerability in mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2, when running on Windows with Cygwin, allows remote attackers to create arbitrary files via a .. (dot dot) in the id parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.positronsecurity.com/advisories/2009-000.html'}, {'name': '1021952', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021952'}, {'name': '20090330 Positron Security Advisory #2009-000: Multiple Vulnerabilities in MapServer v5.2.1 and v4.10.3', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/502271/100/0/threaded'}, {'name': '34603', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34603'}, {'name': 'FEDORA-2009-3383', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00170.html'}, {'name': '34306', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34306'}, {'name': '34520', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34520'}, {'name': 'DSA-1914', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2009/dsa-1914'}, {'name': 'mapserver-mapserv-dir-traversal(49548)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49548'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://trac.osgeo.org/mapserver/ticket/2942'}, {'name': 'FEDORA-2009-3357', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00147.html'}, {'name': '[mapserver-users] 20090326 MapServer 5.2.2 and 4.10.4 released with security fixes', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.html'}]
CVE State: PUBLISHED
Explain CVE-2009-0842
mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to read arbitrary invalid .map files via a full pathname in the map parameter, which triggers the display of partial file contents within an error message, as demonstrated by a /tmp/sekrut.map symlink.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://trac.osgeo.org/mapserver/ticket/2941'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.positronsecurity.com/advisories/2009-000.html'}, {'name': '1021952', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021952'}, {'name': '20090330 Positron Security Advisory #2009-000: Multiple Vulnerabilities in MapServer v5.2.1 and v4.10.3', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/502271/100/0/threaded'}, {'name': '34603', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34603'}, {'name': 'FEDORA-2009-3383', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00170.html'}, {'name': '34306', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34306'}, {'name': '34520', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34520'}, {'name': 'DSA-1914', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2009/dsa-1914'}, {'name': 'FEDORA-2009-3357', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00147.html'}, {'name': '[mapserver-users] 20090326 MapServer 5.2.2 and 4.10.4 released with security fixes', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.html'}]
CVE State: PUBLISHED
Explain CVE-2009-0843
The msLoadQuery function in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to determine the existence of arbitrary files via a full pathname in the queryfile parameter, which triggers different error messages depending on whether this pathname exists.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.positronsecurity.com/advisories/2009-000.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://trac.osgeo.org/mapserver/ticket/2939'}, {'name': '1021952', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021952'}, {'name': '20090330 Positron Security Advisory #2009-000: Multiple Vulnerabilities in MapServer v5.2.1 and v4.10.3', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/502271/100/0/threaded'}, {'name': '34603', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34603'}, {'name': 'FEDORA-2009-3383', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00170.html'}, {'name': '34306', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34306'}, {'name': '34520', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34520'}, {'name': 'DSA-1914', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2009/dsa-1914'}, {'name': 'FEDORA-2009-3357', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00147.html'}, {'name': '[mapserver-users] 20090326 MapServer 5.2.2 and 4.10.4 released with security fixes', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.html'}]
CVE State: PUBLISHED
Explain CVE-2009-0848
Untrusted search path vulnerability in GTK2 in OpenSUSE 11.0 and 11.1 allows local users to execute arbitrary code via a Trojan horse GTK module in an unspecified "relative search path."
Affected Products: n/a
References: [{'name': '34259', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34259'}, {'name': 'SUSE-SR:2009:006', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.html'}, {'name': 'opensuse-gtk2-code-execution(49228)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49228'}]
CVE State: PUBLISHED
Explain CVE-2009-0849
Stack-based buffer overflow in the DtbClsLogin function in NovaStor NovaNET 12 allows remote attackers to (1) execute arbitrary code on Linux platforms via a long username field during backup domain authentication, related to libnnlindtb.so; or (2) cause a denial of service (daemon crash) on Windows platforms via a long username field during backup domain authentication, related to nnwindtb.dll.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': 'novanet-dtbclslogin-bo(49074)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49074'}, {'name': '33954', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33954'}, {'name': '34024', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34024'}, {'name': '52301', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52301'}, {'name': '52302', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52302'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.insight-tech.org/index.php?p=NovaNET-12-Remote-Buffer-Oveflow'}]
CVE State: PUBLISHED
Explain CVE-2009-0850
Cross-site scripting (XSS) vulnerability in BitDefender Internet Security 2009 allows user-assisted remote attackers to inject arbitrary web script or HTML via the filename of a virus-infected file, as demonstrated by a filename inside a (1) rar or (2) zip archive file.
Affected Products: n/a
References: [{'name': '33921', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33921'}, {'name': '20090227 Re: BitDefender Internet Security XSS', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/501299/100/0/threaded'}, {'name': '34082', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34082'}, {'name': '20090226 BitDefender Internet Security XSS', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/501277/100/0/threaded'}, {'name': 'ADV-2009-0557', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0557'}]
CVE State: PUBLISHED
Explain CVE-2009-0851
Multiple SQL injection vulnerabilities in CelerBB 0.0.2, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) viewforum.php and (2) viewtopic.php.
Affected Products: n/a
References: [{'name': '34014', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34014'}, {'name': '8161', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8161'}, {'name': '20090305 CelerBB 0.0.2 Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/501481/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2009-0852
showme.php in CelerBB 0.0.2 allows remote attackers to obtain "reserved information" via the user parameter.
Affected Products: n/a
References: [{'name': '34014', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34014'}, {'name': '8161', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8161'}, {'name': '20090305 CelerBB 0.0.2 Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/501481/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2009-0853
login.php in CelerBB 0.0.2, when magic_quotes_gpc is disabled, allows remote attackers to bypass authentication and obtain administrative access via special characters in the Username parameter, as demonstrated by an admin'# parameter value.
Affected Products: n/a
References: [{'name': '34014', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34014'}, {'name': '8161', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8161'}, {'name': '20090305 CelerBB 0.0.2 Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/501481/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2009-0854
Untrusted search path vulnerability in dash 0.5.4, when used as a login shell, allows local users to execute arbitrary code via a Trojan horse .profile file in the current working directory.
Affected Products: n/a
References: [{'name': '34092', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34092'}, {'name': 'USN-732-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-732-1'}, {'name': 'dash-profile-code-execution(49216)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49216'}, {'name': '34205', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34205'}]
CVE State: PUBLISHED
Explain CVE-2009-0855
Cross-site scripting (XSS) vulnerability in the administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.23 on z/OS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': 'ADV-2009-0854', 'tags': ['vdb-entry'], 'url': 'http://www.vupen.com/english/advisories/2009/0854'}, {'name': '34259', 'tags': ['vdb-entry'], 'url': 'http://www.securityfocus.com/bid/34259'}, {'name': 'ADV-2009-0607', 'tags': ['vdb-entry'], 'url': 'http://www.vupen.com/english/advisories/2009/0607'}, {'name': '34131', 'tags': ['third-party-advisory'], 'url': 'http://secunia.com/advisories/34131'}, {'name': '34461', 'tags': ['third-party-advisory'], 'url': 'http://secunia.com/advisories/34461'}, {'name': 'PK81212', 'tags': ['vendor-advisory'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1PK81212'}, {'name': 'PK77505', 'tags': ['vendor-advisory'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1PK77505'}, {'name': '34001', 'tags': ['vdb-entry'], 'url': 'http://www.securityfocus.com/bid/34001'}, {'name': 'PK82988', 'tags': ['vendor-advisory'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1PK82988'}, {'url': 'http://packetstormsecurity.com/files/170073/IBM-Websphere-Application-Server-7.0-Cross-Site-Scripting.html'}]
CVE State: PUBLISHED
Explain CVE-2009-0856
Multiple cross-site scripting (XSS) vulnerabilities in sample applications in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.35, and 6.1 before 6.1.0.23 on z/OS, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': 'ADV-2009-0607', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0607'}, {'name': 'PK81212', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1PK81212'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg27006876'}, {'name': '1021811', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1021811'}, {'name': 'PK76720', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1PK76720'}, {'name': '34001', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34001'}, {'name': 'ADV-2009-1464', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1464'}]
CVE State: PUBLISHED
Explain CVE-2009-0857
Cross-site scripting (XSS) vulnerability in /prm/reports in the Performance Reporting Module (PRM) for Sun Management Center (SunMC) 3.6.1 and 4.0 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.  NOTE: this can be leveraged for access to the SunMC Web Console.
Affected Products: n/a
References: [{'name': '33999', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33999'}, {'name': 'sunmc-performancereportingmodule-xss(49076)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49076'}, {'name': 'ADV-2009-0605', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0605'}, {'name': '34146', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34146'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-21-125191-04-1'}, {'name': '247046', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-66-247046-1'}, {'name': '1021809', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1021809'}]
CVE State: PUBLISHED
Explain CVE-2009-0858
The response_addname function in response.c in Daniel J. Bernstein djbdns 1.05 and earlier does not constrain offsets in the required manner, which allows remote attackers, with control over a third-party subdomain served by tinydns and axfrdns, to trigger DNS responses containing arbitrary records via crafted zone data for this subdomain.
Affected Products: n/a
References: [{'name': '35820', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35820'}, {'name': '20090228 Re: djbdns misformats some long response packets; patch and example attack', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/501340/100/0/threaded'}, {'name': 'djbdns-response-packet-spoofing(49003)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49003'}, {'name': '20090305 Re: djbdns misformats some long response packets; patch and example attack', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/501479/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://securityandthe.net/2009/03/05/security-issue-in-djbdns-confirmed/'}, {'name': 'DSA-1831', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2009/dsa-1831'}, {'name': '[dns] 20090304 djbdns<=1.05 lets AXFRed subdomains overwrite domains', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://marc.info/?l=djbdns&m=123613000920446&w=2'}, {'name': '33937', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33937'}, {'name': '20090226 djbdns misformats some long response packets; patch and example attack', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/501294/100/0/threaded'}, {'name': '[dns] 20090225 djbdns misformats some long response packets; patch and example', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://marc.info/?l=djbdns&m=123554945710038'}, {'tags': ['x_refsource_MISC'], 'url': 'http://it.slashdot.org/article.pl?sid=09/03/05/2014249'}]
CVE State: PUBLISHED
Explain CVE-2009-0860
Cross-site scripting (XSS) vulnerability in the web user interface in the login application in NetMRI 3.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to error pages.
Affected Products: n/a
References: [{'name': '33824', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33824'}, {'name': '33963', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33963'}, {'name': '20090218 DDIVRT-2009-20 NetMRI Login Application Cross-site Scripting Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/501033/100/0/threaded'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://connection.netcordia.com/forums/t/731.aspx'}]
CVE State: PUBLISHED
Explain CVE-2009-0861
Cross-site scripting (XSS) vulnerability in phpDenora before 1.2.3 allows remote attackers to inject arbitrary web script or HTML via an IRC channel name.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': '51981', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/51981'}, {'name': '33960', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33960'}, {'name': 'phpdenora-ircchannel-xss(48799)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48799'}, {'name': '33822', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33822'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/project/shownotes.php?release_id=661189'}]
CVE State: PUBLISHED
Explain CVE-2009-0862
Cross-site scripting (XSS) vulnerability in the hook_cntrlr_error_output function in modules/page/hooks/listeners.php in the admincp component in TangoCMS 2.2.x (aka Eagle) before 2.2.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://tangocms.org/article/view/2.2.4-released'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://tangocms.org/changelog'}, {'name': '33833', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33833'}, {'name': '33967', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33967'}]
CVE State: PUBLISHED
Explain CVE-2009-0863
SQL injection vulnerability in admin/delete_page.php in S-Cms 1.1 Stable allows remote attackers to execute arbitrary SQL commands via the id parameter.
Affected Products: n/a
References: [{'name': '33799', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33799'}, {'name': 'scms-deletepage-sql-injection(48806)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48806'}, {'name': '8071', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8071'}]
CVE State: PUBLISHED
Explain CVE-2009-0864
S-Cms 1.1 Stable allows remote attackers to bypass authentication and obtain administrative access via an OK value for the login cookie.
Affected Products: n/a
References: [{'name': '33799', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33799'}, {'name': 'scms-cookie-security-bypass(48805)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48805'}, {'name': '8071', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8071'}]
CVE State: PUBLISHED
Explain CVE-2009-0865
Directory traversal vulnerability in the SnapShotToFile method in the GeoVision LiveX (aka LiveX_v8200) ActiveX control 8.1.2 and 8.2.0 in LIVEX_~1.OCX allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in the argument, possibly involving the PlayX and SnapShotX methods.
Affected Products: n/a
References: [{'name': 'geovision-livex-activex-file-overwrite(48773)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48773'}, {'name': '8059', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8059'}, {'name': '33969', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33969'}, {'name': '33782', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33782'}]
CVE State: PUBLISHED