Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2009-0647
msnmsgr.exe in Windows Live Messenger (WLM) 2009 build 14.0.8064.206, and other 14.0.8064.x builds, allows remote attackers to cause a denial of service (application crash) via a modified header in a packet, as possibly demonstrated by a UTF-8.0 value of the charset field in the Content-Type header line.  NOTE: this has been reported as a format string vulnerability by some sources, but the provenance of that information is unknown.
Affected Products: n/a
References: [{'name': '33985', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33985'}, {'name': 'ADV-2009-0466', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0466'}, {'name': 'wlm-packets-dos(48810)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48810'}, {'name': '33825', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33825'}, {'name': '20090218 RE: hello bug in windows live messenger', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/501043/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2009-0648
Multiple cross-site request forgery (CSRF) vulnerabilities in the manage_users handler in admin/index.php in Falt4 CMS (aka Falt4 Extreme) RC4 allow remote attackers to hijack the authentication of administrators for requests that change passwords via the (1) edit and (2) edit_now actions.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstorm.linuxsecurity.com/0902-exploits/falt4-cms-xsrf.txt'}, {'name': '33973', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33973'}, {'name': 'falt4-admin-index-csrf(48786)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48786'}]
CVE State: PUBLISHED
Explain CVE-2009-0649
The web browser in Symbian OS on the Nokia N95 cell phone allows remote attackers to cause a denial of service (crash) via JavaScript code that calls the setAttributeNode method.
Affected Products: n/a
References: [{'name': '8051', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8051'}, {'name': '33767', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33767'}, {'name': '20090213 Nokia N95 browser "setAttributeNode" method crash', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/500954/100/0/threaded'}, {'name': 'nokian95-setattributenode-dos(48763)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48763'}]
CVE State: PUBLISHED
Explain CVE-2009-0650
Stack-based buffer overflow in the GetStatsFromLine function in TPTEST 3.1.7 and earlier, and possibly 5.02, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a STATS line with a long pwd field.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': 'tptest-pwd-bo(48781)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48781'}, {'name': '33972', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33972'}, {'name': '33785', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33785'}, {'name': '8058', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8058'}]
CVE State: PUBLISHED
Explain CVE-2009-0651
Unspecified vulnerability in the Veritas network daemon (aka vnetd) in Symantec Veritas NetBackup Server / Enterprise Server 5.x, 6.0 before MP7 SP1, and 6.5 before 6.5.3.1 allows remote attackers to execute arbitrary code via unknown vectors related to "initial communications setup."
Affected Products: n/a
References: [{'name': 'veritas-netbackup-vnetd-privilege-escalation(48795)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48795'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://securityresponse.symantec.com/avcenter/security/Content/2009.02.17.html'}, {'name': 'ADV-2009-1097', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1097'}, {'name': '1021734', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021734'}, {'name': '33772', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33772'}, {'name': '253287', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-66-253287-1'}, {'name': 'ADV-2009-0461', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0461'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://seer.entsupport.symantec.com/docs/317828.htm'}, {'name': '52269', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52269'}, {'name': '33953', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33953'}]
CVE State: PUBLISHED
Explain CVE-2009-0653
OpenSSL, probably 0.9.6, does not verify the Basic Constraints for an intermediate CA-signed certificate, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack, a related issue to CVE-2002-0970.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.blackhat.com/presentations/bh-dc-09/Marlinspike/BlackHat-DC-09-Marlinspike-Defeating-SSL.pdf'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.blackhat.com/html/bh-dc-09/bh-dc-09-speakers.html#Marlinspike'}]
CVE State: PUBLISHED
Explain CVE-2009-0654
Tor 0.2.0.28, and probably 0.2.0.34 and earlier, allows remote attackers, with control of an entry router and an exit router, to confirm that a sender and receiver are communicating via vectors involving (1) replaying, (2) modifying, (3) inserting, or (4) deleting a single cell, and then observing cell recognition errors at the exit router.  NOTE: the vendor disputes the significance of this issue, noting that the product's design "accepted end-to-end correlation as an attack that is too expensive to solve."
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.blackhat.com/presentations/bh-dc-09/Fu/BlackHat-DC-09-Fu-Break-Tors-Anonymity.pdf'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.blackhat.com/html/bh-dc-09/bh-dc-09-archives.html#Fu'}, {'tags': ['x_refsource_MISC'], 'url': 'http://blog.torproject.org/blog/one-cell-enough'}]
CVE State: PUBLISHED
Explain CVE-2009-0655
Lenovo Veriface III allows physically proximate attackers to login to a Windows account by presenting a "plain image" of the authorized user.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.blackhat.com/presentations/bh-dc-09/Nguyen/BlackHat-DC-09-Nguyen-Face-not-your-password.pdf'}, {'name': '20081208 [SVRT-07-08] Vulnerability in Face Recognition Authentication Mechanism of Lenovo-Asus-Toshiba Laptops', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/498997'}, {'name': '32700', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/32700'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.blackhat.com/html/bh-dc-09/bh-dc-09-archives.html#Nguyen'}, {'tags': ['x_refsource_MISC'], 'url': 'http://security.bkis.vn/?p=292'}, {'name': 'lenovo-plainimage-unauth-access(48961)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48961'}]
CVE State: PUBLISHED
Explain CVE-2009-0656
Asus SmartLogon 1.0.0005 allows physically proximate attackers to bypass "security functions" by presenting an image with a modified viewpoint that matches the posture of a stored image of the authorized notebook user.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.blackhat.com/presentations/bh-dc-09/Nguyen/BlackHat-DC-09-Nguyen-Face-not-your-password.pdf'}, {'name': '20081208 [SVRT-07-08] Vulnerability in Face Recognition Authentication Mechanism of Lenovo-Asus-Toshiba Laptops', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/498997'}, {'name': '32700', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/32700'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.blackhat.com/html/bh-dc-09/bh-dc-09-archives.html#Nguyen'}, {'name': 'asus-image-security-bypass(48962)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48962'}, {'tags': ['x_refsource_MISC'], 'url': 'http://security.bkis.vn/?p=292'}]
CVE State: PUBLISHED
Explain CVE-2009-0657
Toshiba Face Recognition 2.0.2.32 allows physically proximate attackers to obtain notebook access by presenting a large number of images for which the viewpoint and lighting have been modified to match a stored image of the authorized notebook user.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.blackhat.com/presentations/bh-dc-09/Nguyen/BlackHat-DC-09-Nguyen-Face-not-your-password.pdf'}, {'name': '20081208 [SVRT-07-08] Vulnerability in Face Recognition Authentication Mechanism of Lenovo-Asus-Toshiba Laptops', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/498997'}, {'name': 'toshibaface-notebook-unauth-access(48963)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48963'}, {'name': '32700', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/32700'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.blackhat.com/html/bh-dc-09/bh-dc-09-archives.html#Nguyen'}, {'tags': ['x_refsource_MISC'], 'url': 'http://security.bkis.vn/?p=292'}]
CVE State: PUBLISHED
Explain CVE-2009-0659
Stack-based buffer overflow in the GetStatsFromLine function in TPTEST 3.1.7 allows remote attackers to have an unknown impact via a STATS line with a long email field.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': 'tptest-pwd-bo(48781)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48781'}, {'name': '33972', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33972'}, {'name': 'tptest-getstatsfromline-bo(48953)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48953'}]
CVE State: PUBLISHED
Explain CVE-2009-0660
Multiple cross-site scripting (XSS) vulnerabilities in Mahara 1.0 before 1.0.10 and 1.1 before 1.1.2 allow remote attackers to inject arbitrary web script or HTML via a (1) profile and (2) blog, a different vulnerability than CVE-2009-0487.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://mahara.org/interaction/forum/topic.php?id=350'}, {'name': '34231', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34231'}, {'name': '34064', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34064'}, {'name': '34222', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34222'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://wiki.mahara.org/Release_Notes/1.1.2'}, {'name': 'ADV-2009-0665', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0665'}, {'name': 'DSA-1736', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2009/dsa-1736'}, {'name': 'mahara-userprofile-xss(49168)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49168'}]
CVE State: PUBLISHED
Explain CVE-2009-0661
Wee Enhanced Environment for Chat (WeeChat) 0.2.6 allows remote attackers to cause a denial of service (crash) via an IRC PRIVMSG command containing crafted color codes that trigger an out-of-bounds read.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://savannah.nongnu.org/bugs/index.php?25862'}, {'name': '34148', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34148'}, {'name': '34304', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34304'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://weechat.flashtux.org/'}, {'name': '52763', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52763'}, {'name': 'ADV-2009-0758', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0758'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=519940'}, {'name': 'DSA-1744', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2009/dsa-1744'}, {'name': 'weechat-ircmessage-dos(49295)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49295'}, {'name': '34328', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34328'}, {'name': '[oss-security] 20090317 Re: CVE request -- firefox, vlc, WeeChat', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2009/03/17/8'}]
CVE State: PUBLISHED
Explain CVE-2009-0662
The PlonePAS product 3.x before 3.9 and 3.2.x before 3.2.2, a product for Plone, does not properly handle the login form, which allows remote authenticated users to acquire the identity of an arbitrary user via unspecified vectors.
Affected Products: n/a
References: [{'name': '34664', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34664'}, {'name': 'plone-unspecified-session-hijacking(50061)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/50061'}, {'name': '34840', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34840'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://plone.org/products/plone/security/advisories/cve-2009-0662'}, {'name': '53975', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/53975'}]
CVE State: PUBLISHED
Explain CVE-2009-0663
Heap-based buffer overflow in the DBD::Pg (aka DBD-Pg or libdbd-pg-perl) module 1.49 for Perl might allow context-dependent attackers to execute arbitrary code via unspecified input to an application that uses the getline and pg_getline functions to read database rows.
Affected Products: n/a
References: [{'name': 'RHSA-2009:1067', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2009-1067.html'}, {'name': 'libdbdpgperl-unspecified-bo(50467)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/50467'}, {'name': '34755', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34755'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://security.debian.org/pool/updates/main/libd/libdbd-pg-perl/libdbd-pg-perl_1.49-2+etch1.diff.gz'}, {'tags': ['x_refsource_MISC'], 'url': 'https://launchpad.net/bugs/cve/2009-0663'}, {'name': '34909', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34909'}, {'name': 'RHSA-2009:0479', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2009-0479.html'}, {'name': '35685', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35685'}, {'name': 'oval:org.mitre.oval:def:9499', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9499'}, {'name': 'DSA-1780', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2009/dsa-1780'}, {'name': 'SUSE-SR:2009:012', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html'}, {'name': '35058', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35058'}]
CVE State: PUBLISHED
Explain CVE-2009-0664
Multiple cross-site scripting (XSS) vulnerabilities in Mahara 1.0.x before 1.0.11 and 1.1.x before 1.1.3 allow remote attackers to inject arbitrary web script or HTML via (1) the introduction field in a user profile or (2) an arbitrary text block in a user view.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://mahara.org/interaction/forum/topic.php?id=532'}, {'name': 'DSA-1778', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2009/dsa-1778'}, {'name': '53891', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/53891'}, {'name': '34789', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34789'}, {'name': '34677', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34677'}, {'name': '53892', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/53892'}, {'name': '34871', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34871'}]
CVE State: PUBLISHED
Explain CVE-2009-0667
Untrusted search path vulnerability in Agent/Backend.pm in Ocsinventory-Agent before 0.0.9.3, and 1.x before 1.0.1, in OCS Inventory allows local users to gain privileges via a Trojan horse Perl module in an arbitrary directory.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://nana.rulezlan.org/~goneri/ocsinventory-agent/Ocsinventory-Agent-0.0.9.3.tar.gz'}, {'name': 'ADV-2009-1809', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1809'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://security.debian.org/pool/updates/main/o/ocsinventory-agent/ocsinventory-agent_0.0.9.2repack1-4lenny1.diff.gz'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ocsinventory-ng.org/index.php?mact=News%2Ccntnt01%2Cdetail%2C0&cntnt01articleid=144'}, {'name': '55718', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/55718'}, {'name': '35593', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35593'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=506416'}, {'name': '35768', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35768'}, {'name': 'DSA-1828', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2009/dsa-1828'}, {'name': '35727', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35727'}]
CVE State: PUBLISHED
Explain CVE-2009-0668
Unspecified vulnerability in Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to execute arbitrary Python code via vectors involving the ZEO network protocol.
Affected Products: n/a
References: [{'name': 'ADV-2009-2217', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/2217'}, {'name': '36204', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/36204'}, {'name': 'zope-protocol-code-execution(52377)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/52377'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://pypi.python.org/pypi/ZODB3/3.8.2#whats-new-in-zodb-3-8-2'}, {'name': '36205', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/36205'}, {'name': '[zope-announce] 20090806 CVE-2009-0668 and CVE-2009-0669: Releases to fix ZODB ZEO server vulnerabilities', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://mail.zope.org/pipermail/zope-announce/2009-August/002220.html'}, {'name': '56827', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/56827'}, {'name': '35987', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35987'}]
CVE State: PUBLISHED
Explain CVE-2009-0669
Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to bypass authentication via vectors involving the ZEO network protocol.
Affected Products: n/a
References: [{'name': 'ADV-2009-2217', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/2217'}, {'name': '36204', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/36204'}, {'name': '56826', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/56826'}, {'name': 'zope-protocol-auth-bypass(52379)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/52379'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://pypi.python.org/pypi/ZODB3/3.8.2#whats-new-in-zodb-3-8-2'}, {'name': '36205', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/36205'}, {'name': '[zope-announce] 20090806 CVE-2009-0668 and CVE-2009-0669: Releases to fix ZODB ZEO server vulnerabilities', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://mail.zope.org/pipermail/zope-announce/2009-August/002220.html'}, {'name': '35987', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35987'}]
CVE State: PUBLISHED
Explain CVE-2009-0672
SQL injection vulnerability in the Resend_Email module in Raven Web Services RavenNuke 2.30 allows remote authenticated administrators to execute arbitrary SQL commands via the user_prefix parameter to modules.php.
Affected Products: n/a
References: [{'name': '33787', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33787'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ravenphpscripts.com/postt17156.html'}, {'name': 'ravennuke-modules-sql-injection(48791)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48791'}, {'name': '20090216 [waraxe-2009-SA#072] - Multiple Vulnerabilities in RavenNuke 2.3.0', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/500988/100/0/threaded'}, {'name': '8068', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8068'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.waraxe.us/advisory-72.html'}, {'name': '52298', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52298'}]
CVE State: PUBLISHED
Explain CVE-2009-0673
Eval injection vulnerability in the Custom Fields feature in the Your Account module in Raven Web Services RavenNuke 2.30 allows remote authenticated administrators to execute arbitrary PHP code via the ID Field Name box in a yaCustomFields action to admin.php.
Affected Products: n/a
References: [{'name': '33787', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33787'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ravenphpscripts.com/postt17156.html'}, {'name': 'ravennuke-admin-code-execution(48790)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48790'}, {'name': '20090216 [waraxe-2009-SA#072] - Multiple Vulnerabilities in RavenNuke 2.3.0', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/500988/100/0/threaded'}, {'name': '8068', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8068'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.waraxe.us/advisory-72.html'}]
CVE State: PUBLISHED
Explain CVE-2009-0674
images/captcha.php in Raven Web Services RavenNuke 2.30, when register_globals and display_errors are enabled, allows remote attackers to determine the existence of local files by sending requests with full pathnames in the aFonts array parameter, and then observing the error messages, which differ between existing and nonexistent pathnames.
Affected Products: n/a
References: [{'name': '33787', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33787'}, {'name': 'ravennuke-captcha-info-disclosure(48792)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48792'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ravenphpscripts.com/postt17156.html'}, {'name': 'ravennuke-captcha-afonts-info-disclosure(48983)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48983'}, {'name': '20090216 [waraxe-2009-SA#072] - Multiple Vulnerabilities in RavenNuke 2.3.0', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/500988/100/0/threaded'}, {'name': '8068', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8068'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.waraxe.us/advisory-72.html'}]
CVE State: PUBLISHED
Explain CVE-2009-0677
avatarlist.php in the Your Account module, reached through modules.php, in Raven Web Services RavenNuke 2.30 allows remote authenticated users to execute arbitrary code via PHP sequences in an element of the replacements array, which is processed by the preg_replace function with the eval switch, as specified in an element of the patterns array.
Affected Products: n/a
References: [{'name': '33787', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33787'}, {'name': '33928', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33928'}, {'name': '52007', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/52007'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ravenphpscripts.com/postt17156.html&sid=12d1201371612260a42fa846ebce7bad'}, {'name': '20090216 [waraxe-2009-SA#072] - Multiple Vulnerabilities in RavenNuke 2.3.0', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/500988/100/0/threaded'}, {'name': '8068', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8068'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.waraxe.us/advisory-72.html'}, {'name': 'ravennuke-avatarlist-code-execution(48789)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48789'}]
CVE State: PUBLISHED
Explain CVE-2009-0678
images/captcha.php in RavenNuke 2.30 allows remote attackers to obtain sensitive information via an aFonts array parameter value that does not correspond to a valid font file, which reveals the installation path in an error message.
Affected Products: n/a
References: [{'name': 'ravennuke-captcha-info-disclosure(48792)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48792'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ravenphpscripts.com/postt17156.html'}, {'name': '20090216 [waraxe-2009-SA#072] - Multiple Vulnerabilities in RavenNuke 2.3.0', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/500988/100/0/threaded'}, {'name': '8068', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8068'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.waraxe.us/advisory-72.html'}]
CVE State: PUBLISHED
Explain CVE-2009-0679
Cross-site scripting (XSS) vulnerability in the Your Account module in RavenNuke 2.30 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://ravenphpscripts.com/postt17156.html'}, {'name': '52299', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52299'}, {'name': 'ravennuke-youraccount-xss(48978)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48978'}]
CVE State: PUBLISHED
Explain CVE-2009-0680
cgi-bin/welcome/VPN_only in the web interface in Netgear SSL312 allows remote attackers to cause a denial of service (device crash) via a crafted query string, as demonstrated using directory traversal sequences.
Affected Products: n/a
References: [{'name': '20090208 Netgear SSL312 Router - remote DoS', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2009-02/0084.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.helith.net/txt/netgear_ssl312_remote_dos.txt'}, {'name': 'netgear-ssl312-dos(48605)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48605'}, {'name': '33675', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33675'}, {'name': '8008', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8008'}, {'name': '33896', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33896'}]
CVE State: PUBLISHED
Explain CVE-2009-0681
PGP Desktop before 9.10 allows local users to (1) cause a denial of service (crash) via a crafted IOCTL request to pgpdisk.sys, and (2) cause a denial of service (crash) and execute arbitrary code via a crafted IRP in an IOCTL request to pgpwded.sys.
Affected Products: n/a
References: [{'name': '20090413 [Suspected Spam][Positive Technologies SA 2009-01] PGP Desktop Pgpdisk.sys And Pgpwded.sys Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/502633/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://en.securitylab.ru/lab/PT-2009-01'}, {'tags': ['x_refsource_MISC'], 'url': 'https://pgp.custhelp.com/cgi-bin/pgp.cfg/php/enduser/std_adp.php?p_faqid=1014&p_topview=1'}, {'name': '1022034', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1022034'}]
CVE State: PUBLISHED
Explain CVE-2009-0682
vetmonnt.sys in CA Internet Security Suite r3, vetmonnt.sys before 9.0.0.184 in Internet Security Suite r4, and vetmonnt.sys before 10.0.0.217 in Internet Security Suite r5 do not properly verify IOCTL calls, which allows local users to cause a denial of service (system crash) via a crafted call.
Affected Products: n/a
References: [{'name': '20090826 [PT-2009-05] CA Internet Security Suite Denial of Service Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/506103/100/0/threaded'}, {'name': '57228', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/57228'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=214673'}, {'name': '20090818 CA20090818-02: Security Notice for CA Internet Security Suite', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/505880/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://en.securitylab.ru/lab/PT-2009-05'}]
CVE State: PUBLISHED
Explain CVE-2009-0686
The TrendMicro Activity Monitor Module (tmactmon.sys) 2.52.0.1002 in Trend Micro Internet Pro 2008 and 2009, and Security Pro 2008 and 2009, allows local users to gain privileges via a crafted IRP in a METHOD_NEITHER IOCTL request to \Device\tmactmon that overwrites memory.
Affected Products: n/a
References: [{'name': '8322', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8322'}, {'name': '1021955', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021955'}, {'name': '34304', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34304'}, {'tags': ['x_refsource_MISC'], 'url': 'http://milw0rm.com/sploits/2009-trendmicro_local_expl_0day.zip'}, {'tags': ['x_refsource_MISC'], 'url': 'http://en.securitylab.ru/lab/PT-2009-09'}, {'name': 'trend-tmactmon-privilege-escalation(49513)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49513'}, {'name': '20090331 [Positive Technologies SA 2009-09] Trend Micro Internet Security Pro 2009 tmactmon.sys Priviliege Escalation Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/502314/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2009-0687
The pf_test_rule function in OpenBSD Packet Filter (PF), as used in OpenBSD 4.2 through 4.5, NetBSD 5.0 before RC3, MirOS 10 and earlier, and MidnightBSD 0.3-current allows remote attackers to cause a denial of service (panic) via crafted IP packets that trigger a NULL pointer dereference during translation, related to an IPv4 packet with an ICMPv6 payload.
Affected Products: n/a
References: [{'name': '53608', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/53608'}, {'name': '[4.3] 013: RELIABILITY FIX: April 11, 2009', 'tags': ['vendor-advisory', 'x_refsource_OPENBSD'], 'url': 'http://www.openbsd.org/errata43.html#013_pf'}, {'name': 'NetBSD-SA2009-001', 'tags': ['vendor-advisory', 'x_refsource_NETBSD'], 'url': 'http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-001.txt.asc'}, {'name': '8406', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8406'}, {'name': 'openbsd-packetfilter-dos(49837)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49837'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.helith.net/txt/multiple_vendor-PF_null_pointer_dereference.txt'}, {'name': '20090413 OpenBSD 4.3 up to OpenBSD-current: PF null pointer dereference - remote DoS (kernel panic)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/502634'}, {'name': '8581', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8581'}, {'name': '[4.4] 013: RELIABILITY FIX: April 11, 2009', 'tags': ['vendor-advisory', 'x_refsource_OPENBSD'], 'url': 'http://www.openbsd.org/errata44.html#013_pf'}, {'name': 'ADV-2009-1015', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1015'}, {'tags': ['x_refsource_MISC'], 'url': 'ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.3/common/013_pf.patch'}, {'name': '[4.5] 002: RELIABILITY FIX: April 11, 2009', 'tags': ['vendor-advisory', 'x_refsource_OPENBSD'], 'url': 'http://www.openbsd.org/errata45.html#002_pf'}]
CVE State: PUBLISHED
Explain CVE-2009-0690
The Foxit JPEG2000/JBIG2 Decoder add-on before 2.0.2009.616 for Foxit Reader 3.0 before Build 1817 does not properly handle a negative value for the stream offset in a JPEG2000 (aka JPX) stream, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted PDF file that triggers an out-of-bounds read.
Affected Products: n/a
References: [{'name': '35442', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35442'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.foxitsoftware.com/pdf/reader/security.htm#0602'}, {'name': '1022425', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1022425'}, {'name': 'VU#251793', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/251793'}, {'name': '35512', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35512'}, {'name': 'ADV-2009-1640', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1640'}]
CVE State: PUBLISHED
Explain CVE-2009-0691
The Foxit JPEG2000/JBIG2 Decoder add-on before 2.0.2009.616 for Foxit Reader 3.0 before Build 1817 does not properly handle a fatal error during decoding of a JPEG2000 (aka JPX) header, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted PDF file that triggers an invalid memory access.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.foxitsoftware.com/pdf/reader/security.htm#0602'}, {'name': '1022425', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1022425'}, {'name': 'VU#251793', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/251793'}, {'name': '35443', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35443'}, {'name': '35512', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35512'}, {'name': 'ADV-2009-1640', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1640'}]
CVE State: PUBLISHED
Explain CVE-2009-0693
Multiple buffer overflows in Wyse Device Manager (WDM) 4.7.x allow remote attackers to execute arbitrary code via (1) the User-Agent HTTP header to hserver.dll or (2) unspecified input to hagent.exe.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.wyse.com/serviceandsupport/Wyse%20Security%20Bulletin%20WSB09-01.pdf'}, {'name': 'VU#654545', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/654545'}, {'name': "20090710 'Secure' Wyse thin clients vulnerable to remote exploit bugs", 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2009-07/0101.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.theregister.co.uk/2009/07/10/wyse_remote_exploit_bugs/'}]
CVE State: PUBLISHED
Explain CVE-2009-0695
hagent.exe in Wyse Device Manager (WDM) 4.7.x does not require authentication for commands, which allows remote attackers to obtain management access via a crafted query, as demonstrated by a V52 query that triggers a power-off action.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.wyse.com/serviceandsupport/Wyse%20Security%20Bulletin%20WSB09-01.pdf'}, {'name': 'VU#654545', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/654545'}, {'name': "20090710 'Secure' Wyse thin clients vulnerable to remote exploit bugs", 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2009-07/0101.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.theregister.co.uk/2009/07/10/wyse_remote_exploit_bugs/'}, {'name': '19137', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/19137/'}]
CVE State: PUBLISHED
Explain CVE-2009-0698
Integer overflow in the 4xm demuxer (demuxers/demux_4xm.c) in xine-lib 1.1.16.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a 4X movie file with a large current_track value, a similar issue to CVE-2009-0385.
Affected Products: n/a
References: [{'name': 'USN-746-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-746-1'}, {'name': 'MDVSA-2009:299', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2009:299'}, {'name': 'xinelib-4xmdemuxer-code-execution(48954)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48954'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/project/shownotes.php?release_id=660071'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.xine-project.org/show_bug.cgi?id=205'}, {'name': 'MDVSA-2009:298', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2009:298'}, {'name': 'SUSE-SR:2009:009', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.trapkit.de/advisories/TKADV2009-004.txt'}, {'name': '20090128 [TKADV2009-004] FFmpeg Type Conversion Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/500514/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2009-0699
Cross-site scripting (XSS) vulnerability in pagesUTF8/auftrag_allgemeinauftrag.jsp in Plunet BusinessManager 4.1 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the (1) QUB and (2) Bez74 parameters.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.securenetwork.it/ricerca/advisory/download/SN-2008-04.txt'}, {'name': '20090107 Plunet BusinessManager failure in access controls and multiple stored cross site scripting', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2009-01/0032.html'}, {'name': '20090109 Re: Plunet BusinessManager failure in access controls and multiple stored cross site scripting', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2009-01/0054.html'}, {'name': 'businessmanager-qub-bez74-xss(47795)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/47795'}, {'name': '33153', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33153'}]
CVE State: PUBLISHED
Explain CVE-2009-0700
Plunet BusinessManager 4.1 and earlier allows remote authenticated users to bypass access restrictions and (1) read sensitive Customer or Order data via a modified Pfad parameter to pagesUTF8/Sys_DirAnzeige.jsp, or (2) list sensitive Jobs via a direct request to pagesUTF8/auftrag_job.jsp.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.securenetwork.it/ricerca/advisory/download/SN-2008-04.txt'}, {'name': '20090107 Plunet BusinessManager failure in access controls and multiple stored cross site scripting', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2009-01/0032.html'}, {'name': '20090109 Re: Plunet BusinessManager failure in access controls and multiple stored cross site scripting', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2009-01/0054.html'}, {'name': 'businessmanager-multiple-security-bypass(47794)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/47794'}, {'name': '33153', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33153'}]
CVE State: PUBLISHED
Explain CVE-2009-0701
Multiple PHP remote file inclusion vulnerabilities in index.php in Cybershade CMS 0.2b, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) THEME_header and (2) THEME_footer parameters.
Affected Products: n/a
References: [{'name': 'cybershadecms-index-file-include(47725)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/47725'}, {'name': '33101', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33101'}, {'name': '7668', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/7668'}]
CVE State: PUBLISHED
Explain CVE-2009-0702
SQL injection vulnerability in the Phoca Documentation (com_phocadocumentation) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a section action to index.php.
Affected Products: n/a
References: [{'name': '33114', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33114'}, {'name': '7670', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/7670'}, {'name': 'ADV-2009-0026', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0026'}]
CVE State: PUBLISHED
Explain CVE-2009-0703
SQL injection vulnerability in bview.asp in ASPThai.Net Webboard 6.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Affected Products: n/a
References: [{'name': '7635', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/7635'}, {'name': '33084', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33084'}, {'name': '34099', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34099'}, {'name': 'webboard-bview-sql-injection(47722)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/47722'}]
CVE State: PUBLISHED
Explain CVE-2009-0704
SQL injection vulnerability in search.php in WSN Guest 1.23 allows remote attackers to execute arbitrary SQL commands via the search parameter in an advanced action.
Affected Products: n/a
References: [{'name': '7659', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/7659'}, {'name': '33097', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33097'}, {'name': 'wsnguest-search-sql-injection(47723)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/47723'}]
CVE State: PUBLISHED
Explain CVE-2009-0705
SQL injection vulnerability in news.php in PowerScripts PowerNews 2.5.4, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the newsid parameter.
Affected Products: n/a
References: [{'name': 'powernews-news-sql-injection(47701)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/47701'}, {'name': '33081', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33081'}, {'name': '33363', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33363'}, {'name': '51110', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/51110'}, {'name': '7641', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/7641'}]
CVE State: PUBLISHED
Explain CVE-2009-0706
SQL injection vulnerability in the Simple Review (com_simple_review) component 1.3.5 for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the category parameter to index.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/0901-exploits/joomlasimplereview-sql.txt'}, {'name': '33102', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33102'}, {'name': 'simplereview-index-sql-injection(47726)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/47726'}]
CVE State: PUBLISHED
Explain CVE-2009-0707
SQL injection vulnerability in admin/index.php in PowerClan 1.14a allows remote attackers to execute arbitrary SQL commands via the loginemail parameter (aka login field).  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': '51112', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/51112'}, {'name': 'powerclan-index-sql-injection(47702)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/47702'}, {'name': '7642', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/7642'}, {'name': '33083', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33083'}, {'name': '33362', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33362'}]
CVE State: PUBLISHED