Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2009-1345
SQL injection vulnerability in document.php in cpCommerce 1.2.8 allows remote attackers to execute arbitrary SQL commands via the id_document parameter.
Affected Products: n/a
References: [{'name': '1022082', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1022082'}, {'name': '8455', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8455'}, {'name': '34556', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34556'}, {'name': 'cpcommerce-document-sql-injection(49901)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49901'}]
CVE State: PUBLISHED
Explain CVE-2009-1346
SQL injection vulnerability in publico/ficha.php in NetHoteles 3.0 allows remote attackers to execute arbitrary SQL commands via the id_establecimiento parameter.
Affected Products: n/a
References: [{'name': 'nethoteles-ficha-sql-injection(49897)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49897'}, {'name': '53814', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/53814'}, {'name': '8457', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8457'}, {'name': '34743', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34743'}, {'name': '34561', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34561'}]
CVE State: PUBLISHED
Explain CVE-2009-1347
Multiple SQL injection vulnerabilities in stats/index.php in chCounter 3.1.3 allow remote attackers to execute arbitrary SQL commands via (1) the login_name parameter (aka the username field) or (2) the login_pw parameter (aka the password field).
Affected Products: n/a
References: [{'name': '34572', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34572'}, {'name': '24879', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24879'}, {'name': '8461', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8461'}]
CVE State: PUBLISHED
Explain CVE-2009-1348
The AV engine before DAT 5600 in McAfee VirusScan, Total Protection, Internet Security, SecurityShield for Microsoft ISA Server, Security for Microsoft Sharepoint, Security for Email Servers, Email Gateway, and Active Virus Defense allows remote attackers to bypass virus detection via (1) an invalid Headflags field in a malformed RAR archive, (2) an invalid Packsize field in a malformed RAR archive, or (3) an invalid Filelength field in a malformed ZIP archive.
Affected Products: n/a
References: [{'name': '20090501 [TZO-18-2009] Mcafee multiple evasions/bypasses (RAR, ZIP)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/503173/100/0/threaded'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://kc.mcafee.com/corporate/index?page=content&id=SB10001&actp=LIST_RECENT'}, {'name': '34949', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34949'}, {'name': '34780', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34780'}, {'tags': ['x_refsource_MISC'], 'url': 'http://blog.zoller.lu/2009/04/mcafee-multiple-bypassesevasions-ziprar.html'}]
CVE State: PUBLISHED
Explain CVE-2009-1349
Cross-site scripting (XSS) vulnerability in C2Net Stronghold 2.3 allows remote attackers to inject arbitrary web script or HTML via the URI.
Affected Products: n/a
References: [{'name': '34606', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34606'}, {'name': '20090418 Cross-site Scripting vulnerability in Stronghold/2.3 Apache/1.2.6 C2NetUS/2007', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/502799/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2009-1350
Unspecified vulnerability in xtagent.exe in Novell NetIdentity Client before 1.2.4 allows remote attackers to execute arbitrary code by establishing an IPC$ connection to the XTIERRPCPIPE named pipe, and sending RPC messages that trigger a dereference of an arbitrary pointer.
Affected Products: n/a
References: [{'name': '20090406 ZDI-09-016: Novell Client/NetIdentity Agent Remote Arbitrary Pointer Dereference Code Execution Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/502514/100/0/threaded'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://download.novell.com/Download?buildid=6ERQGPjRZ8o~'}, {'name': 'ADV-2009-0954', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0954'}, {'name': '34400', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34400'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.novell.com/show_bug.cgi?id=437511'}, {'name': '1021990', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021990'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.zerodayinitiative.com/advisories/ZDI-09-016/'}]
CVE State: PUBLISHED
Explain CVE-2009-1351
Heap-based buffer overflow in Apollo 37zz allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long URI in a playlist (.m3u) file.
Affected Products: n/a
References: [{'name': '8451', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8451'}, {'name': '53770', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/53770'}, {'name': '34554', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34554'}, {'name': '34050', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34050'}]
CVE State: PUBLISHED
Explain CVE-2009-1352
Stack-based buffer overflow in Dawningsoft PowerCHM 5.7 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an HTML file with a link to a long URL, as demonstrated by a .rar URL.
Affected Products: n/a
References: [{'name': '34517', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34517'}, {'name': 'powerchm-url-bo(49882)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49882'}, {'name': '8434', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8434'}]
CVE State: PUBLISHED
Explain CVE-2009-1353
Buffer overflow in the http_parse_hex function in libz/misc.c in Zervit Webserver 0.02 allows remote attackers to cause a denial of service (daemon crash) via a long URI, related to http.c.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://zervit.svn.sourceforge.net/viewvc/zervit/trunk/src/libz/misc.c?r1=17&r2=19'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://zervit.svn.sourceforge.net/viewvc/zervit/trunk/src/libz/misc.c?view=log'}, {'name': '8447', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8447'}, {'name': '20090414 Zervit Webserver Buffer Overflow', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/502693/100/0/threaded'}, {'name': '53768', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/53768'}, {'name': '34530', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34530'}, {'name': '34735', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34735'}]
CVE State: PUBLISHED
Explain CVE-2009-1354
Directory traversal vulnerability in Mongoose 2.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.
Affected Products: n/a
References: [{'name': '8428', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8428'}, {'name': 'mongoose-directory-traversal(49878)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49878'}, {'name': '20090413 MonGoose 2.4 Directory Traversal Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/502648/100/0/threaded'}, {'name': '34510', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34510'}]
CVE State: PUBLISHED
Explain CVE-2009-1355
Stack-based buffer overflow in muxatmd in IBM AIX 5.2, 5.3, and 6.1 allows local users to gain privileges via a long filename.
Affected Products: n/a
References: [{'name': 'ADV-2009-1056', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1056'}, {'name': 'IZ48495', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www.ibm.com/support/docview.wss?uid=isg1IZ48495'}, {'name': 'IZ48561', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www.ibm.com/support/docview.wss?uid=isg1IZ48561'}, {'name': 'IZ48501', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www.ibm.com/support/docview.wss?uid=isg1IZ48501'}, {'name': '1022065', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1022065'}, {'name': 'IZ48502', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www.ibm.com/support/docview.wss?uid=isg1IZ48502'}, {'name': '34543', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34543'}, {'name': '34662', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34662'}, {'name': '20090415 IBM AIX muxatmd Buffer Overflow Vulnerability', 'tags': ['third-party-advisory', 'x_refsource_IDEFENSE'], 'url': 'http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=784'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://aix.software.ibm.com/aix/efixes/security/muxatmd_advisory.asc'}, {'name': 'IZ48496', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www.ibm.com/support/docview.wss?uid=isg1IZ48496'}, {'name': 'IZ48500', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www.ibm.com/support/docview.wss?uid=isg1IZ48500'}, {'name': 'IZ48499', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www.ibm.com/support/docview.wss?uid=isg1IZ48499'}, {'name': 'oval:org.mitre.oval:def:6402', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6402'}, {'name': 'IZ48562', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www.ibm.com/support/docview.wss?uid=isg1IZ48562'}]
CVE State: PUBLISHED
Explain CVE-2009-1356
Stack-based buffer overflow in Elecard AVC HD Player allows remote attackers to execute arbitrary code via a long MP3 filename in a playlist (.xpl) file.
Affected Products: n/a
References: [{'name': '34560', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34560'}, {'name': '8452', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8452'}]
CVE State: PUBLISHED
Explain CVE-2009-1357
CRLF injection vulnerability in da/DA/Login in Sun Java System Delegated Administrator 6.2 through 6.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the HELP_PAGE parameter.
Affected Products: n/a
References: [{'name': '1022108', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1022108'}, {'name': '255928', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-66-255928-1'}, {'name': '34643', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34643'}, {'name': '20090421 CORE-2009-0114 - HTTP Response Splitting vulnerability in Sun Delegated Administrator', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/502863/100/0/threaded'}, {'name': '34760', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34760'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-21-121581-20-1'}, {'name': '1020305', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020305.1-1'}, {'name': 'ADV-2009-1122', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1122'}, {'name': 'sjs-delegated-login-response-splitting(50004)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/50004'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.coresecurity.com/content/sun-delegated-administrator'}, {'name': '53920', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/53920'}]
CVE State: PUBLISHED
Explain CVE-2009-1358
apt-get in apt before 0.7.21 does not check for the correct error code from gpgv, which causes apt to treat a repository as valid even when it has been signed with a key that has been revoked or expired, which might allow remote attackers to trick apt into installing malicious repositories.
Affected Products: n/a
References: [{'name': '34874', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34874'}, {'name': 'DSA-1779', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2009/dsa-1779'}, {'name': '34829', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34829'}, {'name': '34630', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34630'}, {'name': '34832', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34832'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/ubuntu/+source/apt/+bug/356012'}, {'name': 'USN-762-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/762-1/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=433091'}, {'name': 'apt-aptget-gpgv-security-bypass(50086)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/50086'}]
CVE State: PUBLISHED
Explain CVE-2009-1359
Unspecified vulnerability in the SCTP sockets implementation in Sun OpenSolaris snv_106 through snv_107 allows local users to cause a denial of service (panic) via unknown vectors.
Affected Products: n/a
References: [{'name': '34628', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34628'}, {'name': 'ADV-2009-1120', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1120'}, {'name': '257331', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-66-257331-1'}]
CVE State: PUBLISHED
Explain CVE-2009-1360
The __inet6_check_established function in net/ipv6/inet6_hashtables.c in the Linux kernel before 2.6.29, when Network Namespace Support (aka NET_NS) is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via vectors involving IPv6 packets.
Affected Products: n/a
References: [{'name': 'MDVSA-2009:135', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2009:135'}, {'name': 'SUSE-SA:2009:032', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00002.html'}, {'name': '35656', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35656'}, {'name': '34602', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34602'}, {'name': 'USN-793-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/usn-793-1'}, {'tags': ['x_refsource_MISC'], 'url': 'http://xorl.wordpress.com/2009/04/21/linux-kernel-net_ns-ipv6-null-pointer-dereference/'}, {'name': '35387', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35387'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.29'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=3f53a38131a4e7a053c0aa060aba0411242fb6b9'}]
CVE State: PUBLISHED
Explain CVE-2009-1361
dig.php in GScripts.net DNS Tools allows remote attackers to execute arbitrary commands via shell metacharacters in the host parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': '34773', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34773'}]
CVE State: PUBLISHED
Explain CVE-2009-1362
SQL injection vulnerability in administration/index.php in chCounter 3.1.3 allows remote attackers to execute arbitrary SQL commands via the login_name parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': '24879', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24879'}, {'name': 'chcounter-administration-sql-injection(50353)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/50353'}]
CVE State: PUBLISHED
Explain CVE-2009-1365
Unspecified vulnerability in Adobe Flash Media Server (FMS) before 3.0.4 and 3.5.x before 3.5.2, as used in Flash Media Interactive Server and Flash Media Streaming Server, allows remote attackers to execute arbitrary remote procedures within an ActionScript file on the server via RPC requests.
Affected Products: n/a
References: [{'name': '34790', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34790'}, {'name': '34878', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34878'}, {'name': 'ADV-2009-1234', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1234'}, {'name': '1022148', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1022148'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.adobe.com/support/security/bulletins/apsb09-05.html'}]
CVE State: PUBLISHED
Explain CVE-2009-1366
Cross-site scripting (XSS) vulnerability in Website\admin\Sales\paypalipn.aspx in DotNetNuke (DNN) before 4.9.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "name/value pairs" and "paypal IPN functionality."
Affected Products: n/a
References: [{'name': '34484', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34484'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.dotnetnuke.com/News/SecurityPolicy/Securitybulletinno25/tabid/1260/Default.aspx'}, {'name': '34686', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34686'}]
CVE State: PUBLISHED
Explain CVE-2009-1367
Cross-site scripting (XSS) vulnerability in index.php in moziloCMS 1.11 allows remote attackers to inject arbitrary web script or HTML via the query parameter in search action, a different issue than CVE-2008-6127.2a.
Affected Products: n/a
References: [{'name': 'mozilocms-indexphp-xss(49812)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49812'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://cms.mozilo.de/index.php?cat=10_moziloCMS&page=60_Changelog'}, {'name': '8394', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8394'}, {'name': '34474', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34474'}]
CVE State: PUBLISHED
Explain CVE-2009-1368
Directory traversal vulnerability in index.php in moziloCMS 1.11 allows remote attackers to read arbitrary files via a .. (dot dot) in the page parameter.  NOTE: this might be the same issue as CVE-2008-6126.2, which may have been fixed in 1.10.3.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://cms.mozilo.de/index.php?cat=10_moziloCMS&page=60_Changelog'}, {'name': '8394', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8394'}, {'name': '34474', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34474'}, {'name': 'mozilocms-index-file-include(49813)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49813'}]
CVE State: PUBLISHED
Explain CVE-2009-1369
moziloCMS 1.11 allows remote attackers to obtain sensitive information via the (1) gal[] parameter to gallery.php, (2) page[] and (3) cat[] parameter to index.php, or (4) file[] parameter to download.php, which reveals the installation path in an error message.
Affected Products: n/a
References: [{'name': 'mozilocms-index-path-disclosure(49811)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49811'}, {'name': '8394', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8394'}]
CVE State: PUBLISHED
Explain CVE-2009-1370
Stack-based buffer overflow in ape_plugin.plg in Xilisoft Video Converter 3.1.53.0704n and 5.1.23.0402 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in a .cue file.
Affected Products: n/a
References: [{'name': '8390', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8390'}, {'name': 'vcw-cue-bo(49807)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49807'}, {'name': '34472', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34472'}, {'name': '34660', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34660'}]
CVE State: PUBLISHED
Explain CVE-2009-1371
The CLI_ISCONTAINED macro in libclamav/others.h in ClamAV before 0.95.1 allows remote attackers to cause a denial of service (application crash) via a malformed file with UPack encoding.
Affected Products: n/a
References: [{'name': '53602', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/53602'}, {'name': '1022028', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1022028'}, {'name': '34716', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34716'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://svn.clamav.net/websvn/filedetails.php?repname=clamav-devel&path=%2Ftrunk%2FChangeLog&rev=5032'}, {'name': 'MDVSA-2009:097', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2009:097'}, {'name': '34612', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34612'}, {'name': 'USN-756-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/usn-756-1'}, {'name': 'APPLE-SA-2009-09-10-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html'}, {'name': 'ADV-2009-0985', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0985'}, {'name': 'DSA-1771', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2009/dsa-1771'}, {'name': '34654', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34654'}, {'name': '34446', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34446'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT3865'}, {'name': '36701', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/36701'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.net/bugs/360502'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wwws.clamav.net/bugzilla/show_bug.cgi?id=1552'}]
CVE State: PUBLISHED
Explain CVE-2009-1372
Stack-based buffer overflow in the cli_url_canon function in libclamav/phishcheck.c in ClamAV before 0.95.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted URL.
Affected Products: n/a
References: [{'name': '1022028', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1022028'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://svn.clamav.net/websvn/filedetails.php?repname=clamav-devel&path=%2Ftrunk%2FChangeLog&rev=5032'}, {'name': 'MDVSA-2009:097', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2009:097'}, {'name': '34612', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34612'}, {'name': 'APPLE-SA-2009-09-10-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html'}, {'name': 'ADV-2009-0985', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0985'}, {'name': '34446', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34446'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT3865'}, {'name': '36701', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/36701'}, {'name': '53603', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/53603'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wwws.clamav.net/bugzilla/show_bug.cgi?id=1553'}]
CVE State: PUBLISHED
Explain CVE-2009-1374
Buffer overflow in the decrypt_out function in Pidgin (formerly Gaim) before 2.5.6 allows remote attackers to cause a denial of service (application crash) via a QQ packet.
Affected Products: n/a
References: [{'name': 'FEDORA-2009-5597', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00075.html'}, {'name': 'pidgin-decryptout-bo(50684)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/50684'}, {'name': 'RHSA-2009:1060', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2009-1060.html'}, {'name': 'GLSA-200905-07', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200905-07.xml'}, {'name': '35067', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35067'}, {'name': 'FEDORA-2009-5583', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00051.html'}, {'name': '35329', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35329'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.pidgin.im/news/security/?id=30'}, {'name': 'USN-781-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-781-1'}, {'name': 'oval:org.mitre.oval:def:11654', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11654'}, {'name': '35294', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35294'}, {'name': '35188', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35188'}, {'name': '35194', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35194'}, {'name': 'FEDORA-2009-5552', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00033.html'}, {'name': '35202', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35202'}, {'name': 'ADV-2009-1396', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1396'}, {'name': 'oval:org.mitre.oval:def:18201', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18201'}, {'name': 'MDVSA-2009:173', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2009:173'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=500490'}]
CVE State: PUBLISHED
Explain CVE-2009-1375
The PurpleCircBuffer implementation in Pidgin (formerly Gaim) before 2.5.6 does not properly maintain a certain buffer, which allows remote attackers to cause a denial of service (memory corruption and application crash) via vectors involving the (1) XMPP or (2) Sametime protocol.
Affected Products: n/a
References: [{'name': 'FEDORA-2009-5597', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00075.html'}, {'name': 'RHSA-2009:1060', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2009-1060.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=500491'}, {'name': 'GLSA-200905-07', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200905-07.xml'}, {'name': '35067', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35067'}, {'name': 'FEDORA-2009-5583', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00051.html'}, {'name': '35329', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35329'}, {'name': 'USN-781-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-781-1'}, {'name': '54649', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/54649'}, {'name': 'DSA-1805', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://debian.org/security/2009/dsa-1805'}, {'name': '35294', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35294'}, {'name': '35188', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35188'}, {'name': 'oval:org.mitre.oval:def:10829', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10829'}, {'name': '35194', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35194'}, {'name': 'FEDORA-2009-5552', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00033.html'}, {'name': '35202', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35202'}, {'name': '35215', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35215'}, {'name': 'ADV-2009-1396', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1396'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.pidgin.im/news/security/?id=31'}, {'name': 'pidgin-purplecircbuffer-dos(50683)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/50683'}, {'name': 'MDVSA-2009:173', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2009:173'}]
CVE State: PUBLISHED
Explain CVE-2009-1380
Cross-site scripting (XSS) vulnerability in JMX-Console in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP08 and 4.3 before 4.3.0.CP07 allows remote attackers to inject arbitrary web script or HTML via the filter parameter, related to the key property and the position of quote and colon characters.
Affected Products: n/a
References: [{'name': '37276', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/37276'}, {'name': '1023315', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1023315'}, {'name': 'RHSA-2009:1637', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://rhn.redhat.com/errata/RHSA-2009-1637.html'}, {'name': 'jboss-enterprise-jmxconsole-xss(54698)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/54698'}, {'name': '37671', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/37671'}, {'name': 'RHSA-2009:1636', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://rhn.redhat.com/errata/RHSA-2009-1636.html'}, {'name': 'RHSA-2009:1649', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://rhn.redhat.com/errata/RHSA-2009-1649.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://jira.jboss.org/jira/browse/JBPAPP-1983'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=511224'}, {'name': 'RHSA-2009:1650', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://rhn.redhat.com/errata/RHSA-2009-1650.html'}]
CVE State: PUBLISHED
Explain CVE-2009-1381
The map_yp_alias function in functions/imap_general.php in SquirrelMail before 1.4.19-1 on Debian GNU/Linux, and possibly other operating systems and versions, allows remote attackers to execute arbitrary commands via shell metacharacters in a username string that is used by the ypmatch program.  NOTE: this issue exists because of an incomplete fix for CVE-2009-1579.
Affected Products: n/a
References: [{'name': '35140', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35140'}, {'name': 'FEDORA-2009-5350', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01202.html'}, {'name': '20090521 [SECURITY] [DSA 1802-2] New squirrelmail packages correct incomplete fix', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/503718/100/0/threaded'}, {'name': 'MDVSA-2009:122', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2009:122'}, {'tags': ['x_refsource_MISC'], 'url': 'http://release.debian.org/proposed-updates/stable_diffs/squirrelmail_1.4.15-4+lenny2.debdiff'}, {'name': 'FEDORA-2009-5471', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01195.html'}, {'name': 'DSA-1802', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2009/dsa-1802'}]
CVE State: PUBLISHED
Explain CVE-2009-1382
Multiple stack-based buffer overflows in mimetex.cgi in mimeTeX, when downloaded before 20090713, allow remote attackers to execute arbitrary code via a TeX file with long (1) picture, (2) circle, or (3) input tags.
Affected Products: n/a
References: [{'name': 'ADV-2009-1875', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1875'}, {'name': '35752', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35752'}, {'name': 'ADV-2010-0877', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0877'}, {'name': '20090713 [oCERT-2009-010] mimeTeX and mathTeX buffer overflows and commandinjection', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/504919/100/0/threaded'}, {'name': 'mimetex-mimetex-bo(51794)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/51794'}, {'name': '35816', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35816'}, {'tags': ['x_refsource_MISC'], 'url': 'http://scary.beasts.org/security/CESA-2009-009.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.ocert.org/advisories/ocert-2009-010.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://groups.google.com/group/comp.text.tex/browse_thread/thread/5d56d3d744351578'}, {'name': 'FEDORA-2010-6546', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039314.html'}]
CVE State: PUBLISHED
Explain CVE-2009-1383
The getdirective function in mathtex.cgi in mathTeX, when downloaded before 20090713, allows remote attackers to execute arbitrary commands via shell metacharacters in the dpi tag.
Affected Products: n/a
References: [{'name': 'ADV-2009-1875', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1875'}, {'name': '20090713 [oCERT-2009-010] mimeTeX and mathTeX buffer overflows and commandinjection', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/504919/100/0/threaded'}, {'name': '35816', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35816'}, {'name': 'mathtex-getdirective-command-execution(51795)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/51795'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.ocert.org/advisories/ocert-2009-010.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://groups.google.com/group/comp.text.tex/browse_thread/thread/5d56d3d744351578'}]
CVE State: PUBLISHED
Explain CVE-2009-1384
pam_krb5 2.2.14 through 2.3.4, as used in Red Hat Enterprise Linux (RHEL) 5, generates different password prompts depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.
Affected Products: n/a
References: [{'name': '35230', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35230'}, {'name': 'oval:org.mitre.oval:def:9652', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9652'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=502602'}, {'name': '43314', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/43314'}, {'name': '[oss-security] 20090527 CVE assignment notification (pam_krb5 CVE-2009-1384)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2009/05/27/1'}, {'name': 'oval:org.mitre.oval:def:7081', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7081'}, {'name': 'MDVSA-2010:054', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2010:054'}, {'name': '54791', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/54791'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2011-0003.html'}, {'name': '20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/516397/100/0/threaded'}, {'name': 'ADV-2009-1448', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1448'}, {'name': '35112', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35112'}]
CVE State: PUBLISHED
Explain CVE-2009-1388
The ptrace_start function in kernel/ptrace.c in the Linux kernel 2.6.18 does not properly handle simultaneous execution of the do_coredump function, which allows local users to cause a denial of service (deadlock) via vectors involving the ptrace system call and a coredumping thread.
Affected Products: n/a
References: [{'name': '36131', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/36131'}, {'name': '37471', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/37471'}, {'name': 'oval:org.mitre.oval:def:8680', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8680'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2009-0016.html'}, {'name': 'RHSA-2009:1193', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2009-1193.html'}, {'name': '20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/507985/100/0/threaded'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/attachment.cgi?id=346615'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=504263'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/attachment.cgi?id=346742'}, {'name': '55679', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/55679'}, {'name': 'oval:org.mitre.oval:def:8625', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8625'}, {'name': '35559', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35559'}, {'name': '[oss-security] 20090702 CVE-2009-1388 kernel: do_coredump() vs ptrace_start() deadlock', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://marc.info/?l=oss-security&m=124654277229434&w=2'}, {'name': 'ADV-2009-3316', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/3316'}]
CVE State: PUBLISHED
Explain CVE-2009-1390
Mutt 1.5.19, when linked against (1) OpenSSL (mutt_ssl.c) or (2) GnuTLS (mutt_ssl_gnutls.c), allows connections when only one TLS certificate in the chain is accepted instead of verifying the entire chain, which allows remote attackers to spoof trusted servers via a man-in-the-middle attack.
Affected Products: n/a
References: [{'name': '35288', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35288'}, {'name': 'FEDORA-2009-6465', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00715.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://dev.mutt.org/hg/mutt/rev/64bf199c8d8a'}, {'name': 'mutt-x509-security-bypass(51068)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/51068'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://dev.mutt.org/hg/mutt/rev/8f11dd00c770'}, {'name': '[oss-security] 20090610 Mutt 1.5.19 SSL chain verification flaw', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2009/06/10/2'}]
CVE State: PUBLISHED
Explain CVE-2009-1391
Off-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2.017, as used in AMaViS, SpamAssassin, and possibly other products, allows context-dependent attackers to cause a denial of service (hang or crash) via a crafted zlib compressed stream that triggers a heap-based buffer overflow, as exploited in the wild by Trojan.Downloader-71014 in June 2009.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://article.gmane.org/gmane.mail.virus.amavis.user/33635'}, {'tags': ['x_refsource_MISC'], 'url': 'http://thread.gmane.org/gmane.mail.virus.amavis.user/33635'}, {'name': 'perl-compressrawzlib-inflate-bo(51062)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/51062'}, {'name': 'USN-794-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/794-1/'}, {'name': 'MDVSA-2009:157', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2009:157'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.gentoo.org/show_bug.cgi?id=273141'}, {'name': '35307', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35307'}, {'name': 'GLSA-200908-07', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200908-07.xml'}, {'name': '35685', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35685'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=504386'}, {'name': '35689', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35689'}, {'name': 'ADV-2009-1571', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1571'}, {'name': 'SUSE-SR:2009:012', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html'}, {'name': '55041', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/55041'}, {'tags': ['x_refsource_MISC'], 'url': 'http://article.gmane.org/gmane.mail.virus.amavis.user/33638'}, {'name': '35422', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35422'}, {'name': '35876', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35876'}, {'name': 'FEDORA-2009-7680', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00607.html'}]
CVE State: PUBLISHED
Explain CVE-2009-1394
Stack-based buffer overflow in Motorola Timbuktu Pro 8.6.5 on Windows allows remote attackers to execute arbitrary code by sending a long malformed string over the PlughNTCommand named pipe.
Affected Products: n/a
References: [{'name': '20090625 Motorola Timbuktu Pro PlughNTCommand Stack Based Buffer Overflow Vulnerability', 'tags': ['third-party-advisory', 'x_refsource_IDEFENSE'], 'url': 'http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=809'}, {'name': '1022455', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1022455'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.netopia.com/software/products/tb2/'}, {'name': '35533', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35533'}, {'name': '35496', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35496'}, {'name': '20090625 iDefense Security Advisory 06.25.09: Motorola Timbuktu Pro PlughNTCommand Stack Based Buffer Overflow Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/504554/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2009-1403
SQL injection vulnerability in product_info.php in CRE Loaded 6.2 allows remote attackers to execute arbitrary SQL commands via the products_id parameter.
Affected Products: n/a
References: [{'name': '34640', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34640'}, {'name': '8501', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8501'}, {'name': 'creloaded-productinfo-sql-injection(49987)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49987'}]
CVE State: PUBLISHED