Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2009-0369
Microsoft Internet Explorer 7 allows remote attackers to trick a user into visiting an arbitrary URL via an onclick action that moves a crafted element to the current mouse position, related to a "Clickjacking" vulnerability.
Affected Products: n/a
References: [{'name': '7912', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/7912'}, {'name': 'ie-onclickaction-click-hijacking(48542)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48542'}]
CVE State: PUBLISHED
Explain CVE-2009-0370
Multiple unspecified vulnerabilities in IBM AIX 5.2.0 through 6.1.2 allow local users to append data to arbitrary files, related to (1) rmsock and (2) rmsock64 not creating "secure log files."
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://aix.software.ibm.com/aix/efixes/security/rmsock_advisory.asc'}, {'name': 'oval:org.mitre.oval:def:6028', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6028'}, {'name': 'IZ42786', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www.ibm.com/support/docview.wss?uid=isg1IZ42786'}, {'name': 'IZ42787', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www.ibm.com/support/docview.wss?uid=isg1IZ42787'}, {'name': 'IZ42788', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www.ibm.com/support/docview.wss?uid=isg1IZ42788'}, {'name': '33522', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33522'}, {'name': 'IZ41599', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www.ibm.com/support/docview.wss?uid=isg1IZ41599'}, {'name': 'IZ41593', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www.ibm.com/support/docview.wss?uid=isg1IZ41593'}, {'name': 'IZ40386', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www.ibm.com/support/docview.wss?uid=isg1IZ40386'}, {'name': 'IZ41510', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www.ibm.com/support/docview.wss?uid=isg1IZ41510'}, {'name': 'IZ42785', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www.ibm.com/support/docview.wss?uid=isg1IZ42785'}]
CVE State: PUBLISHED
Explain CVE-2009-0371
Directory traversal vulnerability in post.php in SiteXS CMS 0.1.1 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the type parameter.
Affected Products: n/a
References: [{'name': '33457', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33457'}, {'name': '7879', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/7879'}, {'name': 'sitexs-type-file-include(48236)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48236'}, {'name': 'ADV-2009-0247', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0247'}]
CVE State: PUBLISHED
Explain CVE-2009-0372
Unrestricted file upload vulnerability in index.php in Miltenovik Manojlo MemHT Portal 4.0.1 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension and an image content type via a users editProfile action, then accessing this file via a direct request to the file in images/avatar/uploaded/.
Affected Products: n/a
References: [{'name': '33626', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33626'}, {'name': '7859', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/7859'}, {'name': 'memht-avatar-file-upload(48199)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48199'}, {'name': '33424', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33424'}]
CVE State: PUBLISHED
Explain CVE-2009-0373
SQL injection vulnerability in the ElearningForce Flash Magazine Deluxe (com_flashmagazinedeluxe) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the mag_id parameter in a magazine action to index.php.
Affected Products: n/a
References: [{'name': '7881', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/7881'}, {'name': '33646', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33646'}, {'name': '33455', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33455'}, {'name': 'flashmagazine-index-sql-injection(48226)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48226'}, {'name': 'ADV-2009-0249', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0249'}]
CVE State: PUBLISHED
Explain CVE-2009-0374
Google Chrome 1.0.154.43 allows remote attackers to trick a user into visiting an arbitrary URL via an onclick action that moves a crafted element to the current mouse position, related to a "Clickjacking" vulnerability.  NOTE: a third party disputes the relevance of this issue, stating that "every sufficiently featured browser is and likely will remain susceptible to the behavior known as clickjacking," and adding that the exploit code "is not a valid demonstration of the issue.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.secniche.org/gcr_clkj/'}, {'name': '7903', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/7903'}, {'name': '20090128 Re: Advisory: Google Chrome 1.0.154.43 ClickJacking Vulnerability.', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/500533/100/0/threaded'}, {'name': '20090128 Advisory: Google Chrome 1.0.154.43 ClickJacking Vulnerability.', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/500499/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2009-0375
Buffer overflow in a DLL file in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and Helix Player 10.x allows remote attackers to execute arbitrary code via a crafted Internet Video Recording (IVR) file with a filename length field containing a large integer, which triggers overwrite of an arbitrary memory location with a 0x00 byte value, related to use of RealPlayer through a Windows Explorer plugin.
Affected Products: n/a
References: [{'name': 'ADV-2010-0178', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0178'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://service.real.com/realplayer/security/01192010_player/en/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.fortiguardcenter.com/advisory/FGA-2009-04.html'}, {'name': '33810', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33810'}, {'name': 'realplayer-ivr-bo(48567)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48567'}, {'name': '20090206 RealNetworks RealPlayer IVR File Processing Multiple Code Execute Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/500722/100/0/threaded'}, {'name': '38218', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38218'}, {'name': '33652', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33652'}]
CVE State: PUBLISHED
Explain CVE-2009-0376
Heap-based buffer overflow in a DLL file in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and Helix Player 10.x allows remote attackers to execute arbitrary code via a crafted Internet Video Recording (IVR) file with a modified field that controls an unspecified structure length and triggers heap corruption, related to use of RealPlayer through a Windows Explorer plugin.
Affected Products: n/a
References: [{'name': '20100121 ZDI-10-009: RealNetworks RealPlayer IVR Format Remote Code Execution Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/509097/100/0/threaded'}, {'name': 'ADV-2010-0178', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2010/0178'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://service.real.com/realplayer/security/01192010_player/en/'}, {'name': 'realplayer-ivr-code-execution(48568)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48568'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.fortiguardcenter.com/advisory/FGA-2009-04.html'}, {'name': '33810', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33810'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.zerodayinitiative.com/advisories/ZDI-10-009/'}, {'name': '20090206 RealNetworks RealPlayer IVR File Processing Multiple Code Execute Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/500722/100/0/threaded'}, {'name': '38218', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/38218'}, {'name': '33652', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33652'}]
CVE State: PUBLISHED
Explain CVE-2009-0377
SQL injection vulnerability in the beamospetition (com_beamospetition) 1.0.12 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the mpid parameter in a sign action to index.php, a different vector than CVE-2008-3132.
Affected Products: n/a
References: [{'name': '20090121 Joomla component beamospetition 1.0.12 Sql Injection', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/500250/100/0/threaded'}, {'name': '7847', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/7847'}, {'name': '33391', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33391'}]
CVE State: PUBLISHED
Explain CVE-2009-0378
Cross-site scripting (XSS) vulnerability in index.php in the beamospetition (com_beamospetition) 1.0.12 component for Joomla! allows remote attackers to inject arbitrary web script or HTML via the pet parameter in a sign action.
Affected Products: n/a
References: [{'name': '20090121 Joomla component beamospetition 1.0.12 Sql Injection', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/500250/100/0/threaded'}, {'name': '7847', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/7847'}, {'name': '33391', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33391'}]
CVE State: PUBLISHED
Explain CVE-2009-0379
SQL injection vulnerability in the Prince Clan Chess Club (com_pcchess) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the game_id parameter in a showgame action to index.php, a different vector than CVE-2008-0761.
Affected Products: n/a
References: [{'name': '7846', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/7846'}, {'name': '33394', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33394'}, {'name': 'joomla-pcchess-gameid-sql-injection(48144)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48144'}]
CVE State: PUBLISHED
Explain CVE-2009-0380
SQL injection vulnerability in the Sigsiu Online Business Index 2 (SOBI2, com_sobi2) RC 2.8.2 component for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the bid parameter in a showbiz action to index.php, a different vector than CVE-2008-0607.  NOTE: CVE disputes this issue, since neither "showbiz" nor "bid" appears in the source code for SOBI2
Affected Products: n/a
References: [{'name': '33378', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33378'}, {'name': '7841', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/7841'}, {'name': '20090130 SOBI2 showbiz SQL injection - false, or site-specific', 'tags': ['mailing-list', 'x_refsource_VIM'], 'url': 'http://www.attrition.org/pipermail/vim/2009-January/002136.html'}, {'name': 'sobi2-bid-sql-injection(48131)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48131'}]
CVE State: PUBLISHED
Explain CVE-2009-0381
SQL injection vulnerability in the BazaarBuilder Ecommerce Shopping Cart (com_prod) 5.0 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the cid parameter in a products action to index.php.
Affected Products: n/a
References: [{'name': '33380', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33380'}, {'name': '33612', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33612'}, {'name': '7840', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/7840'}, {'name': 'bazaarbuilder-index-sql-injection(48141)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48141'}]
CVE State: PUBLISHED
Explain CVE-2009-0382
Unspecified vulnerability in Internationalization (i18n) Translation 5.x before 5.x-2.5, a module for Drupal, allows remote attackers with "translate node" permissions to bypass intended access restrictions and read unpublished nodes via unspecified vectors.
Affected Products: n/a
References: [{'name': '33549', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33549'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/358958'}, {'name': '33283', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33283'}]
CVE State: PUBLISHED
Explain CVE-2009-0383
delete.php in Max.Blog 1.0.6 does not properly restrict access, which allows remote attackers to delete arbitrary blog posts via a direct request.
Affected Products: n/a
References: [{'name': 'maxblog-delete-security-bypass(48125)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48125'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mzbservices.com/show_post.php?id=72'}, {'name': '51482', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/51482'}, {'name': '7835', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/7835'}, {'name': '33368', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33368'}, {'name': '33590', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33590'}]
CVE State: PUBLISHED
Explain CVE-2009-0384
SQL injection vulnerability in autor.php in OwnRS CMS 1.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Affected Products: n/a
References: [{'name': '7849', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/7849'}]
CVE State: PUBLISHED
Explain CVE-2009-0386
Heap-based buffer overflow in the qtdemux_parse_samples function in gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka gst-plugins-good) 0.10.9 through 0.10.11 might allow remote attackers to execute arbitrary code via crafted Composition Time To Sample (ctts) atom data in a malformed QuickTime media .mov file.
Affected Products: n/a
References: [{'name': '33405', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33405'}, {'name': 'oval:org.mitre.oval:def:10306', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10306'}, {'name': '20090122 [TKADV2009-003] GStreamer Heap Overflow and Array Index out of Bounds Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/500317/100/0/threaded'}, {'name': '34336', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34336'}, {'name': '33815', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33815'}, {'name': '35777', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35777'}, {'tags': ['x_refsource_MISC'], 'url': 'http://trapkit.de/advisories/TKADV2009-003.txt'}, {'name': 'RHSA-2009:0271', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2009-0271.html'}, {'name': 'GLSA-200907-11', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200907-11.xml'}, {'name': '33650', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33650'}, {'name': 'ADV-2009-0225', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0225'}, {'name': 'SUSE-SR:2009:005', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00000.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=481267'}, {'name': 'USN-736-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-736-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://gstreamer.freedesktop.org/releases/gst-plugins-good/0.10.12.html'}, {'name': '[oss-security] 20090129 CVE Request -- (sort of urgent) gstreamer-plugins-good (repost) (more details about affected versions -- final version)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2009/01/29/3'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://cgit.freedesktop.org/gstreamer/gst-plugins-good/commit/?id=bdc20b9baf13564d9a061343416395f8f9a92b53'}, {'name': 'MDVSA-2009:035', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2009:035'}]
CVE State: PUBLISHED
Explain CVE-2009-0387
Array index error in the qtdemux_parse_samples function in gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka gst-plugins-good) 0.10.9 through 0.10.11 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted Sync Sample (aka stss) atom data in a malformed QuickTime media .mov file, related to "mark keyframes."
Affected Products: n/a
References: [{'name': '33405', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33405'}, {'name': '20090122 [TKADV2009-003] GStreamer Heap Overflow and Array Index out of Bounds Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/500317/100/0/threaded'}, {'name': '34336', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34336'}, {'name': '33815', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33815'}, {'name': '35777', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35777'}, {'tags': ['x_refsource_MISC'], 'url': 'http://trapkit.de/advisories/TKADV2009-003.txt'}, {'name': 'RHSA-2009:0271', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2009-0271.html'}, {'name': 'GLSA-200907-11', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200907-11.xml'}, {'name': '33650', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33650'}, {'name': 'ADV-2009-0225', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0225'}, {'name': 'SUSE-SR:2009:005', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00000.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=481267'}, {'name': 'USN-736-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-736-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://gstreamer.freedesktop.org/releases/gst-plugins-good/0.10.12.html'}, {'name': 'oval:org.mitre.oval:def:10611', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10611'}, {'name': '[oss-security] 20090129 CVE Request -- (sort of urgent) gstreamer-plugins-good (repost) (more details about affected versions -- final version)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2009/01/29/3'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://cgit.freedesktop.org/gstreamer/gst-plugins-good/commit/?id=bdc20b9baf13564d9a061343416395f8f9a92b53'}, {'name': 'MDVSA-2009:035', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2009:035'}]
CVE State: PUBLISHED
Explain CVE-2009-0388
Multiple integer signedness errors in (1) UltraVNC 1.0.2 and 1.0.5 and (2) TightVnc 1.3.9 allow remote VNC servers to cause a denial of service (heap corruption and application crash) or possibly execute arbitrary code via a large length value in a message, related to the (a) ClientConnection::CheckBufferSize and (b) ClientConnection::CheckFileZipBufferSize functions in ClientConnection.cpp.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://forum.ultravnc.info/viewtopic.php?t=14654'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://vnc-tight.svn.sourceforge.net/viewvc/vnc-tight?view=rev&revision=3564'}, {'name': 'ADV-2009-0321', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0321'}, {'name': '33568', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33568'}, {'name': '20090203 CORE-2008-1009 - VNC Multiple Integer Overflows', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/500632/100/0/threaded'}, {'name': '8024', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8024'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.coresecurity.com/content/vnc-integer-overflows'}, {'name': 'ADV-2009-0322', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0322'}, {'name': '7990', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/7990'}, {'name': '33807', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33807'}]
CVE State: PUBLISHED
Explain CVE-2009-0389
Multiple insecure method vulnerabilities in the Web On Windows (WOW) ActiveX control in WOW ActiveX 2 allow remote attackers to (1) create and overwrite arbitrary files via the WriteIniFileString method, (2) execute arbitrary programs via the ShellExecute method, (3) read from the registry via unspecified vectors, and (4) write to the registry via unspecified vectors.  NOTE: vectors 1 and 2 can be used together to execute arbitrary code.
Affected Products: n/a
References: [{'name': 'wow-writeinifilestring-code-execution(48337)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48337'}, {'name': '7910', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/7910'}, {'name': '33515', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33515'}]
CVE State: PUBLISHED
Explain CVE-2009-0390
Argument injection vulnerability in Enomaly Elastic Computing Platform (ECP), formerly Enomalism, before 2.1.1 allows local users to send signals to arbitrary processes by populating the /tmp/enomalism2.pid file with command-line arguments for the kill program.
Affected Products: n/a
References: [{'name': '20090130 CVE-2008-4990 Enomaly ECP/Enomalism: Insecure temporary file creation vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/500573/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2009-0391
Unspecified vulnerability in IBM WebSphere Application Server (WAS) 6.0.1 on z/OS allows attackers to read arbitrary files via unknown vectors.
Affected Products: n/a
References: [{'name': '1021658', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021658'}, {'name': 'PK79232', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1PK79232'}, {'name': '33533', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33533'}, {'name': 'PK72036', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1PK72036'}, {'name': '33729', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33729'}, {'name': 'ADV-2009-0423', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0423'}, {'name': '51663', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/51663'}]
CVE State: PUBLISHED
Explain CVE-2009-0392
Directory traversal vulnerability in sysconf.cgi in Motorola Wimax modem CPEi300 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the page parameter.
Affected Products: n/a
References: [{'name': '33519', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33519'}, {'name': '7915', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/7915'}, {'name': '20090129 Motorola Wimax Modem CPEi300 Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/500545/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2009-0393
Cross-site scripting (XSS) vulnerability in sysconf.cgi in Motorola Wimax modem CPEi300 allows remote authenticated users to inject arbitrary web script or HTML via the page parameter.
Affected Products: n/a
References: [{'name': '33519', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33519'}, {'name': '7915', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/7915'}, {'name': '20090129 Motorola Wimax Modem CPEi300 Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/500545/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2009-0394
SQL injection vulnerability in login.php in Pre Lecture Exercises (PLEs) CMS 1.0 beta 4.2 allows remote attackers to execute arbitrary SQL commands via the school parameter.
Affected Products: n/a
References: [{'name': '33524', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33524'}, {'name': '7917', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/7917'}]
CVE State: PUBLISHED
Explain CVE-2009-0395
SQL injection vulnerability in the login feature in NetArt Media Car Portal 1.0 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.
Affected Products: n/a
References: [{'name': '33521', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33521'}, {'name': '7916', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/7916'}]
CVE State: PUBLISHED
Explain CVE-2009-0396
The Sony Ericsson W910i, W660i, K618i, K610i, Z610i, K810i, K660i, W880i, and K530i phones allow remote attackers to cause a denial of service (device reboot or hang-up) via a malformed WAP Push packet to (1) SMS or (2) UDP port 2948.
Affected Products: n/a
References: [{'name': '33433', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33433'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.mseclab.com/index.php?page_id=123'}, {'name': '20090126 SonyEricsson WAP Push Denial of Service', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/500382/100/0/threaded'}, {'name': '33616', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33616'}, {'name': '1021634', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021634'}]
CVE State: PUBLISHED
Explain CVE-2009-0398
Array index error in the gst_qtp_trak_handler function in gst/qtdemux/qtdemux.c in GStreamer Plug-ins (aka gstreamer-plugins) 0.6.0 allows remote attackers to have an unknown impact via a crafted QuickTime media file.
Affected Products: n/a
References: [{'name': 'RHSA-2009:0269', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2009-0269.html'}, {'name': '33830', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33830'}, {'name': 'oval:org.mitre.oval:def:9886', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9886'}, {'name': '[oss-security] 20090129 CVE Request -- (sort of urgent) gstreamer-plugins-good (repost) (more details about affected versions -- final version)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2009/01/29/3'}]
CVE State: PUBLISHED
Explain CVE-2009-0399
Chipmunk Blogger Script allows remote attackers to gain administrator privileges via a direct request to admin/reguser.php.  NOTE: this is only a vulnerability when the administrator does not properly follow installation directions.
Affected Products: n/a
References: [{'name': '7894', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/7894'}]
CVE State: PUBLISHED
Explain CVE-2009-0400
SQL injection vulnerability in blog.php in SocialEngine 3.06 trial allows remote attackers to execute arbitrary SQL commands via the category_id parameter.
Affected Products: n/a
References: [{'name': '33495', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33495'}, {'name': '33701', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33701'}, {'name': '7900', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/7900'}, {'name': 'socialengine-blog-sql-injection(48316)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48316'}, {'name': '51644', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/51644'}]
CVE State: PUBLISHED
Explain CVE-2009-0401
SQL injection vulnerability in browsecats.php in E-Php CMS allows remote attackers to execute arbitrary SQL commands via the cid parameter.
Affected Products: n/a
References: [{'name': '33470', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33470'}, {'name': '31923', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/31923'}, {'name': 'ephpcms-browsecats-sql-injection(48297)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48297'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/0901-exploits/ephpcmscid-sql.txt'}]
CVE State: PUBLISHED
Explain CVE-2009-0402
SQL injection vulnerability in client/new_account.php in Domain Technologie Control (DTC) before 0.29.16 allows remote attackers to execute arbitrary SQL commands via the (1) familyname, (2) christname, (3) company_name, (4) is_company, (5) email, (6) phone, (7) fax, (8) addr1, (9) addr2, (10) addr3, (11) zipcode, (12) city, (13) state, (14) country, and (15) vat_num parameters.
Affected Products: n/a
References: [{'name': '33496', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33496'}, {'name': 'domaintechnologie-newaccount-sql-injection(48292)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48292'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://freshmeat.net/projects/dtc/?branch_id=22759&release_id=292973'}, {'name': '51631', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/51631'}, {'name': '33698', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33698'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.gplhost.com/gitweb/?p=dtc.git%3Ba=commitdiff%3Bh=056e1d1849ff3aa183a410e2aab1c1c3e969247d'}]
CVE State: PUBLISHED
Explain CVE-2009-0403
SQL injection vulnerability in admin/authenticate.php in Chipmunk Blogger Script allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.
Affected Products: n/a
References: [{'name': 'ADV-2009-0267', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0267'}, {'name': '7894', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/7894'}, {'name': 'chipmunkblog-authenticate-sql-injection(48313)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48313'}]
CVE State: PUBLISHED
Explain CVE-2009-0404
Multiple cross-site scripting (XSS) vulnerabilities in Bioinformatics htmLawed 1.1.3 and 1.1.4 allow remote attackers to inject arbitrary web script or HTML via invalid Cascading Style Sheets (CSS) expressions in the style attribute, which is processed by Internet Explorer 7.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://freshmeat.net/projects/htmlawed/?branch_id=74760&release_id=293026'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.bioinformatics.org/phplabware/forum/viewtopic.php?id=85'}, {'name': '51650', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/51650'}, {'name': '33655', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33655'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://freshmeat.net/projects/htmlawed/?branch_id=74760&release_id=293090'}, {'name': 'htmlawed-unspecified-xss(48333)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48333'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.bioinformatics.org/phplabware/internal_utilities/htmLawed/htmLawed_README.htm#s4.3'}, {'name': '33507', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33507'}]
CVE State: PUBLISHED
Explain CVE-2009-0405
SQL injection vulnerability in articles.php in smartSite CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the var parameter.
Affected Products: n/a
References: [{'name': 'smartsitecms-articles-sql-injection(48321)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48321'}, {'name': '7901', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/7901'}, {'name': '33497', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33497'}]
CVE State: PUBLISHED
Explain CVE-2009-0406
SQL injection vulnerability in index.php in Community CMS 0.4 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
Affected Products: n/a
References: [{'name': '7892', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/7892'}, {'name': '33484', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33484'}, {'name': 'communitycms-index-sql-injection(48304)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48304'}, {'name': 'ADV-2009-0265', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0265'}]
CVE State: PUBLISHED
Explain CVE-2009-0407
SQL injection vulnerability in admin/login.php in PHP-CMS Project 1 allows remote attackers to execute arbitrary SQL commands via the username parameter.
Affected Products: n/a
References: [{'name': '33473', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33473'}, {'name': '7876', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/7876'}, {'name': 'phpcms-login-sql-injection(48267)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48267'}, {'name': 'ADV-2009-0244', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0244'}]
CVE State: PUBLISHED
Explain CVE-2009-0408
Cross-site request forgery (CSRF) vulnerability in osCommerce 2.2 RC 2a allows remote attackers to hijack the authentication of administrators.
Affected Products: n/a
References: [{'name': '51605', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/51605'}, {'name': 'oscommerce-unspecified-csrf(48289)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48289'}, {'tags': ['x_refsource_MISC'], 'url': 'http://holisticinfosec.org/content/view/97/45/'}, {'name': '33446', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33446'}]
CVE State: PUBLISHED
Explain CVE-2009-0409
SQL injection vulnerability in offline_auth.php in Max.Blog 1.0.6 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter.
Affected Products: n/a
References: [{'name': '7899', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/7899'}, {'name': '33493', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33493'}, {'name': '33658', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33658'}, {'name': '20090127 Max.Blog <= 1.0.6 (offline_auth.php) Offline Authentication Bypass', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/500470/100/0/threaded'}, {'name': '51645', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/51645'}]
CVE State: PUBLISHED
Explain CVE-2009-0410
Off-by-one error in the SMTP daemon in GroupWise Internet Agent (GWIA) in Novell GroupWise 6.5x, 7.0, 7.01, 7.02, 7.03, 7.03HP1a, and 8.0 allows remote attackers to execute arbitrary code via a long e-mail address in a malformed RCPT command, leading to a buffer overflow.
Affected Products: n/a
References: [{'name': '33744', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33744'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://download.novell.com/Download?buildid=GjZRRdqCFW0'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.novell.com/support/viewContent.do?externalId=7002502'}, {'name': '33560', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33560'}, {'name': '20090202 ZDI-09-010: Novell Netware Groupwise GWIA RCPT Command Buffer Overflow Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/500609/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.zerodayinitiative.com/advisories/ZDI-09-010/'}]
CVE State: PUBLISHED
Explain CVE-2009-0411
Google Chrome before 1.0.154.46 does not properly restrict access from web pages to the (1) Set-Cookie and (2) Set-Cookie2 HTTP response headers, which allows remote attackers to obtain sensitive information from cookies via XMLHttpRequest calls and other web script.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://codereview.chromium.org/18533'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sites.google.com/a/chromium.org/dev/getting-involved/dev-channel/release-notes'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://src.chromium.org/viewvc/chrome?view=rev&revision=8529'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://codereview.chromium.org/11264'}, {'name': 'googlechrome-xmlhttprequest-info-disclosure(48554)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48554'}]
CVE State: PUBLISHED
Explain CVE-2009-0412
The ProcessLogin function in class.auth.php in Interspire Shopping Cart (ISC) 4.0.1 Ultimate edition allows remote attackers to bypass authentication and obtain administrative access by reusing the RememberToken cookie after a failed admin login attempt.
Affected Products: n/a
References: [{'name': '1021557', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021557'}, {'name': '33212', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33212'}, {'name': '20090112 [BMSA-2009-01] Authentication bypass in Interspire Shopping Cart v4.0.1 and below', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/499967/100/0/threaded'}, {'name': 'interspire-classauth-security-bypass(47899)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/47899'}]
CVE State: PUBLISHED
Explain CVE-2009-0413
Cross-site scripting (XSS) vulnerability in RoundCube Webmail (roundcubemail) 0.2 stable allows remote attackers to inject arbitrary web script or HTML via the background attribute embedded in an HTML e-mail message.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://trac.roundcube.net/changeset/2245'}, {'name': 'ADV-2009-0192', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0192'}, {'name': '33372', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33372'}, {'name': 'roundcube-html-xss(48129)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48129'}, {'name': '33622', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33622'}, {'name': '33827', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33827'}, {'name': 'FEDORA-2009-1256', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00082.html'}]
CVE State: PUBLISHED
Explain CVE-2009-0414
Unspecified vulnerability in Tor before 0.2.0.33 has unspecified impact and remote attack vectors that trigger heap corruption.
Affected Products: n/a
References: [{'name': 'ADV-2009-0210', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0210'}, {'name': '34583', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34583'}, {'name': '[or-announce] 20090122 Tor 0.2.0.33 is released', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://archives.seul.org/or/announce/Jan-2009/msg00000.html'}, {'name': '33677', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33677'}, {'name': 'FEDORA-2009-0897', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00902.html'}, {'name': '33399', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33399'}, {'name': '33635', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33635'}, {'name': 'GLSA-200904-11', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200904-11.xml'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://blog.torproject.org/blog/tor-0.2.0.33-stable-released'}, {'name': '1021633', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021633'}]
CVE State: PUBLISHED
Explain CVE-2009-0415
Untrusted search path vulnerability in trickle 1.07 allows local users to execute arbitrary code via a Trojan horse trickle-overload.so in the current working directory, which is referenced in the LD_PRELOAD path.
Affected Products: n/a
References: [{'name': '[oss-security] 20090129 CVE Request (trickle)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2009/01/29/5'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=513456'}, {'name': '33516', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33516'}]
CVE State: PUBLISHED
Explain CVE-2009-0416
The SSL certificate setup program (genSslCert.sh) in Standards Based Linux Instrumentation for Manageability (SBLIM) sblim-sfcb 1.3.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /var/tmp/key.pem, (2) /var/tmp/cert.pem, and (3) /var/tmp/ssl.cnf temporary files.
Affected Products: n/a
References: [{'name': '33583', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33583'}, {'tags': ['x_refsource_MISC'], 'url': 'http://sourceforge.net/tracker/index.php?func=detail&aid=2561165&group_id=128809&atid=712784'}, {'name': '51783', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/51783'}, {'name': '[oss-security] 20090203 CVE Request: sblim-sfcb genSslCert.sh temp race', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://sourceforge.net/forum/forum.php?forum_id=874261'}, {'name': 'SUSE-SR:2009:004', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html'}, {'name': '33795', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33795'}]
CVE State: PUBLISHED
Explain CVE-2009-0417
Cross-site scripting (XSS) vulnerability in the AgaviWebRouting::gen(null) method in Agavi 0.11 before 0.11.6 and 1.0 before 1.0.0 beta 8 allows remote attackers to inject arbitrary web script or HTML via a crafted URL with certain characters that are not properly handled by web browsers that do not strictly follow RFC 3986, such as Internet Explorer 6 and 7.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://blog.agavi.org/post/75829956/agavi-0-11-6-released-fixes-vulnerability'}, {'name': '33826', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33826'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://trac.agavi.org/ticket/1019'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://blog.agavi.org/post/75830918/agavi-1-0-0-beta-8-released-fixes-vulnerability'}]
CVE State: PUBLISHED