Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2009-0602
Unrestricted file upload vulnerability in upload.php in WikkiTikkiTavi 1.11 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in img/.
Affected Products: n/a
References: [{'name': '33647', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33647'}, {'name': '7998', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/7998'}, {'name': 'wikkitikkitavi-upload-file-upload(48571)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48571'}]
CVE State: PUBLISHED
Explain CVE-2009-0603
Cross-site scripting (XSS) vulnerability in index.php in the Link module 5.x-2.5 for Drupal 5.10 allows remote authenticated users, with "administer content types" privileges, to inject arbitrary web script or HTML via the description parameter (aka the Help field).  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': '51780', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/51780'}, {'name': '33835', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33835'}, {'name': '33642', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33642'}, {'name': '20090205 Drupal Link Module XSS Vulnerability', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2009-02/0036.html'}, {'name': 'link-description-xss(48553)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48553'}]
CVE State: PUBLISHED
Explain CVE-2009-0604
SQL injection vulnerability in index.php in PHP Director 0.21 and earlier allows remote attackers to execute arbitrary SQL commands via the searching parameter.
Affected Products: n/a
References: [{'name': '8014', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8014'}, {'name': 'ADV-2009-0379', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0379'}, {'name': '33694', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33694'}]
CVE State: PUBLISHED
Explain CVE-2009-0605
Stack consumption vulnerability in the do_page_fault function in arch/x86/mm/fault.c in the Linux kernel before 2.6.28.5 allows local users to cause a denial of service (memory corruption) or possibly gain privileges via unspecified vectors that trigger page faults on a machine that has a registered Kprobes probe.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.28.5'}, {'name': '33758', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33758'}, {'name': 'USN-751-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/usn-751-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.27.y.git%3Ba=commit%3Bh=9be260a646bf76fa418ee519afa10196b3164681'}]
CVE State: PUBLISHED
Explain CVE-2009-0606
The link_image function in linker/linker.c in the dynamic linker in Bionic in Open Handset Alliance Android 1.0 on the T-Mobile G1 phone does not properly handle file descriptors 0, 1, and 2 for a setgid program, which allows local users to create arbitrary files owned by certain groups, possibly a related issue to CVE-2002-0820.
Affected Products: n/a
References: [{'name': 'android-dynamic-linker-privilege-escalation(48840)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48840'}, {'name': '33695', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33695'}, {'name': '20090208 rooting your own phone: android security', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/500753/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2009-0607
Multiple integer overflows in malloc_leak.c in Bionic in Open Handset Alliance Android 1.0 have unknown impact and attack vectors, related to the (1) chk_calloc and (2) leak_calloc functions.
Affected Products: n/a
References: [{'name': '33695', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33695'}, {'name': '20090208 rooting your own phone: android security', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/500753/100/0/threaded'}, {'name': 'android-malloc-overflow(48841)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48841'}]
CVE State: PUBLISHED
Explain CVE-2009-0608
Integer overflow in the showLog function in fake_log_device.c in liblog in Open Handset Alliance Android 1.0 allows attackers to trigger a buffer overflow and possibly have unspecified other impact by sending a large number of input lines.
Affected Products: n/a
References: [{'name': '33695', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33695'}, {'name': '20090208 rooting your own phone: android security', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/500753/100/0/threaded'}, {'name': 'android-showlog-bo(48842)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48842'}]
CVE State: PUBLISHED
Explain CVE-2009-0609
Sun Java System Directory Proxy Server in Sun Java System Directory Server Enterprise Edition 6.0 through 6.3, when a JDBC data source is used, does not properly handle (1) a long value in an ADD or (2) long string attributes, which allows remote attackers to cause a denial of service (JDBC backend outage) via crafted LDAP requests.
Affected Products: n/a
References: [{'name': '33761', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33761'}, {'name': '251086', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-66-251086-1'}, {'name': '33923', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33923'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-21-125276-08-1'}]
CVE State: PUBLISHED
Explain CVE-2009-0610
Multiple static code injection vulnerabilities in post.php in Simple PHP News 1.0 final allow remote attackers to inject arbitrary PHP code into news.txt via the (1) title or (2) date parameter, and then execute the code via a direct request to display.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': '51816', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/51816'}, {'name': '33814', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33814'}]
CVE State: PUBLISHED
Explain CVE-2009-0611
Multiple cross-site scripting (XSS) vulnerabilities in qfsearch/AdminServlet in QuickFinder Server in Novell Open Enterprise Server 1.x allow remote attackers to inject arbitrary web script or HTML via (1) the siteloc parameter in a displayaddsite action, the site parameter in a (2) generalproperties or (3) clusterserviceproperties action, (4) the adminurl parameter in a global action, or (5) the print-list parameter.
Affected Products: n/a
References: [{'name': '33886', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33886'}, {'name': '33708', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33708'}, {'name': '51941', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/51941'}, {'name': 'ADV-2009-0421', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0421'}, {'name': 'quickfinderserver-multiple-xss(48619)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48619'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/0902-exploits/nqfs-xss.txt'}, {'name': '1021695', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021695'}]
CVE State: PUBLISHED
Explain CVE-2009-0612
Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 3.x and InterScan Web Security Suite (IWSS) 3.x, when basic authorization is enabled on the standalone proxy, forwards the Proxy-Authorization header from Windows Media Player, which allows remote web servers to obtain credentials by offering a media stream and then capturing this header.
Affected Products: n/a
References: [{'name': 'interscan-proxyauthorization-info-disc(48681)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48681'}, {'name': '33891', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33891'}, {'name': '33687', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33687'}, {'name': '1021716', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021716'}, {'name': '20090209 Trend micro - IWSVA/IWSS - Authorization module password leak', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/500760/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2009-0613
Trend Micro InterScan Web Security Suite (IWSS) 3.1 before build 1237 allows remote authenticated Auditor and Report Only users to bypass intended permission settings, and modify the system configuration, via requests to unspecified JSP pages.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.trendmicro.com/ftp/documentation/readme/iwss_31_win_en_readme_CP_1237_EN.txt'}, {'name': '33867', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33867'}, {'name': 'ADV-2009-0369', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0369'}, {'name': '1021694', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021694'}]
CVE State: PUBLISHED
Explain CVE-2009-0614
Unspecified vulnerability in the Web Server in Cisco Unified MeetingPlace Web Conferencing 6.0 before 6.0(517.0) (aka 6.0 MR4) and 7.0 before 7.0(2) (aka 7.0 MR1) allows remote attackers to bypass authentication and obtain administrative access via a crafted URL.
Affected Products: n/a
References: [{'name': '20090225 Cisco Unified MeetingPlace Web Conferencing Authentication Bypass Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc86.shtml'}, {'name': '33901', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33901'}, {'name': 'cisco-meetingplace-unauth-access(48888)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48888'}]
CVE State: PUBLISHED
Explain CVE-2009-0615
Directory traversal vulnerability in Cisco Application Networking Manager (ANM) before 2.0 and Application Control Engine (ACE) Device Manager before A3(2.1) allows remote authenticated users to read or modify arbitrary files via unspecified vectors, related to "invalid directory permissions."
Affected Products: n/a
References: [{'name': '33903', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33903'}, {'name': '20090225 Cisco ACE Application Control Engine Device Manager and Application Networking Manager Vulnerabilities', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc84.shtml'}, {'name': '1021770', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021770'}]
CVE State: PUBLISHED
Explain CVE-2009-0616
Cisco Application Networking Manager (ANM) before 2.0 uses default usernames and passwords, which makes it easier for remote attackers to access the application, or cause a denial of service via configuration changes, related to "default user credentials during installation."
Affected Products: n/a
References: [{'name': '33903', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33903'}, {'name': '1021771', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021771'}, {'name': '20090225 Cisco ACE Application Control Engine Device Manager and Application Networking Manager Vulnerabilities', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc84.shtml'}]
CVE State: PUBLISHED
Explain CVE-2009-0617
Cisco Application Networking Manager (ANM) before 2.0 uses a default MySQL root password, which makes it easier for remote attackers to execute arbitrary operating-system commands or change system files.
Affected Products: n/a
References: [{'name': '33903', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33903'}, {'name': '1021771', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021771'}, {'name': '20090225 Cisco ACE Application Control Engine Device Manager and Application Networking Manager Vulnerabilities', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc84.shtml'}]
CVE State: PUBLISHED
Explain CVE-2009-0618
Unspecified vulnerability in the Java agent in Cisco Application Networking Manager (ANM) before 2.0 Update A allows remote attackers to gain privileges, and cause a denial of service (service outage) by stopping processes, or obtain sensitive information by reading configuration files.
Affected Products: n/a
References: [{'name': '1021772', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021772'}, {'name': '33903', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33903'}, {'name': '20090225 Cisco ACE Application Control Engine Device Manager and Application Networking Manager Vulnerabilities', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc84.shtml'}]
CVE State: PUBLISHED
Explain CVE-2009-0619
Unspecified vulnerability in the Session Border Controller (SBC) before 3.0(2) for Cisco 7600 series routers allows remote attackers to cause a denial of service (SBC card reload) via crafted packets to TCP port 2000.
Affected Products: n/a
References: [{'name': '1021787', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021787'}, {'name': '20090304 Cisco 7600 Series Router Session Border Controller Denial of Service Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://www.cisco.com/en/US/products/products_security_advisory09186a0080a80faa.shtml'}, {'name': 'cisco-sbc-dos(49055)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49055'}, {'name': '33975', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33975'}]
CVE State: PUBLISHED
Explain CVE-2009-0620
Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers before A2(1.1) uses default (1) usernames and (2) passwords for (a) the administrator and (b) web management, which makes it easier for remote attackers to perform configuration changes or obtain operating-system access.
Affected Products: n/a
References: [{'name': '20090225 Multiple Vulnerabilities in the Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc82.shtml'}, {'name': '33900', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33900'}]
CVE State: PUBLISHED
Explain CVE-2009-0621
Cisco ACE 4710 Application Control Engine Appliance before A1(8a) uses default (1) usernames and (2) passwords for (a) the administrator, (b) web management, and (c) device management, which makes it easier for remote attackers to perform configuration changes to the Device Manager and other components, or obtain operating-system access.
Affected Products: n/a
References: [{'name': '20090225 Multiple Vulnerabilities in the Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc82.shtml'}, {'name': '33900', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33900'}]
CVE State: PUBLISHED
Explain CVE-2009-0622
Unspecified vulnerability in Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers before A2(1.2) and Cisco ACE 4710 Application Control Engine Appliance before A1(8a) allows remote authenticated users to execute arbitrary operating-system commands through a command line interface (CLI).
Affected Products: n/a
References: [{'name': '20090225 Multiple Vulnerabilities in the Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc82.shtml'}, {'name': '33900', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33900'}]
CVE State: PUBLISHED
Explain CVE-2009-0623
Unspecified vulnerability in Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers before A2(1.3) and Cisco ACE 4710 Application Control Engine Appliance before A3(2.1) allows remote attackers to cause a denial of service (device reload) via a crafted SSH packet.
Affected Products: n/a
References: [{'name': '20090225 Multiple Vulnerabilities in the Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc82.shtml'}, {'name': '33900', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33900'}]
CVE State: PUBLISHED
Explain CVE-2009-0624
Unspecified vulnerability in the SNMPv2c implementation in Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers before A2(1.3) and Cisco ACE 4710 Application Control Engine Appliance before A3(2.1) allows remote attackers to cause a denial of service (device reload) via a crafted SNMPv1 packet.
Affected Products: n/a
References: [{'name': '1021769', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021769'}, {'name': '20090225 Multiple Vulnerabilities in the Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc82.shtml'}, {'name': '33900', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33900'}]
CVE State: PUBLISHED
Explain CVE-2009-0625
Unspecified vulnerability in Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers before A2(1.2) and Cisco ACE 4710 Application Control Engine Appliance before A1(8.0) allows remote attackers to cause a denial of service (device reload) via a crafted SNMPv3 packet.
Affected Products: n/a
References: [{'name': '1021769', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021769'}, {'name': '20090225 Multiple Vulnerabilities in the Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc82.shtml'}, {'name': '33900', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33900'}]
CVE State: PUBLISHED
Explain CVE-2009-0626
The SSLVPN feature in Cisco IOS 12.3 through 12.4 allows remote attackers to cause a denial of service (device reload or hang) via a crafted HTTPS packet.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90469.shtml'}, {'name': '34239', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34239'}, {'name': 'oval:org.mitre.oval:def:6919', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6919'}, {'name': '34438', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34438'}, {'name': '1021896', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1021896'}, {'name': '20090325 Cisco IOS Software WebVPN and SSLVPN Vulnerabilities', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90424.shtml'}, {'name': 'ios-sslvpn-dos(49425)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49425'}, {'name': 'ADV-2009-0851', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0851'}]
CVE State: PUBLISHED
Explain CVE-2009-0627
Unspecified vulnerability in Cisco NX-OS before 4.0(1a)N2(1), when running on Nexus 5000 platforms, allows remote attackers to cause a denial of service (crash) via an unspecified "sequence of TCP packets" related to "TCP State manipulation," possibly related to separate attacks against CVE-2008-4609.
Affected Products: n/a
References: [{'name': '1022847', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1022847'}, {'name': '20090908 TCP State Manipulation Denial of Service Vulnerabilities in Multiple Cisco Products', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://www.cisco.com/en/US/products/products_security_advisory09186a0080af511d.shtml'}]
CVE State: PUBLISHED
Explain CVE-2009-0628
Memory leak in the SSLVPN feature in Cisco IOS 12.3 through 12.4 allows remote attackers to cause a denial of service (memory consumption and device crash) by disconnecting an SSL session in an abnormal manner, leading to a Transmission Control Block (TCB) leak.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90469.shtml'}, {'name': 'oval:org.mitre.oval:def:12092', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12092'}, {'name': '34239', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34239'}, {'name': '34438', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34438'}, {'name': '1021896', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1021896'}, {'name': 'ios-sslvpn-tcbleak-dos(49427)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49427'}, {'name': '20090325 Cisco IOS Software WebVPN and SSLVPN Vulnerabilities', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90424.shtml'}, {'name': 'ADV-2009-0851', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0851'}]
CVE State: PUBLISHED
Explain CVE-2009-0629
The (1) Airline Product Set (aka ALPS), (2) Serial Tunnel Code (aka STUN), (3) Block Serial Tunnel Code (aka BSTUN), (4) Native Client Interface Architecture (NCIA) support, (5) Data-link switching (aka DLSw), (6) Remote Source-Route Bridging (RSRB), (7) Point to Point Tunneling Protocol (PPTP), (8) X.25 for Record Boundary Preservation (RBP), (9) X.25 over TCP (XOT), and (10) X.25 Routing features in Cisco IOS 12.2 and 12.4 allows remote attackers to cause a denial of service (device reload) via a series of crafted TCP packets.
Affected Products: n/a
References: [{'name': '20090325 Cisco IOS Software Multiple Features Crafted TCP Sequence Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://www.cisco.com/en/US/products/products_security_advisory09186a0080a904cb.shtml'}, {'name': '1021903', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1021903'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90469.shtml'}, {'name': 'ios-tcp-dos(49420)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49420'}, {'name': '34438', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34438'}, {'name': '34238', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34238'}, {'name': 'ADV-2009-0851', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0851'}]
CVE State: PUBLISHED
Explain CVE-2009-0630
The (1) Cisco Unified Communications Manager Express; (2) SIP Gateway Signaling Support Over Transport Layer Security (TLS) Transport; (3) Secure Signaling and Media Encryption; (4) Blocks Extensible Exchange Protocol (BEEP); (5) Network Admission Control HTTP Authentication Proxy; (6) Per-user URL Redirect for EAPoUDP, Dot1x, and MAC Authentication Bypass; (7) Distributed Director with HTTP Redirects; and (8) TCP DNS features in Cisco IOS 12.0 through 12.4 do not properly handle IP sockets, which allows remote attackers to cause a denial of service (outage or resource consumption) via a series of crafted TCP packets.
Affected Products: n/a
References: [{'name': '34242', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34242'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90469.shtml'}, {'name': '34438', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34438'}, {'name': '20090325 Cisco IOS Software Multiple Features IP Sockets Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://www.cisco.com/en/US/products/products_security_advisory09186a0080a904c6.shtml'}, {'name': 'ios-ipsockets-dos(49418)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49418'}, {'name': 'ADV-2009-0851', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0851'}, {'name': '1021897', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1021897'}]
CVE State: PUBLISHED
Explain CVE-2009-0631
Unspecified vulnerability in Cisco IOS 12.0 through 12.4, when configured with (1) IP Service Level Agreements (SLAs) Responder, (2) Session Initiation Protocol (SIP), (3) H.323 Annex E Call Signaling Transport, or (4) Media Gateway Control Protocol (MGCP) allows remote attackers to cause a denial of service (blocked input queue on the inbound interface) via a crafted UDP packet.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90469.shtml'}, {'name': 'oval:org.mitre.oval:def:6720', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6720'}, {'name': '34245', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34245'}, {'name': '1021904', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021904'}, {'name': 'ios-udp-dos(49419)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49419'}, {'name': '20090325 Cisco IOS Software Multiple Features Crafted UDP Packet Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90426.shtml'}]
CVE State: PUBLISHED
Explain CVE-2009-0632
The IP Phone Personal Address Book (PAB) Synchronizer feature in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 4.1, 4.2 before 4.2(3)SR4b, 4.3 before 4.3(2)SR1b, 5.x before 5.1(3e), 6.x before 6.1(3), and 7.0 before 7.0(2) sends privileged directory-service account credentials to the client in cleartext, which allows remote attackers to modify the CUCM configuration and perform other privileged actions by intercepting these credentials, and then using them in requests unrelated to the intended synchronization task, as demonstrated by (1) DC Directory account credentials in CUCM 4.x and (2) TabSyncSysUser account credentials in CUCM 5.x through 7.x.
Affected Products: n/a
References: [{'name': '34082', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34082'}, {'name': '52589', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52589'}, {'name': '20090311 Cisco Unified Communications Manager IP Phone Personal Address Book Synchronizer Privilege Escalation Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://www.cisco.com/en/US/products/products_security_advisory09186a0080a8643c.shtml'}, {'name': '20090311 Identifying and Mitigating Exploitation of the Cisco Unified Communications Manager IP Phone Personal Address Book Synchronizer Privilege Escalation Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://www.cisco.com/en/US/products/products_applied_mitigation_bulletin09186a0080a86434.html'}, {'name': '1021839', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021839'}, {'name': 'cucm-pab-privilege-escalation(49196)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49196'}, {'name': '34238', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34238'}, {'name': 'ADV-2009-0675', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0675'}]
CVE State: PUBLISHED
Explain CVE-2009-0633
Multiple unspecified vulnerabilities in the (1) Mobile IP NAT Traversal feature and (2) Mobile IPv6 subsystem in Cisco IOS 12.3 through 12.4 allow remote attackers to cause a denial of service (input queue wedge and interface outage) via MIPv6 packets, aka Bug ID CSCsm97220.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90469.shtml'}, {'name': '34438', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34438'}, {'name': 'oval:org.mitre.oval:def:12290', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12290'}, {'name': '34241', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34241'}, {'name': '1021898', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1021898'}, {'name': '20090325 Cisco IOS Software Mobile IP and Mobile IPv6 Vulnerabilities', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://www.cisco.com/en/US/products/products_security_advisory09186a0080a9042f.shtml'}, {'name': 'ios-mobile-dos(49424)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49424'}, {'name': 'ADV-2009-0851', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0851'}]
CVE State: PUBLISHED
Explain CVE-2009-0634
Multiple unspecified vulnerabilities in the home agent (HA) implementation in the (1) Mobile IP NAT Traversal feature and (2) Mobile IPv6 subsystem in Cisco IOS 12.3 through 12.4 allow remote attackers to cause a denial of service (input queue wedge and interface outage) via an ICMP packet, aka Bug ID CSCso05337.
Affected Products: n/a
References: [{'name': 'oval:org.mitre.oval:def:12043', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12043'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90469.shtml'}, {'name': '34438', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34438'}, {'name': '34241', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34241'}, {'name': '1021898', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1021898'}, {'name': '20090325 Cisco IOS Software Mobile IP and Mobile IPv6 Vulnerabilities', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://www.cisco.com/en/US/products/products_security_advisory09186a0080a9042f.shtml'}, {'name': 'ios-mobile-ha-dos(49585)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49585'}, {'name': 'ios-mobile-dos(49424)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49424'}, {'name': 'ADV-2009-0851', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0851'}]
CVE State: PUBLISHED
Explain CVE-2009-0635
Memory leak in the Cisco Tunneling Control Protocol (cTCP) encapsulation feature in Cisco IOS 12.4, when an Easy VPN (aka EZVPN) server is enabled, allows remote attackers to cause a denial of service (memory consumption and device crash) via a sequence of TCP packets.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90469.shtml'}, {'name': '20090325 Cisco IOS cTCP Denial of Service Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90459.shtml'}, {'name': '34438', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34438'}, {'name': '34246', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34246'}, {'name': 'ios-ctcp-dos(49417)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49417'}, {'name': '1021895', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021895'}, {'name': 'ADV-2009-0851', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0851'}]
CVE State: PUBLISHED
Explain CVE-2009-0636
Unspecified vulnerability in Cisco IOS 12.0 through 12.4, when SIP voice services are enabled, allows remote attackers to cause a denial of service (device crash) via a valid SIP message.
Affected Products: n/a
References: [{'name': '20090325 Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://www.cisco.com/en/US/products/products_security_advisory09186a0080a904c0.shtml'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90469.shtml'}, {'name': '34243', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34243'}, {'name': '34438', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34438'}, {'name': 'ios-sip-dos(49421)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49421'}, {'name': '1021902', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1021902'}, {'name': 'ADV-2009-0851', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0851'}]
CVE State: PUBLISHED
Explain CVE-2009-0637
The SCP server in Cisco IOS 12.2 through 12.4, when Role-Based CLI Access is enabled, does not enforce the CLI view configuration for file transfers, which allows remote authenticated users with an attached CLI view to (1) read or (2) overwrite arbitrary files via an SCP command.
Affected Products: n/a
References: [{'name': '20090325 Cisco IOS Software Secure Copy Privilege Escalation Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://www.cisco.com/en/US/products/products_security_advisory09186a0080a904c8.shtml'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90469.shtml'}, {'name': '34438', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34438'}, {'name': '1021899', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1021899'}, {'name': 'ios-scp-priv-escalation(49423)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49423'}, {'name': '34247', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34247'}, {'name': 'ADV-2009-0851', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0851'}]
CVE State: PUBLISHED
Explain CVE-2009-0638
The Cisco Firewall Services Module (FWSM) 2.x, 3.1 before 3.1(16), 3.2 before 3.2(13), and 4.0 before 4.0(6) for Cisco Catalyst 6500 switches and Cisco 7600 routers allows remote attackers to cause a denial of service (traffic-handling outage) via a series of malformed ICMP messages.
Affected Products: n/a
References: [{'name': '20090819 Firewall Services Module Crafted ICMP Message Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://www.cisco.com/en/US/products/products_security_advisory09186a0080af0d1d.shtml'}, {'name': '36085', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/36085'}, {'name': 'cisco-fwsm-icmp-dos(52591)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/52591'}, {'name': '1022747', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1022747'}, {'name': '36373', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/36373'}, {'name': 'ADV-2009-2329', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/2329'}]
CVE State: PUBLISHED
Explain CVE-2009-0639
PHP remote file inclusion vulnerability in moduli/libri/index.php in phpyabs 0.1.2 allows remote attackers to execute arbitrary PHP code via a URL in the Azione parameter.
Affected Products: n/a
References: [{'name': 'ADV-2009-0361', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0361'}, {'name': '8005', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8005'}, {'name': '33670', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33670'}]
CVE State: PUBLISHED
Explain CVE-2009-0640
Directory traversal vulnerability in the administrative web server in Swann DVR4-SecuraNet allows remote attackers to read arbitrary files via a .. (dot dot) in the URI, as demonstrated by reading the vy_netman.cfg file that contains passwords.
Affected Products: n/a
References: [{'name': '33716', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33716'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstorm.linuxsecurity.com/0902-exploits/cctv-disclose.txt'}, {'name': '51897', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/51897'}, {'name': '20090210 Remote Authentication Bypass - Swann DVR4 SecuraNet (possibly DVR9 as well)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/500789/100/0/threaded'}, {'name': '33861', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33861'}]
CVE State: PUBLISHED
Explain CVE-2009-0641
sys_term.c in telnetd in FreeBSD 7.0-RELEASE and other 7.x versions deletes dangerous environment variables with a method that was valid only in older FreeBSD distributions, which might allow remote attackers to execute arbitrary code by passing a crafted environment variable from a telnet client, as demonstrated by an LD_PRELOAD value that references a malicious library.
Affected Products: n/a
References: [{'name': 'FreeBSD-SA-09:05', 'tags': ['vendor-advisory', 'x_refsource_FREEBSD'], 'url': 'http://security.freebsd.org/advisories/FreeBSD-SA-09:05.telnetd.asc'}, {'name': 'freebsd-telnet-ldpreload-code-execution(48780)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48780'}, {'name': '33777', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33777'}, {'name': '20090214 FreeBSD zeroday', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2009-February/067954.html'}, {'name': '8055', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8055'}]
CVE State: PUBLISHED
Explain CVE-2009-0642
ext/openssl/ossl_ocsp.c in Ruby 1.8 and 1.9 does not properly check the return value from the OCSP_basic_verify function, which might allow remote attackers to successfully present an invalid X.509 certificate, possibly involving a revoked certificate.
Affected Products: n/a
References: [{'name': '35937', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35937'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://redmine.ruby-lang.org/issues/show/1091'}, {'name': 'ruby-ocspbasicverify-spoofing(48761)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48761'}, {'name': 'RHSA-2009:1140', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2009-1140.html'}, {'name': 'USN-805-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-805-1'}, {'name': '33769', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33769'}, {'name': '1022505', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1022505'}, {'name': 'oval:org.mitre.oval:def:11450', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11450'}, {'name': '35699', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35699'}, {'name': 'MDVSA-2009:193', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2009:193'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=513528'}, {'name': '33750', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33750'}]
CVE State: PUBLISHED
Explain CVE-2009-0643
Static code injection vulnerability in post.php in Simple PHP News 1.0 final allows remote attackers to inject arbitrary PHP code into news.txt via the post parameter, and then execute the code via a direct request to display.php.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': '7999', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/7999'}, {'name': '51816', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/51816'}, {'name': '33814', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33814'}, {'name': 'ADV-2009-0357', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0357'}, {'name': 'simplephpnews-news-code-execution(48829)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48829'}]
CVE State: PUBLISHED
Explain CVE-2009-0644
The HTTP interface in Swann DVR4-SecuraNet has a certain default administrative username and password, which makes it easier for remote attackers to obtain privileged access.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstorm.linuxsecurity.com/0902-exploits/cctv-disclose.txt'}, {'name': '20090210 Remote Authentication Bypass - Swann DVR4 SecuraNet (possibly DVR9 as well)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/500789/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2009-0645
Directory traversal vulnerability in index.php in Jaws 0.8.8 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the (1) language, (2) Introduction_complete, and (3) use_log parameters, different vectors than CVE-2004-2445.
Affected Products: n/a
References: [{'name': '33607', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33607'}, {'name': '7976', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/7976'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.jaws-project.com/blog/show/jaws-089-released'}, {'name': 'jaws-index-file-include(48476)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48476'}]
CVE State: PUBLISHED
Explain CVE-2009-0646
Multiple SQL injection vulnerabilities in 4Site CMS 2.6 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) login and (2) password parameters to pcgi/4site.pl, (3) page parameter to print/print.shtml, (4) s and (5) i parameters to portfolio/index.shtml, (6) h parameter to hotel/index.php, (7) id parameter to news/news1.shtml, and the (8) th parameter to faq/index.shtml.
Affected Products: n/a
References: [{'name': '4sitecms-hotels-sql-injection(48486)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48486'}, {'name': '20101019 SQL Injection in 4site CMS', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/514376/100/0/threaded'}, {'name': '7964', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/7964'}, {'tags': ['x_refsource_MISC'], 'url': 'http://wsec.ru/wsec-09-002-4site-cms-26-multiple-sql-injections/'}, {'name': '4sitecms-pages-sql-injection(48483)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48483'}, {'name': '51806', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/51806'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.htbridge.ch/advisory/sql_injection_in_4site_cms.html'}, {'name': '51809', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/51809'}, {'name': '4sitecms-faq-sql-injection(48488)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48488'}, {'name': '33594', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33594'}, {'name': '51808', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/51808'}, {'name': '51807', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/51807'}, {'name': '33733', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33733'}, {'name': '4sitecms-news-sql-injection(48487)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48487'}]
CVE State: PUBLISHED