Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2009-1768
Directory traversal vulnerability in download.php in Rama Zaiten CMS 0.9.8 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
Affected Products: n/a
References: [{'name': 'ramacms-download-file-include(50572)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/50572'}, {'name': '35116', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35116'}, {'name': 'ADV-2009-1343', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1343'}, {'name': '54546', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/54546'}, {'name': '34995', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34995'}, {'name': '8700', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8700'}]
CVE State: PUBLISHED
Explain CVE-2009-1769
The web interface in Open Computer and Software Inventory Next Generation (OCS Inventory NG) 1.01 generates different error messages depending on whether a username is valid, which allows remote attackers to enumerate valid usernames.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.ocsinventory-ng.org/index.php?mact=News%2Ccntnt01%2Cdetail%2C0&cntnt01articleid=133&cntnt01returnid=69'}, {'name': '35157', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35157'}, {'name': '35313', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35313'}, {'name': '35023', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35023'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=529344'}, {'name': 'FEDORA-2009-5773', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00063.html'}, {'name': 'FEDORA-2009-5769', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00057.html'}, {'name': 'FEDORA-2009-5764', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00050.html'}]
CVE State: PUBLISHED
Explain CVE-2009-1770
Directory traversal vulnerability in includes/database/examples/addressbook.php in Flyspeck CMS 6.8 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang parameter.
Affected Products: n/a
References: [{'name': '8714', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8714'}, {'name': '35011', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35011'}, {'name': 'ADV-2009-1367', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1367'}]
CVE State: PUBLISHED
Explain CVE-2009-1771
index.php in Flyspeck CMS 6.8 does not require administrative authentication for the updateExistingContent action, which allows remote attackers to create or modify admin accounts via the (1) users[fullname], (2) users[email], (3) users[role_id], (4) users[username], and (5) users[password] parameters.
Affected Products: n/a
References: [{'name': '8714', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8714'}, {'name': '35011', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35011'}, {'name': 'ADV-2009-1367', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1367'}]
CVE State: PUBLISHED
Explain CVE-2009-1772
Cross-site scripting (XSS) vulnerability in activeCollab 2.1 Corporate allows remote attackers to inject arbitrary web script or HTML via the re_route parameter to the login script.
Affected Products: n/a
References: [{'name': '35079', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35079'}, {'tags': ['x_refsource_MISC'], 'url': 'http://pridels-team.blogspot.com/2009/05/activecollab-xss-and-full-path.html'}, {'name': '35022', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35022'}]
CVE State: PUBLISHED
Explain CVE-2009-1773
activeCollab 2.1 Corporate allows remote attackers to obtain sensitive information via an invalid re_route parameter to the login script, which reveals the installation path in an error message.
Affected Products: n/a
References: [{'name': '35079', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35079'}, {'tags': ['x_refsource_MISC'], 'url': 'http://pridels-team.blogspot.com/2009/05/activecollab-xss-and-full-path.html'}, {'name': '35022', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35022'}]
CVE State: PUBLISHED
Explain CVE-2009-1774
Directory traversal vulnerability in plugins/ddb/foot.php in Strawberry 1.1.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the file parameter to example/index.php.  NOTE: this was originally reported as an issue affecting the do parameter, but traversal with that parameter might depend on a modified example/index.php.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': '8681', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8681'}, {'name': 'strawberry-index-file-include(50562)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/50562'}, {'name': '34971', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34971'}, {'name': '28330', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/28330'}]
CVE State: PUBLISHED
Explain CVE-2009-1775
Multiple cross-site scripting (XSS) vulnerabilities in Ulteo Open Virtual Desktop 1.0 allow remote attackers to inject arbitrary web script or HTML via the id parameter to (1) admin/applications.php, (2) admin/appsgroup.php, (3) admin/users.php, (4) admin/usersgroup.php, and (5) admin/tasks.php; (6) show parameter to admin/logs.php; and (7) mode parameter to admin/configuration-partial.php.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.insight-tech.org/index.php?p=Ulteo-Open-Virtual-Desktop-v1-0-multiple-XSS'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ulteo.com/home/en/ovdi/openvirtualdesktop/downloadnow?autolang=en'}, {'name': '34923', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34923'}, {'name': '34927', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34927'}]
CVE State: PUBLISHED
Explain CVE-2009-1776
Multiple cross-site scripting (XSS) vulnerabilities in FormMail.pl in Matt Wright FormMail 1.92, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via javascript: URIs in the (1) request and (2) return_link_url parameters.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.ush.it/team/ush/hack-formmail_192/adv.txt'}, {'name': '20090512 FormMail 1.92 Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/503446/100/0/threaded'}, {'name': '34929', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34929'}, {'name': '35068', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35068'}]
CVE State: PUBLISHED
Explain CVE-2009-1777
CRLF injection vulnerability in FormMail.pl in Matt Wright FormMail 1.92, and possibly earlier, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the redirect parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.ush.it/team/ush/hack-formmail_192/adv.txt'}, {'name': '20090512 FormMail 1.92 Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/503446/100/0/threaded'}, {'name': '34929', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34929'}, {'name': '35068', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35068'}]
CVE State: PUBLISHED
Explain CVE-2009-1778
SQL injection vulnerability in the new user registration feature in BigACE CMS 2.5, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.bigace.de/BIGACE-2.6.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.bigace.de/Security-Fix-for-2.5.html'}, {'name': '8664', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8664'}, {'name': '34920', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34920'}, {'name': '20090512 User options changer (SQLi) EXPLOIT --Bigace CMS -stable release- 2.5-->', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/503448/100/0/threaded'}, {'name': '35063', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35063'}]
CVE State: PUBLISHED
Explain CVE-2009-1779
PHP remote file inclusion vulnerability in admin.php in Frax.dk Php Recommend 1.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the form_include_template parameter.
Affected Products: n/a
References: [{'name': 'ADV-2009-1287', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1287'}, {'name': '34909', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34909'}, {'name': '8658', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8658'}]
CVE State: PUBLISHED
Explain CVE-2009-1780
admin.php in Frax.dk Php Recommend 1.3 and earlier does not require authentication when the user password is changed, which allows remote attackers to gain administrative privileges via modified form_admin_user and form_admin_pass parameters.
Affected Products: n/a
References: [{'name': 'ADV-2009-1287', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1287'}, {'name': '34909', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34909'}, {'name': '8658', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8658'}]
CVE State: PUBLISHED
Explain CVE-2009-1781
Static code injection vulnerability in admin.php in Frax.dk Php Recommend 1.3 and earlier allows remote attackers to inject arbitrary PHP code into phpre_config.php via the form_aula parameter.
Affected Products: n/a
References: [{'name': 'ADV-2009-1287', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1287'}, {'name': '34909', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34909'}, {'name': '8658', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8658'}]
CVE State: PUBLISHED
Explain CVE-2009-1782
Multiple F-Secure anti-virus products, including Anti-Virus for Microsoft Exchange 7.10 and earlier; Internet Gatekeeper for Windows 6.61 and earlier, Windows 6.61 and earlier, and Linux 2.16 and earlier; Internet Security 2009 and earlier, Anti-Virus 2009 and earlier, Client Security 8.0 and earlier, and others; allow remote attackers to bypass malware detection via a crafted (1) ZIP and (2) RAR archive.
Affected Products: n/a
References: [{'name': '35008', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35008'}, {'name': '1022172', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1022172'}, {'name': 'ADV-2009-1262', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1262'}, {'name': '1022170', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1022170'}, {'name': 'fsecure-rar-zip-security-bypass(50346)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/50346'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.f-secure.com/en_EMEA/support/security-advisory/fsc-2009-1.html'}, {'name': '34849', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34849'}, {'name': '1022171', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1022171'}]
CVE State: PUBLISHED
Explain CVE-2009-1783
Multiple FRISK Software F-Prot anti-virus products, including Antivirus for Exchange, Linux on IBM zSeries, Linux x86 File Servers, Linux x86 Mail Servers, Linux x86 Workstations, Solaris Mail Servers, Antivirus for Windows, and others, allow remote attackers to bypass malware detection via a crafted CAB archive.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://blog.zoller.lu/2009/04/advisory-f-prot-frisk-cab-bypass.html'}, {'name': '34896', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34896'}, {'name': '20090509 [TZO-21-2009] Fprot CAB bypass / evasion', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/503393/100/0/threaded'}, {'name': 'fprot-cab-security-bypass(50427)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/50427'}]
CVE State: PUBLISHED
Explain CVE-2009-1784
The AVG parsing engine 8.5 323, as used in multiple AVG anti-virus products including Anti-Virus Network Edition, Internet Security Netzwerk Edition, Server Edition für Linux/FreeBSD, Anti-Virus SBS Edition, and others allows remote attackers to bypass malware detection via a crafted (1) RAR and (2) ZIP archive.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://blog.zoller.lu/2009/04/avg-zip-evasion-bypass.html'}, {'name': 'avg-zip-security-bypass(50426)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/50426'}, {'name': '20090509 [TZO-20-2009] AVG ZIP evasion / bypass', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/503392/100/0/threaded'}, {'name': '34895', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34895'}]
CVE State: PUBLISHED
Explain CVE-2009-1785
Cross-site scripting (XSS) vulnerability in Ulteo Open Virtual Desktop 1.0 allows remote attackers to inject arbitrary web script or HTML via the error parameter to header.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.ulteo.com/home/en/ovdi/openvirtualdesktop/downloadnow?autolang=en'}, {'name': '34923', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34923'}]
CVE State: PUBLISHED
Explain CVE-2009-1786
The malloc subsystem in libc in IBM AIX 5.3 and 6.1 allows local users to create or overwrite arbitrary files via a symlink attack on the log file associated with the MALLOCDEBUG environment variable.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://aix.software.ibm.com/aix/efixes/security/libc_advisory.asc'}, {'name': 'IZ50445', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www.ibm.com/support/docview.wss?uid=isg1IZ50445'}, {'name': 'oval:org.mitre.oval:def:6276', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6276'}, {'name': 'IZ50447', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www.ibm.com/support/docview.wss?uid=isg1IZ50447'}, {'name': '54617', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/54617'}, {'name': 'IZ50121', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www.ibm.com/support/docview.wss?uid=isg1IZ50121'}, {'name': '20090520 IBM AIX libc MALLOCDEBUG File Overwrite Vulnerability', 'tags': ['third-party-advisory', 'x_refsource_IDEFENSE'], 'url': 'http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=802'}, {'name': '35034', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35034'}, {'name': '9306', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/9306'}, {'name': '1022261', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1022261'}, {'name': 'ADV-2009-1380', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1380'}, {'name': 'aix-mallocdebug-privilege-escalation(50636)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/50636'}, {'name': 'IZ50517', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www.ibm.com/support/docview.wss?uid=isg1IZ50517'}, {'name': '35146', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35146'}, {'name': 'IZ50500', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www.ibm.com/support/docview.wss?uid=isg1IZ50500'}, {'name': 'IZ50129', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www.ibm.com/support/docview.wss?uid=isg1IZ50129'}, {'name': 'IZ50139', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www.ibm.com/support/docview.wss?uid=isg1IZ50139'}]
CVE State: PUBLISHED
Explain CVE-2009-1787
Multiple SQL injection vulnerabilities in PHP Dir Submit (aka WebsiteSubmitter and Submitter Script) allow remote attackers to bypass authentication and gain administrative access via the (1) username and (2) password parameters.
Affected Products: n/a
References: [{'name': '35003', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35003'}, {'name': 'ADV-2009-1365', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1365'}, {'name': '35125', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35125'}, {'name': '8710', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8710'}]
CVE State: PUBLISHED
Explain CVE-2009-1788
Heap-based buffer overflow in voc_read_header in libsndfile 1.0.15 through 1.0.19, as used in Winamp 5.552 and possibly other media programs, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a VOC file with an invalid header value.
Affected Products: n/a
References: [{'name': 'MDVSA-2009:132', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2009:132'}, {'tags': ['x_refsource_MISC'], 'url': 'http://trapkit.de/advisories/TKADV2009-006.txt'}, {'name': 'ADV-2009-1348', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1348'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mega-nerd.com/libsndfile/'}, {'name': 'ADV-2009-1324', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1324'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mega-nerd.com/erikd/Blog/CodeHacking/libsndfile/'}, {'name': 'libsndfile-voc-bo(50827)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/50827'}, {'name': '35247', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35247'}, {'name': 'DSA-1814', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2009/dsa-1814'}, {'name': 'libsndfile-aiff-voc-bo(50541)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/50541'}, {'name': '35076', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35076'}, {'name': 'GLSA-200905-09', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200905-09.xml'}, {'name': '35126', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35126'}, {'name': '34978', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34978'}, {'name': '35443', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35443'}]
CVE State: PUBLISHED
Explain CVE-2009-1789
mod/server.mod/servmsg.c in Eggheads Eggdrop and Windrop 1.6.19 and earlier allows remote attackers to cause a denial of service (crash) via a crafted PRIVMSG that causes an empty string to trigger a negative string length copy.  NOTE: this issue exists because of an incorrect fix for CVE-2007-2807.
Affected Products: n/a
References: [{'name': 'eggdrop-servmsg-dos(50547)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/50547'}, {'name': '35104', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35104'}, {'name': '54460', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/54460'}, {'name': '20090515 eggdrop/windrop remote crash vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/503574'}, {'name': 'ADV-2009-1340', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1340'}, {'name': 'FEDORA-2009-5572', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01337.html'}, {'name': '8695', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8695'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://cvs.eggheads.org/viewvc/viewvc.cgi/eggdrop1.6/doc/Changes1.6?revision=1.20&view=markup'}, {'name': '35690', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35690'}, {'name': '20090514 eggdrop/windrop remote crash vulnerability', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2009-05/0129.html'}, {'name': 'MDVSA-2009:126', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2009:126'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=528778'}, {'name': '34985', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34985'}, {'name': 'FEDORA-2009-5568', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01333.html'}, {'name': '35158', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35158'}, {'name': 'DSA-1826', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2009/dsa-1826'}]
CVE State: PUBLISHED
Explain CVE-2009-1790
Cross-site scripting (XSS) vulnerability in CGI RESCUE Trees before 2.11 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
Affected Products: n/a
References: [{'name': '35123', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35123'}, {'name': 'JVN#28521500', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN28521500/index.html'}, {'name': '34999', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34999'}, {'name': '54545', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/54545'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.rescue.ne.jp/whatsnew/blog.cgi/permalink/20090512155247'}, {'name': 'rescuetrees-unspecified-xss(50579)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/50579'}, {'name': 'JVNDB-2009-000028', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000028.html'}]
CVE State: PUBLISHED
Explain CVE-2009-1791
Heap-based buffer overflow in aiff_read_header in libsndfile 1.0.15 through 1.0.19, as used in Winamp 5.552 and possibly other media programs, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an AIFF file with an invalid header value.
Affected Products: n/a
References: [{'name': 'MDVSA-2009:132', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2009:132'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mega-nerd.com/libsndfile/'}, {'name': 'ADV-2009-1324', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1324'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mega-nerd.com/erikd/Blog/CodeHacking/libsndfile/'}, {'name': '35247', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35247'}, {'name': 'DSA-1814', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2009/dsa-1814'}, {'name': 'libsndfile-aiff-voc-bo(50541)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/50541'}, {'name': '35076', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35076'}, {'name': 'GLSA-200905-09', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200905-09.xml'}, {'name': '34978', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34978'}, {'name': '35443', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35443'}]
CVE State: PUBLISHED
Explain CVE-2009-1792
The system.openURL function in StoneTrip Ston3D StandalonePlayer (aka S3DPlayer StandAlone) 1.6.2.4 and 1.7.0.1 and WebPlayer (aka S3DPlayer Web) 1.6.0.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the first argument (the sURL argument).
Affected Products: n/a
References: [{'name': '35105', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35105'}, {'name': '35256', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35256'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.coresecurity.com/content/StoneTrip-S3DPlayers'}, {'name': '20090528 CORE-2009-0401 - StoneTrip S3DPlayers remote command injection', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/503887/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2009-1796
Cross-site scripting (XSS) vulnerability in Sun Java System Portal Server 6.3.1, 7.1, and 7.2 allows remote attackers to inject arbitrary web script or HTML via vectors related to an error page.
Affected Products: n/a
References: [{'name': '54705', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/54705'}, {'name': 'ADV-2009-1411', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1411'}, {'name': '256588', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-66-256588-1'}, {'name': 'javasystem-portalserver-xss(50704)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/50704'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-21-118950-38-1'}, {'name': '35221', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35221'}, {'name': '1022273', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1022273'}, {'name': '35082', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35082'}]
CVE State: PUBLISHED
Explain CVE-2009-1797
Multiple cross-site request forgery (CSRF) vulnerabilities on the Network Management Card (NMC) on American Power Conversion (APC) Switched Rack PDU (aka Rack Mount Power Distribution) devices and other devices allow remote attackers to hijack the authentication of (1) administrator or (2) device users for requests that create new administrative users or have unspecified other impact.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://holisticinfosec.org/content/view/111/45/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://nam-en.apc.com/cgi-bin/nam_en.cfg/php/enduser/std_adp.php?p_faqid=10887'}, {'name': 'VU#166739', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/166739'}, {'name': '37744', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/37744'}]
CVE State: PUBLISHED
Explain CVE-2009-1798
Multiple cross-site scripting (XSS) vulnerabilities on the Network Management Card (NMC) on American Power Conversion (APC) Switched Rack PDU (aka Rack Mount Power Distribution) devices and other devices allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: the login_username vector for Forms/login1 is already covered by CVE-2009-4406.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://holisticinfosec.org/content/view/111/45/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://nam-en.apc.com/cgi-bin/nam_en.cfg/php/enduser/std_adp.php?p_faqid=10887'}, {'name': 'VU#166739', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/166739'}, {'name': '37744', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/37744'}]
CVE State: PUBLISHED
Explain CVE-2009-1799
Multiple SQL injection vulnerabilities in the getGalleryImage function in st_admin/gallery_output.php in ST-Gallery 0.1 alpha, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) gallery_category or (2) gallery_show parameter to example.php.
Affected Products: n/a
References: [{'name': '8636', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8636'}, {'name': '20090507 SQL INJECTION VULNERABILITIES--ST-Gallery version 0.1 alpha', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=124171333011782&w=2'}, {'name': '34875', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34875'}, {'name': 'stgallery-example-sql-injection(50378)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/50378'}]
CVE State: PUBLISHED
Explain CVE-2009-1800
Stack-based buffer overflow in the Chinagames CGAgent ActiveX control 1.x in CGAgent.dll, as distributed in Chinagames iGame 2009, allows remote attackers to execute arbitrary code via a long argument to the CreateChinagames method, as exploited in the wild in April and May 2009.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://downloads.securityfocus.com/vulnerabilities/exploits/34871.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://hi.baidu.com/wi4r/blog/item/8b1c06fb2e3de8819f514671.html'}, {'name': '34871', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34871'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.cisrt.org/enblog/read.php?245'}, {'name': '35005', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35005'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bbs.pediy.com/showthread.php?t=87615'}]
CVE State: PUBLISHED
Explain CVE-2009-1801
Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, allow remote attackers to inject arbitrary web script or HTML via the (1) display parameter to reports.php, the (2) order and (3) extdisplay parameters to config.php, and the (4) sort parameter to recordings/index.php. NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': 'freepbx-reports-xss(50361)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/50361'}, {'name': '54260', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/54260'}, {'name': '54261', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/54261'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://freepbx.org/trac/ticket/3660'}, {'name': '34772', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34772'}, {'name': '34857', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34857'}, {'name': '54259', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/54259'}]
CVE State: PUBLISHED
Explain CVE-2009-1802
Multiple cross-site request forgery (CSRF) vulnerabilities in FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, allow remote attackers to hijack the authentication of admins for requests that create a new admin account or have unspecified other impact.
Affected Products: n/a
References: [{'name': '54262', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/54262'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://freepbx.org/trac/ticket/3660'}, {'name': '34772', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34772'}, {'name': '34857', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34857'}]
CVE State: PUBLISHED
Explain CVE-2009-1803
FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, generates different error messages for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.
Affected Products: n/a
References: [{'name': '54263', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/54263'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://freepbx.org/trac/ticket/3660'}, {'name': '34772', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34772'}, {'name': '34857', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34857'}]
CVE State: PUBLISHED
Explain CVE-2009-1804
Multiple SQL injection vulnerabilities in admin/index.php in VideoScript.us YouTube Video Script allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.
Affected Products: n/a
References: [{'name': '34868', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34868'}, {'name': '8635', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8635'}, {'name': 'videoscript-index-sql-injection(50373)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/50373'}]
CVE State: PUBLISHED
Explain CVE-2009-1805
Unspecified vulnerability in the VMware Descheduled Time Accounting driver in VMware Workstation 6.5.1 and earlier, VMware Player 2.5.1 and earlier, VMware ACE 2.5.1 and earlier, VMware Server 1.x before 1.0.9 build 156507 and 2.x before 2.0.1 build 156745, VMware Fusion 2.x before 2.0.2 build 147997, VMware ESXi 3.5, and VMware ESX 3.0.2, 3.0.3, and 3.5, when the Descheduled Time Accounting Service is not running, allows guest OS users on Windows to cause a denial of service via unknown vectors.
Affected Products: n/a
References: [{'name': '35269', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35269'}, {'name': '35141', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35141'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2009-0007.html'}, {'name': 'oval:org.mitre.oval:def:6130', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6130'}, {'name': '20090529 VMSA-2009-0007 VMware Hosted products and ESX and ESXi patches resolve security issues', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/503912/100/0/threaded'}, {'name': 'ADV-2009-1452', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1452'}, {'name': '1022300', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1022300'}]
CVE State: PUBLISHED
Explain CVE-2009-1806
Unspecified vulnerability in IBM Hardware Management Console (HMC) 7 release 3.4.0 SP2, when Active Memory Sharing is used, has unknown impact and attack vectors, related to a shared memory partition and a shared memory pool with redundant paging Virtual I/O Server (VIOS) partitions.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': 'MB03011', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-1.ibm.com/support/docview.wss?uid=isg1MB03011'}, {'name': '35113', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35113'}, {'name': 'hmc-ams-unspecified(50910)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/50910'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=4671'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-933.ibm.com/support/fixcentral/firmware/readme?fixid=MH01181'}]
CVE State: PUBLISHED
Explain CVE-2009-1807
Unspecified vulnerability in Config.dll in Baofeng products 3.09.04.17 and earlier allows remote attackers to execute arbitrary code by calling the SetAttributeValue method, as exploited in the wild in April and May 2009.
Affected Products: n/a
References: [{'name': 'ADV-2009-1392', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1392'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.cisrt.org/enblog/read.php?245'}]
CVE State: PUBLISHED
Explain CVE-2009-1808
Microsoft Windows XP SP3 allows local users to cause a denial of service (system crash) by making an SPI_SETDESKWALLPAPER SystemParametersInfo call with an improperly terminated pvParam argument, followed by an SPI_GETDESKWALLPAPER SystemParametersInfo call.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.ragestorm.net/blogs/?p=78'}, {'name': 'win-spisetdeskwallpaper-dos(50903)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/50903'}, {'name': '35120', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35120'}, {'name': '1022330', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1022330'}, {'name': '35323', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35323'}]
CVE State: PUBLISHED
Explain CVE-2009-1809
Multiple cross-site scripting (XSS) vulnerabilities in myColex 1.4.2 allow remote attackers to inject arbitrary web script or HTML via (1) the year parameter to modules/kalender.php, (2) the Page parameter in a List action to modules/ereignis.php, (3) the Kontext parameter in a Search action to modules/kategorie.php, or (4) the image parameter to modules/image.php.
Affected Products: n/a
References: [{'name': '34997', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34997'}, {'name': 'ADV-2009-1344', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1344'}, {'name': '8707', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8707'}, {'name': '35112', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35112'}]
CVE State: PUBLISHED
Explain CVE-2009-1810
Multiple SQL injection vulnerabilities in myColex 1.4.2 allow remote attackers to execute arbitrary SQL commands via (1) the formUser parameter (aka the Name field) to common/login.php, and allow remote authenticated users to execute arbitrary SQL commands via the ID parameter in a Detail action to (2) kategorie.php, (3) medium.php, (4) person.php, or (5) schlagwort.php in modules/, related to classes/class.perform.php.
Affected Products: n/a
References: [{'name': '34997', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34997'}, {'name': 'ADV-2009-1344', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1344'}, {'name': '8707', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8707'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.collector.ch/drupal5/?q=node/39'}, {'name': '35111', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35111'}]
CVE State: PUBLISHED
Explain CVE-2009-1811
Multiple cross-site scripting (XSS) vulnerabilities in myGesuad 0.9.14 (aka 0.9) allow remote attackers to inject arbitrary web script or HTML via (1) the Page parameter in a List action to modules/ereignis.php, (2) the Kontext parameter in a Search action to modules/kategorie.php, (3) the image parameter to modules/image.php, or (4) the ID parameter in a Detail action to modules/sitzung.php.
Affected Products: n/a
References: [{'name': '35136', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35136'}, {'name': 'ADV-2009-1345', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1345'}, {'name': '8708', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8708'}, {'name': '34998', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34998'}]
CVE State: PUBLISHED
Explain CVE-2009-1812
Multiple SQL injection vulnerabilities in myGesuad 0.9.14 (aka 0.9) allow remote attackers to execute arbitrary SQL commands via (1) the formUser parameter (aka the Name field) to common/login.php, and allow remote authenticated users to execute arbitrary SQL commands via the ID parameter in a Detail action to (2) kategorie.php, (3) budget.php, (4) zahlung.php, or (5) adresse.php in modules/, related to classes/class.perform.php.
Affected Products: n/a
References: [{'name': 'ADV-2009-1345', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1345'}, {'name': '8708', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8708'}, {'name': '35110', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35110'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.collector.ch/drupal5/?q=node/39'}, {'name': '34998', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34998'}]
CVE State: PUBLISHED
Explain CVE-2009-1813
Multiple SQL injection vulnerabilities in admin/index.php in Submitter Script 2 allow remote attackers to execute arbitrary SQL commands via (1) the uNev parameter (aka the username field) or (2) the uJelszo parameter (aka the Password field).
Affected Products: n/a
References: [{'name': 'ADV-2009-1327', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1327'}, {'name': '8683', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8683'}, {'name': '54475', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/54475'}, {'name': '34970', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34970'}, {'name': '35088', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35088'}, {'name': 'submitterscript-index-sql-injection(50552)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/50552'}]
CVE State: PUBLISHED
Explain CVE-2009-1814
SQL injection vulnerability in mail.php in PHPenpals 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the ID parameter.  NOTE: the profile.php vector is already covered by CVE-2006-0074.
Affected Products: n/a
References: [{'name': 'ADV-2009-1342', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1342'}, {'name': '8706', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8706'}, {'name': '34996', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34996'}, {'name': '18269', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18269'}]
CVE State: PUBLISHED
Explain CVE-2009-1815
Stack-based buffer overflow in Sonic Spot Audioactive Player 1.93b allows remote attackers to execute arbitrary code via a long string in a playlist file, as demonstrated by a long .mp3 URL in a .m3u file.
Affected Products: n/a
References: [{'name': '34987', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34987'}, {'name': '8701', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8701'}, {'name': 'ADV-2009-1339', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1339'}, {'name': '8698', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8698'}]
CVE State: PUBLISHED
Explain CVE-2009-1816
SQL injection vulnerability in admin.php in My Game Script 2.0 allows remote attackers to execute arbitrary SQL commands via the user parameter (aka the username field).  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': '54459', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/54459'}, {'name': 'mygamescript-admin-sql-injection(50528)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/50528'}, {'name': '35085', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35085'}, {'name': '34963', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34963'}, {'name': '8676', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8676'}]
CVE State: PUBLISHED
Explain CVE-2009-1817
Multiple buffer overflows in DigiMode Maya 1.0.2 allow remote attackers to execute arbitrary code via a long string in a malformed (1) .m3u or (2) .m3l playlist file.
Affected Products: n/a
References: [{'name': '8677', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8677'}, {'name': '34960', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34960'}, {'name': 'digimode-m3u-m3l-bo(50533)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/50533'}]
CVE State: PUBLISHED