Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2009-1245
Multiple SQL injection vulnerabilities in the insert_to_pastebin function in php/cccp-admin/inc/functions.php in CCCP Community Clan Portal Pastebin before 2.80 allow remote attackers to execute arbitrary SQL commands via the (1) subject, (2) language, and (3) nickname parameters to php/cccp-pages/submit.php.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': '34264', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34264'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/project/shownotes.php?release_id=670960'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://jcsfog.cvs.sourceforge.net/viewvc/jcsfog/CCCP-Pastebin/php/cccp-admin/inc/functions.php?r1=1.10&r2=1.11'}, {'name': 'communitycode-submit-sql-injection(49426)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49426'}, {'name': '34474', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34474'}]
CVE State: PUBLISHED
Explain CVE-2009-1246
Multiple directory traversal vulnerabilities in Blogplus 1.0 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) row_mysql_blocks_center_down[file] parameter to includes/block_center_down.php; (2) row_mysql_blocks_center_top[file] includes/parameter to block_center_top.php; (3) row_mysql_blocks_left[file] parameter to includes/block_left.php; (4) row_mysql_blocks_right[file] parameter to includes/block_right.php; and row_mysql_bloginfo[theme] parameter to (5) includes/window_down.php and (6) includes/window_top.php.
Affected Products: n/a
References: [{'name': '34261', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34261'}, {'name': 'blogplus-file-theme-file-include(49446)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49446'}, {'name': '8290', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8290'}]
CVE State: PUBLISHED
Explain CVE-2009-1247
SQL injection vulnerability in login.php in Acute Control Panel 1.0.0 allows remote attackers to execute arbitrary SQL commands via the username parameter.
Affected Products: n/a
References: [{'name': '8291', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8291'}, {'name': 'acutecontrol-login-sql-injection(49444)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49444'}, {'name': '34265', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34265'}, {'name': '34485', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34485'}]
CVE State: PUBLISHED
Explain CVE-2009-1248
Multiple PHP remote file inclusion vulnerabilities in Acute Control Panel 1.0.0 allow remote attackers to execute arbitrary PHP code via a URL in the theme_directory parameter to (1) container.php and (2) header.php in themes/.
Affected Products: n/a
References: [{'name': '8291', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8291'}, {'name': '34265', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34265'}, {'name': '34485', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34485'}, {'name': 'acutecontrol-themedirectory-file-include(49443)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49443'}]
CVE State: PUBLISHED
Explain CVE-2009-1249
Cross-site scripting (XSS) vulnerability in Feed element mapper 5.x before 5.x-1.1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via the content title in admin/content/node-type/nodetype/map.
Affected Products: n/a
References: [{'name': '34266', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34266'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/414702'}, {'name': '34497', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34497'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/414644'}]
CVE State: PUBLISHED
Explain CVE-2009-1250
The cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58, and IBM AFS 3.6 before Patch 19, on Linux allows remote attackers to cause a denial of service (system crash) via an RX response with a large error-code value that is interpreted as a pointer and dereferenced, related to use of the ERR_PTR macro.
Affected Products: n/a
References: [{'name': 'ADV-2011-0117', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0117'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.openafs.org/security/openafs-sa-2009-002.patch'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.openafs.org/security/OPENAFS-SA-2009-002.txt'}, {'name': 'ADV-2009-0984', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0984'}, {'name': 'MDVSA-2009:099', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2009:099'}, {'name': '34404', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34404'}, {'name': '36310', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/36310'}, {'name': '34655', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34655'}, {'name': 'DSA-1768', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2009/dsa-1768'}, {'name': 'ID71123', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-1.ibm.com/support/docview.wss?uid=swg1ID71123'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21396389'}, {'name': 'GLSA-201101-05', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201101-05.xml'}, {'name': '34684', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34684'}, {'name': '42896', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/42896'}]
CVE State: PUBLISHED
Explain CVE-2009-1251
Heap-based buffer overflow in the cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58 on Unix platforms allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via an RX response containing more data than specified in a request, related to use of XDR arrays.
Affected Products: n/a
References: [{'name': 'ADV-2011-0117', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2011/0117'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.openafs.org/security/OPENAFS-SA-2009-001.txt'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.openafs.org/security/openafs-sa-2009-001.patch'}, {'name': 'ADV-2009-0984', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0984'}, {'name': 'MDVSA-2009:099', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2009:099'}, {'name': '34407', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34407'}, {'name': '34655', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34655'}, {'name': 'DSA-1768', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2009/dsa-1768'}, {'name': 'GLSA-201101-05', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201101-05.xml'}, {'name': '34684', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34684'}, {'name': '42896', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/42896'}]
CVE State: PUBLISHED
Explain CVE-2009-1253
James Stone Tunapie 2.1 allows local users to overwrite arbitrary files via a symlink attack on an unspecified temporary file.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.net/bugs/314591'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.net/bugs/cve/2009-1253'}, {'name': 'ADV-2009-0972', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0972'}, {'name': '34643', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34643'}, {'name': 'DSA-1764', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2009/dsa-1764'}, {'name': '53426', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/53426'}, {'name': '34417', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34417'}]
CVE State: PUBLISHED
Explain CVE-2009-1254
James Stone Tunapie 2.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a stream URL.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.net/bugs/314591'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.net/bugs/cve/2009-1254'}, {'name': '34418', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34418'}, {'name': 'ADV-2009-0972', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0972'}, {'name': '53427', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/53427'}, {'name': '34643', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34643'}, {'name': 'DSA-1764', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2009/dsa-1764'}]
CVE State: PUBLISHED
Explain CVE-2009-1255
The process_stat function in (1) Memcached before 1.2.8 and (2) MemcacheDB 1.2.0 discloses (a) the contents of /proc/self/maps in response to a stats maps command and (b) memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain sensitive information such as the locations of memory regions, and defeat ASLR protection, by sending a command to the daemon's TCP port.
Affected Products: n/a
References: [{'name': 'FEDORA-2009-4542', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01256.html'}, {'name': 'memcachedb-procselfmaps-info-disclosure(50221)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/50221'}, {'name': 'MDVSA-2009:105', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2009:105'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.positronsecurity.com/advisories/2009-001.html'}, {'name': '1022140', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1022140'}, {'name': 'FEDORA-2009-4199', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-May/msg00851.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://code.google.com/p/memcachedb/source/diff?spec=svn98&r=98&format=side&path=/trunk/memcachedb.c'}, {'name': '20090428 Positron Security Advisory #2009-001: Memcached and MemcacheDB ASLR Bypass Weakness', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2009-04/0282.html'}, {'name': '20090428 Positron Security Advisory #2009-001: Memcached and MemcacheDB ASLR Bypass Weakness', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/503064/100/0/threaded'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://groups.google.com/group/memcached/browse_thread/thread/ff96a9b88fb5d40e'}, {'name': '35175', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35175'}, {'name': '54127', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/54127'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://code.google.com/p/memcachedb/source/browse/trunk/ChangeLog?spec=svn98&r=98'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://code.google.com/p/memcachedb/source/detail?r=98'}, {'name': '34756', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34756'}, {'name': 'ADV-2009-1196', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1196'}, {'name': '34932', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34932'}, {'name': '34915', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34915'}, {'name': 'ADV-2009-1197', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1197'}]
CVE State: PUBLISHED
Explain CVE-2009-1256
SQL injection vulnerability in FlexCMS 2.5 allows remote attackers to execute arbitrary SQL commands via the ItemId parameter.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': '8355', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8355'}, {'name': 'flexcms-itemid-sql-injection(49680)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49680'}, {'name': '34394', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34394'}]
CVE State: PUBLISHED
Explain CVE-2009-1257
Heap-based buffer overflow in Magic ISO Maker 5.5 build 0274 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted CCD file.
Affected Products: n/a
References: [{'name': '34595', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34595'}, {'name': 'magiciso-ccd-bo(49673)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49673'}, {'name': '53262', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/53262'}, {'name': 'ADV-2009-0940', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0940'}, {'name': '8343', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8343'}, {'name': '34574', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34574'}]
CVE State: PUBLISHED
Explain CVE-2009-1258
SQL injection vulnerability in the RD-Autos (com_rdautos) component 1.5.7 for Joomla! allows remote attackers to execute arbitrary SQL commands via the makeid parameter in index.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': '34578', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34578'}, {'name': '34364', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34364'}, {'name': 'rdautos-makeid-sql-injection(49671)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49671'}, {'name': '53138', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/53138'}]
CVE State: PUBLISHED
Explain CVE-2009-1259
SQL injection vulnerability in inc/bb/topic.php in Insane Visions AdaptBB 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the topic_id parameter in a topic action to index.php.
Affected Products: n/a
References: [{'name': 'adaptbb-topic-sql-injection(49681)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49681'}, {'name': '34371', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34371'}, {'name': '8351', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8351'}]
CVE State: PUBLISHED
Explain CVE-2009-1260
Multiple stack-based buffer overflows in UltraISO 9.3.3.2685 and earlier allow remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted (1) CCD or (2) IMG file.
Affected Products: n/a
References: [{'name': 'ultraiso-ccd-img-bo(49672)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49672'}, {'name': '34363', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34363'}, {'name': '53275', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/53275'}, {'name': 'ADV-2009-0935', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0935'}, {'name': '8343', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8343'}, {'name': '34581', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34581'}]
CVE State: PUBLISHED
Explain CVE-2009-1261
Multiple cross-site scripting (XSS) vulnerabilities in Web Help Desk 9.1.22 (evaluation version) allow remote attackers to inject arbitrary web script or HTML via the (1) Report Name, (2) Asset No., and (3) Full Name fields in a Models action.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Affected Products: n/a
References: [{'name': '53423', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/53423'}, {'name': '34391', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34391'}, {'name': '53424', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/53424'}, {'name': '34596', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34596'}, {'name': '53422', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/53422'}, {'name': 'webhelpdesk-multiple-form-xss(49683)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49683'}]
CVE State: PUBLISHED
Explain CVE-2009-1262
Format string vulnerability in Fortinet FortiClient 3.0.614, and possibly earlier, allows local users to execute arbitrary code via format string specifiers in the VPN connection name.
Affected Products: n/a
References: [{'name': '20090410 Re: Layered Defense Research Advisory: Format String Vulnerability: FortiClient Version 3', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/502602/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.layereddefense.com/FortiClient02Apr.html'}, {'name': '34524', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34524'}, {'name': '34343', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34343'}, {'name': '53266', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/53266'}, {'name': 'ADV-2009-0941', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0941'}, {'name': '1021966', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021966'}, {'name': '20090402 Layered Defense Research Advisory: Format String Vulnerability: FortiClient Version 3', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://lists.grok.org.uk/pipermail/full-disclosure/2009-April/068583.html'}, {'name': 'forticlient-vpn-format-string(49633)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49633'}, {'name': '20090402 Layered Defense Research Advisory: Format String Vulnerability: FortiClient Version 3', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/502354/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2009-1263
SQL injection vulnerability in sub_commententry.php in the BookJoomlas (com_bookjoomlas) component 0.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the gbid parameter in a comment action to index.php.
Affected Products: n/a
References: [{'name': '8353', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8353'}, {'name': 'ADV-2009-0952', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0952'}, {'name': 'bookjoomlas-index-sql-injection(49682)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49682'}, {'name': '53421', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/53421'}, {'name': '34392', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34392'}]
CVE State: PUBLISHED
Explain CVE-2009-1264
Frontend User Registration (sr_feuser_register) extension 2.5.20 and earlier for TYPO3 does not properly verify access rights, which allows remote authenticated users to obtain sensitive information such as passwords via unknown attack vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://typo3.org/extensions/repository/view/sr_feuser_register/2.5.21/'}, {'name': '53278', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/53278'}, {'name': 'ADV-2009-0938', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0938'}, {'name': '34586', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34586'}, {'name': '34374', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34374'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-004/'}]
CVE State: PUBLISHED
Explain CVE-2009-1266
Unspecified vulnerability in Wireshark before 1.0.7 has unknown impact and attack vectors.
Affected Products: n/a
References: [{'name': '34778', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34778'}, {'name': 'SUSE-SR:2009:011', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html'}, {'name': '20090417 rPSA-2009-0062-1 tshark wireshark', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/502745/100/0/threaded'}, {'name': 'wireshark-unspecified(50334)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/50334'}, {'name': '35416', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35416'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://wiki.rpath.com/Advisories:rPSA-2009-0062'}]
CVE State: PUBLISHED
Explain CVE-2009-1267
Unspecified vulnerability in the LDAP dissector in Wireshark 0.99.2 through 1.0.6, when running on Windows, allows remote attackers to cause a denial of service (crash) via unknown attack vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.wireshark.org/security/wnpa-sec-2009-02.html'}, {'name': '1022027', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1022027'}, {'name': 'wireshark-ldap-home-dos(49814)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49814'}, {'name': '34778', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34778'}, {'name': 'SUSE-SR:2009:011', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html'}, {'name': '20090417 rPSA-2009-0062-1 tshark wireshark', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/502745/100/0/threaded'}, {'name': '34457', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34457'}, {'name': '35416', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35416'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://wiki.rpath.com/Advisories:rPSA-2009-0062'}, {'name': 'oval:org.mitre.oval:def:6099', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6099'}]
CVE State: PUBLISHED
Explain CVE-2009-1270
libclamav/untar.c in ClamAV before 0.95 allows remote attackers to cause a denial of service (infinite loop) via a crafted TAR file that causes (1) clamd and (2) clamscan to hang.
Affected Products: n/a
References: [{'name': 'clamav-untar-dos(49846)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49846'}, {'name': '34357', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34357'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://wwws.clamav.net/bugzilla/show_bug.cgi?id=1462'}, {'name': '34716', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34716'}, {'name': '53461', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/53461'}, {'name': 'MDVSA-2009:097', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2009:097'}, {'name': 'ADV-2009-0934', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0934'}, {'name': 'APPLE-SA-2009-09-10-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html'}, {'name': 'DSA-1771', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2009/dsa-1771'}, {'name': '[oss-security] 20090407 Re: CVE request: clamav clamd and clamscan DoS and bypass by malformated archive', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2009/04/07/6'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT3865'}, {'name': '36701', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/36701'}, {'name': 'USN-754-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/usn-754-1'}]
CVE State: PUBLISHED
Explain CVE-2009-1271
The JSON_parser function (ext/json/JSON_parser.c) in PHP 5.2.x before 5.2.9 allows remote attackers to cause a denial of service (segmentation fault) via a malformed string to the json_decode API function.
Affected Products: n/a
References: [{'name': '[oss-security] 20090401 CVE request: PHP 5.2.9', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2009/04/01/9'}, {'name': 'DSA-1775', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2009/dsa-1775'}, {'name': 'FEDORA-2009-3768', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01451.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://cvs.php.net/viewvc.cgi/php-src/ext/json/JSON_parser.c?r1=1.1.2.14&r2=1.1.2.15'}, {'name': '34770', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34770'}, {'name': 'APPLE-SA-2009-09-10-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.php.net/releases/5_2_9.php'}, {'name': '35007', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35007'}, {'name': '34933', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34933'}, {'name': '34830', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34830'}, {'name': 'USN-761-2', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-761-2'}, {'name': 'RHSA-2009:0350', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2009-0350.html'}, {'name': 'FEDORA-2009-3848', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01465.html'}, {'name': '35003', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35003'}, {'name': '35685', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35685'}, {'name': 'SUSE-SR:2009:012', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT3865'}, {'name': '36701', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/36701'}, {'name': 'MDVSA-2009:090', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2009:090'}, {'name': '35306', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35306'}, {'name': 'USN-761-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/761-1/'}, {'name': 'DSA-1789', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2009/dsa-1789'}]
CVE State: PUBLISHED
Explain CVE-2009-1272
The php_zip_make_relative_path function in php_zip.c in PHP 5.2.x before 5.2.9 allows context-dependent attackers to cause a denial of service (crash) via a ZIP file that contains filenames with relative paths, which is not properly handled during extraction.
Affected Products: n/a
References: [{'name': '[oss-security] 20090409 Re: CVE request: PHP 5.2.9', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2009/04/09/1'}, {'name': '[oss-security] 20090401 CVE request: PHP 5.2.9', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2009/04/01/9'}, {'name': 'APPLE-SA-2009-09-10-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.php.net/releases/5_2_9.php'}, {'tags': ['x_refsource_MISC'], 'url': 'http://cvs.php.net/viewvc.cgi/php-src/ext/zip/php_zip.c?r1=1.1.2.48&r2=1.1.2.49'}, {'name': '35685', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35685'}, {'name': 'SUSE-SR:2009:012', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT3865'}, {'name': '36701', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/36701'}, {'name': 'HPSBMA02447', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://marc.info/?l=bugtraq&m=125017764422557&w=2'}, {'name': 'SSRT090062', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://marc.info/?l=bugtraq&m=125017764422557&w=2'}]
CVE State: PUBLISHED
Explain CVE-2009-1273
pam_ssh 1.92 and possibly other versions, as used when PAM is compiled with USE=ssh, generates different error messages depending on whether the username is valid or invalid, which makes it easier for remote attackers to enumerate usernames.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.gentoo.org/show_bug.cgi?id=263579'}, {'name': '34986', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34986'}, {'name': '34536', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34536'}, {'name': 'FEDORA-2009-3500', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-May/msg00116.html'}, {'name': 'FEDORA-2009-3627', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-May/msg00145.html'}]
CVE State: PUBLISHED
Explain CVE-2009-1274
Integer overflow in the qt_error parse_trak_atom function in demuxers/demux_qt.c in xine-lib 1.1.16.2 and earlier allows remote attackers to execute arbitrary code via a Quicktime movie file with a large count value in an STTS atom, which triggers a heap-based buffer overflow.
Affected Products: n/a
References: [{'name': '34593', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34593'}, {'name': '20090404 [TKADV2009-005] xine-lib Quicktime STTS Atom Integer Overflow', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/502481/100/0/threaded'}, {'name': '1021989', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021989'}, {'name': '53288', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/53288'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/project/shownotes.php?group_id=9655&release_id=673233'}, {'name': 'SUSE-SR:2009:011', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html'}, {'name': 'MDVSA-2009:299', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2009:299'}, {'name': 'FEDORA-2009-3428', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00210.html'}, {'name': 'xinelib-demuxqt-bo(49714)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49714'}, {'name': '34384', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34384'}, {'name': '35416', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35416'}, {'name': 'MDVSA-2009:298', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2009:298'}, {'name': 'FEDORA-2009-3433', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00215.html'}, {'name': '34712', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34712'}, {'name': 'ADV-2009-0937', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0937'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.xine-project.org/show_bug.cgi?id=224'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.trapkit.de/advisories/TKADV2009-005.txt'}]
CVE State: PUBLISHED
Explain CVE-2009-1275
Apache Tiles 2.1 before 2.1.2, as used in Apache Struts and other products, evaluates Expression Language (EL) expressions twice in certain circumstances, which allows remote attackers to conduct cross-site scripting (XSS) attacks or obtain sensitive information via unspecified vectors, related to the (1) tiles:putAttribute and (2) tiles:insertTemplate JSP tags.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://issues.apache.org/struts/browse/TILES-351'}, {'name': '34657', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34657'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://svn.apache.org/viewvc/tiles/framework/trunk/src/site/apt/security/security-bulletin-1.apt?revision=741913'}]
CVE State: PUBLISHED
Explain CVE-2009-1276
XScreenSaver in Sun Solaris 10 and OpenSolaris before snv_109, and Solaris 8 and 9 with GNOME 2.0 or 2.0.2, allows physically proximate attackers to obtain sensitive information by reading popup windows, which are displayed even when the screen is locked, as demonstrated by Thunderbird new-mail notifications.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-21-120094-22-1'}, {'name': 'ADV-2009-0978', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0978'}, {'name': '1022009', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1022009'}, {'name': '34421', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34421'}, {'name': '255308', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-66-255308-1'}]
CVE State: PUBLISHED
Explain CVE-2009-1277
SQL injection vulnerability in index.php in Gravity Board X (GBX) 2.0 BETA allows remote attackers to execute arbitrary SQL commands via the member_id parameter in a viewprofile action.  NOTE: the board_id issue is already covered by CVE-2008-2996.2.
Affected Products: n/a
References: [{'name': '34370', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34370'}, {'name': '8350', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8350'}, {'name': 'gravityboardx-index-sql-injection(49678)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49678'}]
CVE State: PUBLISHED
Explain CVE-2009-1278
Static code injection vulnerability in forms/ajax/configure.php in Gravity Board X (GBX) 2.0 BETA allows remote attackers to inject arbitrary PHP code into config.php via the configure action to index.php.
Affected Products: n/a
References: [{'name': '34370', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34370'}, {'name': 'gravityboardx-index-code-execution(49679)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49679'}, {'name': '8350', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8350'}]
CVE State: PUBLISHED
Explain CVE-2009-1279
Multiple cross-site scripting (XSS) vulnerabilities in Joomla! 1.5 through 1.5.9 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to the (1) com_admin component, (2) com_search component when "Gather Search Statistics" is enabled, and (3) the category view in the com_content component.
Affected Products: n/a
References: [{'name': '34360', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34360'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://developer.joomla.org/security/news/294-20090302-core-comcontent-xss.html'}, {'name': '34551', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34551'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://developer.joomla.org/security/news/293-20090301-core-multiple-xsscsrf.html'}, {'name': 'admin-search-unspecified-xss(49655)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49655'}, {'name': 'content-categoryview-xss(49654)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49654'}]
CVE State: PUBLISHED
Explain CVE-2009-1280
Multiple cross-site request forgery (CSRF) vulnerabilities in the com_media component for Joomla! 1.5.x through 1.5.9 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Affected Products: n/a
References: [{'name': 'media-unspecified-csrf(49656)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49656'}, {'name': '34551', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34551'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://developer.joomla.org/security/news/293-20090301-core-multiple-xsscsrf.html'}]
CVE State: PUBLISHED
Explain CVE-2009-1281
Cross-site scripting (XSS) vulnerability in glFusion before 1.1.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': '34575', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34575'}, {'name': '34377', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34377'}, {'name': '53287', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/53287'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.glfusion.org/article.php/glfusion113'}]
CVE State: PUBLISHED
Explain CVE-2009-1282
SQL injection vulnerability in private/system/lib-session.php in glFusion 1.1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the glf_session cookie parameter.
Affected Products: n/a
References: [{'name': '8347', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8347'}, {'tags': ['x_refsource_MISC'], 'url': 'http://retrogod.altervista.org/9sg_glfuso_sql_cookies.html'}, {'name': '34575', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34575'}, {'name': '34361', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34361'}, {'name': '53286', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/53286'}, {'name': '20090403 glFusion <= 1.1.2 COM_applyFilter()/cookies remote blind sql', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=123877379105028&w=2'}, {'name': 'glfusion-libsession-sql-injection(49652)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49652'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.glfusion.org/wiki/doku.php?id=glfusion:whatsnew'}]
CVE State: PUBLISHED
Explain CVE-2009-1283
glFusion before 1.1.3 performs authentication with a user-provided password hash instead of a password, which allows remote attackers to gain privileges by obtaining the hash and using it in the glf_password cookie, aka "User Masquerading." NOTE: this can be leveraged with a separate SQL injection vulnerability to steal hashes.
Affected Products: n/a
References: [{'name': '8347', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8347'}, {'tags': ['x_refsource_MISC'], 'url': 'http://retrogod.altervista.org/9sg_glfuso_sql_cookies.html'}, {'name': '34575', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34575'}, {'name': '20090403 glFusion <= 1.1.2 COM_applyFilter()/cookies remote blind sql', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://marc.info/?l=bugtraq&m=123877379105028&w=2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.glfusion.org/article.php/glfusion113'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.glfusion.org/wiki/doku.php?id=glfusion:whatsnew'}]
CVE State: PUBLISHED
Explain CVE-2009-1284
Buffer overflow in BibTeX 0.99 allows context-dependent attackers to cause a denial of service (memory corruption and crash) via a long .bib bibliography file.
Affected Products: n/a
References: [{'name': '[oss-security] 20090401 CVE request -- bibtex, pam_ssh', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2009/04/01/8'}, {'name': 'GLSA-201206-28', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201206-28.xml'}, {'name': 'FEDORA-2009-10730', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-November/msg00505.html'}, {'name': '34445', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34445'}, {'name': 'FEDORA-2009-10857', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-November/msg00507.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=492136'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=520920'}, {'name': 'USN-937-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-937-1'}]
CVE State: PUBLISHED
Explain CVE-2009-1285
Static code injection vulnerability in the getConfigFile function in setup/lib/ConfigFile.class.php in phpMyAdmin 3.x before 3.1.3.2 allows remote attackers to inject arbitrary PHP code into configuration files.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.phpmyadmin.net/home_page/security/PMASA-2009-4.php'}, {'name': 'ADV-2009-1045', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1045'}, {'name': '34741', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34741'}, {'name': '34727', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34727'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_3_1_3/phpMyAdmin/setup/lib/ConfigFile.class.php?r1=12248&r2=12301&pathrev=12342'}, {'name': '34526', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34526'}, {'name': 'FEDORA-2009-3700', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00452.html'}, {'name': 'FEDORA-2009-3692', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00442.html'}]
CVE State: PUBLISHED
Explain CVE-2009-1286
The IMAP task in the server in IBM Lotus Domino 8.0.2 before FP1 IF1 and 8.5 before IF3 allows remote attackers to cause a denial of service (daemon crash) via a MIME e-mail message with RFC822 attachments (aka blobs) containing malformed root entities.
Affected Products: n/a
References: [{'name': 'ADV-2009-0986', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0986'}, {'name': '34441', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34441'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21381566'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21379894'}, {'name': '1022024', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1022024'}, {'name': '34657', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34657'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21379915'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21381562'}]
CVE State: PUBLISHED
Explain CVE-2009-1287
Cross-site scripting (XSS) vulnerability in Cisco Subscriber Edge Services Manager (SESM) allows remote attackers to inject arbitrary web script or HTML via the URI.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': '1022030', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1022030'}, {'name': '34454', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34454'}, {'name': 'sesm-unspecified-xss(50349)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/50349'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.xc0re.net/index.php?p=1_17_Cisco-Subscriber-Edge-Services-Manager-Multiple-Vulnerabilities'}]
CVE State: PUBLISHED