Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2009-0866
pHNews Alpha 1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for extra/genbackup.php.
Affected Products: n/a
References: [{'name': 'phnews-genbackup-info-disclosure(48801)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48801'}, {'name': '8073', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8073'}]
CVE State: PUBLISHED
Explain CVE-2009-0867
The HRM-S service in Fujitsu Enhanced Support Facility 3.0 and 3.0.1 allows remote attackers to obtain (1) hardware and (2) software information via unspecified requests in a client connection.
Affected Products: n/a
References: [{'name': 'fujitsu-enhanced-hrms-info-disclosure(48817)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48817'}, {'name': '33831', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33831'}, {'name': '33974', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33974'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.fujitsu.com/global/support/software/security/products-f/esf-200901e.html'}]
CVE State: PUBLISHED
Explain CVE-2009-0868
CRLF injection vulnerability in the WebLink template in Fujitsu Jasmine2000 Enterprise Edition allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.fujitsu.com/global/support/software/security/products-f/jasmine-200901e.html'}, {'name': '33832', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33832'}, {'name': '33971', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/33971'}, {'name': 'jasmine2000-weblink-response-splitting(48818)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/48818'}]
CVE State: PUBLISHED
Explain CVE-2009-0869
Buffer overflow in the client in IBM Tivoli Storage Manager (TSM) HSM 5.3.2.0 through 5.3.5.0, 5.4.0.0 through 5.4.2.5, and 5.5.0.0 through 5.5.1.4 on Windows allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors.
Affected Products: n/a
References: [{'name': '1021820', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1021820'}, {'name': '34189', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34189'}, {'name': 'IC59481', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-1.ibm.com/support/docview.wss?uid=swg1IC59481'}, {'name': 'ADV-2009-0638', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0638'}, {'name': '34034', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34034'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21329223'}]
CVE State: PUBLISHED
Explain CVE-2009-0870
The NFSv4 Server module in the kernel in Sun Solaris 10, and OpenSolaris before snv_111, allow local users to cause a denial of service (infinite loop and system hang) by accessing an hsfs filesystem that is shared through NFSv4, related to the rfs4_op_readdir function.
Affected Products: n/a
References: [{'name': 'ADV-2009-0765', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0765'}, {'name': 'ADV-2009-0635', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0635'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.avaya.com/elmodocs2/security/ASA-2009-090.htm'}, {'name': '252469', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-66-252469-1'}, {'name': '1021819', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1021819'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-21-139462-02-1'}, {'name': '34371', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34371'}, {'name': '34031', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34031'}, {'name': 'solaris-nfsv4-hsfs-dos(49133)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49133'}, {'name': '34193', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34193'}]
CVE State: PUBLISHED
Explain CVE-2009-0871
The SIP channel driver in Asterisk Open Source 1.4.22, 1.4.23, and 1.4.23.1; 1.6.0 before 1.6.0.6; 1.6.1 before 1.6.1.0-rc2; and Asterisk Business Edition C.2.3, with the pedantic option enabled, allows remote authenticated users to cause a denial of service (crash) via a SIP INVITE request without any headers, which triggers a NULL pointer dereference in the (1) sip_uri_headers_cmp and (2) sip_uri_params_cmp functions.
Affected Products: n/a
References: [{'name': '52568', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52568'}, {'name': '34070', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34070'}, {'name': '1021834', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021834'}, {'name': '20090310 AST-2009-002: Remote Crash Vulnerability in SIP channel driver', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/501656/100/0/threaded'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.digium.com/view.php?id=14417'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.digium.com/view.php?id=13547'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://downloads.digium.com/pub/security/AST-2009-002.html'}, {'name': 'ADV-2009-0667', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0667'}, {'name': '34229', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34229'}]
CVE State: PUBLISHED
Explain CVE-2009-0872
The NFS server in Sun Solaris 10, and OpenSolaris before snv_111, does not properly implement the AUTH_NONE (aka sec=none) security mode in combination with other security modes, which allows remote attackers to bypass intended access restrictions and read or modify files, as demonstrated by a combination of the AUTH_NONE and AUTH_SYS security modes.
Affected Products: n/a
References: [{'name': '253588', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-66-253588-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.avaya.com/elmodocs2/security/ASA-2009-093.htm'}, {'name': '52559', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52559'}, {'name': '1021833', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1021833'}, {'name': 'solaris-nfssec-unauthorized-access(49170)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49170'}, {'name': 'ADV-2009-0658', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0658'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-21-139462-02-1'}, {'name': '34063', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34063'}, {'name': '34429', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34429'}, {'name': '34213', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34213'}, {'name': 'ADV-2009-0798', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0798'}]
CVE State: PUBLISHED
Explain CVE-2009-0873
The NFS daemon (aka nfsd) in Sun Solaris 10 and OpenSolaris before snv_106, when NFSv3 is used, does not properly implement combinations of security modes, which allows remote attackers to bypass intended access restrictions and read or modify files, as demonstrated by a combination of the sec=sys and sec=krb5 security modes, related to modes that "override each other."
Affected Products: n/a
References: [{'name': 'ADV-2009-0814', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0814'}, {'name': '34435', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34435'}, {'name': '1021832', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1021832'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.avaya.com/elmodocs2/security/ASA-2009-096.htm'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-21-139462-02-1'}, {'name': 'solaris-nfsd-unauthorized-access(49171)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49171'}, {'name': 'ADV-2009-0657', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0657'}, {'name': '34062', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34062'}, {'name': '34225', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34225'}, {'name': '52560', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52560'}, {'name': '250306', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-66-250306-1'}]
CVE State: PUBLISHED
Explain CVE-2009-0874
Multiple unspecified vulnerabilities in the Doors subsystem in the kernel in Sun Solaris 8 through 10, and OpenSolaris before snv_94, allow local users to cause a denial of service (process hang), or possibly bypass file permissions or gain kernel-context privileges, via vectors including ones related to (1) an argument handling deadlock in a door server and (2) watchpoint problems in the door_call function.
Affected Products: n/a
References: [{'name': '1021840', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021840'}, {'name': '242486', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-66-242486-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-21-117350-61-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.avaya.com/elmodocs2/security/ASA-2009-095.htm'}, {'name': 'ADV-2009-0673', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0673'}, {'name': '34227', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34227'}, {'name': 'ADV-2009-0766', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0766'}, {'name': '34375', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34375'}, {'name': '34081', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34081'}]
CVE State: PUBLISHED
Explain CVE-2009-0875
Race condition in the Doors subsystem in the kernel in Sun Solaris 8 through 10, and OpenSolaris before snv_94, allows local users to cause a denial of service (process hang), or possibly bypass file permissions or gain kernel-context privileges, via vectors involving the time at which control is transferred from a caller to a door server.
Affected Products: n/a
References: [{'name': '1021840', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021840'}, {'name': '242486', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-66-242486-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-21-117350-61-1'}, {'name': '52561', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52561'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.avaya.com/elmodocs2/security/ASA-2009-095.htm'}, {'name': 'ADV-2009-0673', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0673'}, {'name': '34227', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34227'}, {'name': 'ADV-2009-0766', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0766'}, {'name': '34375', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34375'}, {'name': '34081', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34081'}]
CVE State: PUBLISHED
Explain CVE-2009-0876
Sun xVM VirtualBox 2.0.0, 2.0.2, 2.0.4, 2.0.6r39760, 2.1.0, 2.1.2, and 2.1.4r42893 on Linux allows local users to gain privileges via a hardlink attack, which preserves setuid/setgid bits on Linux, related to DT_RPATH:$ORIGIN.
Affected Products: n/a
References: [{'name': '34080', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34080'}, {'name': 'xvmvirtualbox-unspecified-priv-escalation(49193)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49193'}, {'name': 'ADV-2009-0674', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0674'}, {'name': '[oss-security] 20090316 CVE-2009-0876 (VirtualBox) references', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2009/03/15/1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.gentoo.org/show_bug.cgi?id=260331'}, {'name': '[oss-security] 20090317 Re: CVE-2009-0876 (VirtualBox) references', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2009/03/17/2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.virtualbox.org/ticket/3444'}, {'name': '1021841', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021841'}, {'name': '34232', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34232'}, {'name': '52580', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52580'}, {'name': '254568', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-66-254568-1'}]
CVE State: PUBLISHED
Explain CVE-2009-0877
Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Communications Express allow remote attackers to inject arbitrary web script or HTML via the (1) Full Name or (2) Subject field.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://sosoblood.freehostia.com/SJSC/html_injection.gif'}, {'name': '20090310 Sun Java System Communications Express [HTML Injection]', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/501672/100/0/threaded'}, {'name': '34083', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34083'}, {'name': '52718', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52718'}]
CVE State: PUBLISHED
Explain CVE-2009-0878
The read_game_map function in src/terrain_translation.cpp in Wesnoth before r32987 allows remote attackers to cause a denial of service (memory consumption and daemon hang) via a map with a large (1) width or (2) height.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://launchpad.net/bugs/336396'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://packages.debian.org/changelogs/pool/main/w/wesnoth/wesnoth_1.5.12-1/changelog'}, {'name': 'wesnoth-readgamemap-dos(49294)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49294'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://packages.debian.org/changelogs/pool/main/w/wesnoth/wesnoth_1.4.7-4/changelog'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://svn.gna.org/viewcvs/wesnoth/trunk/src/terrain_translation.cpp?r2=32987&rev=32987&r1=31859&dir_pagestart=200'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://svn.gna.org/viewcvs/wesnoth/trunk/src/terrain_translation.cpp?rev=33078&dir_pagestart=200&view=log'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://gna.org/bugs/index.php?13031'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://launchpad.net/bugs/335089'}]
CVE State: PUBLISHED
Explain CVE-2009-0879
The CIM server in IBM Director before 5.20.3 Service Update 2 on Windows allows remote attackers to cause a denial of service (daemon crash) via a long consumer name, as demonstrated by an M-POST request to a long /CIMListener/ URI.
Affected Products: n/a
References: [{'name': 'ADV-2009-0656', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0656'}, {'name': '52615', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52615'}, {'name': '20090310 SEC Consult SA-20090305-1 :: IBM Director CIM Server Remote Denial of Service Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/501638/100/0/threaded'}, {'name': '34212', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34212'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www14.software.ibm.com/webapp/iwm/web/reg/download.do?source=dmp&S_PKG=director_x_520&S_TACT=sms&lang=en_US&cp=UTF-8'}, {'name': 'director-cim-consumer-dos(49285)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49285'}, {'name': '1021825', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1021825'}, {'name': '34061', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34061'}, {'name': '8190', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8190'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.sec-consult.com/files/20090305-1_IBM_director_DoS.txt'}]
CVE State: PUBLISHED
Explain CVE-2009-0880
Directory traversal vulnerability in the CIM server in IBM Director before 5.20.3 Service Update 2 on Windows allows remote attackers to load and execute arbitrary local DLL code via a .. (dot dot) in a /CIMListener/ URI in an M-POST request.
Affected Products: n/a
References: [{'name': 'ADV-2009-0656', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0656'}, {'name': '52616', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52616'}, {'name': '20090310 SEC Consult SA-20090305-2 :: IBM Director CIM Server Local Privilege Escalation Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/501639/100/0/threaded'}, {'name': '34065', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34065'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.sec-consult.com/files/20090305-2_IBM_director_privilege_escalation.txt'}, {'name': '34212', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34212'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www14.software.ibm.com/webapp/iwm/web/reg/download.do?source=dmp&S_PKG=director_x_520&S_TACT=sms&lang=en_US&cp=UTF-8'}, {'name': 'director-cim-directory-traversal(49286)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49286'}]
CVE State: PUBLISHED
Explain CVE-2009-0881
SQL injection vulnerability in ejemplo/paises.php in isiAJAX 1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Affected Products: n/a
References: [{'name': 'isiajax-paises-sql-injection(49113)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49113'}, {'name': '8167', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8167'}]
CVE State: PUBLISHED
Explain CVE-2009-0882
Multiple SQL injection vulnerabilities in nForum 1.5 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to showtheme.php and the (2) user parameter to userinfo.php.
Affected Products: n/a
References: [{'name': '34030', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34030'}, {'name': '20090306 nForum 1.5 Multiple SQL Injection', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/501560/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2009-0883
SQL injection vulnerability in Blue Eye CMS 1.0.0 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the BlueEyeCMS_login cookie parameter.
Affected Products: n/a
References: [{'name': 'blueeyecms-blueeyecmslogin-sql-injection(49104)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49104'}, {'name': '34022', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34022'}, {'name': '8165', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8165'}]
CVE State: PUBLISHED
Explain CVE-2009-0884
Buffer overflow in FileZilla Server before 0.9.31 allows remote attackers to cause a denial of service via unspecified vectors related to SSL/TLS packets.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/project/shownotes.php?release_id=665428'}, {'name': '34006', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34006'}, {'name': '1021812', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021812'}, {'name': '34089', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34089'}, {'name': 'filezillaserver-ssltls-dos(49107)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49107'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://filezilla-project.org/index.php'}, {'name': 'ADV-2009-0603', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0603'}]
CVE State: PUBLISHED
Explain CVE-2009-0885
Multiple heap-based buffer overflows in Media Commands 1.0 allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a long string in a (1) M3U, (2) M3l, (3) TXT, and (4) LRC playlist file.
Affected Products: n/a
References: [{'name': '33958', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/33958'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.securityfocus.com/data/vulnerabilities/exploits/33958-2.py'}, {'name': 'ADV-2009-0583', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0583'}, {'name': '52346', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/52346'}, {'name': 'mediacommands-playlist-bo(49035)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49035'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.securityfocus.com/data/vulnerabilities/exploits/33958.rb'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.securityfocus.com/data/vulnerabilities/exploits/33958.py'}, {'name': '34122', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34122'}, {'name': '8135', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8135'}]
CVE State: PUBLISHED
Explain CVE-2009-0886
Directory traversal vulnerability in login.php in OneOrZero Helpdesk 1.6.5.7 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the default_language parameter.
Affected Products: n/a
References: [{'name': '8169', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8169'}, {'name': 'htms-login-file-include(49114)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49114'}, {'name': '34029', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34029'}, {'name': '8168', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/8168'}]
CVE State: PUBLISHED
Explain CVE-2009-0887
Integer signedness error in the _pam_StrTok function in libpam/pam_misc.c in Linux-PAM (aka pam) 1.0.3 and earlier, when a configuration file contains non-ASCII usernames, might allow remote attackers to cause a denial of service, and might allow remote authenticated users to obtain login access with a different user's non-ASCII username, via a login attempt.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/libpam/pam_misc.c?r1=1.9&amp%3Br2=1.10&amp%3Bview=patch'}, {'name': 'MDVSA-2009:077', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2009:077'}, {'name': '[oss-security] 20090305 CVE Request -- pam', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2009/03/05/1'}, {'name': 'FEDORA-2009-3204', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00398.html'}, {'name': 'linuxpam-pamstrtok-priv-escalation(49110)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49110'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://pam.cvs.sourceforge.net/viewvc/pam/Linux-PAM/libpam/pam_misc.c?view=log'}, {'name': '34010', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34010'}, {'name': 'FEDORA-2009-3231', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00420.html'}, {'name': '34733', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34733'}]
CVE State: PUBLISHED
Explain CVE-2009-0888
Heap-based buffer overflow in the JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 might allow remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2009-0510, CVE-2009-0511, CVE-2009-0512, and CVE-2009-0889.
Affected Products: n/a
References: [{'name': '35274', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35274'}, {'name': 'ADV-2009-1547', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1547'}, {'name': 'TA09-161A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA09-161A.html'}, {'name': '35734', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35734'}, {'name': 'RHSA-2009:1109', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2009-1109.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.adobe.com/support/security/bulletins/apsb09-07.html'}, {'name': '1022361', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1022361'}, {'name': 'GLSA-200907-06', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200907-06.xml'}, {'name': '34580', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34580'}, {'name': '35496', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35496'}]
CVE State: PUBLISHED
Explain CVE-2009-0889
Heap-based buffer overflow in the JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 might allow remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2009-0510, CVE-2009-0511, CVE-2009-0512, and CVE-2009-0888.
Affected Products: n/a
References: [{'name': '35274', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35274'}, {'name': 'ADV-2009-1547', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1547'}, {'name': 'TA09-161A', 'tags': ['third-party-advisory', 'x_refsource_CERT'], 'url': 'http://www.us-cert.gov/cas/techalerts/TA09-161A.html'}, {'name': '35734', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35734'}, {'name': 'RHSA-2009:1109', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2009-1109.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.adobe.com/support/security/bulletins/apsb09-07.html'}, {'name': '1022361', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1022361'}, {'name': 'GLSA-200907-06', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-200907-06.xml'}, {'name': '34580', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34580'}, {'name': '35496', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35496'}]
CVE State: PUBLISHED
Explain CVE-2009-0891
The Web Services Security component in IBM WebSphere Application Server 7.0 before Fix Pack 1 (7.0.0.1), 6.1 before Fix Pack 23 (6.1.0.23),and 6.0.2 before Fix Pack 33 (6.0.2.33) does not properly enforce (1) nonce and (2) timestamp expiration values in WS-Security bindings as stored in the com.ibm.wsspi.wssecurity.core custom property, which allows remote authenticated users to conduct session hijacking attacks.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg27007951'}, {'name': '34131', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34131'}, {'name': 'websphere-ws-security-session-hijacking(49391)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49391'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg27006876'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg27014463'}, {'name': 'PK66676', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-1.ibm.com/support/search.wss?rs=0&q=PK66676&apar=only'}]
CVE State: PUBLISHED
Explain CVE-2009-0892
The administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.23 and 7.0 before 7.0.0.3 allows attackers to hijack user sessions in "specific scenarios" related to a forced logout.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg27007951'}, {'name': 'PK74966', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg1PK74966'}, {'name': '34501', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34501'}, {'name': '34131', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/34131'}, {'name': 'websphere-console-session-hijacking(49499)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/49499'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg27014463'}]
CVE State: PUBLISHED
Explain CVE-2009-0893
Multiple heap-based buffer overflows in xvidcore/src/decoder.c in the xvidcore library in Xvid before 1.2.2, as used by Windows Media Player and other applications, allow remote attackers to execute arbitrary code by providing a crafted macroblock (aka MBlock) number in a video stream in a crafted movie file that triggers heap memory corruption, related to a "missing resync marker range check" and the (1) decoder_iframe, (2) decoder_pframe, and (3) decoder_bframe functions.
Affected Products: n/a
References: [{'name': '35274', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35274'}, {'name': 'ADV-2009-1468', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1468'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.it-isac.org/postings/cyber/alertdetail.php?id=4634&selyear=2009&menutype=menupublic'}, {'name': '35156', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35156'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://cvs.xvid.org/cvs/viewvc.cgi/xvidcore/src/decoder.c'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://cvs.xvid.org/cvs/viewvc.cgi/xvidcore/src/decoder.c?r1=1.80&r2=1.81'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.xvid.org/News.64.0.html?&cHash=0170b4e439&tx_ttnews%5BbackPid%5D=64&tx_ttnews%5Btt_news%5D=7'}]
CVE State: PUBLISHED
Explain CVE-2009-0894
Heap-based buffer overflow in the decoder_create function in the initialization functionality in xvidcore/src/decoder.c in Xvid before 1.2.2, as used by Windows Media Player and other applications, allows remote attackers to execute arbitrary code via vectors involving the DirectShow (aka DShow) frontend and improper handling of the XVID_ERR_MEMORY return code during processing of a crafted movie file. NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://cvs.xvid.org/cvs/viewvc.cgi/xvidcore/src/decoder.c'}, {'name': '35158', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35158'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://cvs.xvid.org/cvs/viewvc.cgi/xvidcore/src/decoder.c?r1=1.80&r2=1.81'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.xvid.org/News.64.0.html?&cHash=0170b4e439&tx_ttnews%5BbackPid%5D=64&tx_ttnews%5Btt_news%5D=7'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.it-isac.org/postings/cyber/alertdetail.php?id=4635&selyear=2009&menutype=menupublic'}]
CVE State: PUBLISHED
Explain CVE-2009-0895
Integer overflow in Novell eDirectory 8.7.3.x before 8.7.3.10 ftf2 and 8.8.x before 8.8.5.2 allows remote attackers to execute arbitrary code via an NDS Verb 0x1 request containing a large integer value that triggers a heap-based buffer overflow.
Affected Products: n/a
References: [{'name': 'ADV-2009-3379', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/3379'}, {'name': '37184', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/37184'}, {'name': 'application-control-request-overflow(50616)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/50616'}, {'name': '20091124 Novell eDirectory Remote Code Execution', 'tags': ['third-party-advisory', 'x_refsource_ISS'], 'url': 'http://www.iss.net/threats/356.html'}, {'name': '37554', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/37554'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.novell.com/support/viewContent.do?externalId=7004912'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.novell.com/show_bug.cgi?id=524344'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.novell.com/show_bug.cgi?id=545887'}]
CVE State: PUBLISHED
Explain CVE-2009-0896
Buffer overflow in the queue manager in IBM WebSphere MQ 6.x before 6.0.2.7 and 7.x before 7.0.1.0 allows remote attackers to execute arbitrary code via a crafted request.
Affected Products: n/a
References: [{'name': '35170', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35170'}, {'name': 'websphere-mq-clientconnection-bo(50641)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/50641'}, {'name': 'ADV-2009-1463', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/1463'}, {'name': '1022311', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1022311'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21386826'}, {'name': '35303', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/35303'}, {'name': 'IZ50784', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-1.ibm.com/support/docview.wss?uid=swg1IZ50784'}]
CVE State: PUBLISHED
Explain CVE-2009-0897
IBM WebSphere Partner Gateway (WPG) 6.1.0 before 6.1.0.1 and 6.1.1 before 6.1.1.1 allows remote authenticated users to obtain sensitive information via vectors related to the "schema DB2 instance id" and the bcgarchive (aka the archiver script).
Affected Products: n/a
References: [{'name': 'JR31482', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21366016'}, {'name': '35136', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35136'}, {'name': 'websphere-pg-bcgarchive-info-disclosure(50643)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/50643'}]
CVE State: PUBLISHED
Explain CVE-2009-0898
Stack-based buffer overflow in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via a crafted HTTP request.
Affected Products: n/a
References: [{'name': '37294', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/37294'}, {'name': 'SSRT090101', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01950877'}, {'name': '37261', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/37261'}, {'name': 'SSRT090257', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://marc.info/?l=bugtraq&m=126046355120442&w=2'}, {'name': '20091209 HP OpenView Network Node Manager Remote Code Execution', 'tags': ['third-party-advisory', 'x_refsource_ISS'], 'url': 'http://www.iss.net/threats/357.html'}, {'name': 'HPSBMA02483', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01950877'}]
CVE State: PUBLISHED
Explain CVE-2009-0899
IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.24 and 7.0 through 7.0.0.4, IBM WebSphere Portal Server 5.1 through 6.0, and IBM Integrated Solutions Console (ISC) 6.0.1 do not properly set the IsSecurityEnabled security flag during migration of WebSphere Member Manager (WMM) to Virtual Member Manager (VMM) and a Federated Repository, which allows attackers to obtain sensitive information from repositories via unspecified vectors.
Affected Products: n/a
References: [{'name': '35406', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35406'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21375859'}, {'name': 'websphere-issecurityenabled-info-disclosure(50882)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/50882'}, {'name': 'PK78134', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-1.ibm.com/support/docview.wss?uid=swg1PK78134'}]
CVE State: PUBLISHED
Explain CVE-2009-0900
Heap-based buffer overflow in the client in IBM WebSphere MQ 6.0 before 6.0.2.7 and 7.0 before 7.0.1.0 allows local users to gain privileges via crafted SSL information in a Client Channel Definition Table (CCDT) file.
Affected Products: n/a
References: [{'name': 'IC59375', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www.ibm.com/support/docview.wss?uid=swg1IC59375'}, {'name': 'websphere-mq-client-ccdt-bo(51038)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/51038'}]
CVE State: PUBLISHED
Explain CVE-2009-0903
IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.3, and the Feature Pack for Web Services for WAS 6.1 before 6.1.0.25, when a WS-Security policy is established at the operation level, does not properly handle inbound requests that lack a SOAPAction or WS-Addressing Action, which allows remote attackers to bypass intended access restrictions via a crafted request to a JAX-WS application.
Affected Products: n/a
References: [{'name': 'PK87767', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-1.ibm.com/support/docview.wss?uid=swg1PK87767'}, {'name': '35594', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35594'}, {'name': 'PK72138', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-1.ibm.com/support/docview.wss?uid=swg1PK72138'}, {'name': 'PK81944', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-1.ibm.com/support/docview.wss?uid=swg1PK81944'}, {'name': 'websphere-jaxws-wssecurity-sec-bypass(51293)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/51293'}]
CVE State: PUBLISHED
Explain CVE-2009-0904
The IBM Stax XMLStreamWriter in the Web Services component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 does not properly process XML encoding, which allows remote attackers to bypass intended access restrictions and possibly modify data via "XML fuzzing attacks" sent through SOAP requests.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg27007951'}, {'name': 'websphere-soap-security-bypass(51490)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/51490'}, {'name': '35741', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/35741'}, {'name': 'PK84015', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-1.ibm.com/support/docview.wss?uid=swg1PK84015'}]
CVE State: PUBLISHED
Explain CVE-2009-0905
IBM WebSphere MQ 6.0 before 6.0.2.8 and 7.0 before 7.0.1.0 does not properly handle long group names, which might allow local users to gain privileges by leveraging combinations of group names with the same initial substring.
Affected Products: n/a
References: [{'name': 'websphere-mq-group-weak-security(51042)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/51042'}, {'name': 'IZ37102', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www.ibm.com/support/docview.wss?uid=swg1IZ37102'}]
CVE State: PUBLISHED
Explain CVE-2009-0906
The Service Component Architecture (SCA) feature pack for IBM WebSphere Application Server (WAS) SCA 1.0 before 1.0.0.3 allows remote authenticated users to bypass intended authentication.transport access restrictions and obtain unspecified access via unknown vectors.
Affected Products: n/a
References: [{'name': 'was-sca-scaallauthorizedusers-sec-bypass(52074)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/52074'}, {'name': 'PK86047', 'tags': ['vendor-advisory', 'x_refsource_AIXAPAR'], 'url': 'http://www-1.ibm.com/support/docview.wss?uid=swg1PK86047'}, {'name': '36306', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/36306'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg27015429'}]
CVE State: PUBLISHED
Explain CVE-2009-0908
Unspecified vulnerability in the ACE shared folders implementation in the VMware Host Guest File System (HGFS) shared folders feature in VMware ACE 2.5.1 and earlier allows attackers to enable a disabled shared folder.
Affected Products: n/a
References: [{'name': '20090403 VMSA-2009-0005 VMware Hosted products, VI Client and patches for ESX and ESXi resolve multiple security issues', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2009/Apr/0036.html'}, {'name': '34373', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34373'}, {'name': 'oval:org.mitre.oval:def:6399', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6399'}, {'name': '1021975', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021975'}, {'name': 'ADV-2009-0944', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0944'}, {'name': '[security-announce] 20090403 VMSA-2009-0005 VMware Hosted products, VI Client and patches for ESX and ESXi resolve multiple security issues', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.vmware.com/pipermail/security-announce/2009/000054.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2009-0005.html'}]
CVE State: PUBLISHED
Explain CVE-2009-0909
Heap-based buffer overflow in the VNnc Codec in VMware Workstation 6.5.x before 6.5.2 build 156735, VMware Player 2.5.x before 2.5.2 build 156735, VMware ACE 2.5.x before 2.5.2 build 156735, and VMware Server 2.0.x before 2.0.1 build 156745 allows remote attackers to execute arbitrary code via a crafted web page or video file, aka ZDI-CAN-435.
Affected Products: n/a
References: [{'name': 'GLSA-201209-25', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201209-25.xml'}, {'name': '20090403 VMSA-2009-0005 VMware Hosted products, VI Client and patches for ESX and ESXi resolve multiple security issues', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2009/Apr/0036.html'}, {'name': '34373', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/34373'}, {'name': 'ADV-2009-0944', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2009/0944'}, {'name': '[security-announce] 20090403 VMSA-2009-0005 VMware Hosted products, VI Client and patches for ESX and ESXi resolve multiple security issues', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.vmware.com/pipermail/security-announce/2009/000054.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2009-0005.html'}, {'name': '1021974', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1021974'}, {'name': 'oval:org.mitre.oval:def:6251', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6251'}]
CVE State: PUBLISHED