Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2009-4378 State: PUBLISHED Published: 2009-12-21T21:00:00 Last Updated: 2024-08-07T07:01:20.151Z Vendors: n/a Products: n/a Problem Types: n/a Description: The IPMI dissector in Wireshark 1.2.0 through 1.2.4 on Windows allows remote attackers to cause a denial of service (crash) via a crafted packet, related to "formatting a date/time using strftime." Additional Analyst Notes: - CVE Program Container: References: - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4319 - http://osvdb.org/61179 - http://secunia.com/advisories/37842 - http://www.vupen.com/english/advisories/2009/3596 - https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01248.html - http://ww
h/advisories/2009/3596 - https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01248.html - http://www.securityfocus.com/bid/37407 - http://www.securitytracker.com/id?1023374 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7576 - http://www.wireshark.org/security/wnpa-sec-2009-09.html
CVE ID: CVE-2009-4379 State: PUBLISHED Published: 2009-12-22T23:00:00Z Last Updated: 2024-09-17T03:55:07.411Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Valarsoft Webmatic before 3.0.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different issue than CVE-2008-2924. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/37335 - http://secunia.com/advisories/37735 - http://www.valarsoft.com/index.php?stage=0&section=5&newsID=165&action=6
CVE ID: CVE-2009-4380 State: PUBLISHED Published: 2009-12-22T23:00:00Z Last Updated: 2024-09-17T03:38:38.561Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in Valarsoft Webmatic before 3.0.3 allow remote attackers to execute arbitrary SQL commands via unspecified vectors, a different issue than CVE-2008-2925. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/37335 - http://secunia.com/advisories/37735 - http://www.valarsoft.com/index.php?stage=0&section=5&newsID=165&action=6
CVE ID: CVE-2009-4381 State: PUBLISHED Published: 2009-12-22T23:00:00 Last Updated: 2024-08-07T07:01:20.494Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in index.php in texmedia Million Pixel Script 3 allows remote attackers to inject arbitrary web script or HTML via the pa parameter. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/37315 - http://osvdb.org/60961 - https://exchange.xforce.ibmcloud.com/vulnerabilities/54742 - http://secunia.com/advisories/37700 - http://packetstormsecurity.org/0912-exploits/mps-xss.txt
/vulnerabilities/54742 - http://secunia.com/advisories/37700 - http://packetstormsecurity.org/0912-exploits/mps-xss.txt - http://www.exploit-db.com/exploits/10399
CVE ID: CVE-2009-4382 State: PUBLISHED Published: 2009-12-22T23:00:00 Last Updated: 2024-08-07T07:01:20.610Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in module.php in PHPFABER CMS, possibly 1.3.36, allows remote attackers to inject arbitrary web script or HTML via the mod parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.org/0912-exploits/phpfabercms-xss.txt - http://www.vupen.com/english/advisories/2009/3526 - http://www.securityfocus.com/bid/37329 - http://www.exploit-db.com/exploits/10443
CVE ID: CVE-2009-4383 State: PUBLISHED Published: 2009-12-22T23:00:00Z Last Updated: 2024-09-16T18:23:22.313Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in Pforum.php in Rocomotion P forum before 1.28 allows remote attackers to read arbitrary files via directory traversal sequences in unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000084.html - http://jvn.jp/en/jp/JVN00152874/index.html - http://another.rocomotion.jp/12604561773482.html - http://another.rocomotion.jp/12568911093444.html - http://secunia.com/advisories/37691
CVE ID: CVE-2009-4384 State: PUBLISHED Published: 2009-12-22T23:00:00 Last Updated: 2024-08-07T07:01:20.523Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Scriptsez.net Ez Poll Hoster (EPH) allow remote attackers to inject arbitrary web script or HTML via the (1) pid parameter in a code action to index.php and the (2) uid parameter in a view action to profile.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2009/3529 - http://secunia.com/advisories/37716 - http://www.exploit-db.com/exploits/10439 - http://packetstormsecurity.org/0912-exploits/ezpollhoster-xssxsrf.t
s/37716 - http://www.exploit-db.com/exploits/10439 - http://packetstormsecurity.org/0912-exploits/ezpollhoster-xssxsrf.txt
CVE ID: CVE-2009-4385 State: PUBLISHED Published: 2009-12-22T23:00:00 Last Updated: 2024-08-07T07:01:20.076Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Scriptsez.net Ez Poll Hoster (EPH) allow remote attackers to (1) hijack the authentication of arbitrary users for requests that delete polls via the delete_poll action to index.php; and hijack the authentication of administrators for requests that (2) delete users via the manage action to admin.php, or (3) send arbitrary email to arbitrary users in the email action to admin.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/en
the email action to admin.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2009/3529 - http://secunia.com/advisories/37716 - http://www.exploit-db.com/exploits/10439 - http://packetstormsecurity.org/0912-exploits/ezpollhoster-xssxsrf.txt
CVE ID: CVE-2009-4386 State: PUBLISHED Published: 2009-12-22T23:00:00 Last Updated: 2024-08-07T07:01:20.161Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in hotel_tiempolibre_ext.php in Venalsur Booking Centre Booking System for Hotels Group, when magic_quotes_gpc is enabled, allows remote attackers to execute arbitrary SQL commands via the NoticiaID parameter and other unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/10393 - http://secunia.com/advisories/32430 - http://packetstormsecurity.org/0912-exploits/b2cbcs-sql.txt - http://www.securityfocus.com/archive/1/508429/100/0/thre
- http://packetstormsecurity.org/0912-exploits/b2cbcs-sql.txt - http://www.securityfocus.com/archive/1/508429/100/0/threaded - http://www.vupen.com/english/advisories/2009/3538
CVE ID: CVE-2009-4387 State: PUBLISHED Published: 2009-12-22T23:00:00Z Last Updated: 2024-09-16T17:29:04.222Z Vendors: n/a Products: n/a Problem Types: n/a Description: The cross-site scripting (XSS) protection mechanism in ShowInContentAreaAction.do in ManageEngine Password Manager Pro (PMP) before 6.1 Build 6104 uses case-sensitive checks for malicious inputs, which allows remote attackers to inject arbitrary web script or HTML via the searchtext parameter and other unspecified inputs. Additional Analyst Notes: - CVE Program Container: References: - http://www.scip.ch/?vuldb.4063 - http://www.scip.ch/publikationen/advisories/scip_advisory-4063_manageengine_pmp_script_injection.txt - http:/
ldb.4063 - http://www.scip.ch/publikationen/advisories/scip_advisory-4063_manageengine_pmp_script_injection.txt - http://forums.manageengine.com/#Topic/49000003740390 - http://www.manageengine.com/products/passwordmanagerpro/release-notes.html - http://secunia.com/advisories/37765 - http://www.vupen.com/english/advisories/2009/3540 - http://www.securityfocus.com/bid/37336
CVE ID: CVE-2009-4388 State: PUBLISHED Published: 2009-12-22T23:00:00Z Last Updated: 2024-09-16T20:21:37.713Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the ListMan (nl_listman) extension 1.2.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/37771 - http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-020/
CVE ID: CVE-2009-4389 State: PUBLISHED Published: 2009-12-22T23:00:00Z Last Updated: 2024-09-16T18:40:03.481Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in the Watchdog (aba_watchdog) extension 2.0.2 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unknown attack vectors. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/37770 - http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-020/
CVE ID: CVE-2009-4390 State: PUBLISHED Published: 2009-12-22T23:00:00Z Last Updated: 2024-09-17T02:31:21.687Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the Car (car) extension 0.1.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-020/
CVE ID: CVE-2009-4391 State: PUBLISHED Published: 2009-12-22T23:00:00Z Last Updated: 2024-09-16T23:40:28.056Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the File list (dr_blob) extension 2.1.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-020/
CVE ID: CVE-2009-4392 State: PUBLISHED Published: 2009-12-22T23:00:00Z Last Updated: 2024-09-16T19:30:42.126Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the XDS Staff List (xds_staff) extension 0.0.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-020/
CVE ID: CVE-2009-4393 State: PUBLISHED Published: 2009-12-22T23:00:00Z Last Updated: 2024-09-17T02:16:20.130Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the Document Directorys (danp_documentdirs) extension 1.10.7 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-020/
CVE ID: CVE-2009-4394 State: PUBLISHED Published: 2009-12-22T23:00:00Z Last Updated: 2024-09-17T00:21:17.133Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the Random Prayer 2 (ste_prayer2) extension 0.0.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-020/
CVE ID: CVE-2009-4395 State: PUBLISHED Published: 2009-12-22T23:00:00Z Last Updated: 2024-09-17T02:21:20.774Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Random Prayer 2 (ste_prayer2) extension 0.0.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-020/
CVE ID: CVE-2009-4396 State: PUBLISHED Published: 2009-12-22T23:00:00Z Last Updated: 2024-09-16T20:27:42.730Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the Diocese of Portsmouth Resources Database (pd_resources) extension 0.1.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-020/
CVE ID: CVE-2009-4397 State: PUBLISHED Published: 2009-12-22T23:00:00Z Last Updated: 2024-09-16T16:39:01.197Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Diocese of Portsmouth Resources Database (pd_resources) extension 0.1.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-020/
CVE ID: CVE-2009-4398 State: PUBLISHED Published: 2009-12-22T23:00:00Z Last Updated: 2024-09-16T18:39:48.498Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Parish of the Holy Spirit Religious Art Gallery (hs_religiousartgallery) extension 0.1.2 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-020/
CVE ID: CVE-2009-4399 State: PUBLISHED Published: 2009-12-22T23:00:00Z Last Updated: 2024-09-17T02:36:19.729Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the Parish of the Holy Spirit Religious Art Gallery (hs_religiousartgallery) extension 0.1.2 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-020/
CVE ID: CVE-2009-4400 State: PUBLISHED Published: 2009-12-22T23:00:00Z Last Updated: 2024-09-16T22:56:15.178Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Parish Administration Database (ste_parish_admin) extension 0.1.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-020/
CVE ID: CVE-2009-4401 State: PUBLISHED Published: 2009-12-22T23:00:00Z Last Updated: 2024-09-16T20:12:20.890Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the Parish Administration Database (ste_parish_admin) extension 0.1.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-020/
CVE ID: CVE-2009-4402 State: PUBLISHED Published: 2009-12-23T18:00:00 Last Updated: 2024-08-07T07:01:20.312Z Vendors: n/a Products: n/a Problem Types: n/a Description: The default configuration of SQL-Ledger 2.8.24 allows remote attackers to perform unspecified administrative operations by providing an arbitrary password to the admin interface. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/508559/100/0/threaded - http://secunia.com/advisories/37877 - http://www.securityfocus.com/bid/37431
CVE ID: CVE-2009-4403 State: PUBLISHED Published: 2009-12-23T18:00:00 Last Updated: 2024-08-07T07:01:20.679Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in index.php in Rumba XML 1.8 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/37840 - https://exchange.xforce.ibmcloud.com/vulnerabilities/54913 - http://osvdb.org/61137 - http://www.exploit-db.com/exploits/10534 - http://www.securityfocus.com/archive/1/508536/100/0/threaded
CVE ID: CVE-2009-4404 State: PUBLISHED Published: 2009-12-23T18:00:00 Last Updated: 2024-08-07T07:01:20.512Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in t-prot (TOFU Protection) before 2.8 allows remote attackers to cause a denial of service via unspecified vectors related to the "--maxlines" option and a crafted email message. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://freshmeat.net/projects/t-prot/releases/309781 - http://osvdb.org/61235 - http://secunia.com/advisories/37874 - https://exchange.xforce.ibmcloud.com/vulnerabilities/54936
CVE ID: CVE-2009-4405 State: PUBLISHED Published: 2009-12-23T21:00:00 Last Updated: 2024-08-07T07:01:20.804Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple unspecified vulnerabilities in Trac before 0.11.6 have unknown impact and attack vectors, possibly related to (1) "policy checks in report results when using alternate formats" or (2) a "check for the 'raw' role that is missing in docutils < 0.6." Additional Analyst Notes: - CVE Program Container: References: - http://trac.edgewall.org/browser/tags/trac-0.11.6/RELEASE - https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01169.html - http://www.vupen.com/english/advisories/2009/3615 - http://secun
s/fedora-package-announce/2009-December/msg01169.html - http://www.vupen.com/english/advisories/2009/3615 - http://secunia.com/advisories/37807 - http://secunia.com/advisories/37901 - https://exchange.xforce.ibmcloud.com/vulnerabilities/54983 - https://bugzilla.redhat.com/show_bug.cgi?id=542394
CVE ID: CVE-2009-4406 State: PUBLISHED Published: 2009-12-23T21:00:00 Last Updated: 2024-08-07T07:01:20.618Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Forms/login1 in American Power Conversion (APC) Switched Rack PDU AP7932 B2, running rpdu 3.3.3 or 3.7.0 on AOS 3.3.4, and possibly other versions, allows remote attackers to inject arbitrary web script or HTML via the login_username parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.packetstormsecurity.org/0912-exploits/apc-xss.txt - http://www.securityfocus.com/archive/1/508468/100/0/threaded - http://www.securityfocus.com/bid/37338 - http://www.
xt - http://www.securityfocus.com/archive/1/508468/100/0/threaded - http://www.securityfocus.com/bid/37338 - http://www.securitytracker.com/id?1023331 - https://exchange.xforce.ibmcloud.com/vulnerabilities/54824
CVE ID: CVE-2009-4407 State: PUBLISHED Published: 2009-12-23T21:00:00 Last Updated: 2024-08-07T07:01:20.155Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in PyForum 1.0.3 and possibly earlier versions, and possibly zForum, allow remote attackers to hijack the authentication of victims for requests that change passwords, and other unspecified requests, via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/61050 - http://secunia.com/advisories/37764 - https://exchange.xforce.ibmcloud.com/vulnerabilities/54853 - http://www.securityfocus.com/archive/1/508478/100/0/threade
https://exchange.xforce.ibmcloud.com/vulnerabilities/54853 - http://www.securityfocus.com/archive/1/508478/100/0/threaded
CVE ID: CVE-2009-4408 State: PUBLISHED Published: 2009-12-23T21:00:00 Last Updated: 2024-08-07T07:01:20.253Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in models.parser in PyForum 1.0.3 and possibly earlier versions, and possibly zForum, allow remote attackers to inject arbitrary web script or HTML via crafted BBcode (1) img or (2) url tags, which are not properly handled when a post is viewed. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/54855 - http://www.osvdb.org/61051 - http://secunia.com/advisories/37764 - http://www.securityfocus.com/archive/1/50
ies/54855 - http://www.osvdb.org/61051 - http://secunia.com/advisories/37764 - http://www.securityfocus.com/archive/1/508478/100/0/threaded
CVE ID: CVE-2009-4409 State: PUBLISHED Published: 2009-12-23T21:00:00Z Last Updated: 2024-09-17T01:35:32.632Z Vendors: n/a Products: n/a Problem Types: n/a Description: The (1) CHAP and (2) MS-CHAP-V2 authentication capabilities in the PPP Access Concentrator (PPPAC) function in Internet Initiative Japan SEIL/B1 firmware 1.00 through 2.52 use the same challenge for each authentication attempt, which allows remote attackers to bypass authentication via a replay attack. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/37628 - http://www.securityfocus.com/bid/37293 - http://jvn.jp/en/jp/JVN49602378/index.html - http://www.osvdb.org/61118 - http://ww
://www.securityfocus.com/bid/37293 - http://jvn.jp/en/jp/JVN49602378/index.html - http://www.osvdb.org/61118 - http://www.seil.jp/seilseries/security/2009/a00697.php - http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000079.html
CVE ID: CVE-2009-4410 State: PUBLISHED Published: 2009-12-24T16:00:00 Last Updated: 2024-08-07T07:01:20.209Z Vendors: n/a Products: n/a Problem Types: n/a Description: The fuse_ioctl_copy_user function in the ioctl handler in fs/fuse/file.c in the Linux kernel 2.6.29-rc1 through 2.6.30.y uses the wrong variable in an argument to the kunmap function, which allows local users to cause a denial of service (panic) via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/37453 - https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01344.html - https://bugzilla.redhat.com/show_bug.cgi?id=549400 - http://secunia.com/a
package-announce/2009-December/msg01344.html - https://bugzilla.redhat.com/show_bug.cgi?id=549400 - http://secunia.com/advisories/37928 - http://www.openwall.com/lists/oss-security/2009/12/23/1 - http://osvdb.org/61335
CVE ID: CVE-2009-4411 State: PUBLISHED Published: 2009-12-24T16:00:00 Last Updated: 2024-08-07T07:01:20.069Z Vendors: n/a Products: n/a Problem Types: n/a Description: The (1) setfacl and (2) getfacl commands in XFS acl 2.2.47, when running in recursive (-R) mode, follow symbolic links even when the --physical (aka -P) or -L option is specified, which might allow local users to modify the ACL for arbitrary files or directories via a symlink attack. Additional Analyst Notes: - CVE Program Container: References: - http://oss.sgi.com/bugzilla/show_bug.cgi?id=790 - http://osvdb.org/61302 - http://git.savannah.gnu.org/cgit/acl.git/commit/?id=63451a0 - http://www.securityfocus.com/bid/37455 - http
.org/61302 - http://git.savannah.gnu.org/cgit/acl.git/commit/?id=63451a0 - http://www.securityfocus.com/bid/37455 - http://secunia.com/advisories/37907 - http://www.openwall.com/lists/oss-security/2009/12/23/2 - http://www.mandriva.com/security/advisories?name=MDVSA-2009:345 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=499076 - http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00000.html - http://secunia.com/advisories/38420 - https://exchange.xforce.ibmcloud.com/vulnerabilities/55004