Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2009-2337 State: PUBLISHED Published: 2009-07-07T18:35:00 Last Updated: 2024-08-07T05:44:55.959Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in includes/module/book/index.inc.php in w3b|cms Gaestebuch Guestbook Module 3.0.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the spam_id parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.w3bcms.de/2.news/54.kommentare/ - https://exchange.xforce.ibmcloud.com/vulnerabilities/49853 - http://secunia.com/advisories/34650 - http://www.securityfocus.com/bid/34477 - http://www.exploit-db.com/exploits/8396 - http://o
cunia.com/advisories/34650 - http://www.securityfocus.com/bid/34477 - http://www.exploit-db.com/exploits/8396 - http://osvdb.org/53614
CVE ID: CVE-2009-2338 State: PUBLISHED Published: 2009-07-07T18:35:00 Last Updated: 2024-08-07T05:44:55.956Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in includes/startmodules.inc.php in FreeWebshop.org 2.2.9 R2, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang_file parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/8446 - http://secunia.com/advisories/34707 - http://www.securityfocus.com/bid/34538
CVE ID: CVE-2009-2339 State: PUBLISHED Published: 2009-07-07T19:00:00 Last Updated: 2024-08-07T05:44:55.970Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in index.php in Rentventory allows remote attackers to execute arbitrary SQL commands via the product parameter. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/55555 - http://secunia.com/advisories/35676 - http://www.exploit-db.com/exploits/9081
CVE ID: CVE-2009-2340 State: PUBLISHED Published: 2009-07-07T19:00:00 Last Updated: 2024-08-07T05:44:55.971Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in admin/index.php in Opial 1.0 allows remote attackers to execute arbitrary SQL commands via the txtUserName (aka User Name) parameter. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/9079 - http://www.securityfocus.com/bid/35560 - http://osvdb.org/55560 - http://secunia.com/advisories/35677
CVE ID: CVE-2009-2341 State: PUBLISHED Published: 2009-07-07T19:00:00 Last Updated: 2024-08-07T05:44:55.975Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in albumdetail.php in Opial 1.0 allows remote attackers to execute arbitrary SQL commands via the albumid parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/35562 - http://www.exploit-db.com/exploits/9080 - http://osvdb.org/55561 - http://secunia.com/advisories/35677
CVE ID: CVE-2009-2342 State: PUBLISHED Published: 2009-07-07T19:00:00Z Last Updated: 2024-09-17T00:16:44.456Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in admin.php (aka the login page) in Content Management Made Easy (CMME) before 1.22 allows remote attackers to inject arbitrary web script or HTML via the username field. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/35610 - http://sourceforge.net/project/shownotes.php?release_id=694724 - http://sourceforge.net/tracker/?func=detail&aid=2500186&group_id=215535&atid=1034058
CVE ID: CVE-2009-2343 State: PUBLISHED Published: 2009-07-07T19:00:00Z Last Updated: 2024-09-17T00:56:06.776Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in people.php in Zoph before 0.7.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/35567 - http://www.zoph.org/ - http://secunia.com/advisories/35700 - http://sourceforge.net/project/shownotes.php?release_id=694128 - http://osvdb.org/55554
CVE ID: CVE-2009-2344 State: PUBLISHED Published: 2009-07-07T19:00:00 Last Updated: 2024-08-07T05:44:55.955Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web-based management interfaces in Sourcefire Defense Center (DC) and 3D Sensor before 4.8.2 allow remote authenticated users to gain privileges via a $admin value for the admin parameter in an edit action to admin/user/user.cgi and unspecified other components. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/35658 - http://www.securitytracker.com/id?1022500 - http://www.exploit-db.com/exploits/9074 - http://www.securityfocus.com/archive/1/504694/100/0/threaded - http://www.vu
- http://www.exploit-db.com/exploits/9074 - http://www.securityfocus.com/archive/1/504694/100/0/threaded - http://www.vupen.com/english/advisories/2009/1785 - http://www.securityfocus.com/bid/35553
CVE ID: CVE-2009-2345 State: PUBLISHED Published: 2009-07-07T19:00:00Z Last Updated: 2024-09-16T22:26:19.256Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in ClanSphere before 2009.0.1 allow remote attackers to execute arbitrary SQL commands via unknown parameters to the gbook module and unspecified other components. Additional Analyst Notes: - CVE Program Container: References: - http://www.clansphere.net/index/news/view/id/405/ - http://www.vupen.com/english/advisories/2009/1794 - http://www.securityfocus.com/bid/35576 - http://secunia.com/advisories/35694
CVE ID: CVE-2009-2346 State: PUBLISHED Published: 2009-09-08T18:00:00 Last Updated: 2024-08-07T05:44:55.999Z Vendors: n/a Products: n/a Problem Types: n/a Description: The IAX2 protocol implementation in Asterisk Open Source 1.2.x before 1.2.35, 1.4.x before 1.4.26.2, 1.6.0.x before 1.6.0.15, and 1.6.1.x before 1.6.1.6; Business Edition B.x.x before B.2.5.10, C.2.x before C.2.4.3, and C.3.x before C.3.1.1; and s800i 1.3.x before 1.3.0.3 allows remote attackers to cause a denial of service (call-number exhaustion) by initiating many IAX2 message exchanges, a related issue to CVE-2008-3263. Additional Analyst Notes: - CVE Program Container: References: - http://securitytracker.com/id?1022819 -
CVE-2008-3263. Additional Analyst Notes: - CVE Program Container: References: - http://securitytracker.com/id?1022819 - http://www.securityfocus.com/archive/1/506257/100/0/threaded - http://secunia.com/advisories/36593 - http://www.securityfocus.com/bid/36275 - http://downloads.asterisk.org/pub/security/AST-2009-006.html
CVE ID: CVE-2009-2347 State: PUBLISHED Published: 2009-07-14T20:16:00 Last Updated: 2024-08-07T05:44:55.963Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple integer overflows in inter-color spaces conversion tools in libtiff 3.8 through 3.8.2, 3.9, and 4.0 allow context-dependent attackers to execute arbitrary code via a TIFF image with large (1) width and (2) height values, which triggers a heap-based buffer overflow in the (a) cvt_whole_image function in tiff2rgba and (b) tiffcvt function in rgb2ycbcr. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/35817 - http://secunia.com/advisories/35866 - https://www.redhat.com/archiv
References: - http://secunia.com/advisories/35817 - http://secunia.com/advisories/35866 - https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00663.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-2347 - http://osvdb.org/55821 - https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00724.html - http://www.vupen.com/english/advisories/2009/1870 - http://www.ocert.org/advisories/ocert-2009-012.html - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10988 - http://www.securitytracker.com/id?1022539 - http://www.vupen.com/english/advisories/2011/0621 - http://www.ubuntu.com/usn/USN-801-1 - http://secunia.com/adviso
39 - http://www.vupen.com/english/advisories/2011/0621 - http://www.ubuntu.com/usn/USN-801-1 - http://secunia.com/advisories/35811 - http://secunia.com/advisories/35883 - http://security.gentoo.org/glsa/glsa-201209-02.xml - http://secunia.com/advisories/36194 - http://bugzilla.maptools.org/show_bug.cgi?id=2079 - http://www.securityfocus.com/archive/1/504892/100/0/threaded - http://www.mandriva.com/security/advisories?name=MDVSA-2009:150 - http://security.gentoo.org/glsa/glsa-200908-03.xml - https://exchange.xforce.ibmcloud.com/vulnerabilities/51688 - http://secunia.com/advisories/35911 - http://article.gmane.org/gmane.linux.debian.devel.changes.unstable/178563/ - http://osvdb.org/55822 - htt
sories/35911 - http://article.gmane.org/gmane.linux.debian.devel.changes.unstable/178563/ - http://osvdb.org/55822 - http://www.redhat.com/support/errata/RHSA-2009-1159.html - http://www.securityfocus.com/bid/35652 - http://www.debian.org/security/2009/dsa-1835 - http://www.mandriva.com/security/advisories?name=MDVSA-2011:043 - http://secunia.com/advisories/50726
CVE ID: CVE-2009-2348 State: PUBLISHED Published: 2009-07-17T16:00:00 Last Updated: 2024-08-07T05:44:56.000Z Vendors: n/a Products: n/a Problem Types: n/a Description: Android 1.5 CRBxx allows local users to bypass the (1) Manifest.permission.CAMERA (aka android.permission.CAMERA) and (2) Manifest.permission.AUDIO_RECORD (aka android.permission.RECORD_AUDIO) configuration settings by installing and executing an application that does not make a permission request before using the camera or microphone. Additional Analyst Notes: - CVE Program Container: References: - http://android.git.kernel.org/?p=platform/packages/apps/Camera.git%3Ba=commit%3Bh=e655d54160e5a56d4909f2459eeae9012e9f187f - http
droid.git.kernel.org/?p=platform/packages/apps/Camera.git%3Ba=commit%3Bh=e655d54160e5a56d4909f2459eeae9012e9f187f - http://android.git.kernel.org/?p=platform/frameworks/base.git%3Ba=commit%3Bh=7b7225c8fdbead25235c74811b30ff4ee690dc58 - https://exchange.xforce.ibmcloud.com/vulnerabilities/51798 - http://www.securityfocus.com/archive/1/505012/100/0/threaded - http://www.openwall.com/lists/oss-security/2009/07/16/4 - http://www.securityfocus.com/bid/35717 - http://android.git.kernel.org/?p=platform/frameworks/base.git%3Ba=commit%3Bh=4d8adefd35efdea849611b8b02d61f9517e47760 - http://www.ocert.org/advisories/ocert-2009-011.html
CVE ID: CVE-2009-2350 State: PUBLISHED Published: 2009-07-07T23:00:00 Last Updated: 2024-08-07T05:44:55.941Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Internet Explorer 6.0.2900.2180 and earlier does not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header or (2) specifying the content of a Refresh header, a related issue to CVE-2009-1312. Additional Analyst Notes: - CVE Program Container: References: - http://websecurity.com.ua/3386/ - http://websecurity.com.ua/3275/ - http://www.securityfocus.com/archive/1/504723/100/0/threaded
ebsecurity.com.ua/3386/ - http://websecurity.com.ua/3275/ - http://www.securityfocus.com/archive/1/504723/100/0/threaded - http://www.securityfocus.com/archive/1/504718/100/0/threaded - http://www.securityfocus.com/bid/35570
CVE ID: CVE-2009-2351 State: PUBLISHED Published: 2009-07-07T23:00:00 Last Updated: 2024-08-07T05:44:55.960Z Vendors: n/a Products: n/a Problem Types: n/a Description: Opera 9.52 and earlier does not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header or (2) specifying the content of a Refresh header, a related issue to CVE-2009-1312. NOTE: it was later reported that 10.00 Beta 3 Build 1699 is also affected. Additional Analyst Notes: - CVE Program Container: References: - http://websecurity.com.ua/3386/ - http://websecurity.com.ua/3275/ - http://www.secur
VE Program Container: References: - http://websecurity.com.ua/3386/ - http://websecurity.com.ua/3275/ - http://www.securityfocus.com/archive/1/504723/100/0/threaded - http://www.securityfocus.com/archive/1/504718/100/0/threaded - http://www.securityfocus.com/bid/35571
CVE ID: CVE-2009-2352 State: PUBLISHED Published: 2009-07-07T23:00:00 Last Updated: 2024-08-07T05:44:55.978Z Vendors: n/a Products: n/a Problem Types: n/a Description: Google Chrome 1.0.154.48 and earlier does not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header or (2) specifying the content of a Refresh header, a related issue to CVE-2009-1312. NOTE: it was later reported that 2.0.172.28, 2.0.172.37, and 3.0.193.2 Beta are also affected. Additional Analyst Notes: - CVE Program Container: References: - http://websecurity.com.ua/3386/ - http://www.secur
ted. Additional Analyst Notes: - CVE Program Container: References: - http://websecurity.com.ua/3386/ - http://www.securityfocus.com/bid/35572 - http://websecurity.com.ua/3275/ - http://www.securityfocus.com/archive/1/504723/100/0/threaded - http://www.securityfocus.com/archive/1/504718/100/0/threaded
CVE ID: CVE-2009-2353 State: PUBLISHED Published: 2009-07-07T23:00:00 Last Updated: 2024-08-07T05:44:56.038Z Vendors: n/a Products: n/a Problem Types: n/a Description: encoder.php in eAccelerator allows remote attackers to execute arbitrary code by copying a local executable file to a location under the web root via the -o option, and then making a direct request to this file, related to upload of image files. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/504695/100/0/threaded - http://www.mandriva.com/security/advisories?name=MDVSA-2009:188
CVE ID: CVE-2009-2354 State: PUBLISHED Published: 2009-07-07T23:00:00 Last Updated: 2024-08-07T05:44:55.961Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the auth_checkpass function in the login page in NullLogic Groupware 1.2.7 allows remote attackers to execute arbitrary SQL commands via the username parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2009/1817 - http://www.nth-dimension.org.uk/utils/get.php?downloadsid=55 - http://www.securityfocus.com/archive/1/504737/100/0/threaded
CVE ID: CVE-2009-2355 State: PUBLISHED Published: 2009-07-07T23:00:00 Last Updated: 2024-08-07T05:44:55.935Z Vendors: n/a Products: n/a Problem Types: n/a Description: The forum module in NullLogic Groupware 1.2.7 allows remote authenticated users to cause a denial of service (application crash) by specifying (1) an empty string or (2) a non-numeric string when selecting a forum, related to the fmessagelist function. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2009/1817 - http://www.nth-dimension.org.uk/utils/get.php?downloadsid=55 - http://www.securityfocus.com/archive/1/504737/100/0/threaded
CVE ID: CVE-2009-2356 State: PUBLISHED Published: 2009-07-07T23:00:00 Last Updated: 2024-08-07T05:44:56.042Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple stack-based buffer overflows in the pgsqlQuery function in NullLogic Groupware 1.2.7, when PostgreSQL is used, might allow remote attackers to execute arbitrary code via input to the (1) POP3, (2) SMTP, or (3) web component that triggers a long SQL query. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2009/1817 - http://www.nth-dimension.org.uk/utils/get.php?downloadsid=55 - http://www.securityfocus.com/archive/1/504737/100/0/threaded
CVE ID: CVE-2009-2357 State: PUBLISHED Published: 2009-07-07T23:00:00 Last Updated: 2024-08-07T05:44:56.093Z Vendors: n/a Products: n/a Problem Types: n/a Description: The default configuration of TekRADIUS 3.0 uses the sa account to communicate with Microsoft SQL Server, which makes it easier for remote attackers to obtain privileged access to the database and the underlying Windows operating system. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2009/1816 - http://www.securityfocus.com/archive/1/504740/100/0/threaded - http://www.nth-dimension.org.uk/utils/get.php?downloadsid=56
CVE ID: CVE-2009-2358 State: PUBLISHED Published: 2009-07-07T23:00:00 Last Updated: 2024-08-07T05:44:56.073Z Vendors: n/a Products: n/a Problem Types: n/a Description: TekRADIUS 3.0 uses BUILTIN\Users:R permissions for the TekRADIUS.ini file, which allows local users to obtain obfuscated database credentials by reading this file. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2009/1816 - http://www.securityfocus.com/archive/1/504740/100/0/threaded - http://www.nth-dimension.org.uk/utils/get.php?downloadsid=56
CVE ID: CVE-2009-2359 State: PUBLISHED Published: 2009-07-07T23:00:00 Last Updated: 2024-08-07T05:44:55.961Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in TekRADIUS 3.0 allow context-dependent attackers to execute arbitrary SQL commands via (1) the GUI client, as demonstrated by input to the Browse Users text box in the Users tab; or (2) the command-line client, as demonstrated by a certain trcli -r command. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2009/1816 - http://www.securityfocus.com/archive/1/504740/100/0/threaded - http://www.nth-dimension.org.uk/utils/get.php?downloa
6 - http://www.securityfocus.com/archive/1/504740/100/0/threaded - http://www.nth-dimension.org.uk/utils/get.php?downloadsid=56
CVE ID: CVE-2009-2360 State: PUBLISHED Published: 2009-07-08T15:00:00 Last Updated: 2024-08-07T05:44:56.087Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in passwd/main.php in the Passwd module before 3.1.1 for Horde allows remote attackers to inject arbitrary web script or HTML via the backend parameter. Additional Analyst Notes: - CVE Program Container: References: - http://bugs.horde.org/ticket/8398 - http://www.vupen.com/english/advisories/2009/1784 - http://secunia.com/advisories/35769 - http://secunia.com/advisories/35720 - http://www.securityfocus.com/bid/35573 - http://www.debian.org/security/2009/dsa-1829 - http://lists.horde.or
es/35720 - http://www.securityfocus.com/bid/35573 - http://www.debian.org/security/2009/dsa-1829 - http://lists.horde.org/archives/announce/2009/000507.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/51542
CVE ID: CVE-2009-2361 State: PUBLISHED Published: 2009-07-08T15:00:00 Last Updated: 2024-08-07T05:44:56.073Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in include/class.staff.php in osTicket before 1.6 RC5 allows remote attackers to execute arbitrary SQL commands via the staff username parameter. Additional Analyst Notes: - CVE Program Container: References: - http://osticket.com/forums/project.php?issueid=118 - http://www.osvdb.org/55472 - http://www.exploit-db.com/exploits/9032 - http://www.securityfocus.com/archive/1/504615/100/0/threaded - http://www.ngenuity.org/wordpress/2009/06/26/osticket-admin-login-blind-sql-injection/ - http://www.securi
/0/threaded - http://www.ngenuity.org/wordpress/2009/06/26/osticket-admin-login-blind-sql-injection/ - http://www.securityfocus.com/bid/35516 - https://exchange.xforce.ibmcloud.com/vulnerabilities/51417 - http://www.securitytracker.com/id?1022480 - http://www.vupen.com/english/advisories/2009/1726 - http://secunia.com/advisories/35629
CVE ID: CVE-2009-2362 State: PUBLISHED Published: 2009-07-08T15:00:00 Last Updated: 2024-08-07T05:44:56.012Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in KUDRSOFT AudioPLUS 2.0.0.215 allows remote attackers to execute arbitrary code via a long string in a (1) .lst or (2) .m3u playlist file. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/9064 - http://packetstormsecurity.org/0907-exploits/audioplus-overflow.txt - http://osvdb.org/55528 - https://exchange.xforce.ibmcloud.com/vulnerabilities/51484 - http://secunia.com/advisories/35673 - http://www.vupen.com/english/advisories/2009/1764
CVE ID: CVE-2009-2363 State: PUBLISHED Published: 2009-07-08T15:00:00 Last Updated: 2024-08-07T05:44:56.091Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in KUDRSOFT AudioPLUS 2.00.215 allows remote attackers to execute arbitrary code via a .pls playlist file with a playlist entry containing a long File1 argument. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.org/0907-exploits/audiopluspls-overflow.txt - http://www.exploit-db.com/exploits/9070 - https://exchange.xforce.ibmcloud.com/vulnerabilities/51485
CVE ID: CVE-2009-2364 State: PUBLISHED Published: 2009-07-08T15:00:00 Last Updated: 2024-08-07T05:44:56.086Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in Mp3-Nator 2.0 allows remote attackers to execute arbitrary code via (1) a long string in a .plf file and (2) a long string in the listdata.dat file, possibly related to a track entry. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2009/1765 - https://exchange.xforce.ibmcloud.com/vulnerabilities/51486 - http://www.exploit-db.com/exploits/9136 - http://www.exploit-db.com/exploits/9060
CVE ID: CVE-2009-2365 State: PUBLISHED Published: 2009-07-08T15:00:00 Last Updated: 2024-08-07T05:44:56.043Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in login.asp in DataCheck Solutions GalleryPal FE 1.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/55471 - https://exchange.xforce.ibmcloud.com/vulnerabilities/51403 - http://secunia.com/advisories/35626
CVE ID: CVE-2009-2366 State: PUBLISHED Published: 2009-07-08T15:00:00 Last Updated: 2024-08-07T05:44:56.098Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in login.asp in DataCheck Solutions ForumPal FE 1.1 and ForumPal 1.5 allows remote attackers to execute arbitrary SQL commands via the (1) password parameter in 1.1 and (2) p_password parameter in 1.5. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/55497 - https://exchange.xforce.ibmcloud.com/vulnerabilities/51403 - http://secunia.com/advisories/35603 - http://www.osvdb.org/55496 - http://ww
xforce.ibmcloud.com/vulnerabilities/51403 - http://secunia.com/advisories/35603 - http://www.osvdb.org/55496 - http://www.exploit-db.com/exploits/9024 - http://secunia.com/advisories/35589
CVE ID: CVE-2009-2367 State: PUBLISHED Published: 2009-07-08T15:00:00 Last Updated: 2024-08-07T05:44:56.089Z Vendors: n/a Products: n/a Problem Types: n/a Description: cgi-bin/makecgi-pro in Iomega StorCenter Pro generates predictable session IDs, which allows remote attackers to hijack active sessions and gain privileges via brute force guessing attacks on the session_id parameter. Additional Analyst Notes: - CVE Program Container: References: - http://trac.metasploit.com/browser/framework3/trunk/modules/auxiliary/admin/http/iomega_storcenterpro_sessionid.rb?rev=6733 - http://osvdb.org/55586 - http://secunia.com/advisories/35666 - https://exchange.xforce.ibmcloud.com/vulnerabilities/51539