Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2009-4497 State: PUBLISHED Published: 2010-01-07T19:00:00Z Last Updated: 2024-09-16T19:31:55.241Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in LXR Cross Referencer 0.9.5 and 0.9.6 allows remote attackers to inject arbitrary web script or HTML via the i parameter to the ident program. Additional Analyst Notes: - CVE Program Container: References: - http://sourceforge.net/mailarchive/message.php?msg_name=E1NS2s4-0001PE-F2%403bkjzd1.ch3.sourceforge.com - http://secunia.com/advisories/38117
CVE ID: CVE-2009-4498 State: PUBLISHED Published: 2009-12-31T18:00:00 Last Updated: 2024-08-07T07:08:36.847Z Vendors: n/a Products: n/a Problem Types: n/a Description: The node_process_command function in Zabbix Server before 1.8 allows remote attackers to execute arbitrary commands via a crafted request. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/508436/30/60/threaded - https://support.zabbix.com/browse/ZBX-1030 - http://www.openwall.com/lists/oss-security/2010/04/02/1 - http://secunia.com/advisories/37740 - http://www.vupen.com/english/advisories/2009/3514
CVE ID: CVE-2009-4499 State: PUBLISHED Published: 2009-12-31T18:00:00Z Last Updated: 2024-09-16T19:46:23.353Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the get_history_lastid function in the nodewatcher component in Zabbix Server before 1.6.8 allows remote attackers to execute arbitrary SQL commands via a crafted request, possibly related to the send_history_last_id function in zabbix_server/trapper/nodehistory.c. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/508436/30/60/threaded - https://support.zabbix.com/browse/ZBX-1031 - http://secunia.com/advisories/37740 - http://www.vupen.com/en
60/threaded - https://support.zabbix.com/browse/ZBX-1031 - http://secunia.com/advisories/37740 - http://www.vupen.com/english/advisories/2009/3514
CVE ID: CVE-2009-4500 State: PUBLISHED Published: 2009-12-31T18:00:00Z Last Updated: 2024-09-17T01:56:19.933Z Vendors: n/a Products: n/a Problem Types: n/a Description: The process_trap function in trapper/trapper.c in Zabbix Server before 1.6.6 allows remote attackers to cause a denial of service (crash) via a crafted request with data that lacks an expected : (colon) separator, which triggers a NULL pointer dereference. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/508436/30/60/threaded - https://support.zabbix.com/browse/ZBX-993 - http://secunia.com/advisories/37740 - http://www.vupen.com/english/advisories/2009/3514
CVE ID: CVE-2009-4501 State: PUBLISHED Published: 2009-12-31T18:00:00Z Last Updated: 2024-09-17T01:37:01.050Z Vendors: n/a Products: n/a Problem Types: n/a Description: The zbx_get_next_field function in libs/zbxcommon/str.c in Zabbix Server before 1.6.8 allows remote attackers to cause a denial of service (crash) via a request that lacks expected separators, which triggers a NULL pointer dereference, as demonstrated using the Command keyword. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/508436/30/60/threaded - https://support.zabbix.com/browse/ZBX-1355 - http://secunia.com/advisories/37740 - http://www.vupen.com/english/advisories/2
s://support.zabbix.com/browse/ZBX-1355 - http://secunia.com/advisories/37740 - http://www.vupen.com/english/advisories/2009/3514
CVE ID: CVE-2009-4502 State: PUBLISHED Published: 2009-12-31T18:00:00Z Last Updated: 2024-09-17T00:05:31.046Z Vendors: n/a Products: n/a Problem Types: n/a Description: The NET_TCP_LISTEN function in net.c in Zabbix Agent before 1.6.7, when running on FreeBSD or Solaris, allows remote attackers to bypass the EnableRemoteCommands setting and execute arbitrary commands via shell metacharacters in the argument to net.tcp.listen. NOTE: this attack is limited to attacks from trusted IP addresses. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/508439 - https://support.zabbix.com/browse/ZBX-1032 - http://secunia.com/advisories/37740 - http://
yfocus.com/archive/1/508439 - https://support.zabbix.com/browse/ZBX-1032 - http://secunia.com/advisories/37740 - http://www.vupen.com/english/advisories/2009/3514
CVE ID: CVE-2009-4505 State: PUBLISHED Published: 2010-03-26T18:00:00 Last Updated: 2024-08-07T07:08:36.693Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in OpenCMS OAMP Comments Module 1.0.1 allow remote attackers to inject arbitrary web script or HTML via the name field in a comment, and other unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.csnc.ch/misc/files/advisories/CVE-2009-4505_opencms_oamp_comments_module_xss_cyrill_brunschwiler.txt - http://www.securityfocus.com/bid/38926 - http://secunia.com/advisories/39099 - http://www.securityfocus.com/archive/1/510291/100/0/thread
tyfocus.com/bid/38926 - http://secunia.com/advisories/39099 - http://www.securityfocus.com/archive/1/510291/100/0/threaded
CVE ID: CVE-2009-4509 State: PUBLISHED Published: 2010-04-13T17:00:00 Last Updated: 2024-08-07T07:08:36.779Z Vendors: n/a Products: n/a Problem Types: n/a Description: The administrative web console on the TANDBERG Video Communication Server (VCS) before X4.3 uses predictable session cookies in (1) tandberg/web/lib/secure.php and (2) tandberg/web/user/lib/secure.php, which makes it easier for remote attackers to bypass authentication, and execute arbitrary code by loading a custom software update, via a crafted "Cookie: tandberg_login=" HTTP header. Additional Analyst Notes: - CVE Program Container: References: - http://ftp.tandberg.com/pub/software/vcs/TANDBERG%20Video%20Communication%20Ser
: - CVE Program Container: References: - http://ftp.tandberg.com/pub/software/vcs/TANDBERG%20Video%20Communication%20Server%20Software%20Release%20Notes%20%28X4%29.pdf - http://www.vsecurity.com/resources/advisory/20100409-1 - http://secunia.com/advisories/39275 - http://www.securityfocus.com/archive/1/510672/100/0/threaded
CVE ID: CVE-2009-4510 State: PUBLISHED Published: 2010-04-13T17:00:00Z Last Updated: 2024-09-16T17:33:35.477Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SSH service on the TANDBERG Video Communication Server (VCS) before X5.1 uses a fixed DSA key, which makes it easier for remote attackers to conduct man-in-the-middle attacks and spoof arbitrary servers via crafted SSH packets. Additional Analyst Notes: - CVE Program Container: References: - http://ftp.tandberg.com/pub/software/vcs/TANDBERG%20Video%20Communication%20Server%20Software%20Release%20Notes%20%28X5%29.pdf - http://www.vsecurity.com/resources/advisory/20100409-2 - http://secunia.com/advisories/39275
CVE ID: CVE-2009-4511 State: PUBLISHED Published: 2010-04-13T17:00:00 Last Updated: 2024-08-07T07:08:36.845Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple directory traversal vulnerabilities in the web administration interface on the TANDBERG Video Communication Server (VCS) before X5.1 allow remote authenticated users to read arbitrary files via a .. (dot dot) in the page parameter to (1) helppage.php or (2) user/helppage.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.vsecurity.com/resources/advisory/20100409-3 - http://www.securityfocus.com/archive/1/510670/100/0/threaded - http://secunia.com/advisories/39275
CVE ID: CVE-2009-4512 State: PUBLISHED Published: 2009-12-31T19:00:00 Last Updated: 2024-08-07T07:08:38.387Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in index.php in Oscailt 3.3, when Use Friendly URL's is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the obj_id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/54023 - http://securityreason.com/exploitalert/7422 - http://packetstormsecurity.org/0910-exploits/oscailt33-lfi.txt - http://www.vupen.com/english/advisories/2009/3096 - http://secunia.com/advisories/
org/0910-exploits/oscailt33-lfi.txt - http://www.vupen.com/english/advisories/2009/3096 - http://secunia.com/advisories/37180
CVE ID: CVE-2009-4513 State: PUBLISHED Published: 2009-12-31T19:00:00 Last Updated: 2024-08-07T07:08:38.151Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the Workflow module 5.x before 5.x-2.4 and 6.x before 6.x-1.2, a module for Drupal, allow remote authenticated users, with "administer workflow" privileges, to inject arbitrary web script or HTML via the name of a (1) workflow or (2) workflow state. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/54028 - http://www.securityfocus.com/bid/36878 - http://drupal.org/node/612834 - http://drupal.org/node/61283
rabilities/54028 - http://www.securityfocus.com/bid/36878 - http://drupal.org/node/612834 - http://drupal.org/node/612832 - http://drupal.org/node/617456 - http://www.vupen.com/english/advisories/2009/3089 - http://secunia.com/advisories/37203
CVE ID: CVE-2009-4514 State: PUBLISHED Published: 2009-12-31T19:00:00Z Last Updated: 2024-09-16T19:47:25.762Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the OpenSocial Shindig-Integrator module 5.x and 6.x before 6.x-2.1, a module for Drupal, allows remote authenticated users, with "create application" privileges, to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/37200 - http://drupal.org/node/617422 - http://www.securityfocus.com/bid/36862 - http://drupal.org/node/615584 - http://www.vupen.com/english/advisories/2009/3087
CVE ID: CVE-2009-4515 State: PUBLISHED Published: 2009-12-31T19:00:00Z Last Updated: 2024-09-17T03:22:46.291Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Storm module 6.x before 6.x-1.25 for Drupal does not enforce privilege requirements for storminvoiceitem nodes, which allows remote attackers to read node titles via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/37202 - http://drupal.org/node/617480 - http://drupal.org/node/617494 - http://www.vupen.com/english/advisories/2009/3090 - http://www.securityfocus.com/bid/36879
CVE ID: CVE-2009-4516 State: PUBLISHED Published: 2009-12-31T19:00:00Z Last Updated: 2024-09-17T03:03:36.818Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the FAQ Ask module 5.x and 6.x before 6.x-2.0, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://drupal.org/node/617444 - http://secunia.com/advisories/37201 - http://www.vupen.com/english/advisories/2009/3088 - http://www.securityfocus.com/bid/36877
CVE ID: CVE-2009-4517 State: PUBLISHED Published: 2009-12-31T19:00:00Z Last Updated: 2024-09-16T23:10:48.439Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the FAQ Ask module 5.x and 6.x before 6.x-2.0, a module for Drupal, allows remote attackers to hijack the authentication of arbitrary users for requests that access unpublished content. Additional Analyst Notes: - CVE Program Container: References: - http://drupal.org/node/617444 - http://secunia.com/advisories/37201 - http://www.vupen.com/english/advisories/2009/3088
CVE ID: CVE-2009-4518 State: PUBLISHED Published: 2009-12-31T19:00:00Z Last Updated: 2024-09-17T03:14:00.357Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Insert Node module 5.x before 5.x-1.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via an inserted node. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2009/3086 - http://secunia.com/advisories/37199 - http://drupal.org/node/617400 - http://drupal.org/node/616546 - http://www.securityfocus.com/bid/36861
CVE ID: CVE-2009-4519 State: PUBLISHED Published: 2009-12-31T19:00:00 Last Updated: 2024-08-07T07:08:38.041Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple unspecified vulnerabilities in Ortro before 1.3.4 have unknown impact and attack vectors. Additional Analyst Notes: - CVE Program Container: References: - http://dev.ortro.net/news/show/8 - https://exchange.xforce.ibmcloud.com/vulnerabilities/54026 - http://www.vupen.com/english/advisories/2009/3057 - http://www.ortro.net/
CVE ID: CVE-2009-4520 State: PUBLISHED Published: 2009-12-31T19:00:00Z Last Updated: 2024-09-16T22:01:44.558Z Vendors: n/a Products: n/a Problem Types: n/a Description: The CCK Comment Reference module 5.x before 5.x-1.2 and 6.x before 6.x-1.3, a module for Drupal, allows remote attackers to bypass intended access restrictions and read comments by using the autocomplete path. Additional Analyst Notes: - CVE Program Container: References: - http://drupal.org/node/617380 - http://www.vupen.com/english/advisories/2009/3084 - http://www.securityfocus.com/bid/36863 - http://secunia.com/advisories/37206
CVE ID: CVE-2009-4521 State: PUBLISHED Published: 2009-12-31T19:00:00 Last Updated: 2024-08-07T07:08:38.122Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in birt-viewer/run in Eclipse Business Intelligence and Reporting Tools (BIRT) before 2.5.0, as used in KonaKart and other products, allows remote attackers to inject arbitrary web script or HTML via the __report parameter. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.eclipse.org/bugs/show_bug.cgi?id=259127 - http://www.securityfocus.com/archive/1/507172/100/0/threaded - http://secunia.com/advisories/37025 - https://exchange.xforce.ibmcloud.com/vulnerabi
m/archive/1/507172/100/0/threaded - http://secunia.com/advisories/37025 - https://exchange.xforce.ibmcloud.com/vulnerabilities/53773 - http://antisnatchor.com/2008/12/18/eclipse-birt-reflected-xss - http://www.securityfocus.com/bid/36674 - http://www.osvdb.org/58941
CVE ID: CVE-2009-4522 State: PUBLISHED Published: 2009-12-31T19:00:00 Last Updated: 2024-08-07T07:08:37.947Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in search.5.html in BloofoxCMS 0.3.5 allows remote attackers to inject arbitrary web script or HTML via the search parameter to index.php. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/36700 - http://osvdb.org/58948 - https://exchange.xforce.ibmcloud.com/vulnerabilities/53788 - http://secunia.com/advisories/37020 - http://packetstormsecurity.org/0910-exploits/bloofo
ud.com/vulnerabilities/53788 - http://secunia.com/advisories/37020 - http://packetstormsecurity.org/0910-exploits/bloofoxcms-xss.txt
CVE ID: CVE-2009-4523 State: PUBLISHED Published: 2009-12-31T19:00:00 Last Updated: 2024-08-07T07:08:38.107Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in index.php in Zainu 1.0 allows remote attackers to inject arbitrary web script or HTML via the searchSongKeyword parameter in a SearchSong action. Additional Analyst Notes: - CVE Program Container: References: - http://www.packetstormsecurity.org/0910-exploits/zainu-xss.txt - http://secunia.com/advisories/36798 - https://exchange.xforce.ibmcloud.com/vulnerabilities/53790 - http://www.securityfocus.com/bid/36701
CVE ID: CVE-2009-4524 State: PUBLISHED Published: 2009-12-31T19:00:00 Last Updated: 2024-08-07T07:08:37.950Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the RealName module 6.x-1.x before 6.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via a realname (aka real name) element. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/36699 - http://secunia.com/advisories/37058 - http://www.vupen.com/english/advisories/2009/2921 - http://osvdb.org/58944 - http://drupal.org/node/604760 - https://exchange.xforce.ibmcloud.com/vulnerabilities/53787
CVE ID: CVE-2009-4525 State: PUBLISHED Published: 2009-12-31T19:00:00 Last Updated: 2024-08-07T07:08:38.277Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Print (aka Printer, e-mail and PDF versions) module 5.x before 5.x-4.9 and 6.x before 6.x-1.9, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via crafted data in a list of links. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2009/2922 - https://exchange.xforce.ibmcloud.com/vulnerabilities/53789 - http://drupal.org/node/604806 - http://secunia.com/advisories/37059 - http://drupal.org/no
d.com/vulnerabilities/53789 - http://drupal.org/node/604806 - http://secunia.com/advisories/37059 - http://drupal.org/node/604808 - http://drupal.org/node/604804 - http://osvdb.org/58952 - http://www.securityfocus.com/bid/36707
CVE ID: CVE-2009-4526 State: PUBLISHED Published: 2009-12-31T19:00:00Z Last Updated: 2024-09-16T16:52:49.999Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Send by e-mail sub-module in the Print (aka Printer, e-mail and PDF versions) module 5.x before 5.x-4.9 and 6.x before 6.x-1.9, a module for Drupal, does not properly enforce privilege requirements, which allows remote attackers to read page titles by requesting a "Send to friend" form. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2009/2922 - http://drupal.org/node/604806 - http://osvdb.org/58951 - http://secunia.com/advisories/37059 - http://drupal.org/node/6048
tp://drupal.org/node/604806 - http://osvdb.org/58951 - http://secunia.com/advisories/37059 - http://drupal.org/node/604808 - http://drupal.org/node/604804 - http://www.securityfocus.com/bid/36707
CVE ID: CVE-2009-4527 State: PUBLISHED Published: 2009-12-31T19:00:00 Last Updated: 2024-08-07T07:08:38.075Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Shibboleth authentication module 5.x before 5.x-3.4 and 6.x before 6.x-3.2, a module for Drupal, does not properly remove statically granted privileges after a logout or other session change, which allows physically proximate attackers to gain privileges by using an unattended web browser. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/36684 - http://secunia.com/advisories/37057 - https://exchange.xforce.ibmcloud.com/vulnerabilities/53779 - http://drupal.org/node/604488 -
nia.com/advisories/37057 - https://exchange.xforce.ibmcloud.com/vulnerabilities/53779 - http://drupal.org/node/604488 - http://www.vupen.com/english/advisories/2009/2919
CVE ID: CVE-2009-4528 State: PUBLISHED Published: 2009-12-31T19:00:00 Last Updated: 2024-08-07T07:08:38.135Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Organic Groups (OG) Vocabulary module 6.x before 6.x-1.0 for Drupal allows remote authenticated group members to bypass intended access restrictions, and create, modify, or read a vocabulary, via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2009/2920 - http://drupal.org/node/604354 - http://www.securityfocus.com/bid/36685 - http://osvdb.org/58947 - http://drupal.org/node/604514 - https://exchange.xforce.ibmcloud.com/vulnerabilities/53780 - htt
ttp://osvdb.org/58947 - http://drupal.org/node/604514 - https://exchange.xforce.ibmcloud.com/vulnerabilities/53780 - http://secunia.com/advisories/37060
CVE ID: CVE-2009-4529 State: PUBLISHED Published: 2009-12-31T19:00:00 Last Updated: 2024-08-07T07:08:37.936Z Vendors: n/a Products: n/a Problem Types: n/a Description: InterVations NaviCOPA Web Server 3.0.1.2 and earlier allows remote attackers to obtain the source code for a web page via a trailing encoded space character in a URI, as demonstrated by /index.html%20 and /index.php%20 URIs. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/37014 - http://www.vupen.com/english/advisories/2009/2927 - http://pocoftheday.blogspot.com/2009/10/navicopa-web-server-3012-remote-source.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/53799 - http:
2009/10/navicopa-web-server-3012-remote-source.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/53799 - http://www.packetstormsecurity.org/0910-exploits/navicopa-disclose.txt - http://freetexthost.com/n5l0h34pxc - http://www.securityfocus.com/bid/36705 - http://osvdb.org/58949
CVE ID: CVE-2009-4530 State: PUBLISHED Published: 2009-12-31T19:00:00Z Last Updated: 2024-09-16T19:47:26.735Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mongoose 2.8.0 and earlier allows remote attackers to obtain the source code for a web page by appending ::$DATA to the URI. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/36934 - http://packetstormsecurity.org/0910-exploits/mongoose-disclose.txt
CVE ID: CVE-2009-4531 State: PUBLISHED Published: 2009-12-31T19:00:00 Last Updated: 2024-08-07T07:08:38.094Z Vendors: n/a Products: n/a Problem Types: n/a Description: httpdx 1.4.4 and earlier allows remote attackers to obtain the source code for a web page by appending a . (dot) character to the URI. Additional Analyst Notes: - CVE Program Container: References: - http://freetexthost.com/eiyfyt0km5 - http://www.osvdb.org/58857 - https://exchange.xforce.ibmcloud.com/vulnerabilities/53733 - http://packetstormsecurity.org/0910-exploits/httpdx-disclose.txt - http://secunia.com/advisories/37013 - http://pocoftheday.blogspot.com/2009/10/httpdx-144-remote-arbitrary-source.html
CVE ID: CVE-2009-4532 State: PUBLISHED Published: 2009-12-31T19:00:00 Last Updated: 2024-08-07T07:08:37.969Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Webform module 5.x before 5.x-2.8 and 6.x before 6.x-2.8, a module for Drupal, allows remote authenticated users, with webform creation privileges, to inject arbitrary web script or HTML via a field label. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/36708 - http://secunia.com/advisories/37021 - http://osvdb.org/58945 - http://www.vupen.com/english/advisories/2009/2923 - https://exchange.xforce.ibmcloud.com/vulnerabilities/5379
rg/58945 - http://www.vupen.com/english/advisories/2009/2923 - https://exchange.xforce.ibmcloud.com/vulnerabilities/53796 - http://drupal.org/node/604942
CVE ID: CVE-2009-4533 State: PUBLISHED Published: 2009-12-31T19:00:00 Last Updated: 2024-08-07T07:08:37.982Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Webform module 5.x before 5.x-2.8 and 6.x before 6.x-2.8, a module for Drupal, does not prevent caching of a page that contains token placeholders for a default value, which allows remote attackers to read session variables via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/36708 - http://secunia.com/advisories/37021 - http://www.vupen.com/english/advisories/2009/2923 - http://drupal.org/node/604920 - http://drupal.org/node/604942 - http://drupal.org/n
n.com/english/advisories/2009/2923 - http://drupal.org/node/604920 - http://drupal.org/node/604942 - http://drupal.org/node/604922 - http://osvdb.org/58946 - https://exchange.xforce.ibmcloud.com/vulnerabilities/53797