Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2009-4440 State: PUBLISHED Published: 2009-12-28T19:00:00 Last Updated: 2024-08-07T07:01:20.710Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Proxy Server (DPS) in Sun Java System Directory Server Enterprise Edition 6.0 through 6.3.1 does not properly handle multiple client connections within a short time window, which allows remote attackers to hijack the backend connection of an authenticated user, and obtain the privileges of this user, by making a client connection in opportunistic circumstances, related to "long binds," aka Bug Ids 6828462 and 6823593. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/adviso
828462 and 6823593. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2009/3647 - http://sunsolve.sun.com/search/document.do?assetkey=1-21-141958-01-1 - http://www.securityfocus.com/bid/37481 - http://www.securitytracker.com/id?1023389 - http://sunsolve.sun.com/search/document.do?assetkey=1-66-270789-1 - http://secunia.com/advisories/37915
CVE ID: CVE-2009-4441 State: PUBLISHED Published: 2009-12-28T19:00:00 Last Updated: 2024-08-07T07:01:20.623Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Proxy Server (DPS) in Sun Java System Directory Server Enterprise Edition 6.0 through 6.3.1 does not enable the SO_KEEPALIVE socket option, which makes it easier for remote attackers to cause a denial of service (connection slot exhaustion) via multiple connections, aka Bug Id 6782659. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2009/3647 - http://sunsolve.sun.com/search/document.do?assetkey=1-21-141958-01-1 - http://www.securityfocus.com/bid/37481 - http:/
- http://sunsolve.sun.com/search/document.do?assetkey=1-21-141958-01-1 - http://www.securityfocus.com/bid/37481 - http://www.securitytracker.com/id?1023389 - http://sunsolve.sun.com/search/document.do?assetkey=1-66-270789-1 - http://secunia.com/advisories/37915
CVE ID: CVE-2009-4442 State: PUBLISHED Published: 2009-12-28T19:00:00 Last Updated: 2024-08-07T07:01:20.273Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Proxy Server (DPS) in Sun Java System Directory Server Enterprise Edition 6.0 through 6.3.1 does not properly implement the max-client-connections configuration setting, which allows remote attackers to cause a denial of service (connection slot exhaustion) by making multiple connections and performing no operations on these connections, aka Bug Id 6648665. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2009/3647 - http://sunsolve.sun.com/search/document.do?as
ntainer: References: - http://www.vupen.com/english/advisories/2009/3647 - http://sunsolve.sun.com/search/document.do?assetkey=1-21-141958-01-1 - http://www.securityfocus.com/bid/37481 - http://www.securitytracker.com/id?1023389 - http://sunsolve.sun.com/search/document.do?assetkey=1-66-270789-1 - http://secunia.com/advisories/37915
CVE ID: CVE-2009-4443 State: PUBLISHED Published: 2009-12-28T19:00:00 Last Updated: 2024-08-07T07:01:20.398Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in the psearch (aka persistent search) functionality in Directory Proxy Server (DPS) in Sun Java System Directory Server Enterprise Edition 6.0 through 6.3.1 allows remote attackers to cause a denial of service (psearch outage) by using a crafted psearch client to send requests that trigger a psearch thread loop, aka Bug Id 6855978. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2009/3647 - http://sunsolve.sun.com/search/document.do?assetkey=1-
References: - http://www.vupen.com/english/advisories/2009/3647 - http://sunsolve.sun.com/search/document.do?assetkey=1-21-141958-01-1 - http://www.securityfocus.com/bid/37481 - http://www.securitytracker.com/id?1023389 - http://sunsolve.sun.com/search/document.do?assetkey=1-66-270789-1 - http://secunia.com/advisories/37915
CVE ID: CVE-2009-4444 State: PUBLISHED Published: 2009-12-29T19:00:00Z Last Updated: 2024-09-16T18:12:47.226Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Internet Information Services (IIS) 5.x and 6.x uses only the portion of a filename before a ; (semicolon) character to determine the file extension, which allows remote attackers to bypass intended extension restrictions of third-party upload applications via a filename with a (1) .asp, (2) .cer, or (3) .asa first extension, followed by a semicolon and a safe extension, as demonstrated by the use of asp.dll to handle a .asp;.jpg file. Additional Analyst Notes: - CVE Program Container: References: - http://www.secur
of asp.dll to handle a .asp;.jpg file. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/37460 - http://securitytracker.com/id?1023387 - http://blogs.technet.com/msrc/archive/2009/12/27/new-reports-of-a-vulnerability-in-iis.aspx - http://secunia.com/advisories/37831 - http://soroush.secproject.com/downloadable/iis-semicolon-report.pdf - http://www.vupen.com/english/advisories/2009/3634
CVE ID: CVE-2009-4445 State: PUBLISHED Published: 2009-12-29T19:00:00 Last Updated: 2024-08-07T07:01:20.343Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Internet Information Services (IIS), when used in conjunction with unspecified third-party upload applications, allows remote attackers to create empty files with arbitrary extensions via a filename containing an initial extension followed by a : (colon) and a safe extension, as demonstrated by an upload of a .asp:.jpg file that results in creation of an empty .asp file, related to support for the NTFS Alternate Data Streams (ADS) filename syntax. NOTE: it could be argued that this is a vulnerability in the third-par
TFS Alternate Data Streams (ADS) filename syntax. NOTE: it could be argued that this is a vulnerability in the third-party product, not IIS, because the third-party product should be applying its extension restrictions to the portion of the filename before the colon. Additional Analyst Notes: - CVE Program Container: References: - http://securitytracker.com/id?1023387 - http://soroush.secproject.com/downloadable/iis-semicolon-report.pdf - https://exchange.xforce.ibmcloud.com/vulnerabilities/55308
CVE ID: CVE-2009-4446 State: PUBLISHED Published: 2009-12-29T20:15:00 Last Updated: 2024-08-07T07:01:20.713Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in admin.php in phpInstantGallery 1.1 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/37502 - https://exchange.xforce.ibmcloud.com/vulnerabilities/55062 - http://www.exploit-db.com/exploits/10709
CVE ID: CVE-2009-4447 State: PUBLISHED Published: 2009-12-29T20:15:00 Last Updated: 2024-08-07T07:01:20.319Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jax Guestbook 3.5.0 allows remote attackers to bypass authentication and modify administrator settings via a direct request to admin/guestbook.admin.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/10626 - http://osvdb.org/61299 - http://secunia.com/advisories/37921 - http://www.securityfocus.com/bid/37466 - https://exchange.xforce.ibmcloud.com/vulnerabilities/55077
CVE ID: CVE-2009-4448 State: PUBLISHED Published: 2009-12-29T20:15:00 Last Updated: 2024-08-07T07:01:20.701Z Vendors: n/a Products: n/a Problem Types: n/a Description: inc/functions_time.php in MyBB (aka MyBulletinBoard) 1.4.10, and possibly earlier versions, allows remote attackers to cause a denial of service (CPU consumption) via a crafted request with a large year value, which triggers a long loop, as reachable through member.php and possibly other vectors. Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2010/10/08/7 - http://secunia.com/advisories/37906 - http://openwall.com/lists/oss-security/2010/10/11/8 - http://openwall.com/lis
/7 - http://secunia.com/advisories/37906 - http://openwall.com/lists/oss-security/2010/10/11/8 - http://openwall.com/lists/oss-security/2010/12/06/2 - http://dev.mybboard.net/projects/mybb/repository/revisions/4613/diff/branches/1.4-stable/inc/functions_time.php - http://dev.mybboard.net/issues/600 - http://blog.mybboard.net/2009/12/29/mybb-1-4-11-released-minor-patch-security-update/
CVE ID: CVE-2009-4449 State: PUBLISHED Published: 2009-12-29T20:15:00 Last Updated: 2024-08-07T07:01:20.338Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in MyBB (aka MyBulletinBoard) 1.4.10, and possibly earlier versions, when changing the user avatar from the gallery, allows remote authenticated users to determine the existence of files via directory traversal sequences in the avatar and possibly the gallery parameters, related to (1) admin/modules/user/users.php and (2) usercp.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/37489 - http://openwall.com/lists/oss-security/2010/10/08/7 - ht
ntainer: References: - http://www.securityfocus.com/bid/37489 - http://openwall.com/lists/oss-security/2010/10/08/7 - http://dev.mybboard.net/projects/mybb/repository/revisions/4663/diff/branches/1.4-stable/admin/modules/user/users.php - http://secunia.com/advisories/37906 - http://openwall.com/lists/oss-security/2010/10/11/8 - http://dev.mybboard.net/issues/617 - http://www.vupen.com/english/advisories/2009/3651 - http://openwall.com/lists/oss-security/2010/12/06/2 - http://osvdb.org/61359 - http://blog.mybboard.net/2009/12/29/mybb-1-4-11-released-minor-patch-security-update/ - http://dev.mybboard.net/projects/mybb/repository/revisions/4663/diff/branches/1.4-stable/usercp.php
CVE ID: CVE-2009-4450 State: PUBLISHED Published: 2009-12-29T20:15:00 Last Updated: 2024-08-07T07:01:20.386Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in map.php in LiveZilla 3.1.8.3 allow remote attackers to inject arbitrary web script or HTML via the (1) lat, (2) lng, and (3) zom parameters, which are not properly handled when processed with templates/map.tpl. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/37990 - http://osvdb.org/61348 - http://www.securityfocus.com/archive/1/508613/100/0/threaded - http://forum.intern0t.net/intern0t-advisories/1998-intern0t-livezilla-cross
yfocus.com/archive/1/508613/100/0/threaded - http://forum.intern0t.net/intern0t-advisories/1998-intern0t-livezilla-cross-site-scripting-vulnerability.html
CVE ID: CVE-2009-4451 State: PUBLISHED Published: 2009-12-29T20:15:00 Last Updated: 2024-08-07T07:01:20.298Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in upper.php in kandalf upper 0.1 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in fileup/. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/61370 - http://www.exploit-db.com/exploits/10672 - http://secunia.com/advisories/37946
CVE ID: CVE-2009-4452 State: PUBLISHED Published: 2009-12-29T20:15:00 Last Updated: 2024-08-07T07:01:20.350Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kaspersky Anti-Virus 5.0 (5.0.712); Antivirus Personal 5.0.x; Anti-Virus 6.0 (6.0.3.837), 7 (7.0.1.325), 2009 (8.0.0.x), and 2010 (9.0.0.463); and Internet Security 7 (7.0.1.325), 2009 (8.0.0.x), and 2010 (9.0.0.463); use weak permissions (Everyone:Full Control) for the BASES directory, which allows local users to gain SYSTEM privileges by replacing an executable or DLL with a Trojan horse. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2009/3573 - http://www.securitytr
Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2009/3573 - http://www.securitytracker.com/id?1023366 - http://secunia.com/advisories/37730 - http://www.securityfocus.com/archive/1/508508/100/0/threaded - http://www.exploit-db.com/exploits/10484 - http://secunia.com/advisories/37398 - http://www.securitytracker.com/id?1023367
CVE ID: CVE-2009-4453 State: PUBLISHED Published: 2009-12-29T20:15:00 Last Updated: 2024-08-07T07:01:20.306Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure method vulnerability in SoftCab Sound Converter ActiveX control (sndConverter.ocx) 1.2 allows remote attackers to create or overwrite arbitrary files via the SaveFormat method. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/55082 - http://www.exploit-db.com/exploits/10649 - http://osvdb.org/61351 - http://secunia.com/advisories/37967
CVE ID: CVE-2009-4454 State: PUBLISHED Published: 2009-12-29T22:00:00 Last Updated: 2024-08-07T07:01:20.485Z Vendors: n/a Products: n/a Problem Types: n/a Description: vccleaner in VideoCache 1.9.2 allows local users with Squid proxy user privileges to overwrite arbitrary files via a symlink attack on /var/log/videocache/vccleaner.log. Additional Analyst Notes: - CVE Program Container: References: - http://archives.neohapsis.com/archives/fulldisclosure/2009-12/0366.html - http://www.securityfocus.com/archive/1/508507/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/54916 - http://secunia.com/advisories/37733
CVE ID: CVE-2009-4455 State: PUBLISHED Published: 2009-12-29T23:00:00 Last Updated: 2024-08-07T07:01:20.709Z Vendors: n/a Products: n/a Problem Types: n/a Description: The default configuration of Cisco ASA 5500 Series Adaptive Security Appliance (Cisco ASA) 7.0, 7.1, 7.2, 8.0, 8.1, and 8.2 allows portal traffic to access arbitrary backend servers, which might allow remote authenticated users to bypass intended access restrictions and access unauthorized web sites via a crafted URL obfuscated with ROT13 and a certain encoding. NOTE: this issue was originally reported as a vulnerability related to lack of restrictions to URLs listed in the Cisco WebVPN bookmark component, but the vendor state
ulnerability related to lack of restrictions to URLs listed in the Cisco WebVPN bookmark component, but the vendor states that "The bookmark feature is not a security feature." Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/61132 - http://www.vupen.com/english/advisories/2009/3577 - http://www.securitytracker.com/id?1023368 - http://www.securityfocus.com/archive/1/508530/100/0/threaded - http://secunia.com/advisories/37710 - http://tools.cisco.com/security/center/viewAlert.x?alertId=19609
CVE ID: CVE-2009-4456 State: PUBLISHED Published: 2009-12-30T00:00:00 Last Updated: 2024-08-07T07:01:20.352Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in news_detail.php in Green Desktiny 2.3.1, and possibly earlier versions, allows remote attackers to execute arbitrary SQL commands via the id parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/10710 - http://secunia.com/advisories/37839 - http://osvdb.org/61353
CVE ID: CVE-2009-4457 State: PUBLISHED Published: 2009-12-30T00:00:00 Last Updated: 2024-08-07T07:01:20.316Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple unspecified vulnerabilities in the Vsftpd Webmin module before 1.3b for the Vsftpd server have unknown impact and attack vectors related to "Some security issues." Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/37991 - http://www.securityfocus.com/bid/41443 - http://freshmeat.net/projects/vsftpdwebmin/releases/310064 - http://www.vupen.com/english/advisories/2009/3650 - http://osvdb.org/61362
CVE ID: CVE-2009-4458 State: PUBLISHED Published: 2009-12-30T00:00:00 Last Updated: 2024-08-07T07:01:20.388Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.5.2 and 2.6.0rc2, and possibly other versions, allow remote attackers to inject arbitrary web script or HTML via the (1) tech parameter to admin/admin/config.php during a trunks display action, the (2) description parameter during an Add Zap Channel action, and (3) unspecified vectors during an Add Recordings action. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/61357 - https://exchange.xforce.ibmcloud.com/vulnerabilities/55054
CVE Program Container: References: - http://osvdb.org/61357 - https://exchange.xforce.ibmcloud.com/vulnerabilities/55054 - http://www.exploit-db.com/exploits/10645 - http://secunia.com/advisories/37972 - https://exchange.xforce.ibmcloud.com/vulnerabilities/55053 - http://osvdb.org/61358 - http://www.securityfocus.com/bid/37482
CVE ID: CVE-2009-4459 State: PUBLISHED Published: 2009-12-30T19:00:00 Last Updated: 2024-08-07T07:01:20.431Z Vendors: n/a Products: n/a Problem Types: n/a Description: Redmine 0.8.7 and earlier uses the title tag before defining the character encoding in a meta tag, which allows remote attackers to conduct cross-site scripting (XSS) attacks and inject arbitrary script via UTF-7 encoded values in the title parameter to a new issue page, which may be interpreted as script by Internet Explorer 7 and 8. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/37425 - http://www.exploit-db.com/exploits/10554 - https://exchange.xforce.ibmcloud.com/vulnerabi
.securityfocus.com/bid/37425 - http://www.exploit-db.com/exploits/10554 - https://exchange.xforce.ibmcloud.com/vulnerabilities/54947
CVE ID: CVE-2009-4460 State: PUBLISHED Published: 2009-12-30T19:00:00 Last Updated: 2024-08-07T07:01:20.354Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Auto-Surf Traffic Exchange Script 1.1 allow remote attackers to inject arbitrary web script or HTML via the rid parameter to (1) index.php, (2) faq.php, and (3) register.php. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/61286 - http://osvdb.org/61285 - http://secunia.com/advisories/37894 - http://www.exploit-db.com/exploits/10616 - http://osvdb.org/61287
CVE ID: CVE-2009-4461 State: PUBLISHED Published: 2009-12-30T19:00:00 Last Updated: 2024-08-07T07:01:20.366Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in FlatPress 0.909 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) contact.php, (2) login.php, and (3) search.php. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/37938 - http://www.securityfocus.com/bid/37471 - http://www.exploit-db.com/exploits/10688
CVE ID: CVE-2009-4462 State: PUBLISHED Published: 2009-12-30T19:00:00 Last Updated: 2024-08-07T07:01:20.712Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in the NetBiterConfig utility (NetBiterConfig.exe) 1.3.0 for Intellicom NetBiter WebSCADA allows remote attackers to execute arbitrary code via a long hn (hostname) parameter in a crafted HICP-protocol UDP packet. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/181737 - http://www.securityfocus.com/bid/37325 - http://www.vupen.com/english/advisories/2009/3542 - http://blog.48bits.com/2009/12/12/exposing-hms-hicp-protocol-0day-light/ - http://reversemod
lish/advisories/2009/3542 - http://blog.48bits.com/2009/12/12/exposing-hms-hicp-protocol-0day-light/ - http://reversemode.com/index.php?option=com_content&task=view&id=65&Itemid=1 - http://support.intellicom.se/getfile.cfm?FID=150&FPID=85 - http://www.securityfocus.com/archive/1/508449/100/0/threaded
CVE ID: CVE-2009-4463 State: PUBLISHED Published: 2009-12-30T19:00:00 Last Updated: 2024-08-07T07:01:20.818Z Vendors: n/a Products: n/a Problem Types: n/a Description: Intellicom NetBiter WebSCADA devices use default passwords for the HICP network configuration service, which makes it easier for remote attackers to modify network settings and cause a denial of service. NOTE: this is only a vulnerability when the administrator does not follow recommendations in the product's installation documentation. NOTE: this issue was originally reported to be hard-coded passwords, not default passwords. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/61506 - http://
default passwords. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/61506 - http://www.kb.cert.org/vuls/id/902793 - http://reversemode.com/index.php?option=com_content&task=view&id=65&Itemid=1 - http://support.intellicom.se/getfile.cfm?FID=151 - http://www.securityfocus.com/archive/1/508449/100/0/threaded - http://blog.48bits.com/?p=781
CVE ID: CVE-2009-4464 State: PUBLISHED Published: 2009-12-30T19:00:00 Last Updated: 2024-08-07T07:01:20.710Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in searchadvance.asp in Active Business Directory 2 allows remote attackers to inject arbitrary web script or HTML via the search parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.packetstormsecurity.org/0912-exploits/abd-xss.txt - http://secunia.com/advisories/37863 - https://exchange.xforce.ibmcloud.com/vulnerabilities/55010 - http://osvdb.org/61267
CVE ID: CVE-2009-4465 State: PUBLISHED Published: 2009-12-30T19:00:00 Last Updated: 2024-08-07T07:01:20.304Z Vendors: n/a Products: n/a Problem Types: n/a Description: DeluxeBB 1.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain user and configuration information, log data, and gain administrative access via a direct request to scripts in (1) templates/ including (2) templates/deluxe/admincp/, (3) templates/corporate/admincp/, and (4) templates/blue/admincp/; (5) images/; (6) logs/ including (7) logs/cp.php; (8) wysiwyg/; (9) docs/; (10) classes/; (11) lang/; and (12) settings/. Additional Analyst Notes: - CVE Program
cp.php; (8) wysiwyg/; (9) docs/; (10) classes/; (11) lang/; and (12) settings/. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/37448 - http://www.exploit-db.com/exploits/10598 - https://exchange.xforce.ibmcloud.com/vulnerabilities/54975 - https://exchange.xforce.ibmcloud.com/vulnerabilities/54977 - https://exchange.xforce.ibmcloud.com/vulnerabilities/54978
CVE ID: CVE-2009-4466 State: PUBLISHED Published: 2009-12-30T19:00:00 Last Updated: 2024-08-07T07:01:20.741Z Vendors: n/a Products: n/a Problem Types: n/a Description: DeluxeBB 1.3 allows remote attackers to obtain sensitive information via a crafted page parameter to misc.php, which reveals the installation path in an error message. NOTE: this issue might be resultant from improperly controlled computation in tools.php that leads to a denial of service (CPU or memory consumption). Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/37448 - http://www.exploit-db.com/exploits/10598 - https://exchange.xforce.ibmcloud.com/vulnerabilities/54980
CVE ID: CVE-2009-4467 State: PUBLISHED Published: 2009-12-30T19:00:00 Last Updated: 2024-08-07T07:01:20.479Z Vendors: n/a Products: n/a Problem Types: n/a Description: misc.php in DeluxeBB 1.3 allows remote attackers to register accounts without a valid email address via a valemail action with the valmem set to a pre-assigned user ID, which is visible from a memberlist action. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/37448 - http://www.exploit-db.com/exploits/10598 - https://exchange.xforce.ibmcloud.com/vulnerabilities/54979