Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2009-4239 State: PUBLISHED Published: 2009-12-09T19:00:00 Last Updated: 2024-08-07T06:54:10.109Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Web console in IBM InfoSphere Information Server 8.1 before FP1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg21406224 - http://www.vupen.com/english/advisories/2009/3432 - https://exchange.xforce.ibmcloud.com/vulnerabilities/54608 - http://www.securityfocus.com/bid/37246 - http://www-01.ibm.com/support/docview.wss?uid=swg1JR3
m/vulnerabilities/54608 - http://www.securityfocus.com/bid/37246 - http://www-01.ibm.com/support/docview.wss?uid=swg1JR32573 - http://secunia.com/advisories/37556 - http://www.osvdb.org/60806
CVE ID: CVE-2009-4240 State: PUBLISHED Published: 2009-12-09T19:00:00 Last Updated: 2024-08-07T06:54:10.209Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple buffer overflows in unspecified setuid executables in the DataStage subsystem in IBM InfoSphere Information Server 8.1 before FP1 have unknown impact and attack vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/60807 - http://www-01.ibm.com/support/docview.wss?uid=swg21406224 - http://www.securityfocus.com/bid/37245 - http://www.vupen.com/english/advisories/2009/3432 - http://www-01.ibm.com/support/docview.wss?uid=swg1JR30394 - http://secunia.com/advisories/37556 - https://
s/2009/3432 - http://www-01.ibm.com/support/docview.wss?uid=swg1JR30394 - http://secunia.com/advisories/37556 - https://exchange.xforce.ibmcloud.com/vulnerabilities/54609
CVE ID: CVE-2009-4241 State: PUBLISHED Published: 2010-01-25T19:00:00 Last Updated: 2024-08-07T06:54:10.146Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and Helix Player 10.x allows remote attackers to execute arbitrary code via a file with invalid ASMRuleBook structures that trigger heap memory corruption. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2010/0178 - https://exchange.xforce.ibmcloud.com/vulner
Container: References: - http://www.vupen.com/english/advisories/2010/0178 - https://exchange.xforce.ibmcloud.com/vulnerabilities/55794 - http://securitytracker.com/id?1023489 - http://www.securityfocus.com/archive/1/509100/100/0/threaded - http://service.real.com/realplayer/security/01192010_player/en/ - http://www.zerodayinitiative.com/advisories/ZDI-10-005/ - http://secunia.com/advisories/38218 - http://www.securityfocus.com/bid/37880
CVE ID: CVE-2009-4242 State: PUBLISHED Published: 2010-01-25T19:00:00 Last Updated: 2024-08-07T06:54:10.208Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the CGIFCodec::GetPacketBuffer function in datatype/image/gif/common/gifcodec.cpp in RealNetworks RealPlayer 10; RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741; RealPlayer 11 11.0.0 through 11.0.4; RealPlayer Enterprise; Mac RealPlayer 10, 10.1, and 11.0; Linux RealPlayer 10; and Helix Player 10.x allows remote attackers to execute arbitrary code via a GIF file with crafted chunk sizes that trigger improper memory allocation. Additional Analyst Notes: - CVE Program Container: References: - http:/
k sizes that trigger improper memory allocation. Additional Analyst Notes: - CVE Program Container: References: - http://www.redhat.com/support/errata/RHSA-2010-0094.html - http://www.vupen.com/english/advisories/2010/0178 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10144 - https://exchange.xforce.ibmcloud.com/vulnerabilities/55795 - http://securitytracker.com/id?1023489 - https://bugzilla.redhat.com/show_bug.cgi?id=561436 - http://lists.helixcommunity.org/pipermail/datatype-cvs/2008-September/008633.html - http://service.real.com/realplayer/security/01192010_player/en/ - http://secunia.com/advisories/38450 - http://www.zerodayinitiative.com/advis
m/realplayer/security/01192010_player/en/ - http://secunia.com/advisories/38450 - http://www.zerodayinitiative.com/advisories/ZDI-10-006/ - http://osvdb.org/61966 - http://secunia.com/advisories/38218 - https://helixcommunity.org/viewcvs/datatype/image/gif/common/gifcodec.cpp?view=log#rev1.8 - http://www.securityfocus.com/archive/1/509096/100/0/threaded - http://www.securityfocus.com/bid/37880
CVE ID: CVE-2009-4243 State: PUBLISHED Published: 2010-01-25T19:00:00 Last Updated: 2024-08-07T06:54:10.171Z Vendors: n/a Products: n/a Problem Types: n/a Description: RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and Helix Player 10.x allow remote attackers to have an unspecified impact via a crafted media file that uses HTTP chunked transfer coding, related to an "overflow." Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2010/0178 - http://securitytracker.com/id?1023489 - http://service.real.com
s: - http://www.vupen.com/english/advisories/2010/0178 - http://securitytracker.com/id?1023489 - http://service.real.com/realplayer/security/01192010_player/en/ - https://exchange.xforce.ibmcloud.com/vulnerabilities/55796 - http://osvdb.org/61967 - http://secunia.com/advisories/38218 - http://www.securityfocus.com/bid/37880
CVE ID: CVE-2009-4244 State: PUBLISHED Published: 2010-01-25T19:00:00 Last Updated: 2024-08-07T06:54:10.240Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in RealNetworks RealPlayer 10; RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741; RealPlayer 11 11.0.0 through 11.0.4; RealPlayer Enterprise; Mac RealPlayer 10, 10.1, and 11.0; Linux RealPlayer 10; and Helix Player 10.x allows remote attackers to execute arbitrary code via an SIPR codec field with a small length value that triggers incorrect memory allocation. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2010/0178 - http://securitytracker.com/
: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2010/0178 - http://securitytracker.com/id?1023489 - http://service.real.com/realplayer/security/01192010_player/en/ - http://secunia.com/advisories/38218 - http://www.securityfocus.com/bid/37880 - http://www.zerodayinitiative.com/advisories/ZDI-10-008/ - https://exchange.xforce.ibmcloud.com/vulnerabilities/55797 - http://www.securityfocus.com/archive/1/509098/100/0/threaded
CVE ID: CVE-2009-4245 State: PUBLISHED Published: 2010-01-25T19:00:00 Last Updated: 2024-08-07T06:54:10.237Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and Helix Player 10.x allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a compressed GIF file, related to gifcodec.cpp and gifimage.cpp. Additional Analyst Notes: - CVE Program Container: References: - http://www.redhat.com/support/errata/RHSA-2010-0094.
p. Additional Analyst Notes: - CVE Program Container: References: - http://www.redhat.com/support/errata/RHSA-2010-0094.html - http://lists.helixcommunity.org/pipermail/datatype-cvs/2008-July/008455.html - http://www.vupen.com/english/advisories/2010/0178 - https://helixcommunity.org/viewcvs/datatype/image/gif/common/gifcodec.cpp?view=log#rev1.7 - http://osvdb.org/61969 - https://helixcommunity.org/viewcvs/datatype/image/gif/common/gifimage.cpp?view=log#rev1.6 - http://securitytracker.com/id?1023489 - http://service.real.com/realplayer/security/01192010_player/en/ - http://secunia.com/advisories/38450 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A99
secunia.com/advisories/38450 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9998 - https://helixcommunity.org/viewcvs/datatype/image/gif/common/pub/gifcodec.h?view=log#rev1.5 - http://secunia.com/advisories/38218 - https://exchange.xforce.ibmcloud.com/vulnerabilities/55800 - https://bugzilla.redhat.com/show_bug.cgi?id=561441 - http://www.securityfocus.com/bid/37880
CVE ID: CVE-2009-4246 State: PUBLISHED Published: 2010-01-25T19:00:00 Last Updated: 2024-08-07T06:54:10.207Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and Helix Player 10.x allows user-assisted remote attackers to execute arbitrary code via a malformed .RJS skin file that contains a web.xmb file with crafted length values. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2010/0178 - https://exchange.xforce.
tes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2010/0178 - https://exchange.xforce.ibmcloud.com/vulnerabilities/55799 - http://securitytracker.com/id?1023489 - http://service.real.com/realplayer/security/01192010_player/en/ - http://www.zerodayinitiative.com/advisories/ZDI-10-010/ - http://www.securityfocus.com/archive/1/509104/100/0/threaded - http://secunia.com/advisories/38218 - http://www.securityfocus.com/bid/37880
CVE ID: CVE-2009-4247 State: PUBLISHED Published: 2010-01-25T19:00:00 Last Updated: 2024-08-07T06:54:10.219Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in protocol/rtsp/rtspclnt.cpp in RealNetworks RealPlayer 10; RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741; RealPlayer 11 11.0.x; RealPlayer SP 1.0.0 and 1.0.1; RealPlayer Enterprise; Mac RealPlayer 10, 10.1, 11.0, and 11.0.1; Linux RealPlayer 10, 11.0.0, and 11.0.1; and Helix Player 10.x, 11.0.0, and 11.0.1 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an ASM RuleBook with a large number of rules, related to an "array overflow." Ad
or possibly execute arbitrary code via an ASM RuleBook with a large number of rules, related to an "array overflow." Additional Analyst Notes: - CVE Program Container: References: - http://www.redhat.com/support/errata/RHSA-2010-0094.html - http://www.vupen.com/english/advisories/2010/0178 - http://securitytracker.com/id?1023489 - http://service.real.com/realplayer/security/01192010_player/en/ - http://secunia.com/advisories/38450 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10677 - http://lists.helixcommunity.org/pipermail/protocol-cvs/2009-August/001943.html - https://helixcommunity.org/viewcvs/protocol/rtsp/rtspclnt.cpp?view=log#rev1.245 - http
col-cvs/2009-August/001943.html - https://helixcommunity.org/viewcvs/protocol/rtsp/rtspclnt.cpp?view=log#rev1.245 - http://lists.helixcommunity.org/pipermail/helix-client-dev/2009-August/008092.html - http://secunia.com/advisories/38218 - https://bugzilla.redhat.com/show_bug.cgi?id=561338 - http://www.securityfocus.com/bid/37880 - https://exchange.xforce.ibmcloud.com/vulnerabilities/55802
CVE ID: CVE-2009-4248 State: PUBLISHED Published: 2010-01-25T19:00:00 Last Updated: 2024-08-07T06:54:10.214Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the RTSPProtocol::HandleSetParameterRequest function in client/core/rtspprotocol.cpp in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and Helix Player 10.x allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted RTSP SET_PARAMETER request. Additional Analyst Notes: - CVE Program Container: References: - ht
trary code via a crafted RTSP SET_PARAMETER request. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=561361 - http://www.redhat.com/support/errata/RHSA-2010-0094.html - http://www.vupen.com/english/advisories/2010/0178 - https://helixcommunity.org/viewcvs/client/core/rtspprotocol.cpp?view=log#rev1.55.2.19 - http://securitytracker.com/id?1023489 - http://service.real.com/realplayer/security/01192010_player/en/ - http://secunia.com/advisories/38450 - http://lists.helixcommunity.org/pipermail/client-dev/2008-January/004591.html - http://lists.helixcommunity.org/pipermail/client-cvs/2008-January/003759.html - https://helixcommunity.org
004591.html - http://lists.helixcommunity.org/pipermail/client-cvs/2008-January/003759.html - https://helixcommunity.org/viewcvs/client/core/rtspprotocol.cpp?view=log#rev1.86 - http://secunia.com/advisories/38218 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10641 - http://lists.helixcommunity.org/pipermail/client-cvs/2008-January/003756.html - http://www.securityfocus.com/bid/37880 - https://exchange.xforce.ibmcloud.com/vulnerabilities/55801
CVE ID: CVE-2009-4249 State: PUBLISHED Published: 2009-12-10T00:00:00 Last Updated: 2024-08-07T06:54:10.267Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in CutePHP CuteNews 1.4.6, when register_globals is enabled and magic_quotes_gpc is disabled, allow remote attackers to inject arbitrary web script or HTML via the (1) lastusername and (2) mod parameters to index.php; and (3) the title parameter to search.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/54222 - https://exchange.xforce.ibmcloud.com/vulnerabilities/54220 - http://www.morningstarsecurity.c
om/vulnerabilities/54222 - https://exchange.xforce.ibmcloud.com/vulnerabilities/54220 - http://www.morningstarsecurity.com/advisories/MORNINGSTAR-2009-02-CuteNews.txt - https://exchange.xforce.ibmcloud.com/vulnerabilities/54219 - http://www.securityfocus.com/archive/1/507782/100/0/threaded - http://www.securityfocus.com/bid/36971
CVE ID: CVE-2009-4250 State: PUBLISHED Published: 2009-12-10T00:00:00 Last Updated: 2024-08-07T06:54:10.323Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allow remote attackers to inject arbitrary web script or HTML via (1) the result parameter to register.php; (2) the user parameter to search.php; the (3) cat_msg, (4) source_msg, (5) postponed_selected, (6) unapproved_selected, and (7) news_per_page parameters in a list action to the editnews module of index.php; and (8) the link tag in news comments. NOTE: some of the vulnerabilities require register_globals to be enable
ndex.php; and (8) the link tag in news comments. NOTE: some of the vulnerabilities require register_globals to be enabled and/or magic_quotes_gpc to be disabled. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/54237 - https://exchange.xforce.ibmcloud.com/vulnerabilities/54224 - https://exchange.xforce.ibmcloud.com/vulnerabilities/54222 - https://exchange.xforce.ibmcloud.com/vulnerabilities/54221 - http://www.morningstarsecurity.com/advisories/MORNINGSTAR-2009-02-CuteNews.txt - http://www.securityfocus.com/archive/1/507782/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/54223 - http://www.securityfocus
/archive/1/507782/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/54223 - http://www.securityfocus.com/bid/36971
CVE ID: CVE-2009-4251 State: PUBLISHED Published: 2009-12-10T00:00:00 Last Updated: 2024-08-07T06:54:10.223Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in Jasc Paint Shop Pro 8.10 (aka Corel Paint Shop Pro) allows user-assisted remote attackers to execute arbitrary code via a crafted PNG file. NOTE: this might be the same issue as CVE-2007-2366. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/37204 - http://osvdb.org/60592 - https://exchange.xforce.ibmcloud.com/vulnerabilities/54551 - http://secunia.com/advisories/37591 - http://www.vupen.com/english/advisories/2009/3418 - http://aluigi.freeforums.o
1 - http://secunia.com/advisories/37591 - http://www.vupen.com/english/advisories/2009/3418 - http://aluigi.freeforums.org/post8780.html - http://www.packetstormsecurity.org/0912-exploits/jasc-overflow.txt
CVE ID: CVE-2009-4252 State: PUBLISHED Published: 2009-12-10T01:00:00 Last Updated: 2024-08-07T06:54:10.217Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in images.php in Image Hosting Script DPI 1.1 Final (1.1F) allows remote attackers to inject arbitrary web script or HTML via the date parameter. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.clixint.com/support/viewtopic.php?f=3&t=542 - http://www.exploit-db.com/exploits/10300 - http://secunia.com/advisories/37456
CVE ID: CVE-2009-4253 State: PUBLISHED Published: 2009-12-10T01:00:00 Last Updated: 2024-08-07T06:54:10.220Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in dspStats.php in PowerPhlogger 2.2.5 allows remote attackers to inject arbitrary web script or HTML via the edit parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.websecurity.com.ua/1845 - http://secunia.com/advisories/30423 - http://www.securityfocus.com/bid/37150 - https://exchange.xforce.ibmcloud.com/vulnerabilities/54541
CVE ID: CVE-2009-4254 State: PUBLISHED Published: 2009-12-10T01:00:00 Last Updated: 2024-08-07T06:54:10.209Z Vendors: n/a Products: n/a Problem Types: n/a Description: PowerPhlogger 2.2.5 allows remote attackers to obtain sensitive information via a direct request to (1) edCss.inc.php, (2) foot.inc.php, (3) get_csscolors.inc.php, (4) head.inc.php, (5) head_stuff.inc.php, (6) loglist.inc.php, and (7) pphlogger_send.inc.php in include/, which reveals the installation path in an error message. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/54543 - http://www.websecurity.com.ua/1845
CVE ID: CVE-2009-4255 State: PUBLISHED Published: 2009-12-10T01:00:00 Last Updated: 2024-08-07T06:54:10.211Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the You!Hostit! template 1.0.1 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the created_by_alias parameter in index.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/54570 - http://www.exploit-db.com/exploits/10301 - http://secunia.com/advisories/37601
CVE ID: CVE-2009-4256 State: PUBLISHED Published: 2009-12-10T01:00:00 Last Updated: 2024-08-07T06:54:10.208Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in cource.php in AlefMentor 2.0 and 2.2 allow remote attackers to execute arbitrary SQL commands via the (1) cont_id and (2) courc_id parameters in a pregled action. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/10358 - http://secunia.com/advisories/37626 - https://exchange.xforce.ibmcloud.com/vulnerabilities/54624
CVE ID: CVE-2009-4257 State: PUBLISHED Published: 2010-01-25T19:00:00 Last Updated: 2024-08-07T06:54:10.213Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in datatype/smil/common/smlpkt.cpp in smlrender.dll in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10 and 11.0.0, and Helix Player 10.x and 11.0.0 allows remote attackers to execute arbitrary code via an SMIL file with crafted string lengths. Additional Analyst Notes: - CVE Program Container: References: - http://www.redhat.com/support/errata/RHSA-2010-0094.html -
tional Analyst Notes: - CVE Program Container: References: - http://www.redhat.com/support/errata/RHSA-2010-0094.html - http://www.securityfocus.com/archive/1/509105/100/0/threaded - http://www.vupen.com/english/advisories/2010/0178 - http://lists.helixcommunity.org/pipermail/datatype-cvs/2008-September/008678.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/55798 - http://securitytracker.com/id?1023489 - http://service.real.com/realplayer/security/01192010_player/en/ - https://bugzilla.redhat.com/show_bug.cgi?id=561309 - http://secunia.com/advisories/38450 - https://helixcommunity.org/viewcvs/datatype/smil/common/smlpkt.cpp?view=log#rev1.12 - https://oval.cisecurity.org/repositor
ps://helixcommunity.org/viewcvs/datatype/smil/common/smlpkt.cpp?view=log#rev1.12 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11110 - http://secunia.com/advisories/38218 - http://www.zerodayinitiative.com/advisories/ZDI-10-007/ - http://www.securityfocus.com/bid/37880
CVE ID: CVE-2009-4261 State: PUBLISHED Published: 2009-12-21T16:00:00 Last Updated: 2024-08-07T06:54:10.347Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple directory traversal vulnerabilities in the iallocator framework in Ganeti 1.2.4 through 1.2.8, 2.0.0 through 2.0.4, and 2.1.0 before 2.1.0~rc2 allow (1) remote attackers to execute arbitrary programs via a crafted external script name supplied through the HTTP remote API (RAPI) and allow (2) local users to execute arbitrary programs and gain privileges via a crafted external script name supplied through a gnt-* command, related to "path sanitization errors." Additional Analyst Notes: - CVE Program Container: Reference
ugh a gnt-* command, related to "path sanitization errors." Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/37849 - http://www.vupen.com/english/advisories/2009/3599 - http://www.securityfocus.com/archive/1/508535/100/0/threaded - http://www.openwall.com/lists/oss-security/2009/12/17/5 - http://git.ganeti.org/?p=ganeti.git%3Ba=blobdiff%3Bf=NEWS%3Bh=34b46426eca82c351e0a478c71edb66b9bb4b228%3Bhp=7f916c59238503915e927377d887b93eef1f676c%3Bhb=e5823b7e2cd8a3c9037a10aa59823a45642ce29f%3Bhpb=f95c81bf21c177f7e6a2c53ea0613034326329bd - http://git.ganeti.org/?p=ganeti.git%3Ba=commit%3Bh=f95c81bf21c177f7e6a2c53ea0613034326329bd - http://git.ganeti.org/?p=g
http://git.ganeti.org/?p=ganeti.git%3Ba=commit%3Bh=f95c81bf21c177f7e6a2c53ea0613034326329bd - http://git.ganeti.org/?p=ganeti.git%3Ba=blobdiff%3Bf=lib/utils.py%3Bh=bcd8e107bbc44ff94a4bc3dc405b5547719f001d%3Bhp=df2d18027e83b7783e146cbbe58f7efa92317980%3Bhb=f95c81bf21c177f7e6a2c53ea0613034326329bd%3Bhpb=4fe80ef2ed1cda3a6357274eccafe5c1f21a5283 - http://www.ocert.org/advisories/ocert-2009-019.html - http://git.ganeti.org/?p=ganeti.git%3Ba=blobdiff%3Bf=lib/constants.py%3Bh=81302575487a44ed192e61aa7b21888a215ef215%3Bhp=c353878ed83ce66d21c237da5e709dedd7b6f26b%3Bhb=0084657a21afb49c6f74498f27b97dfdbc42b383%3Bhpb=d24cb69273e4b03ffcd4e4768d95841b5570e264 - http://groups.google.com/group/ganeti/browse
9c6f74498f27b97dfdbc42b383%3Bhpb=d24cb69273e4b03ffcd4e4768d95841b5570e264 - http://groups.google.com/group/ganeti/browse_thread/thread/cbce23d89103a8d2