Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2009-4468 State: PUBLISHED Published: 2009-12-30T19:00:00 Last Updated: 2024-08-07T07:01:20.426Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in misc.php in DeluxeBB 1.3 allows remote attackers to inject arbitrary web script or HTML via the page parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/37448 - http://www.exploit-db.com/exploits/10598 - https://exchange.xforce.ibmcloud.com/vulnerabilities/54976
CVE ID: CVE-2009-4469 State: PUBLISHED Published: 2009-12-30T20:00:00 Last Updated: 2024-08-07T07:01:20.391Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in pagenumber.inc.php in phpPowerCards 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO, the (2) archiv parameter, and the (3) subcat parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/55059 - http://www.securityfocus.com/bid/37508 - http://www.exploit-db.com/exploits/10668
CVE ID: CVE-2009-4470 State: PUBLISHED Published: 2009-12-30T21:00:00 Last Updated: 2024-08-07T07:01:20.307Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in boardrule.php in DVBBS 2.0 allows remote attackers to execute arbitrary SQL commands via the groupboardid parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/506258/100/0/threaded - http://www.securityfocus.com/bid/36282
CVE ID: CVE-2009-4471 State: PUBLISHED Published: 2009-12-30T21:00:00 Last Updated: 2024-08-07T07:01:20.315Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple PHP remote file inclusion vulnerabilities in FreeSchool 1.1.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the CLASSPATH parameter to (1) bib_form.php, (2) bib_pldetails.php, (3) bib_plform.php, (4) bib_plsearchc.php, (5) bib_plsearchs.php, (6) bib_save.php, (7) bib_searchc.php, (8) bib_searchs.php, (9) edi_form.php, (10) edi_save.php, (11) gen_form.php, (12) gen_save.php, (13) lin_form.php, (14) lin_save.php, (15) luo_form.php, (16) luo_save.php, (17) sog_form.php, or (18) sog_save.ph
.php, (13) lin_form.php, (14) lin_save.php, (15) luo_form.php, (16) luo_save.php, (17) sog_form.php, or (18) sog_save.php in biblioteca/; (19) cal_insert.php, (20) cal_save.php, or (21) cal_saveactivity.php in calendario/; (22) circolari/cir_save.php; or (23) modulistica/mdl_save.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/9582 - http://www.vupen.com/english/advisories/2009/2535 - https://exchange.xforce.ibmcloud.com/vulnerabilities/53017 - http://secunia.com/advisories/36605
CVE ID: CVE-2009-4472 State: PUBLISHED Published: 2009-12-30T21:00:00 Last Updated: 2024-08-07T07:01:20.298Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple PHP remote file inclusion vulnerabilities in PHPope 1.0.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) GLOBALS[config][dir][plugins] parameter to plugins/address/admin/index.php, (2) GLOBALS[config][dir][functions] parameter to plugins/im/compose.php, and (3) GLOBALS[config][dir][classes] parameter to plugins/cssedit/admin/index.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/53018 - http://www.exploit-d
- CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/53018 - http://www.exploit-db.com/exploits/9583 - http://www.vupen.com/english/advisories/2009/2536
CVE ID: CVE-2009-4473 State: PUBLISHED Published: 2009-12-30T21:00:00 Last Updated: 2024-08-07T07:01:20.799Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in WorkArea/ContentDesigner/ekformsiframe.aspx in Ektron CMS400.NET 7.6.1.53 and 7.6.6.47, and possibly 7.52 through 7.66sp2, allow remote attackers to inject arbitrary web script or HTML via the (1) css, (2) eca, (3) id, and (4) skin parameters. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/36279 - http://dev.ektron.com/notices.aspx?id=19074 - http://osv
ntainer: References: - http://www.securityfocus.com/bid/36279 - http://dev.ektron.com/notices.aspx?id=19074 - http://osvdb.org/57667 - https://exchange.xforce.ibmcloud.com/vulnerabilities/53043 - http://dev.ektron.com/forum.aspx?g=posts&t=28048 - http://secunia.com/advisories/36591
CVE ID: CVE-2009-4474 State: PUBLISHED Published: 2009-12-30T21:00:00 Last Updated: 2024-08-07T07:01:20.828Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the Mike de Boer zoom (com_zoom) component 2.0 for Mambo allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/9588 - http://www.securityfocus.com/bid/36281
CVE ID: CVE-2009-4475 State: PUBLISHED Published: 2009-12-30T21:00:00 Last Updated: 2024-08-07T07:01:20.490Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the Joomlub (com_joomlub) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the aid parameter in an auction edit action to index.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.org/0909-exploits/joomlajoomlub-sql.txt - http://www.securityfocus.com/bid/36287 - http://www.exploit-db.com/exploits/9593 - http://secunia.com/advisories/36607
CVE ID: CVE-2009-4476 State: PUBLISHED Published: 2009-12-30T21:00:00Z Last Updated: 2024-09-16T22:51:29.159Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in HAURI ViRobot Desktop 5.5 before 2009-09-28.00 allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by a certain module in VulnDisco Pack Professional 7.15 through 8.11. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/36241 - http://secunia.com/advisories/36512 - http://intevydis.com/vd-list.shtml
CVE ID: CVE-2009-4477 State: PUBLISHED Published: 2009-12-30T21:00:00 Last Updated: 2024-08-07T07:01:20.332Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in page.html in Xstate Real Estate 1.0 allows remote attackers to execute arbitrary SQL commands via the pid parameter. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/36529 - http://osvdb.org/57670 - http://www.exploit-db.com/exploits/9565 - https://exchange.xforce.ibmcloud.com/vulnerabilities/52968
CVE ID: CVE-2009-4478 State: PUBLISHED Published: 2009-12-30T21:00:00 Last Updated: 2024-08-07T07:01:20.559Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Xstate Real Estate 1.0 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) home.html or (2) lands.html. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/36529 - http://www.exploit-db.com/exploits/9565 - https://exchange.xforce.ibmcloud.com/vulnerabilities/52970 - http://osvdb.org/57672 - http://osvdb.org/57671
CVE ID: CVE-2009-4479 State: PUBLISHED Published: 2009-12-30T21:00:00Z Last Updated: 2024-09-16T20:47:21.770Z Vendors: n/a Products: n/a Problem Types: n/a Description: LDAP3A.exe in MailSite 8.0.4 allows remote attackers to cause a denial of service (heap memory corruption and daemon crash) via unspecified vectors, as demonstrated by a certain module in VulnDisco Pack Professional 7.13 through 8.11. NOTE: as of 20091229, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.
tifier for tracking purposes. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/36240 - http://secunia.com/advisories/36573 - http://intevydis.com/vd-list.shtml
CVE ID: CVE-2009-4480 State: PUBLISHED Published: 2009-12-30T21:00:00Z Last Updated: 2024-09-16T18:48:40.187Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the web service in AzeoTech DAQFactory 5.77 might allow remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by a certain module in VulnDisco Pack Professional 7.16 through 8.11. NOTE: as of 20091229, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes. Additional Analyst Notes: - CVE Program Container: References: - http://intevydis.com/vd-list.sh
for tracking purposes. Additional Analyst Notes: - CVE Program Container: References: - http://intevydis.com/vd-list.shtml - http://secunia.com/advisories/36504
CVE ID: CVE-2009-4481 State: REJECTED Published: 2009-12-30T21:00:00 Last Updated: 2010-01-14T10:00:00 Description: No description available.
CVE ID: CVE-2009-4482 State: PUBLISHED Published: 2009-12-30T21:00:00Z Last Updated: 2024-09-16T20:07:34.541Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in MediaServer.exe in TVersity 1.6 allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by the vd_tversity module in VulnDisco Pack Professional 8.11. NOTE: as of 20091229, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/57761 - http://secunia.com/advisories/
Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/57761 - http://secunia.com/advisories/36588 - http://www.intevydis.com/blog/?p=57 - http://intevydis.com/vd-list.shtml
CVE ID: CVE-2009-4483 State: PUBLISHED Published: 2009-12-30T21:00:00Z Last Updated: 2024-09-17T00:10:31.171Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in LDAP3A.exe in MailSite 8.0.4 allows remote attackers to cause a denial of service (daemon crash) via unknown vectors, as demonstrated by a certain module in VulnDisco Pack Professional 7.13 through 8.11. NOTE: as of 20091229, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.co
fier for tracking purposes. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/36240 - http://secunia.com/advisories/36573 - http://intevydis.com/vd-list.shtml
CVE ID: CVE-2009-4484 State: PUBLISHED Published: 2009-12-30T21:00:00 Last Updated: 2024-08-07T07:01:20.829Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple stack-based buffer overflows in the CertDecoder::GetName function in src/asn.cpp in TaoCrypt in yaSSL before 1.9.9, as used in mysqld in MySQL 5.0.x before 5.0.90, MySQL 5.1.x before 5.1.43, MySQL 5.5.x through 5.5.0-m2, and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption and daemon crash) by establishing an SSL connection and sending an X.509 client certificate with a crafted name field, as demonstrated by mysql_overflow1.py and the vd_mysql5 module in
n X.509 client certificate with a crafted name field, as demonstrated by mysql_overflow1.py and the vd_mysql5 module in VulnDisco Pack Professional 8.11. NOTE: this was originally reported for MySQL 5.0.51a. Additional Analyst Notes: - CVE Program Container: References: - http://intevydis.com/mysql_overflow1.py.txt - http://dev.mysql.com/doc/refman/5.1/en/news-5-1-43.html - http://secunia.com/advisories/38573 - http://www.ubuntu.com/usn/USN-1397-1 - http://secunia.com/advisories/37493 - http://www.yassl.com/release.html - http://www.yassl.com/news.html#yassl199 - http://bazaar.launchpad.net/~mysql/mysql-server/mysql-5.0/revision/2837.1.1 - http://www.intevydis.com/blog/?p=106 - http://intevy
aar.launchpad.net/~mysql/mysql-server/mysql-5.0/revision/2837.1.1 - http://www.intevydis.com/blog/?p=106 - http://intevydis.com/mysql_demo.html - http://intevydis.blogspot.com/2010/01/mysq-yassl-stack-overflow.html - http://secunia.com/advisories/38364 - http://secunia.com/advisories/38517 - http://yassl.cvs.sourceforge.net/viewvc/yassl/yassl/taocrypt/src/asn.cpp?r1=1.13&r2=1.14 - http://www.securityfocus.com/bid/37974 - http://securitytracker.com/id?1023513 - http://ubuntu.com/usn/usn-897-1 - http://www.metasploit.com/modules/exploit/linux/mysql/mysql_yassl_getname - http://www.vupen.com/english/advisories/2010/0236 - http://archives.neohapsis.com/archives/dailydave/2010-q1/0002.html - http
//www.vupen.com/english/advisories/2010/0236 - http://archives.neohapsis.com/archives/dailydave/2010-q1/0002.html - https://bugzilla.redhat.com/show_bug.cgi?id=555313 - http://bugs.mysql.com/bug.php?id=50227 - http://www.securityfocus.com/bid/37640 - https://exchange.xforce.ibmcloud.com/vulnerabilities/55416 - http://www.intevydis.com/blog/?p=57 - http://isc.sans.org/diary.html?storyid=7900 - http://lists.mysql.com/commits/96697 - http://securitytracker.com/id?1023402 - http://dev.mysql.com/doc/refman/5.0/en/news-5-0-90.html - http://www.osvdb.org/61956 - http://intevydis.com/vd-list.shtml - http://secunia.com/advisories/38344 - http://www.securityfocus.com/bid/37943 - http://www.vupen.com/e
om/vd-list.shtml - http://secunia.com/advisories/38344 - http://www.securityfocus.com/bid/37943 - http://www.vupen.com/english/advisories/2010/0233 - http://lists.immunitysec.com/pipermail/dailydave/2010-January/006020.html - http://www.debian.org/security/2010/dsa-1997
CVE ID: CVE-2009-4485 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2021-01-06T16:16:03 Description: No description available.
CVE ID: CVE-2009-4486 State: PUBLISHED Published: 2010-01-08T18:00:00 Last Updated: 2024-08-07T07:01:20.927Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in the eDirectory plugin in Novell iManager before 2.7.3 allows remote attackers to execute arbitrary code via vectors that trigger long arguments to an unspecified sub-application, related to importing and exporting from a schema. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/38030 - http://www.novell.com/support/viewContent.do?externalId=7004985&sliceId=1 - http://osvdb.org/61584 - https://exchange.xforce.ibmcloud.com/vulnerabilities/55468 - http://
rnalId=7004985&sliceId=1 - http://osvdb.org/61584 - https://exchange.xforce.ibmcloud.com/vulnerabilities/55468 - http://www.securityfocus.com/bid/37672 - http://www.vupen.com/english/advisories/2010/0074 - http://www.zerodayinitiative.com/advisories/ZDI-10-001/
CVE ID: CVE-2009-4487 State: PUBLISHED Published: 2010-01-13T20:00:00 Last Updated: 2024-08-07T07:01:20.466Z Vendors: n/a Products: n/a Problem Types: n/a Description: nginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/37711 - http://www.ush.it/team/ush/hack_httpd_escape/adv.txt - http://www.securityfocus.com/archive/1/508830/100/0/threaded
CVE ID: CVE-2009-4488 State: PUBLISHED Published: 2010-01-13T20:00:00 Last Updated: 2025-01-21T16:48:02.245Z Vendors: n/a Products: n/a Problem Types: n/a Description: Varnish 2.0.6 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator. NOTE: the vendor disputes the significance of this report, stating that "This is not a security problem in Varnish or any other piece of software which writes a logfile. The real problem is the mistaken belief that you can cat(1) a random logfile to
ece of software which writes a logfile. The real problem is the mistaken belief that you can cat(1) a random logfile to your terminal safely. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.ush.it/team/ush/hack_httpd_escape/adv.txt - http://www.securityfocus.com/bid/37713 - http://www.securityfocus.com/archive/1/508830/100/0/threaded
CVE ID: CVE-2009-4489 State: PUBLISHED Published: 2010-01-13T20:00:00 Last Updated: 2024-08-07T07:01:20.661Z Vendors: n/a Products: n/a Problem Types: n/a Description: header.c in Cherokee before 0.99.32 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator. Additional Analyst Notes: - CVE Program Container: References: - http://svn.cherokee-project.com/changeset/3944 - http://secunia.com/advisories/37933 - http://www.vupen.com/english/advisories/2010/0090 - http://www.securityfocus
944 - http://secunia.com/advisories/37933 - http://www.vupen.com/english/advisories/2010/0090 - http://www.securityfocus.com/bid/37715 - http://www.ush.it/team/ush/hack_httpd_escape/adv.txt - http://svn.cherokee-project.com/changeset/3977 - http://www.securityfocus.com/archive/1/508830/100/0/threaded
CVE ID: CVE-2009-4490 State: PUBLISHED Published: 2010-01-13T20:00:00 Last Updated: 2024-08-07T07:01:20.432Z Vendors: n/a Products: n/a Problem Types: n/a Description: mini_httpd 1.19 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator. Additional Analyst Notes: - CVE Program Container: References: - http://www.ush.it/team/ush/hack_httpd_escape/adv.txt - http://www.securityfocus.com/archive/1/508830/100/0/threaded
CVE ID: CVE-2009-4491 State: PUBLISHED Published: 2010-01-13T00:00:00 Last Updated: 2024-08-07T07:01:20.480Z Vendors: n/a Products: n/a Problem Types: n/a Description: thttpd 2.25b0 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://www.ush.it/team/ush/hack_httpd_escape/adv.txt - http://www.securityfocus.com/archive/1/508830/100/0/threaded - http://seclists.org/fulldisclosure/2023/No
cape/adv.txt - http://www.securityfocus.com/archive/1/508830/100/0/threaded - http://seclists.org/fulldisclosure/2023/Nov/13 - http://packetstormsecurity.com/files/175949/m-privacy-TightGate-Pro-Code-Execution-Insecure-Permissions.html
CVE ID: CVE-2009-4492 State: PUBLISHED Published: 2010-01-13T20:00:00 Last Updated: 2024-08-07T07:01:20.327Z Vendors: n/a Products: n/a Problem Types: n/a Description: WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through patchlevel 248, 1.8.8dev, 1.9.1 through patchlevel 376, and 1.9.2dev writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator. Additional Analyst Notes: - CVE Program Container: References: - http://www.ruby-lang.org/en/news/2010/01/10/webrick-escape-seque
l Analyst Notes: - CVE Program Container: References: - http://www.ruby-lang.org/en/news/2010/01/10/webrick-escape-sequence-injection - http://www.redhat.com/support/errata/RHSA-2011-0909.html - http://secunia.com/advisories/37949 - http://www.vupen.com/english/advisories/2010/0089 - http://www.redhat.com/support/errata/RHSA-2011-0908.html - http://www.ush.it/team/ush/hack_httpd_escape/adv.txt - http://www.securityfocus.com/bid/37710 - http://www.securityfocus.com/archive/1/508830/100/0/threaded - http://securitytracker.com/id?1023429
CVE ID: CVE-2009-4493 State: PUBLISHED Published: 2010-01-13T20:00:00 Last Updated: 2024-08-07T07:01:20.803Z Vendors: n/a Products: n/a Problem Types: n/a Description: Orion Application Server 2.0.7 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator. Additional Analyst Notes: - CVE Program Container: References: - http://www.ush.it/team/ush/hack_httpd_escape/adv.txt - http://www.securityfocus.com/archive/1/508830/100/0/threaded
CVE ID: CVE-2009-4494 State: PUBLISHED Published: 2010-01-13T20:00:00 Last Updated: 2024-08-07T07:01:20.463Z Vendors: n/a Products: n/a Problem Types: n/a Description: AOLserver 4.5.1 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/37712 - http://www.ush.it/team/ush/hack_httpd_escape/adv.txt - http://www.securityfocus.com/archive/1/508830/100/0/threaded
CVE ID: CVE-2009-4495 State: PUBLISHED Published: 2010-01-13T20:00:00 Last Updated: 2024-08-07T07:01:20.425Z Vendors: n/a Products: n/a Problem Types: n/a Description: Yaws 1.85 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/37716 - http://www.ush.it/team/ush/hack_httpd_escape/adv.txt - http://www.securityfocus.com/archive/1/508830/100/0/threaded
CVE ID: CVE-2009-4496 State: PUBLISHED Published: 2010-01-13T20:00:00 Last Updated: 2024-08-07T07:01:20.793Z Vendors: n/a Products: n/a Problem Types: n/a Description: Boa 0.94.14rc21 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041271.html - http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041274.html - http://secunia.com/ad
May/041271.html - http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041274.html - http://secunia.com/advisories/39775 - http://www.securityfocus.com/bid/37718 - http://www.ush.it/team/ush/hack_httpd_escape/adv.txt - http://www.vupen.com/english/advisories/2010/1133 - http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041285.html - http://www.securityfocus.com/archive/1/508830/100/0/threaded