Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2009-4534 State: PUBLISHED Published: 2009-12-31T19:00:00Z Last Updated: 2024-09-16T18:43:37.575Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open redirect vulnerability in the FAQ Ask module 5.x and 6.x before 6.x-2.0, a module for Drupal, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://drupal.org/node/617444 - http://www.securityfocus.com/bid/36877
CVE ID: CVE-2009-4535 State: PUBLISHED Published: 2009-12-31T19:00:00Z Last Updated: 2024-09-17T00:56:01.571Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mongoose 2.8.0 and earlier allows remote attackers to obtain the source code for a web page by appending a / (slash) character to the URI. Additional Analyst Notes: - CVE Program Container: References: - http://pocoftheday.blogspot.com/2009/10/mongoose-web-server-v280-remote-source_22.html - http://secunia.com/advisories/36934 - http://freetexthost.com/0lcsrgt3vw
CVE ID: CVE-2009-4536 State: PUBLISHED Published: 2010-01-12T17:00:00 Last Updated: 2024-08-07T07:08:37.954Z Vendors: n/a Products: n/a Problem Types: n/a Description: drivers/net/e1000/e1000_main.c in the e1000 driver in the Linux kernel 2.6.32.3 and earlier handles Ethernet frames that exceed the MTU by processing certain trailing payload data as if it were a complete frame, which allows remote attackers to bypass packet filters via a large packet with a crafted payload. NOTE: this vulnerability exists because of an incorrect fix for CVE-2009-1385. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/35265 - http://secunia.com/advisories/38276 - ht
s: - CVE Program Container: References: - http://secunia.com/advisories/35265 - http://secunia.com/advisories/38276 - http://marc.info/?t=126203102000001&r=1&w=2 - http://securitytracker.com/id?1023420 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13226 - http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00008.html - http://www.redhat.com/support/errata/RHSA-2010-0111.html - http://secunia.com/advisories/38779 - https://bugzilla.redhat.com/show_bug.cgi?id=552126 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12440 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%
on/oval%3Aorg.mitre.oval%3Adef%3A12440 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10607 - http://secunia.com/advisories/38296 - http://blog.c22.cc/2009/12/27/26c3-cat-procsysnetipv4fuckups/ - http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.html - http://www.redhat.com/support/errata/RHSA-2010-0053.html - http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00000.html - http://www.redhat.com/support/errata/RHSA-2010-0882.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/55648 - http://www.debian.org/security/2010/dsa-1996 - http://www.redhat.com/support/errata/RHSA-2010-0019.html - http://www.openwall.com
w.debian.org/security/2010/dsa-1996 - http://www.redhat.com/support/errata/RHSA-2010-0019.html - http://www.openwall.com/lists/oss-security/2009/12/28/1 - http://www.vmware.com/security/advisories/VMSA-2011-0009.html - http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035159.html - http://www.securityfocus.com/bid/37519 - http://www.openwall.com/lists/oss-security/2009/12/29/2 - http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00007.html - http://events.ccc.de/congress/2009/Fahrplan/events/3596.en.html - https://rhn.redhat.com/errata/RHSA-2010-0095.html - http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00005.html - http://www.openwall.com/
A-2010-0095.html - http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00005.html - http://www.openwall.com/lists/oss-security/2009/12/31/1 - http://www.redhat.com/support/errata/RHSA-2010-0020.html - http://secunia.com/advisories/38031 - http://secunia.com/advisories/38610 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7453 - http://www.debian.org/security/2010/dsa-2005 - http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00002.html - http://www.redhat.com/support/errata/RHSA-2010-0041.html - http://secunia.com/advisories/38492
CVE ID: CVE-2009-4537 State: PUBLISHED Published: 2010-01-12T17:00:00 Last Updated: 2024-08-07T07:08:38.104Z Vendors: n/a Products: n/a Problem Types: n/a Description: drivers/net/r8169.c in the r8169 driver in the Linux kernel 2.6.32.3 and earlier does not properly check the size of an Ethernet frame that exceeds the MTU, which allows remote attackers to (1) cause a denial of service (temporary network outage) via a packet with a crafted size, in conjunction with certain packets containing A characters and certain packets containing E characters; or (2) cause a denial of service (system crash) via a packet with a crafted size, in conjunction with certain packets containing '\0' characters,
ervice (system crash) via a packet with a crafted size, in conjunction with certain packets containing '\0' characters, related to the value of the status register and erroneous behavior associated with the RxMaxSize register. NOTE: this vulnerability exists because of an incorrect fix for CVE-2009-1389. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=550907 - http://www.securityfocus.com/bid/37521 - http://lists.opensuse.org/opensuse-security-announce/2010-07/msg00006.html - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9439 - http://www.redhat.com/support/errata/RHSA-2010-0111.html - http:
/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9439 - http://www.redhat.com/support/errata/RHSA-2010-0111.html - http://blog.c22.cc/2009/12/27/26c3-cat-procsysnetipv4fuckups/ - http://securitytracker.com/id?1023419 - http://www.redhat.com/support/errata/RHSA-2010-0053.html - http://marc.info/?l=linux-netdev&m=126202972828626&w=2 - http://www.redhat.com/support/errata/RHSA-2010-0019.html - http://secunia.com/advisories/40645 - https://exchange.xforce.ibmcloud.com/vulnerabilities/55647 - http://www.openwall.com/lists/oss-security/2009/12/28/1 - http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035159.html - http://www.openwall.com/lists/oss-security/2009/12/29/2 - http:
g/pipermail/package-announce/2010-February/035159.html - http://www.openwall.com/lists/oss-security/2009/12/29/2 - http://www.novell.com/linux/security/advisories/2010_23_kernel.html - http://events.ccc.de/congress/2009/Fahrplan/events/3596.en.html - https://rhn.redhat.com/errata/RHSA-2010-0095.html - http://secunia.com/advisories/39742 - http://www.openwall.com/lists/oss-security/2009/12/31/1 - http://www.redhat.com/support/errata/RHSA-2010-0020.html - http://secunia.com/advisories/38031 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7443 - http://secunia.com/advisories/38610 - http://www.debian.org/security/2010/dsa-2053 - http://twitter.com/dakami
%3A7443 - http://secunia.com/advisories/38610 - http://www.debian.org/security/2010/dsa-2053 - http://twitter.com/dakami/statuses/7104238406 - http://marc.info/?t=126202986900002&r=1&w=2 - http://secunia.com/advisories/39830 - http://www.redhat.com/support/errata/RHSA-2010-0041.html - http://www.vupen.com/english/advisories/2010/1857
CVE ID: CVE-2009-4538 State: PUBLISHED Published: 2010-01-12T17:00:00 Last Updated: 2024-08-07T07:08:38.032Z Vendors: n/a Products: n/a Problem Types: n/a Description: drivers/net/e1000e/netdev.c in the e1000e driver in the Linux kernel 2.6.32.3 and earlier does not properly check the size of an Ethernet frame that exceeds the MTU, which allows remote attackers to have an unspecified impact via crafted packets, a related issue to CVE-2009-4537. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/38276 - http://securitytracker.com/id?1023420 - http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00008.html - https://exchange.xforce.ibmclou
d?1023420 - http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00008.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/55645 - https://bugzilla.redhat.com/show_bug.cgi?id=551214 - http://www.redhat.com/support/errata/RHSA-2010-0111.html - http://secunia.com/advisories/38779 - http://secunia.com/advisories/38296 - http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.html - http://www.redhat.com/support/errata/RHSA-2010-0053.html - http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00000.html - http://www.debian.org/security/2010/dsa-1996 - http://www.redhat.com/support/errata/RHSA-2010-0019.html - http://www.openwall.com/lists/oss-security/
y/2010/dsa-1996 - http://www.redhat.com/support/errata/RHSA-2010-0019.html - http://www.openwall.com/lists/oss-security/2009/12/28/1 - http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035159.html - http://www.mandriva.com/security/advisories?name=MDVSA-2010:066 - http://www.openwall.com/lists/oss-security/2009/12/29/2 - https://rhn.redhat.com/errata/RHSA-2010-0095.html - http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00005.html - http://www.openwall.com/lists/oss-security/2009/12/31/1 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9702 - http://www.redhat.com/support/errata/RHSA-2010-0020.html - http://secunia.
finition/oval%3Aorg.mitre.oval%3Adef%3A9702 - http://www.redhat.com/support/errata/RHSA-2010-0020.html - http://secunia.com/advisories/38031 - http://www.securityfocus.com/bid/37523 - http://secunia.com/advisories/38610 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7016 - http://www.debian.org/security/2010/dsa-2005 - http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00002.html - http://www.redhat.com/support/errata/RHSA-2010-0041.html - http://secunia.com/advisories/38492
CVE ID: CVE-2009-4539 State: PUBLISHED Published: 2010-01-04T17:00:00 Last Updated: 2024-08-07T07:08:38.124Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in main.php in SQLiteManager 1.2.0 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/52357 - http://secunia.com/advisories/28642 - http://www.securityfocus.com/bid/36002 - http://www.securityfocus.com/archive/1/505636/100/0/threaded
CVE ID: CVE-2009-4540 State: PUBLISHED Published: 2010-01-04T17:00:00 Last Updated: 2024-08-07T07:08:38.066Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in page.php in Mini CMS 1.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/9406 - https://exchange.xforce.ibmcloud.com/vulnerabilities/52369 - http://www.securityfocus.com/bid/36011
CVE ID: CVE-2009-4541 State: PUBLISHED Published: 2010-01-04T17:00:00 Last Updated: 2024-08-07T07:08:38.059Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple PHP remote file inclusion vulnerabilities in IsolSoft Support Center 2.5 allow remote attackers to execute arbitrary PHP code via a URL in the lang parameter to (1) newticket.php or (2) rempass.php, or a URL in the lang parameter in an adduser action to (3) index.php. NOTE: this can also be leveraged to include and execute arbitrary local files via .. (dot dot) sequences. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/56870 - http://www.securityfocus.com/bid/35997 - http://osvdb.org/
CVE Program Container: References: - http://osvdb.org/56870 - http://www.securityfocus.com/bid/35997 - http://osvdb.org/56869 - https://exchange.xforce.ibmcloud.com/vulnerabilities/52350 - http://secunia.com/advisories/36208 - http://www.exploit-db.com/exploits/9397 - http://osvdb.org/56871 - https://exchange.xforce.ibmcloud.com/vulnerabilities/52352
CVE ID: CVE-2009-4542 State: PUBLISHED Published: 2010-01-04T17:00:00 Last Updated: 2024-08-07T07:08:37.979Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in newticket.php in IsolSoft Support Center 2.5 allows remote attackers to inject arbitrary web script or HTML via the lang parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/35997 - http://www.exploit-db.com/exploits/9397 - https://exchange.xforce.ibmcloud.com/vulnerabilities/52351
CVE ID: CVE-2009-4543 State: PUBLISHED Published: 2010-01-04T17:00:00 Last Updated: 2024-08-07T07:08:38.375Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in index.php in Cromosoft Technologies Facil Helpdesk 2.3 Lite allows remote attackers to execute arbitrary PHP code via a URL in the lng parameter. NOTE: this can also be leveraged to include and execute arbitrary local files via .. (dot dot) sequences. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/52362 - https://exchange.xforce.ibmcloud.com/vulnerabilities/52363 - http://secunia.com/advisories/36209 - http://www.e
/52362 - https://exchange.xforce.ibmcloud.com/vulnerabilities/52363 - http://secunia.com/advisories/36209 - http://www.exploit-db.com/exploits/9396
CVE ID: CVE-2009-4544 State: PUBLISHED Published: 2010-01-04T17:00:00 Last Updated: 2024-08-07T07:08:37.950Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in kbase/kbase.php in Cromosoft Technologies Facil Helpdesk 2.3 Lite allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/36209 - http://www.exploit-db.com/exploits/9396 - https://exchange.xforce.ibmcloud.com/vulnerabilities/52361
CVE ID: CVE-2009-4545 State: PUBLISHED Published: 2010-01-04T17:00:00 Last Updated: 2024-08-07T07:08:37.958Z Vendors: n/a Products: n/a Problem Types: n/a Description: Logoshows BBS 2.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for database/globepersonnel.mdb. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/52365 - http://www.exploit-db.com/exploits/9400
CVE ID: CVE-2009-4546 State: PUBLISHED Published: 2010-01-04T17:00:00 Last Updated: 2024-08-07T07:08:37.974Z Vendors: n/a Products: n/a Problem Types: n/a Description: globepersonnel_login.asp in Logoshows BBS 2.0 allows remote attackers to bypass authentication and gain administrative access by setting the (1) pb_username (aka pb%5Fusername) and (2) level cookies. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/52366 - http://www.exploit-db.com/exploits/9400
CVE ID: CVE-2009-4547 State: PUBLISHED Published: 2010-01-04T17:00:00 Last Updated: 2024-08-07T07:08:38.001Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in ViArt CMS 3.x allow remote attackers to inject arbitrary web script or HTML via the (1) category_id parameter to forums.php, or the forum_id parameter to (2) forum.php or (3) forum_topic_new.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/36003 - https://exchange.xforce.ibmcloud.com/vulnerabilities/52371 - http://osvdb.org/56883 - http://secunia.com/advisories/36241 - http://packetstormsecurity.org/0908-exploits/viartc
371 - http://osvdb.org/56883 - http://secunia.com/advisories/36241 - http://packetstormsecurity.org/0908-exploits/viartcms-xss.txt - http://osvdb.org/56884 - http://osvdb.org/56885
CVE ID: CVE-2009-4548 State: PUBLISHED Published: 2010-01-04T17:00:00 Last Updated: 2024-08-07T07:08:38.040Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in ViArt Helpdesk 3.x allow remote attackers to inject arbitrary web script or HTML via the category_id parameter to (1) products.php, (2) article.php, (3) product_details.php, or (4) reviews.php; the (5) forum_id parameter to forum.php; or the (6) search_category_id parameter to products_search.php. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/36240 - https://exchange.xforce.ibmcloud.com/vulnerabilities/52349 - http://osvdb.o
ces: - http://secunia.com/advisories/36240 - https://exchange.xforce.ibmcloud.com/vulnerabilities/52349 - http://osvdb.org/56882 - http://osvdb.org/56879 - http://osvdb.org/56880 - http://osvdb.org/56878 - http://osvdb.org/56877 - http://packetstormsecurity.org/0908-exploits/viarthd-xss.txt - http://osvdb.org/56881
CVE ID: CVE-2009-4549 State: PUBLISHED Published: 2010-01-04T17:00:00 Last Updated: 2024-08-07T07:08:37.940Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in A2 Media Player Pro 2.51 allows remote attackers to execute arbitrary code via a long string in a (1) .m3u or (2) .m3l playlist file. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/9377
CVE ID: CVE-2009-4550 State: PUBLISHED Published: 2010-01-04T17:00:00 Last Updated: 2024-08-07T07:08:38.188Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the Kunena Forum (com_kunena) component 1.5.3 and 1.5.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the func parameter to index.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/9408 - http://www.securityfocus.com/bid/36020 - http://secunia.com/advisories/36245
CVE ID: CVE-2009-4551 State: PUBLISHED Published: 2010-01-04T17:00:00 Last Updated: 2024-08-07T07:08:38.023Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the Survey Pro module for Miniweb 2.0 allows remote attackers to execute arbitrary SQL commands via the campaign_id parameter in a results action to index.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/9339 - http://www.securityfocus.com/bid/35870
CVE ID: CVE-2009-4552 State: PUBLISHED Published: 2010-01-04T17:00:00 Last Updated: 2024-08-07T07:08:37.931Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Survey Pro module for Miniweb 2.0 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/9339 - http://www.securityfocus.com/bid/35870
CVE ID: CVE-2009-4553 State: PUBLISHED Published: 2010-01-04T17:00:00 Last Updated: 2024-08-07T07:08:37.994Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in iRehearse allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long string in a .m3u playlist file. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/9392 - https://exchange.xforce.ibmcloud.com/vulnerabilities/55479
CVE ID: CVE-2009-4554 State: PUBLISHED Published: 2010-01-04T21:00:00 Last Updated: 2024-08-07T07:08:37.916Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Snitz Forums 2000 3.4.07 allow remote attackers to inject arbitrary web script or HTML via (1) the url parameter to pop_send_to_friend.asp, related to a crafted onload attribute of an IMG element; or (2) an onload attribute in a sound tag. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/507207/100/0/threaded - http://www.securityfocus.com/bid/36710 - http://www.vupen.com/english/advisories/2009/2957 - https://exchange
threaded - http://www.securityfocus.com/bid/36710 - http://www.vupen.com/english/advisories/2009/2957 - https://exchange.xforce.ibmcloud.com/vulnerabilities/53804 - http://secunia.com/advisories/35733 - https://exchange.xforce.ibmcloud.com/vulnerabilities/53803
CVE ID: CVE-2009-4555 State: PUBLISHED Published: 2010-01-04T21:00:00 Last Updated: 2024-08-07T07:08:37.962Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in AgoraCart 5.2.005 and 5.2.006 and AgoraCart GOLD 5.5.005 allow remote attackers to hijack the authentication of administrators for requests that (1) modify a .htaccess file via an unspecified request to protected/manager.cgi or (2) change the password of an administrative account. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/36789 - http://holisticinfosec.org/content/view/129/45/ - https://exchange.xforce.ibmcloud.co
p://secunia.com/advisories/36789 - http://holisticinfosec.org/content/view/129/45/ - https://exchange.xforce.ibmcloud.com/vulnerabilities/53808
CVE ID: CVE-2009-4556 State: PUBLISHED Published: 2010-01-04T21:00:00 Last Updated: 2024-08-07T07:08:38.127Z Vendors: n/a Products: n/a Problem Types: n/a Description: Quick Heal AntiVirus Plus 2009 10.00 SP1 and Quick Heal Total Security 2009 10.00 SP1 use weak permissions (Everyone: Full Control) for the product files, which allows local users to gain privileges by replacing executables with Trojan horse programs, as demonstrated by replacing quhlpsvc.exe. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/53746 - http://www.securityfocus.com/bid/36662 - http://www.securityfocus.com/archive/1/507121/100/0/threaded - http://
/53746 - http://www.securityfocus.com/bid/36662 - http://www.securityfocus.com/archive/1/507121/100/0/threaded - http://secunia.com/advisories/37033
CVE ID: CVE-2009-4557 State: PUBLISHED Published: 2010-01-04T21:00:00 Last Updated: 2024-08-07T07:08:37.952Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Image Assist module 5.x-1.x before 5.x-1.8, 5.x-2.x before 2.0-alpha4, 6.x-1.x before 6.x-1.1, 6.x-2.x before 2.0-alpha4, and 6.x-3.x-dev before 2009-07-15, a module for Drupal, allows remote authenticated users, with image-node creation privileges, to inject arbitrary web script or HTML via a node title. Additional Analyst Notes: - CVE Program Container: References: - http://drupal.org/node/520564 - https://exchange.xforce.ibmcloud.com/vulnerabilities/51786 - http://www.security
nces: - http://drupal.org/node/520564 - https://exchange.xforce.ibmcloud.com/vulnerabilities/51786 - http://www.securityfocus.com/bid/35710 - http://secunia.com/advisories/35879 - http://osvdb.org/55866
CVE ID: CVE-2009-4558 State: PUBLISHED Published: 2010-01-04T21:00:00 Last Updated: 2024-08-07T07:08:37.939Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Image Assist module 5.x-1.x before 5.x-1.8, 5.x-2.x before 2.0-alpha4, 6.x-1.x before 6.x-1.1, 6.x-2.x before 2.0-alpha4, and 6.x-3.x-dev before 2009-07-15, a module for Drupal, does not properly enforce privilege requirements for unspecified pages, which allows remote attackers to read the (1) title or (2) body of an arbitrary node via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - http://drupal.org/node/520564 - http://osvdb.org/55867 - http://www.securityfocus.com/bid/35710 - https://e
eferences: - http://drupal.org/node/520564 - http://osvdb.org/55867 - http://www.securityfocus.com/bid/35710 - https://exchange.xforce.ibmcloud.com/vulnerabilities/51787 - http://secunia.com/advisories/35879