Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
227, and CVE-2009-1137. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/34881 - http://secunia.com/advisories/32428 - http://www.vupen.com/english/advisories/2009/1290 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-017 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6106 - http://www.securitytracker.com/id?1022205 - http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=789 - http://www.us-cert.gov/cas/techalerts/TA09-132A.html
CVE ID: CVE-2009-0227 State: PUBLISHED Published: 2009-05-12T22:00:00 Last Updated: 2024-08-07T04:24:18.263Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in the PowerPoint 4.2 conversion filter (PP4X32.DLL) in Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3 allows remote attackers to execute arbitrary code via a large number of structures in sound data in a file that uses a PowerPoint 4.0 native file format, leading to memory corruption, aka "Legacy File Format Vulnerability," a different vulnerability than CVE-2009-0222, CVE-2009-0223, CVE-2009-0226, and CVE-2009-1137. Additional Analyst Notes: - CVE Program Container: References: - htt
2, CVE-2009-0223, CVE-2009-0226, and CVE-2009-1137. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/32428 - http://www.vupen.com/english/advisories/2009/1290 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-017 - http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=787 - http://osvdb.org/54384 - http://www.securitytracker.com/id?1022205 - http://www.securityfocus.com/bid/34882 - http://www.us-cert.gov/cas/techalerts/TA09-132A.html - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6239
CVE ID: CVE-2009-0228 State: PUBLISHED Published: 2009-06-10T17:37:00 Last Updated: 2024-08-07T04:24:18.196Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in the EnumeratePrintShares function in Windows Print Spooler Service (win32spl.dll) in Microsoft Windows 2000 SP4 allows remote printer servers to execute arbitrary code via a crafted ShareName in a response to an RPC request, related to "printing data structures," aka "Buffer Overflow in Print Spooler Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - http://support.avaya.com/elmodocs2/security/ASA-2009-217.htm - https://oval.cisecurity.org/repository/search/definitio
- http://support.avaya.com/elmodocs2/security/ASA-2009-217.htm - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6317 - http://www.vupen.com/english/advisories/2009/1541 - http://www.us-cert.gov/cas/techalerts/TA09-160A.html - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-022 - http://www.securityfocus.com/bid/35206 - http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=806 - http://osvdb.org/54932 - http://secunia.com/advisories/35365 - http://www.securitytracker.com/id?1022352
CVE ID: CVE-2009-0229 State: PUBLISHED Published: 2009-06-10T17:37:00 Last Updated: 2024-08-07T04:24:18.406Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Windows Printing Service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 allows local users to read arbitrary files via a crafted separator page, aka "Print Spooler Read File Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - http://support.avaya.com/elmodocs2/security/ASA-2009-217.htm - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5815 - http://www.vupen.com/english/advisories/2009/1541 - h
/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5815 - http://www.vupen.com/english/advisories/2009/1541 - http://www.us-cert.gov/cas/techalerts/TA09-160A.html - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-022 - http://www.securityfocus.com/bid/35208 - http://secunia.com/advisories/35365 - http://www.securitytracker.com/id?1022352 - http://osvdb.org/54933
CVE ID: CVE-2009-0230 State: PUBLISHED Published: 2009-06-10T17:37:00 Last Updated: 2024-08-07T04:24:18.364Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Windows Print Spooler in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 allows remote authenticated users to gain privileges via a crafted RPC message that triggers loading of a DLL file from an arbitrary directory, aka "Print Spooler Load Library Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - http://support.avaya.com/elmodocs2/security/ASA-2009-217.htm - http://www.vupen.com/english/advisories/2009/1541 - http://www.securityfocus
a.com/elmodocs2/security/ASA-2009-217.htm - http://www.vupen.com/english/advisories/2009/1541 - http://www.securityfocus.com/bid/35209 - http://osvdb.org/54934 - http://www.us-cert.gov/cas/techalerts/TA09-160A.html - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-022 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6287 - http://secunia.com/advisories/35365 - http://www.securitytracker.com/id?1022352
CVE ID: CVE-2009-0231 State: PUBLISHED Published: 2009-07-15T15:00:00 Last Updated: 2024-08-07T04:24:18.356Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Embedded OpenType (EOT) Font Engine (T2EMBED.DLL) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via a crafted name table in a data record that triggers an integer truncation and a heap-based buffer overflow, aka "Embedded OpenType Font Heap Overflow Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/m
Notes: - CVE Program Container: References: - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-029 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5457 - http://osvdb.org/55842 - http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=811 - http://www.vupen.com/english/advisories/2009/1887 - http://www.securitytracker.com/id?1022543 - http://www.us-cert.gov/cas/techalerts/TA09-195A.html
CVE ID: CVE-2009-0232 State: PUBLISHED Published: 2009-07-15T15:00:00 Last Updated: 2024-08-07T04:24:18.357Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in the Embedded OpenType (EOT) Font Engine in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via a crafted name table, aka "Embedded OpenType Font Integer Overflow Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-029 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg
s/security-updates/securitybulletins/2009/ms09-029 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5678 - http://www.vupen.com/english/advisories/2009/1887 - http://www.securitytracker.com/id?1022543 - http://www.us-cert.gov/cas/techalerts/TA09-195A.html
CVE ID: CVE-2009-0233 State: PUBLISHED Published: 2009-03-11T14:00:00 Last Updated: 2024-08-07T04:24:18.375Z Vendors: n/a Products: n/a Problem Types: n/a Description: The DNS Resolver Cache Service (aka DNSCache) in Windows DNS Server in Microsoft Windows 2000 SP4, Server 2003 SP1 and SP2, and Server 2008, when dynamic updates are enabled, does not reuse cached DNS responses in all applicable situations, which makes it easier for remote attackers to predict transaction IDs and poison caches by simultaneously sending crafted DNS queries and responses, aka "DNS Server Query Validation Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://oval.cisecurity.org/
Validation Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6228 - http://www.us-cert.gov/cas/techalerts/TA09-069A.html - http://www.vupen.com/english/advisories/2009/0661 - http://secunia.com/advisories/34217 - http://www.securityfocus.com/bid/33982 - http://support.avaya.com/elmodocs2/security/ASA-2009-083.htm - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-008 - http://www.securitytracker.com/id?1021831 - http://blogs.technet.com/srd/archive/2009/03/13/ms09-008-dns-and-wins-server-security-update-in-more-detail.aspx - http://osvdb.org/52517
CVE ID: CVE-2009-0234 State: PUBLISHED Published: 2009-03-11T14:00:00 Last Updated: 2024-08-07T04:24:18.478Z Vendors: n/a Products: n/a Problem Types: n/a Description: The DNS Resolver Cache Service (aka DNSCache) in Windows DNS Server in Microsoft Windows 2000 SP4, Server 2003 SP1 and SP2, and Server 2008 does not properly cache crafted DNS responses, which makes it easier for remote attackers to predict transaction IDs and poison caches by sending many crafted DNS queries that trigger "unnecessary lookups," aka "DNS Server Response Validation Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - http://www.us-cert.gov/cas/techalerts/TA09-069A.html - http://www.vu
alyst Notes: - CVE Program Container: References: - http://www.us-cert.gov/cas/techalerts/TA09-069A.html - http://www.vupen.com/english/advisories/2009/0661 - http://secunia.com/advisories/34217 - http://www.kb.cert.org/vuls/id/319331 - http://osvdb.org/52518 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5715 - http://support.avaya.com/elmodocs2/security/ASA-2009-083.htm - http://www.securityfocus.com/bid/33988 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-008 - http://www.securitytracker.com/id?1021831 - http://blogs.technet.com/srd/archive/2009/03/13/ms09-008-dns-and-wins-server-security-update-in-more-detail.aspx
CVE ID: CVE-2009-0235 State: PUBLISHED Published: 2009-04-15T03:49:00 Last Updated: 2024-08-07T04:24:18.448Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in the Word 97 text converter in WordPad in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted Word 97 file that triggers memory corruption, related to use of inconsistent integer data sizes for an unspecified length field, aka "WordPad Word 97 Text Converter Stack Overflow Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/34470 - http://www.securitytra
al Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/34470 - http://www.securitytracker.com/id?1022043 - http://www.us-cert.gov/cas/techalerts/TA09-104A.html - http://osvdb.org/53664 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5893 - http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=783 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-010 - http://www.vupen.com/english/advisories/2009/1024
CVE ID: CVE-2009-0236 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2009-0237 State: PUBLISHED Published: 2009-04-15T03:49:00 Last Updated: 2024-08-07T04:24:18.379Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in cookieauth.dll in the HTML forms authentication component in Microsoft Forefront Threat Management Gateway, Medium Business Edition (TMG MBE); and Internet Security and Acceleration (ISA) Server 2006, 2006 Supportability Update, and 2006 SP1; allows remote attackers to inject arbitrary web script or HTML via "authentication input" to this component, aka "Cross-Site Scripting Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://docs.microsoft.com/en
Scripting Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-016 - http://osvdb.org/53637 - http://www.us-cert.gov/cas/techalerts/TA09-104A.html - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5771 - http://www.vupen.com/english/advisories/2009/1030 - http://www.securitytracker.com/id?1022046 - http://secunia.com/advisories/34687
CVE ID: CVE-2009-0238 State: PUBLISHED Published: 2009-02-25T16:00:00 Last Updated: 2024-08-07T04:24:18.463Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1; and Excel in Microsoft Office 2004 and 2008 for Mac allow remote attackers to execute arbitrary code via a crafted Excel document that triggers an access attempt on an invalid object, as exploited in the wild in February 2009 by Trojan.Mdropper.AC. Additional Analyst Notes: - CVE Program Container: References: - http://www.microsoft.com/techne
by Trojan.Mdropper.AC. Additional Analyst Notes: - CVE Program Container: References: - http://www.microsoft.com/technet/security/advisory/968272.mspx - http://www.vupen.com/english/advisories/2009/1023 - https://exchange.xforce.ibmcloud.com/vulnerabilities/48875 - http://www.us-cert.gov/cas/techalerts/TA09-104A.html - http://www.securityfocus.com/bid/33870 - http://www.symantec.com/business/security_response/writeup.jsp?docid=2009-022310-4202-99 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-009 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5968 - http://isc.sans.org/diary.html?storyid=5923 - http://securitytracker
rch/definition/oval%3Aorg.mitre.oval%3Adef%3A5968 - http://isc.sans.org/diary.html?storyid=5923 - http://securitytracker.com/id?1021744 - http://blogs.zdnet.com/security/?p=2658
CVE ID: CVE-2009-0239 State: PUBLISHED Published: 2009-06-10T17:37:00 Last Updated: 2024-08-07T04:24:18.368Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Windows Search 4.0 for Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted file that appears in a preview in a search result, aka "Script Execution in Windows Search Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2009/1542 - http://osvdb.org/54935 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009
advisories/2009/1542 - http://osvdb.org/54935 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-023 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5428 - http://www.us-cert.gov/cas/techalerts/TA09-160A.html - http://www.securitytracker.com/id?1022353 - http://secunia.com/advisories/35366
CVE ID: CVE-2009-0240 State: PUBLISHED Published: 2009-01-21T02:00:00 Last Updated: 2024-08-07T04:24:18.369Z Vendors: n/a Products: n/a Problem Types: n/a Description: listing.php in WebSVN 2.0 and possibly 1.7 beta, when using an SVN authz file, allows remote authenticated users to read changelogs or diffs for restricted projects via a modified repname parameter. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/33945 - http://secunia.com/advisories/34191 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=512191 - http://www.gentoo.org/security/en/glsa/glsa-200903-20.xml - https://exchange.xforce.ibmcloud.com/vulnerabilities/48171 - http://www.op
too.org/security/en/glsa/glsa-200903-20.xml - https://exchange.xforce.ibmcloud.com/vulnerabilities/48171 - http://www.openwall.com/lists/oss-security/2009/01/18/2 - http://secunia.com/advisories/32338 - http://www.debian.org/security/2009/dsa-1725
CVE ID: CVE-2009-0241 State: PUBLISHED Published: 2009-01-21T11:00:00 Last Updated: 2024-08-07T04:24:18.448Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in the process_path function in gmetad/server.c in Ganglia 3.1.1 allows remote attackers to cause a denial of service (crash) via a request to the gmetad service with a long pathname. Additional Analyst Notes: - CVE Program Container: References: - http://bugzilla.ganglia.info/cgi-bin/bugzilla/show_bug.cgi?id=223 - http://security.gentoo.org/glsa/glsa-200903-22.xml - http://secunia.com/advisories/33506 - http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html - http://secunia.com/
.com/advisories/33506 - http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html - http://secunia.com/advisories/34228 - http://www.mail-archive.com/ganglia-developers%40lists.sourceforge.net/msg04929.html - http://www.securityfocus.com/bid/33299 - http://secunia.com/advisories/35416
CVE ID: CVE-2009-0242 State: REJECTED Published: 2009-01-21T11:00:00 Last Updated: 2017-08-07T12:57:01 Description: No description available.
CVE ID: CVE-2009-0243 State: PUBLISHED Published: 2009-01-21T20:00:00 Last Updated: 2024-08-07T04:24:18.493Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Windows does not properly enforce the Autorun and NoDriveTypeAutoRun registry values, which allows physically proximate attackers to execute arbitrary code by (1) inserting CD-ROM media, (2) inserting DVD media, (3) connecting a USB device, and (4) connecting a Firewire device; (5) allows user-assisted remote attackers to execute arbitrary code by mapping a network drive; and allows user-assisted attackers to execute arbitrary code by clicking on (6) an icon under My Computer\Devices with Removable Storage and (7) an
tackers to execute arbitrary code by clicking on (6) an icon under My Computer\Devices with Removable Storage and (7) an option in an AutoPlay dialog, related to the Autorun.inf file. NOTE: vectors 1 and 3 on Vista are already covered by CVE-2008-0951. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id?1021629 - http://isc.sans.org/diary.html?storyid=5695 - http://www.us-cert.gov/cas/techalerts/TA09-020A.html
CVE ID: CVE-2009-0244 State: PUBLISHED Published: 2009-01-21T20:00:00 Last Updated: 2024-08-07T04:24:18.392Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the OBEX FTP Service in the Microsoft Bluetooth stack in Windows Mobile 6 Professional, and probably Windows Mobile 5.0 for Pocket PC and 5.0 for Pocket PC Phone Edition, allows remote authenticated users to list arbitrary directories, and create or read arbitrary files, via a .. (dot dot) in a pathname. NOTE: this can be leveraged for code execution by writing to a Startup folder. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/33598 - http://
p folder. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/33598 - http://www.seguridadmobile.com/windows-mobile/windows-mobile-security/Microsoft-Bluetooth-Stack-Directory-Traversal.html - http://www.securityfocus.com/archive/1/500199/100/0/threaded - http://securityreason.com/securityalert/4938 - http://www.securityfocus.com/bid/33359 - https://exchange.xforce.ibmcloud.com/vulnerabilities/48124
CVE ID: CVE-2009-0245 State: PUBLISHED Published: 2009-01-22T02:00:00Z Last Updated: 2024-09-17T00:06:51.124Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Usagi Project MyNETS 1.2.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different issue than CVE-2008-4629. Additional Analyst Notes: - CVE Program Container: References: - http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000001.html - http://usagi-project.org/PRESS/archives/57 - http://secunia.com/advisories/33409 - http://jvn.jp/en/jp/JVN36802959/index.html - http://www.securityfocus.com/bid/33145
CVE ID: CVE-2009-0246 State: PUBLISHED Published: 2009-01-22T16:00:00 Last Updated: 2024-08-07T04:24:18.425Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in easyHDR PRO 1.60.2 allows user-assisted attackers to execute arbitrary code via an invalid Radiance RGBE (aka .hdr) file. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/4941 - http://secunia.com/secunia_research/2008-61/ - http://www.vupen.com/english/advisories/2009/0190 - http://www.securityfocus.com/bid/33363 - http://easyhdr.com/version.php - http://www.securityfocus.com/archive/1/500192/100/0/threaded - http://secunia.com/advisories/3
easyhdr.com/version.php - http://www.securityfocus.com/archive/1/500192/100/0/threaded - http://secunia.com/advisories/33468 - https://exchange.xforce.ibmcloud.com/vulnerabilities/48119 - http://osvdb.org/51609
CVE ID: CVE-2009-0247 State: PUBLISHED Published: 2009-01-22T16:00:00 Last Updated: 2024-08-07T04:24:18.419Z Vendors: n/a Products: n/a Problem Types: n/a Description: The server for 53KF Web IM 2009 Home, Professional, and Enterprise editions relies on client-side protection mechanisms against cross-site scripting (XSS), which allows remote attackers to conduct XSS attacks by using a modified client to send a crafted IM message, related to the msg variable. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/33341 - https://exchange.xforce.ibmcloud.com/vulnerabilities/48096 - http://www.securityfocus.com/archive/1/500169/100/0/threaded
CVE ID: CVE-2009-0248 State: PUBLISHED Published: 2009-01-22T16:00:00 Last Updated: 2024-08-07T04:24:18.369Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in rankup.asp in Katy Whitton RankEm allows remote attackers to inject arbitrary web script or HTML via the siteID parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/48071 - http://www.securityfocus.com/bid/33324 - https://www.exploit-db.com/exploits/7805 - https://exchange.xforce.ibmcloud.com/vulnerabilities/48072
CVE ID: CVE-2009-0249 State: PUBLISHED Published: 2009-01-22T16:00:00 Last Updated: 2024-08-07T04:24:18.500Z Vendors: n/a Products: n/a Problem Types: n/a Description: Katy Whitton RankEm stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing credentials via a direct request for database/topsites.mdb. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/48070 - https://www.exploit-db.com/exploits/7805
CVE ID: CVE-2009-0250 State: PUBLISHED Published: 2009-01-22T16:00:00 Last Updated: 2024-08-07T04:24:18.419Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ryneezy phoSheezy 0.2 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the file containing the administrator's password hash via a direct request for config/password. Additional Analyst Notes: - CVE Program Container: References: - http://securityreason.com/securityalert/4935 - http://osvdb.org/51411 - https://www.exploit-db.com/exploits/7780 - http://secunia.com/advisories/33531 - https://exchange.xforce.ibmcloud.com/vulnerabilities/48056