Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
009/08/multiple-browsers-fake-url-folder-file.html - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6437 - https://exchange.xforce.ibmcloud.com/vulnerabilities/53009
CVE ID: CVE-2009-3007 State: PUBLISHED Published: 2009-08-28T15:00:00 Last Updated: 2024-08-07T06:14:55.159Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mozilla Firefox 3.5.1 and SeaMonkey 1.1.17, and Flock 2.5.1, allow context-dependent attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary file: URL after a victim has visited any file: URL, as demonstrated by a visit to a file: document written by the attacker. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/53010 - http://lostmon.blogspot.com/2009/08/multiple-browsers-fake-url-folder-file.html
CVE ID: CVE-2009-3008 State: PUBLISHED Published: 2009-08-28T15:00:00 Last Updated: 2024-08-07T06:14:55.254Z Vendors: n/a Products: n/a Problem Types: n/a Description: K-Meleon 1.5.3 allows context-dependent attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary file: URL after a victim has visited any file: URL, as demonstrated by a visit to a file: document written by the attacker. Additional Analyst Notes: - CVE Program Container: References: - http://lostmon.blogspot.com/2009/08/multiple-browsers-fake-url-folder-file.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/53011
CVE ID: CVE-2009-3009 State: PUBLISHED Published: 2009-09-08T18:00:00 Last Updated: 2024-08-07T06:14:55.295Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Ruby on Rails 2.x before 2.2.3, and 2.3.x before 2.3.4, allows remote attackers to inject arbitrary web script or HTML by placing malformed Unicode strings into a form helper. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/36278 - http://weblog.rubyonrails.org/2009/9/4/xss-vulnerability-in-ruby-on-rails - http://secunia.com/advisories/36600 - http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html - http://www.vupen
unia.com/advisories/36600 - http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html - http://www.vupen.com/english/advisories/2009/2544 - https://exchange.xforce.ibmcloud.com/vulnerabilities/53036 - http://support.apple.com/kb/HT4077 - http://www.debian.org/security/2009/dsa-1887 - http://groups.google.com/group/rubyonrails-security/msg/7f57cd7794e1d1b4?dmode=source - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=545063 - http://www.osvdb.org/57666 - http://securitytracker.com/id?1022824 - http://secunia.com/advisories/36717 - http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html
CVE ID: CVE-2009-3010 State: PUBLISHED Published: 2009-08-31T16:00:00 Last Updated: 2024-08-07T06:14:55.402Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre; SeaMonkey 1.1.17; and Mozilla 1.7.x and earlier do not properly block data: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header that contains JavaScript sequences in a data:text/html URI or (2) entering a data:text/html URI with JavaScript sequences when specifying the content of a Refresh header. NOTE: in some product versions, the JavaScr
I with JavaScript sequences when specifying the content of a Refresh header. NOTE: in some product versions, the JavaScript executes outside of the context of the HTTP site. Additional Analyst Notes: - CVE Program Container: References: - http://websecurity.com.ua/3386/ - http://websecurity.com.ua/3315/ - https://exchange.xforce.ibmcloud.com/vulnerabilities/52999
CVE ID: CVE-2009-3011 State: PUBLISHED Published: 2009-08-31T16:00:00 Last Updated: 2024-08-07T06:14:55.398Z Vendors: n/a Products: n/a Problem Types: n/a Description: Google Chrome 1.0.154.48 and earlier, 2.0.172.28, 2.0.172.37, and 3.0.193.2 Beta does not properly block data: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header that contains JavaScript sequences in a data:text/html URI or (2) entering a data:text/html URI with JavaScript sequences when specifying the content of a Refresh header. NOTE: the JavaScript executes outside of the context of the HTTP site. Additi
pecifying the content of a Refresh header. NOTE: the JavaScript executes outside of the context of the HTTP site. Additional Analyst Notes: - CVE Program Container: References: - http://websecurity.com.ua/3386/ - http://websecurity.com.ua/3315/ - https://exchange.xforce.ibmcloud.com/vulnerabilities/52998
CVE ID: CVE-2009-3012 State: PUBLISHED Published: 2009-08-31T16:00:00Z Last Updated: 2024-09-16T23:26:15.470Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre does not properly block data: URIs in Location headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Location header that contains JavaScript sequences in a data:text/html URI or (2) entering a data:text/html URI with JavaScript sequences when specifying the content of a Location header. NOTE: the JavaScript executes outside of the context of the HTTP site. Additional Anal
the content of a Location header. NOTE: the JavaScript executes outside of the context of the HTTP site. Additional Analyst Notes: - CVE Program Container: References: - http://websecurity.com.ua/3386/ - http://websecurity.com.ua/3323/
CVE ID: CVE-2009-3013 State: PUBLISHED Published: 2009-08-31T16:00:00 Last Updated: 2024-08-07T06:14:55.168Z Vendors: n/a Products: n/a Problem Types: n/a Description: Opera 9.52 and earlier, and 10.00 Beta 3 Build 1699, does not properly block data: URIs in Location headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Location header that contains JavaScript sequences in a data:text/html URI or (2) entering a data:text/html URI with JavaScript sequences when specifying the content of a Location header. NOTE: the JavaScript executes outside of the context of the HTTP site. Additional Analyst Notes: - CVE
Location header. NOTE: the JavaScript executes outside of the context of the HTTP site. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/52996 - http://websecurity.com.ua/3386/ - http://websecurity.com.ua/3323/
CVE ID: CVE-2009-3014 State: PUBLISHED Published: 2009-08-31T16:00:00 Last Updated: 2024-08-07T06:14:55.185Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre; SeaMonkey 1.1.17; and Mozilla 1.7.x and earlier do not properly handle javascript: URIs in HTML links within 302 error documents sent from web servers, which allows user-assisted remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Location HTTP response header or (2) specifying the content of a Location HTTP response header. Additional Analyst Notes: - CVE Program Container: References: - http://websecurity.co
a Location HTTP response header. Additional Analyst Notes: - CVE Program Container: References: - http://websecurity.com.ua/3373/ - http://websecurity.com.ua/3386/ - https://exchange.xforce.ibmcloud.com/vulnerabilities/52995 - http://www.securityfocus.com/archive/1/506163/100/0/threaded
CVE ID: CVE-2009-3015 State: PUBLISHED Published: 2009-08-31T16:00:00 Last Updated: 2024-08-07T06:14:55.254Z Vendors: n/a Products: n/a Problem Types: n/a Description: QtWeb 3.0 Builds 001 and 003 does not properly block javascript: and data: URIs in Refresh and Location headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header that contains a javascript: URI, (2) entering a javascript: URI when specifying the content of a Refresh header, (3) injecting a Refresh header that contains JavaScript sequences in a data:text/html URI, (4) entering a data:text/html URI with JavaScript sequences when sp
ntains JavaScript sequences in a data:text/html URI, (4) entering a data:text/html URI with JavaScript sequences when specifying the content of a Refresh header, (5) injecting a Location header that contains JavaScript sequences in a data:text/html URI, or (6) entering a data:text/html URI with JavaScript sequences when specifying the content of a Location header. Additional Analyst Notes: - CVE Program Container: References: - http://websecurity.com.ua/3386/ - https://exchange.xforce.ibmcloud.com/vulnerabilities/52993
CVE ID: CVE-2009-3016 State: PUBLISHED Published: 2009-08-31T16:00:00 Last Updated: 2024-08-07T06:14:55.257Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apple Safari 4.0.3 does not properly block javascript: and data: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header that contains a javascript: URI, (2) entering a javascript: URI when specifying the content of a Refresh header, (3) injecting a Refresh header that contains JavaScript sequences in a data:text/html URI, or (4) entering a data:text/html URI with JavaScript sequences when specifying the content
nces in a data:text/html URI, or (4) entering a data:text/html URI with JavaScript sequences when specifying the content of a Refresh header. Additional Analyst Notes: - CVE Program Container: References: - http://websecurity.com.ua/3386/ - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6475 - https://exchange.xforce.ibmcloud.com/vulnerabilities/52992
CVE ID: CVE-2009-3017 State: PUBLISHED Published: 2009-08-31T16:00:00 Last Updated: 2024-08-07T06:14:55.495Z Vendors: n/a Products: n/a Problem Types: n/a Description: Orca Browser 1.2 build 5 does not properly block data: URIs in Refresh and Location headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header that contains JavaScript sequences in a data:text/html URI, (2) entering a data:text/html URI with JavaScript sequences when specifying the content of a Refresh header, (3) injecting a Location header that contains JavaScript sequences in a data:text/html URI, or (4) entering a data:text/ht
) injecting a Location header that contains JavaScript sequences in a data:text/html URI, or (4) entering a data:text/html URI with JavaScript sequences when specifying the content of a Location header; and does not properly handle javascript: URIs in HTML links within 302 error documents sent from web servers, which allows user-assisted remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (5) injecting a Location HTTP response header or (6) specifying the content of a Location HTTP response header. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/53002 - http://websecurity.com.ua/3386/ - ht
ntainer: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/53002 - http://websecurity.com.ua/3386/ - http://www.securityfocus.com/archive/1/506163/100/0/threaded
CVE ID: CVE-2009-3018 State: PUBLISHED Published: 2009-08-31T16:00:00 Last Updated: 2024-08-07T06:14:55.546Z Vendors: n/a Products: n/a Problem Types: n/a Description: Maxthon Browser 3.0.0.145 Alpha with Ultramode does not properly block javascript: and data: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header that contains a javascript: URI, (2) entering a javascript: URI when specifying the content of a Refresh header, (3) injecting a Refresh header that contains JavaScript sequences in a data:text/html URI, or (4) entering a data:text/html URI with JavaScript sequences
at contains JavaScript sequences in a data:text/html URI, or (4) entering a data:text/html URI with JavaScript sequences when specifying the content of a Refresh header; does not properly block data: URIs in Location headers in HTTP responses, which allows user-assisted remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (5) injecting a Location header that contains JavaScript sequences in a data:text/html URI or (6) entering a data:text/html URI with JavaScript sequences when specifying the content of a Location header; and does not properly handle javascript: URIs in HTML links within (a) 301 and (b) 302 error documents sent from web servers, which allows
ly handle javascript: URIs in HTML links within (a) 301 and (b) 302 error documents sent from web servers, which allows user-assisted remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (7) injecting a Location HTTP response header or (8) specifying the content of a Location HTTP response header. Additional Analyst Notes: - CVE Program Container: References: - http://websecurity.com.ua/3386/ - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6524 - https://exchange.xforce.ibmcloud.com/vulnerabilities/53001 - http://www.securityfocus.com/archive/1/506163/100/0/threaded
CVE ID: CVE-2009-3019 State: PUBLISHED Published: 2009-08-31T16:00:00 Last Updated: 2024-08-07T06:14:55.767Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Internet Explorer 6 on Windows XP SP2 and SP3, and Internet Explorer 7 on Vista, allows remote attackers to cause a denial of service (application crash) via JavaScript code that calls createElement to create an instance of the LI element, and then calls setAttribute to set the value attribute. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/9455
CVE ID: CVE-2009-3020 State: PUBLISHED Published: 2009-08-31T16:00:00 Last Updated: 2024-08-07T06:14:55.231Z Vendors: n/a Products: n/a Problem Types: n/a Description: win32k.sys in Microsoft Windows Server 2003 SP2 allows remote attackers to cause a denial of service (system crash) by referencing a crafted .eot file in the src descriptor of an @font-face Cascading Style Sheets (CSS) rule in an HTML document, possibly related to the Embedded OpenType (EOT) Font Engine, a different vulnerability than CVE-2006-0010, CVE-2009-0231, and CVE-2009-0232. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://sec
s are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/36250 - http://milw0rm.com/sploits/2009-wwbsod.zip - http://www.osvdb.org/57016 - http://www.securityfocus.com/bid/36029 - http://www.exploit-db.com/exploits/9417 - https://exchange.xforce.ibmcloud.com/vulnerabilities/52403
CVE ID: CVE-2009-3021 State: PUBLISHED Published: 2009-08-31T20:00:00Z Last Updated: 2024-09-16T16:13:46.423Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Site Calendar 'mycaljp' plugin 2.0.0 through 2.0.6, as used in the Japanese extended package of Geeklog 1.5.0 through 1.5.2 and when distributed 20090629 or earlier, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvn.jp/en/jp/JVN20478978/index.html - http://www.geeklog.jp/article.php/20090820020302431 - http://secunia.com/advisories/36404 - http://jvndb.jvn.jp/ja/contents
p://www.geeklog.jp/article.php/20090820020302431 - http://secunia.com/advisories/36404 - http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000055.html - http://secunia.com/advisories/36413
CVE ID: CVE-2009-3022 State: PUBLISHED Published: 2009-08-31T20:00:00 Last Updated: 2025-01-21T16:08:56.507Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in bingo!CMS 1.2 and earlier allows remote attackers to hijack the authentication of other users for requests that modify configuration or change content via unspecified vectors. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/52838 - http://osvdb.org/57425 - http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000058.html - http://www.bingo-cms.jp/security/jvn68640473.html - http://jvn.jp/e
ndb.jvn.jp/ja/contents/2009/JVNDB-2009-000058.html - http://www.bingo-cms.jp/security/jvn68640473.html - http://jvn.jp/en/jp/JVN68640473/index.html - http://secunia.com/advisories/36458
CVE ID: CVE-2009-3023 State: PUBLISHED Published: 2009-08-31T20:00:00 Last Updated: 2024-08-07T06:14:55.348Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the FTP Service in Microsoft Internet Information Services (IIS) 5.0 through 6.0 allows remote authenticated users to execute arbitrary code via a crafted NLST (NAME LIST) command that uses wildcards, leading to memory corruption, aka "IIS FTP Service RCE and DoS Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - http://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ975191 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6080 - h
b%3B%5BLN%5D%3BQ975191 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6080 - http://www.securityfocus.com/bid/36189 - http://www.exploit-db.com/exploits/9541 - http://www.us-cert.gov/cas/techalerts/TA09-286A.html - http://www.vupen.com/english/advisories/2009/2481 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-053 - http://www.exploit-db.com/exploits/9559 - http://www.kb.cert.org/vuls/id/276653
CVE ID: CVE-2009-3024 State: PUBLISHED Published: 2009-08-31T20:00:00 Last Updated: 2024-08-07T06:14:55.277Z Vendors: n/a Products: n/a Problem Types: n/a Description: The verify_hostname_of_cert function in the certificate checking feature in IO-Socket-SSL (IO::Socket::SSL) 1.14 through 1.25 only matches the prefix of a hostname when no wildcard is used, which allows remote attackers to bypass the hostname check for a certificate. Additional Analyst Notes: - CVE Program Container: References: - http://cpansearch.perl.org/src/SULLR/IO-Socket-SSL-1.30/Changes - http://www.vupen.com/english/advisories/2011/0118 - http://www.gentoo.org/security/en/glsa/glsa-201101-06.xml - http://lists.opensuse
pen.com/english/advisories/2011/0118 - http://www.gentoo.org/security/en/glsa/glsa-201101-06.xml - http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.html - http://secunia.com/advisories/42893 - http://www.openwall.com/lists/oss-security/2009/08/28/1 - http://www.openwall.com/lists/oss-security/2009/08/29/1 - http://www.openwall.com/lists/oss-security/2009/08/31/4
CVE ID: CVE-2009-3025 State: PUBLISHED Published: 2009-08-31T20:00:00 Last Updated: 2024-08-07T06:14:55.424Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in Pidgin 2.6.0 allows remote attackers to cause a denial of service (crash) via a link in a Yahoo IM. Additional Analyst Notes: - CVE Program Container: References: - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6167 - https://exchange.xforce.ibmcloud.com/vulnerabilities/52994 - http://www.openwall.com/lists/oss-security/2009/08/19/2 - http://developer.pidgin.im/wiki/ChangeLog
CVE ID: CVE-2009-3026 State: PUBLISHED Published: 2009-08-31T20:00:00 Last Updated: 2024-08-07T06:14:55.553Z Vendors: n/a Products: n/a Problem Types: n/a Description: protocols/jabber/auth.c in libpurple in Pidgin 2.6.0, and possibly other versions, does not follow the "require TLS/SSL" preference when connecting to older Jabber servers that do not follow the XMPP specification, which causes libpurple to connect to the server without the expected encryption and allows remote attackers to sniff sessions. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/36368 - http://developer.pidgin.im/viewmtn/revision/diff/312e056d702d29379ea61aea9d27765f127
//www.securityfocus.com/bid/36368 - http://developer.pidgin.im/viewmtn/revision/diff/312e056d702d29379ea61aea9d27765f127bc888/with/55897c4ce0787edc1e7721b7f4a9b5cbc8357279 - http://developer.pidgin.im/ticket/8131 - http://secunia.com/advisories/37071 - http://www.openwall.com/lists/oss-security/2009/08/24/2 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=542891 - https://exchange.xforce.ibmcloud.com/vulnerabilities/53000 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5757 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11070
CVE ID: CVE-2009-3027 State: PUBLISHED Published: 2009-12-11T16:00:00 Last Updated: 2024-08-07T06:14:56.480Z Vendors: n/a Products: n/a Problem Types: n/a Description: VRTSweb.exe in VRTSweb in Symantec Backup Exec Continuous Protection Server (CPS) 11d, 12.0, and 12.5; Veritas NetBackup Operations Manager (NOM) 6.0 GA through 6.5.5; Veritas Backup Reporter (VBR) 6.0 GA through 6.6; Veritas Storage Foundation (SF) 3.5; Veritas Storage Foundation for Windows High Availability (SFWHA) 4.3MP2, 5.0, 5.0RP1a, 5.0RP2, 5.1, and 5.1AP1; Veritas Storage Foundation for High Availability (SFHA) 3.5; Veritas Storage Foundation for Oracle (SFO) 4.1, 5.0, and 5.0.1; Veritas Storage Foundation for DB2 4.1
ity (SFHA) 3.5; Veritas Storage Foundation for Oracle (SFO) 4.1, 5.0, and 5.0.1; Veritas Storage Foundation for DB2 4.1 and 5.0; Veritas Storage Foundation for Sybase 4.1 and 5.0; Veritas Storage Foundation for Oracle Real Application Cluster (SFRAC) 3.5, 4.0, 4.1, and 5.0; Veritas Storage Foundation Manager (SFM) 1.0, 1.0 MP1, 1.1, 1.1.1Ux, 1.1.1Win, and 2.0; Veritas Cluster Server (VCS) 3.5, 4.0, 4.1, and 5.0; Veritas Cluster Server One (VCSOne) 2.0, 2.0.1, and 2.0.2; Veritas Application Director (VAD) 1.1 and 1.1 Platform Expansion; Veritas Cluster Server Management Console (VCSMC) 5.1, 5.5, and 5.5.1; Veritas Storage Foundation Cluster File System (SFCFS) 3.5, 4.0, 4.1, and 5.0; Veritas
ole (VCSMC) 5.1, 5.5, and 5.5.1; Veritas Storage Foundation Cluster File System (SFCFS) 3.5, 4.0, 4.1, and 5.0; Veritas Storage Foundation Cluster File System for Oracle RAC (SFCFS RAC) 5.0; Veritas Command Central Storage (CCS) 4.x, 5.0, and 5.1; Veritas Command Central Enterprise Reporter (CC-ER) 5.0 GA, 5.0 MP1, 5.0 MP1RP1, and 5.1; Veritas Command Central Storage Change Manager (CC-SCM) 5.0 and 5.1; and Veritas MicroMeasure 5.0 does not properly validate authentication requests, which allows remote attackers to trigger the unpacking of a WAR archive, and execute arbitrary code in the contained files, via crafted data to TCP port 14300. Additional Analyst Notes: - CVE Program Container: R
ry code in the contained files, via crafted data to TCP port 14300. Additional Analyst Notes: - CVE Program Container: References: - http://marc.info/?l=bugtraq&m=126046186917330&w=2 - http://seer.entsupport.symantec.com/docs/337930.htm - http://www.zerodayinitiative.com/advisories/ZDI-09-098/ - http://www.vupen.com/english/advisories/2009/3467 - http://secunia.com/advisories/37637 - http://seer.entsupport.symantec.com/docs/337279.htm - http://www.securityfocus.com/bid/37012 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7986 - http://securitytracker.com/id?1023309 - http://www.osvdb.org/60884 - http://marc.info/?l=bugtraq&m=126046186917330&w=2 - htt