Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2009-4623 State: PUBLISHED Published: 2010-01-18T20:00:00 Last Updated: 2024-08-07T07:08:37.980Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple PHP remote file inclusion vulnerabilities in Advanced Comment System 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the ACS_path parameter to (1) index.php and (2) admin.php in advanced_comment_system/. NOTE: this might only be a vulnerability when the administrator has not followed installation instructions in install.php. NOTE: this might be the same as CVE-2020-35598. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/36643 - http://www.exploit-db.c
onal Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/36643 - http://www.exploit-db.com/exploits/9623
CVE ID: CVE-2009-4624 State: PUBLISHED Published: 2010-01-18T20:00:00 Last Updated: 2024-08-07T07:08:37.977Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in download.php in Nicecoder iDesk allows remote attackers to execute arbitrary SQL commands via the cat_id parameter, a different vector than CVE-2005-3843. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/53139 - http://www.securityfocus.com/bid/36348 - http://secunia.com/advisories/36659 - http://www.exploit-db.com/exploits/9631
CVE ID: CVE-2009-4625 State: PUBLISHED Published: 2010-01-18T20:00:00 Last Updated: 2024-08-07T07:08:38.107Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the updateOnePage function in components/com_bfsurvey_pro/controller.php in BF Survey Pro Free (com_bfsurvey_profree) 1.2.4, and other versions before 1.2.6, a component for Joomla!, allows remote attackers to execute arbitrary SQL commands via the table parameter in an updateOnePage action to index.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/9601 - http://osvdb.org/57883 - https://exchange.xforce.ibmcloud.com/vulnerabilities/53107 - ht
.exploit-db.com/exploits/9601 - http://osvdb.org/57883 - https://exchange.xforce.ibmcloud.com/vulnerabilities/53107 - http://secunia.com/advisories/36657 - http://www.vupen.com/english/advisories/2009/2609 - http://www.tamlyncreative.com.au/software/forum/index.php?topic=357.msg1334#msg1334
CVE ID: CVE-2009-4626 State: PUBLISHED Published: 2010-01-18T20:00:00 Last Updated: 2024-08-07T07:08:38.436Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in menu.php in phpNagios 1.2.0 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the conf[lang] parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/53119 - http://www.vupen.com/english/advisories/2009/2615 - http://www.exploit-db.com/exploits/9611
CVE ID: CVE-2009-4627 State: PUBLISHED Published: 2010-01-18T20:00:00 Last Updated: 2024-08-07T07:08:37.977Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in sources/_template_parser.php in Moa Gallery 1.2.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the p_filename parameter, a different issue than CVE-2009-4614. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/52778 - http://www.exploit-db.com/exploits/9525 - http://www.vupen.com/english/advisories/2009/2430
CVE ID: CVE-2009-4628 State: PUBLISHED Published: 2010-01-18T20:00:00 Last Updated: 2024-08-07T07:08:37.979Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the TemplatePlaza.com TPDugg (com_tpdugg) component 1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a tags action to index.php. Additional Analyst Notes: - CVE Program Container: References: - http://evilc0de.blogspot.com/2009/09/tpdugg-joomla-component-11-blind-sql.html - http://osvdb.org/57894 - http://www.templateplazza.com/extensions-updates/tpdugg-component-update-v-1.1.1.html - http://www.securityfocus.com/bid/36321 - https://exchange.xforce
tensions-updates/tpdugg-component-update-v-1.1.1.html - http://www.securityfocus.com/bid/36321 - https://exchange.xforce.ibmcloud.com/vulnerabilities/53108 - http://www.vupen.com/english/advisories/2009/2610 - http://secunia.com/advisories/36656 - http://www.exploit-db.com/exploits/9602
CVE ID: CVE-2009-4629 State: PUBLISHED Published: 2010-01-29T18:00:00Z Last Updated: 2024-09-17T02:58:07.207Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mozilla Necko, as used in Thunderbird 3.0.1, SeaMonkey, and other applications, performs DNS prefetching even when the app type is APP_TYPE_MAIL or APP_TYPE_EDITOR, which makes it easier for remote attackers to determine the network location of the application's user by logging DNS requests, as demonstrated by DNS requests triggered by reading text/plain e-mail messages in Thunderbird. Additional Analyst Notes: - CVE Program Container: References: - https://secure.grepular.com/DNS_Prefetch_Exposure_on_Thunderbird_and_Webmail
es: - CVE Program Container: References: - https://secure.grepular.com/DNS_Prefetch_Exposure_on_Thunderbird_and_Webmail - https://bugzilla.mozilla.org/show_bug.cgi?id=492196
CVE ID: CVE-2009-4630 State: PUBLISHED Published: 2010-01-29T18:00:00Z Last Updated: 2024-09-17T02:32:48.298Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mozilla Necko, as used in Firefox, SeaMonkey, and other applications, performs DNS prefetching of domain names contained in links within local HTML documents, which makes it easier for remote attackers to determine the network location of the application's user by logging DNS requests. NOTE: the vendor disputes the significance of this issue, stating "I don't think we necessarily need to worry about that case." Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=492196
e." Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=492196 - https://bugzilla.mozilla.org/show_bug.cgi?id=453403
CVE ID: CVE-2009-4631 State: PUBLISHED Published: 2010-02-10T02:00:00 Last Updated: 2024-08-07T07:08:38.212Z Vendors: n/a Products: n/a Problem Types: n/a Description: Off-by-one error in the VP3 decoder (vp3.c) in FFmpeg 0.5 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted VP3 file that triggers an out-of-bounds read and possibly memory corruption. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/36805 - http://www.securityfocus.com/bid/36465 - https://roundup.ffmpeg.org/roundup/ffmpeg/issue1240 - http://scarybeastsecurity.blogspot.com/2009/09/patching-ffmpeg-into-shape.html - https://roundup
ndup/ffmpeg/issue1240 - http://scarybeastsecurity.blogspot.com/2009/09/patching-ffmpeg-into-shape.html - https://roundup.ffmpeg.org/roundup/ffmpeg/issue1483 - http://secunia.com/advisories/38643 - http://www.debian.org/security/2010/dsa-2000
CVE ID: CVE-2009-4632 State: PUBLISHED Published: 2010-02-10T02:00:00 Last Updated: 2024-08-07T07:08:37.948Z Vendors: n/a Products: n/a Problem Types: n/a Description: oggparsevorbis.c in FFmpeg 0.5 does not properly perform certain pointer arithmetic, which might allow remote attackers to obtain sensitive memory contents and cause a denial of service via a crafted file that triggers an out-of-bounds read. Additional Analyst Notes: - CVE Program Container: References: - http://www.mandriva.com/security/advisories?name=MDVSA-2011:088 - http://secunia.com/advisories/36805 - http://www.securityfocus.com/bid/36465 - http://secunia.com/advisories/39482 - https://roundup.ffmpeg.org/roundup/ffmpeg/
ttp://www.securityfocus.com/bid/36465 - http://secunia.com/advisories/39482 - https://roundup.ffmpeg.org/roundup/ffmpeg/issue1240 - http://www.mandriva.com/security/advisories?name=MDVSA-2011:061 - http://www.mandriva.com/security/advisories?name=MDVSA-2011:112 - http://www.mandriva.com/security/advisories?name=MDVSA-2011:114 - http://scarybeastsecurity.blogspot.com/2009/09/patching-ffmpeg-into-shape.html - http://secunia.com/advisories/38643 - http://www.vupen.com/english/advisories/2011/1241 - http://www.mandriva.com/security/advisories?name=MDVSA-2011:060 - http://www.debian.org/security/2010/dsa-2000 - http://www.ubuntu.com/usn/USN-931-1 - http://www.vupen.com/english/advisories/2010/093
bian.org/security/2010/dsa-2000 - http://www.ubuntu.com/usn/USN-931-1 - http://www.vupen.com/english/advisories/2010/0935
CVE ID: CVE-2009-4633 State: PUBLISHED Published: 2010-02-10T02:00:00 Last Updated: 2024-08-07T07:08:37.953Z Vendors: n/a Products: n/a Problem Types: n/a Description: vorbis_dec.c in FFmpeg 0.5 uses an assignment operator when a comparison operator was intended, which might allow remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted file that modifies a loop counter and triggers a heap-based buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - http://www.mandriva.com/security/advisories?name=MDVSA-2011:088 - http://secunia.com/advisories/36805 - http://www.securityfocus.com/bid/36465 - http://secunia.com/advisories/39482
088 - http://secunia.com/advisories/36805 - http://www.securityfocus.com/bid/36465 - http://secunia.com/advisories/39482 - https://roundup.ffmpeg.org/roundup/ffmpeg/issue1240 - http://www.mandriva.com/security/advisories?name=MDVSA-2011:061 - http://www.mandriva.com/security/advisories?name=MDVSA-2011:112 - http://www.mandriva.com/security/advisories?name=MDVSA-2011:114 - http://scarybeastsecurity.blogspot.com/2009/09/patching-ffmpeg-into-shape.html - http://secunia.com/advisories/38643 - http://www.vupen.com/english/advisories/2011/1241 - http://www.mandriva.com/security/advisories?name=MDVSA-2011:060 - http://www.debian.org/security/2010/dsa-2000 - http://www.ubuntu.com/usn/USN-931-1 - htt
dvisories?name=MDVSA-2011:060 - http://www.debian.org/security/2010/dsa-2000 - http://www.ubuntu.com/usn/USN-931-1 - http://www.vupen.com/english/advisories/2010/0935
CVE ID: CVE-2009-4634 State: PUBLISHED Published: 2010-02-10T02:00:00 Last Updated: 2024-08-07T07:08:38.031Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple integer underflows in FFmpeg 0.5 allow remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted file that (1) bypasses a validation check in vorbis_dec.c and triggers a wraparound of the stack pointer, or (2) access a pointer from out-of-bounds memory in mov.c, related to an elst tag that appears before a tag that creates a stream. Additional Analyst Notes: - CVE Program Container: References: - http://www.mandriva.com/security/advisories?name=MDVSA-2011:088 - http://secunia.com/
E Program Container: References: - http://www.mandriva.com/security/advisories?name=MDVSA-2011:088 - http://secunia.com/advisories/36805 - http://www.securityfocus.com/bid/36465 - http://secunia.com/advisories/39482 - https://roundup.ffmpeg.org/roundup/ffmpeg/issue1240 - http://www.mandriva.com/security/advisories?name=MDVSA-2011:061 - http://www.mandriva.com/security/advisories?name=MDVSA-2011:112 - http://www.mandriva.com/security/advisories?name=MDVSA-2011:114 - http://scarybeastsecurity.blogspot.com/2009/09/patching-ffmpeg-into-shape.html - http://www.mandriva.com/security/advisories?name=MDVSA-2011:059 - http://secunia.com/advisories/38643 - http://www.vupen.com/english/advisories/2011/
ity/advisories?name=MDVSA-2011:059 - http://secunia.com/advisories/38643 - http://www.vupen.com/english/advisories/2011/1241 - http://www.mandriva.com/security/advisories?name=MDVSA-2011:060 - http://www.debian.org/security/2010/dsa-2000 - http://www.ubuntu.com/usn/USN-931-1 - http://www.vupen.com/english/advisories/2010/0935
CVE ID: CVE-2009-4635 State: PUBLISHED Published: 2010-02-10T02:00:00 Last Updated: 2024-08-07T07:08:37.972Z Vendors: n/a Products: n/a Problem Types: n/a Description: FFmpeg 0.5 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted MOV container with improperly ordered tags that cause (1) mov.c and (2) utils.c to use inconsistent codec types and identifiers, leading to processing of a video-structure pointer by the mp3 decoder, and a stack-based buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - http://www.mandriva.com/security/advisories?name=MDVSA-2011:088 - http://secunia.com/advisories/36805 - http://www.sec
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:088 - http://secunia.com/advisories/36805 - http://www.securityfocus.com/bid/36465 - http://secunia.com/advisories/39482 - https://roundup.ffmpeg.org/roundup/ffmpeg/issue1240 - http://www.mandriva.com/security/advisories?name=MDVSA-2011:061 - http://www.mandriva.com/security/advisories?name=MDVSA-2011:112 - http://www.mandriva.com/security/advisories?name=MDVSA-2011:114 - http://scarybeastsecurity.blogspot.com/2009/09/patching-ffmpeg-into-shape.html - http://www.mandriva.com/security/advisories?name=MDVSA-2011:059 - http://secunia.com/advisories/38643 - http://www.vupen.com/english/advisories/2011/1241 - http://www.mandriva.com/se
9 - http://secunia.com/advisories/38643 - http://www.vupen.com/english/advisories/2011/1241 - http://www.mandriva.com/security/advisories?name=MDVSA-2011:060 - http://www.debian.org/security/2010/dsa-2000 - http://www.ubuntu.com/usn/USN-931-1 - http://www.vupen.com/english/advisories/2010/0935
CVE ID: CVE-2009-4636 State: PUBLISHED Published: 2010-02-10T02:00:00 Last Updated: 2024-08-07T07:08:38.390Z Vendors: n/a Products: n/a Problem Types: n/a Description: FFmpeg 0.5 allows remote attackers to cause a denial of service (hang) via a crafted file that triggers an infinite loop. Additional Analyst Notes: - CVE Program Container: References: - http://www.mandriva.com/security/advisories?name=MDVSA-2011:088 - http://secunia.com/advisories/36805 - http://www.securityfocus.com/bid/36465 - https://roundup.ffmpeg.org/roundup/ffmpeg/issue1240 - http://www.mandriva.com/security/advisories?name=MDVSA-2011:061 - http://www.mandriva.com/security/advisories?name=MDVSA-2011:062 - http://www.man
curity/advisories?name=MDVSA-2011:061 - http://www.mandriva.com/security/advisories?name=MDVSA-2011:062 - http://www.mandriva.com/security/advisories?name=MDVSA-2011:112 - http://www.mandriva.com/security/advisories?name=MDVSA-2011:114 - http://scarybeastsecurity.blogspot.com/2009/09/patching-ffmpeg-into-shape.html - http://www.mandriva.com/security/advisories?name=MDVSA-2011:089 - http://secunia.com/advisories/38643 - http://www.vupen.com/english/advisories/2011/1241 - http://www.debian.org/security/2010/dsa-2000
CVE ID: CVE-2009-4637 State: PUBLISHED Published: 2010-02-10T02:00:00 Last Updated: 2024-08-07T07:08:37.987Z Vendors: n/a Products: n/a Problem Types: n/a Description: FFmpeg 0.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors that trigger a stack-based buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/36805 - http://www.securityfocus.com/bid/36465 - http://secunia.com/advisories/39482 - https://roundup.ffmpeg.org/roundup/ffmpeg/issue1240 - http://scarybeastsecurity.blogspot.com/2009/09/patching-ffmpeg-into-shape.html - http://secunia.com/advisories/38643 - http:
://scarybeastsecurity.blogspot.com/2009/09/patching-ffmpeg-into-shape.html - http://secunia.com/advisories/38643 - http://www.debian.org/security/2010/dsa-2000 - http://www.ubuntu.com/usn/USN-931-1 - http://www.vupen.com/english/advisories/2010/0935
CVE ID: CVE-2009-4638 State: PUBLISHED Published: 2010-02-10T02:00:00 Last Updated: 2024-08-07T07:08:37.997Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in FFmpeg 0.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/36805 - http://www.securityfocus.com/bid/36465 - https://roundup.ffmpeg.org/roundup/ffmpeg/issue1240 - http://scarybeastsecurity.blogspot.com/2009/09/patching-ffmpeg-into-shape.html - http://secunia.com/advisories/38643 - http://www.debian.org/security/2010/dsa-2000
CVE ID: CVE-2009-4639 State: PUBLISHED Published: 2010-02-10T02:00:00 Last Updated: 2024-08-07T07:08:38.126Z Vendors: n/a Products: n/a Problem Types: n/a Description: The av_rescale_rnd function in the AVI demuxer in FFmpeg 0.5 allows remote attackers to cause a denial of service (crash) via a crafted AVI file that triggers a divide-by-zero error. Additional Analyst Notes: - CVE Program Container: References: - http://www.mandriva.com/security/advisories?name=MDVSA-2011:088 - http://secunia.com/advisories/36805 - http://www.securityfocus.com/bid/36465 - http://secunia.com/advisories/39482 - https://roundup.ffmpeg.org/roundup/ffmpeg/issue1240 - http://www.mandriva.com/security/advisories?nam
advisories/39482 - https://roundup.ffmpeg.org/roundup/ffmpeg/issue1240 - http://www.mandriva.com/security/advisories?name=MDVSA-2011:061 - https://roundup.ffmpeg.org/roundup/ffmpeg/issue1245 - http://www.mandriva.com/security/advisories?name=MDVSA-2011:112 - http://scarybeastsecurity.blogspot.com/2009/09/patching-ffmpeg-into-shape.html - http://www.mandriva.com/security/advisories?name=MDVSA-2011:059 - http://www.vupen.com/english/advisories/2011/1241 - http://www.mandriva.com/security/advisories?name=MDVSA-2011:060 - http://www.ubuntu.com/usn/USN-931-1 - http://www.vupen.com/english/advisories/2010/0935
CVE ID: CVE-2009-4640 State: PUBLISHED Published: 2010-02-10T02:00:00 Last Updated: 2024-08-07T07:08:38.160Z Vendors: n/a Products: n/a Problem Types: n/a Description: Array index error in vorbis_dec.c in FFmpeg 0.5 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted Vorbis file that triggers an out-of-bounds read. Additional Analyst Notes: - CVE Program Container: References: - http://www.mandriva.com/security/advisories?name=MDVSA-2011:088 - http://secunia.com/advisories/36805 - http://www.securityfocus.com/bid/36465 - http://secunia.com/advisories/39482 - https://roundup.ffmpeg.org/roundup/ffmpeg/issue1240 - http://www.mandriva.com/securi
tp://secunia.com/advisories/39482 - https://roundup.ffmpeg.org/roundup/ffmpeg/issue1240 - http://www.mandriva.com/security/advisories?name=MDVSA-2011:061 - http://www.mandriva.com/security/advisories?name=MDVSA-2011:112 - http://www.mandriva.com/security/advisories?name=MDVSA-2011:114 - http://scarybeastsecurity.blogspot.com/2009/09/patching-ffmpeg-into-shape.html - http://secunia.com/advisories/38643 - http://www.vupen.com/english/advisories/2011/1241 - http://www.mandriva.com/security/advisories?name=MDVSA-2011:060 - http://www.debian.org/security/2010/dsa-2000 - http://www.ubuntu.com/usn/USN-931-1 - http://www.vupen.com/english/advisories/2010/0935
CVE ID: CVE-2009-4641 State: PUBLISHED Published: 2010-02-11T21:00:00 Last Updated: 2024-08-07T07:08:38.266Z Vendors: n/a Products: n/a Problem Types: n/a Description: gnome-screensaver 2.28.0 does not resume adherence to its activation settings after an inhibiting application becomes unavailable on the session bus, which allows physically proximate attackers to access an unattended workstation on which screen locking had been intended. Additional Analyst Notes: - CVE Program Container: References: - http://www.mandriva.com/security/advisories?name=MDVSA-2010:040 - http://www.ubuntu.com/usn/USN-866-1 - https://bugzilla.gnome.org/show_bug.cgi?id=600488 - https://launchpad.net/bugs/411350
CVE ID: CVE-2009-4642 State: PUBLISHED Published: 2010-02-11T21:00:00Z Last Updated: 2024-09-17T00:55:59.220Z Vendors: n/a Products: n/a Problem Types: n/a Description: gnome-screensaver 2.26.1 relies on the gnome-session D-Bus interface to determine session idle time, even when an Xfce desktop such as Xubuntu or Mythbuntu is used, which allows physically proximate attackers to access an unattended workstation on which screen locking had been intended. Additional Analyst Notes: - CVE Program Container: References: - http://bugzilla.xfce.org/show_bug.cgi?id=5927 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=536381 - https://launchpad.net/bugs/493573 - https://bugzilla.gnome.org/show_bug.
s.debian.org/cgi-bin/bugreport.cgi?bug=536381 - https://launchpad.net/bugs/493573 - https://bugzilla.gnome.org/show_bug.cgi?id=592093 - https://launchpad.net/bugs/411350
CVE ID: CVE-2009-4643 State: PUBLISHED Published: 2010-02-15T18:00:00Z Last Updated: 2024-09-17T04:03:38.368Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in dsInstallerService.dll in the Juniper Installer Service, as used in Juniper Odyssey Access Client 4.72.11421.0 and other products, allows remote attackers to execute arbitrary code via a long string in a malformed DSSETUPSERVICE_CMD_UNINSTALL command to the NeoterisSetupService named pipe. Additional Analyst Notes: - CVE Program Container: References: - https://www.juniper.net/alerts/viewalert.jsp?actionBtn=Search&txtAlertNumber=PSN-2009-10-540&viewMode=view - http://labs.idefense.com/intelligen
alerts/viewalert.jsp?actionBtn=Search&txtAlertNumber=PSN-2009-10-540&viewMode=view - http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=850
CVE ID: CVE-2009-4644 State: PUBLISHED Published: 2010-02-19T17:00:00 Last Updated: 2024-08-07T07:08:37.992Z Vendors: n/a Products: n/a Problem Types: n/a Description: Accellion Secure File Transfer Appliance before 8_0_105 allows remote authenticated administrators to bypass the restricted shell and execute arbitrary commands via shell metacharacters to the ping command, as demonstrated by modifying the cli program. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/38176 - http://www.portcullis-security.com/338.php - https://exchange.xforce.ibmcloud.com/vulnerabilities/56248
CVE ID: CVE-2009-4645 State: PUBLISHED Published: 2010-02-19T17:00:00 Last Updated: 2024-08-07T07:08:38.183Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in web_client_user_guide.html in Accellion Secure File Transfer Appliance before 8_0_105 allows remote attackers to read arbitrary files via a .. (dot dot) in the lang parameter. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/56246 - http://www.securityfocus.com/bid/38176 - http://secunia.com/advisories/38538 - http://www.portcullis-security.com/340.php
CVE ID: CVE-2009-4646 State: PUBLISHED Published: 2010-02-19T17:00:00Z Last Updated: 2024-09-16T16:58:55.501Z Vendors: n/a Products: n/a Problem Types: n/a Description: Static code injection vulnerability in the administrative web interface in Accellion Secure File Transfer Appliance allows remote authenticated administrators to inject arbitrary shell commands by appending them to a request to update the SNMP public community string. Additional Analyst Notes: - CVE Program Container: References: - http://www.portcullis-security.com/339.php - http://secunia.com/advisories/38538
CVE ID: CVE-2009-4647 State: PUBLISHED Published: 2010-02-19T17:00:00 Last Updated: 2024-08-07T07:08:38.036Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Accellion Secure File Transfer Appliance before 7_0_296 allows remote attackers to inject arbitrary web script or HTML via the username parameter, which is not properly handled when the administrator views audit logs. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/56247 - http://www.portcullis-security.com/339.php - http://www.securityfocus.com/bid/38176 - http://secunia.com/advisories/38522