Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2009-2228 State: PUBLISHED Published: 2009-06-26T18:00:00 Last Updated: 2024-08-07T05:44:55.610Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in engine.php in Kasseler CMS allows remote attackers to inject arbitrary web script or HTML via the url parameter in a redirect action. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/35457 - http://www.exploit-db.com/exploits/8997 - http://www.vupen.com/english/advisories/2009/1652
CVE ID: CVE-2009-2229 State: PUBLISHED Published: 2009-06-26T18:00:00 Last Updated: 2024-08-07T05:44:55.300Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in engine.php in Kasseler CMS 1.3.5 lite allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter during a download action, a different vector than CVE-2008-3087. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/35523 - http://www.kasseler-cms.net/engine.php?do=attach&file=uploads/forum/17555/1.3.5_to_1.3.6.zip - http://www.kasseler-cms.net/forum/
w.kasseler-cms.net/engine.php?do=attach&file=uploads/forum/17555/1.3.5_to_1.3.6.zip - http://www.kasseler-cms.net/forum/showtopic/1929/2.html - http://www.securityfocus.com/bid/35457 - http://www.exploit-db.com/exploits/8997 - http://www.vupen.com/english/advisories/2009/1652
CVE ID: CVE-2009-2230 State: PUBLISHED Published: 2009-06-26T18:00:00 Last Updated: 2024-08-07T05:44:55.451Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in inc/datahandlers/user.php in MyBB (aka MyBulletinBoard) before 1.4.7 allows remote authenticated users to execute arbitrary SQL commands via the birthdayprivacy parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/35458 - http://www.exploit-db.com/exploits/9001 - http://secunia.com/advisories/35517 - http://blog.mybboard.net/2009/06/15/mybb-147-released-security-update/ - http://mybboard.net/download/104 - http://www.vupen.com/english/adviso
t/2009/06/15/mybb-147-released-security-update/ - http://mybboard.net/download/104 - http://www.vupen.com/english/advisories/2009/1653
CVE ID: CVE-2009-2231 State: PUBLISHED Published: 2009-06-26T18:00:00 Last Updated: 2024-08-07T05:44:55.293Z Vendors: n/a Products: n/a Problem Types: n/a Description: MIDAS 1.43 allows remote attackers to bypass authentication and obtain administrative access via an admin account record in a MIDAS cookie. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/51281 - http://www.exploit-db.com/exploits/8987 - http://www.vupen.com/english/advisories/2009/1646
CVE ID: CVE-2009-2232 State: PUBLISHED Published: 2009-06-26T18:00:00 Last Updated: 2024-08-07T05:44:55.571Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in image.php in Softbiz Banner Ad Management Script allows remote attackers to execute arbitrary SQL commands via the size_id parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/51277 - http://www.securityfocus.com/bid/35453 - http://secunia.com/advisories/35549
CVE ID: CVE-2009-2233 State: PUBLISHED Published: 2009-06-26T18:00:00 Last Updated: 2024-08-07T05:44:55.592Z Vendors: n/a Products: n/a Problem Types: n/a Description: The admin interface in AWScripts.com Gallery Search Engine 1.5 allows remote attackers to bypass authentication and gain administrative access by setting the awse_logged cookie to 1. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/8994 - http://www.vupen.com/english/advisories/2009/1649 - https://exchange.xforce.ibmcloud.com/vulnerabilities/51276 - http://secunia.com/advisories/35513
CVE ID: CVE-2009-2234 State: PUBLISHED Published: 2009-06-27T18:00:00 Last Updated: 2024-08-07T05:44:55.622Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in admin.php in VICIDIAL Call Center Suite 2.0.5-173 allow remote attackers to execute arbitrary SQL commands via the (1) Username parameter ($PHP_AUTH_USER) and (2) Password parameter ($PHP_AUTH_PW). Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/35056 - https://exchange.xforce.ibmcloud.com/vulnerabilities/50665 - http://www.eflo.net/vicidial/security_fix_admin_20090522.patch - http://www.exploit-db.com/exploits/8755
CVE ID: CVE-2009-2235 State: PUBLISHED Published: 2009-06-27T18:00:00 Last Updated: 2024-08-07T05:44:55.931Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in page.php in Your Articles Directory allows remote attackers to execute arbitrary SQL commands via the id parameter. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/35192 - http://www.exploit-db.com/exploits/8762 - http://www.securityfocus.com/bid/35062
CVE ID: CVE-2009-2236 State: PUBLISHED Published: 2009-06-27T18:00:00 Last Updated: 2024-08-07T05:44:55.353Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in yad-admin/login.php in Your Article Directory allows remote attackers to execute arbitrary SQL commands via the txtAdminEmail parameter. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/35059 - http://secunia.com/advisories/35192 - http://www.exploit-db.com/exploits/8761 - https://exchange.xforce.ibmcloud.com/vulnerabilities/50669
CVE ID: CVE-2009-2237 State: PUBLISHED Published: 2009-06-27T18:00:00 Last Updated: 2024-08-07T05:44:55.785Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in Views Bulk Operations 5.x-1.x before 5.x-1.4 and 6.x-1.x before 6.x-1.7, a module for Drupal, allows remote attackers to bypass intended access restrictions and modify "nodes or classes of nodes" via unknown vectors, probably related to registered procedures (aka actions). Additional Analyst Notes: - CVE Program Container: References: - http://drupal.org/node/468450 - https://exchange.xforce.ibmcloud.com/vulnerabilities/50659 - http://www.securityfocus.com/bid/35051 - http://secunia.com/advisories/
ange.xforce.ibmcloud.com/vulnerabilities/50659 - http://www.securityfocus.com/bid/35051 - http://secunia.com/advisories/35117
CVE ID: CVE-2009-2238 State: PUBLISHED Published: 2009-06-27T18:00:00 Last Updated: 2024-08-07T05:44:55.625Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in includes/shared_scripts/wysiwyg_editor/assetmanager/assetmanager.asp in DMXReady Registration Manager 1.1 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in assets/webblogmanager. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/50651 - http://www.exploit-db.com/exploits/8749 - http://www.securityfocus.com/bid/35039
e.ibmcloud.com/vulnerabilities/50651 - http://www.exploit-db.com/exploits/8749 - http://www.securityfocus.com/bid/35039 - http://www.securityfocus.com/archive/1/503648/100/0/threaded
CVE ID: CVE-2009-2239 State: PUBLISHED Published: 2009-06-27T18:00:00 Last Updated: 2024-08-07T05:44:55.613Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the (1) casinobase (com_casinobase), (2) casino_blackjack (com_casino_blackjack), and (3) casino_videopoker (com_casino_videopoker) components 0.3.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter to index.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/50645 - http://www.securityfocus.com/bid/35041 - http://www.exploit-db.com/exploits/8743
CVE ID: CVE-2009-2240 State: PUBLISHED Published: 2009-06-27T18:00:00Z Last Updated: 2024-09-16T20:59:10.692Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in AD2000 free-sw leger (aka Web Conference Room Free) 1.6.4 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/35068 - http://secunia.com/advisories/35148 - http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000031.html - http://www.ad2000.co.jp/service/index.html - http://jvn.jp/en/jp/JVN57036470/index.html
CVE ID: CVE-2009-2241 State: PUBLISHED Published: 2009-06-27T18:00:00 Last Updated: 2024-08-07T05:44:55.902Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in search.asp in ASP Inline Corporate Calendar allows remote attackers to inject arbitrary web script or HTML via the keyword parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/35054 - https://exchange.xforce.ibmcloud.com/vulnerabilities/50666 - http://www.exploit-db.com/exploits/8756 - http://secunia.com/advisories/35187
CVE ID: CVE-2009-2242 State: PUBLISHED Published: 2009-06-27T18:00:00 Last Updated: 2024-08-07T05:44:55.672Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in active_appointments.asp in ASP Inline Corporate Calendar allows remote attackers to execute arbitrary SQL commands via the order parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/35054 - https://exchange.xforce.ibmcloud.com/vulnerabilities/50667 - http://www.exploit-db.com/exploits/8756 - http://secunia.com/advisories/35187
CVE ID: CVE-2009-2243 State: PUBLISHED Published: 2009-06-27T18:00:00 Last Updated: 2024-08-07T05:44:55.352Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in active_appointments.asp in ASP Inline Corporate Calendar allows remote attackers to execute arbitrary SQL commands via the sortby parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/50667 - http://secunia.com/advisories/35187
CVE ID: CVE-2009-2254 State: PUBLISHED Published: 2009-06-30T10:00:00 Last Updated: 2024-08-07T05:44:55.724Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/sqlpatch.php, which allows remote attackers to execute arbitrary SQL commands via the query_string parameter in an execute action, in conjunction with a PATH_INFO of password_forgotten.php, related to a "SQL Execution" issue. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/55343 - http://www.zen-cart.com/forum/showthread.php?t=130161 - http://www.securityfocus.com/bid/35468 - http://www.zen-cart.co
http://www.zen-cart.com/forum/showthread.php?t=130161 - http://www.securityfocus.com/bid/35468 - http://www.zen-cart.com/forum/attachment.php?attachmentid=5965 - http://www.exploit-db.com/exploits/9005 - http://secunia.com/advisories/35550 - https://exchange.xforce.ibmcloud.com/vulnerabilities/51317
CVE ID: CVE-2009-2255 State: PUBLISHED Published: 2009-06-30T10:00:00 Last Updated: 2024-08-07T05:44:55.794Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/record_company.php, which allows remote attackers to execute arbitrary code by uploading a .php file via the record_company_image parameter in conjunction with a PATH_INFO of password_forgotten.php, then accessing this file via a direct request to the file in images/. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/35467 - http://www.osvdb.org/55344 - http://www.zen-cart.com/forum/showt
References: - http://www.securityfocus.com/bid/35467 - http://www.osvdb.org/55344 - http://www.zen-cart.com/forum/showthread.php?t=130161 - https://exchange.xforce.ibmcloud.com/vulnerabilities/51316 - http://www.zen-cart.com/forum/attachment.php?attachmentid=5965 - http://www.exploit-db.com/exploits/9004 - http://secunia.com/advisories/35550
CVE ID: CVE-2009-2256 State: PUBLISHED Published: 2009-06-30T10:00:00 Last Updated: 2024-08-07T05:44:55.663Z Vendors: n/a Products: n/a Problem Types: n/a Description: The administrative web interface on the Netgear DG632 with firmware 3.4.0_ap allows remote attackers to cause a denial of service (web outage) via an HTTP POST request to cgi-bin/firmwarecfg. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/504345/100/0/threaded - http://www.tomneaves.co.uk/Netgear_DG632_Remote_DoS.txt - http://www.securityfocus.com/archive/1/504341/100/0/threaded - http://www.exploit-db.com/exploits/8964 - http://securitytracker.com/id?1022403
CVE ID: CVE-2009-2257 State: PUBLISHED Published: 2009-06-30T10:00:00 Last Updated: 2024-08-07T05:44:55.899Z Vendors: n/a Products: n/a Problem Types: n/a Description: The administrative web interface on the Netgear DG632 with firmware 3.4.0_ap allows remote attackers to bypass authentication via a direct request to (1) gateway/commands/saveconfig.html, and (2) stattbl.htm, (3) modemmenu.htm, (4) onload.htm, (5) form.css, (6) utility.js, and possibly (7) indextop.htm in html/. Additional Analyst Notes: - CVE Program Container: References: - http://www.tomneaves.co.uk/Netgear_DG632_Authentication_Bypass.txt - http://www.securityfocus.com/archive/1/504312/100/0/threaded - http://www.exploit-db
r_DG632_Authentication_Bypass.txt - http://www.securityfocus.com/archive/1/504312/100/0/threaded - http://www.exploit-db.com/exploits/8963 - http://securitytracker.com/id?1022404
CVE ID: CVE-2009-2258 State: PUBLISHED Published: 2009-06-30T10:00:00 Last Updated: 2024-08-07T05:44:55.934Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in cgi-bin/webcm in the administrative web interface on the Netgear DG632 with firmware 3.4.0_ap allows remote attackers to list arbitrary directories via a .. (dot dot) in the nextpage parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.tomneaves.co.uk/Netgear_DG632_Authentication_Bypass.txt - http://www.securityfocus.com/archive/1/504312/100/0/threaded - http://www.exploit-db.com/exploits/8963 - http://securitytracker.com/id?1022404
CVE ID: CVE-2009-2259 State: REJECTED Published: 2009-06-30T10:00:00 Last Updated: 2012-09-13T09:00:00 Description: No description available.
CVE ID: CVE-2009-2260 State: PUBLISHED Published: 2009-06-30T10:00:00.000Z Last Updated: 2025-11-04T21:08:05.507Z Vendors: n/a Products: n/a Problem Types: n/a Description: stardict 3.0.1, when Enable Net Dict is configured, sends the contents of the clipboard to a dictionary server, which allows remote attackers to obtain sensitive information by sniffing the network. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/504583 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=534731 - https://www.redhat.com/archives/fedora-package-announce/2010-January/msg00121.html
CVE ID: CVE-2009-2261 State: PUBLISHED Published: 2009-06-30T10:00:00 Last Updated: 2024-08-07T05:44:55.761Z Vendors: n/a Products: n/a Problem Types: n/a Description: PeaZIP 2.6.1, 2.5.1, and earlier on Windows allows user-assisted remote attackers to execute arbitrary commands via a .zip archive with a .txt file whose name contains | (pipe) characters and a command. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/8881
CVE ID: CVE-2009-2262 State: PUBLISHED Published: 2009-06-30T10:00:00 Last Updated: 2024-08-07T05:44:55.847Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in install/di.php in AjaxPortal 3.0 allows remote attackers to execute arbitrary PHP code via a URL in the pathtoserverdata parameter. NOTE: the installation instructions specify deleting the install/ folder. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/504618/100/0/threaded
CVE ID: CVE-2009-2263 State: PUBLISHED Published: 2009-06-30T10:00:00 Last Updated: 2024-08-07T05:44:55.287Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in index.php in Awesome PHP Mega File Manager 1.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter. NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC share pathname or an ftp, ftps, or ssh2.sftp URL. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/9025 - http://secunia.com/advisories/35545
CVE ID: CVE-2009-2265 State: PUBLISHED Published: 2009-07-05T16:00:00 Last Updated: 2024-08-07T05:44:55.927Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple directory traversal vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to create executable files in arbitrary directories via directory traversal sequences in the input to unspecified connector modules, as exploited in the wild for remote code execution in July 2009, related to the file browser and the editor/filemanager/connectors/ directory. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2009/1825 - http://www.ocert.org/advisories/ocert-2009-
Container: References: - http://www.vupen.com/english/advisories/2009/1825 - http://www.ocert.org/advisories/ocert-2009-007.html - http://sourceforge.net/project/shownotes.php?release_id=695430 - http://secunia.com/advisories/35909 - http://www.debian.org/security/2009/dsa-1836 - https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00710.html - http://secunia.com/advisories/35833 - http://www.vupen.com/english/advisories/2009/1813 - http://mail.zope.org/pipermail/zope-dev/2009-July/037195.html - http://www.securitytracker.com/id?1022513 - http://isc.sans.org/diary.html?storyid=6724 - http://www.securityfocus.com/archive/1/504721/100/0/threaded - https://www.redhat.com/archive
/diary.html?storyid=6724 - http://www.securityfocus.com/archive/1/504721/100/0/threaded - https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00750.html - http://packetstormsecurity.com/files/163271/Adobe-ColdFusion-8-Remote-Command-Execution.html
CVE ID: CVE-2009-2266 State: PUBLISHED Published: 2009-09-09T17:00:00Z Last Updated: 2024-09-16T20:16:28.127Z Vendors: n/a Products: n/a Problem Types: n/a Description: OXID eShop 4.x before 4.1.4-21266, 3.x, and 2.x allows remote attackers to obtain sensitive information (session details and order history of other users) via a crafted cookie. Additional Analyst Notes: - CVE Program Container: References: - http://www.oxidforge.org/wiki/Security_bulletins/2009-003
CVE ID: CVE-2009-2267 State: PUBLISHED Published: 2009-11-02T15:00:00 Last Updated: 2024-08-07T05:44:55.920Z Vendors: n/a Products: n/a Problem Types: n/a Description: VMware Workstation 6.5.x before 6.5.3 build 185404, VMware Player 2.5.x before 2.5.3 build 185404, VMware ACE 2.5.x before 2.5.3 build 185404, VMware Server 1.x before 1.0.10 build 203137 and 2.x before 2.0.2 build 203138, VMware Fusion 2.x before 2.0.6 build 196839, VMware ESXi 3.5 and 4.0, and VMware ESX 2.5.5, 3.0.3, 3.5, and 4.0, when Virtual-8086 mode is used, do not properly set the exception code upon a page fault (aka #PF) exception, which allows guest OS users to gain privileges on the guest OS by specifying a crafted
a page fault (aka #PF) exception, which allows guest OS users to gain privileges on the guest OS by specifying a crafted value for the cs register. Additional Analyst Notes: - CVE Program Container: References: - http://security.gentoo.org/glsa/glsa-201209-25.xml - http://www.vupen.com/english/advisories/2009/3062 - http://lists.vmware.com/pipermail/security-announce/2009/000069.html - http://securitytracker.com/id?1023082 - http://www.securityfocus.com/bid/36841 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8473 - http://www.securityfocus.com/archive/1/507523/100/0/threaded - http://www.securityfocus.com/archive/1/507539/100/0/threaded - http://sec
ityfocus.com/archive/1/507523/100/0/threaded - http://www.securityfocus.com/archive/1/507539/100/0/threaded - http://securitytracker.com/id?1023083 - http://www.vmware.com/security/advisories/VMSA-2009-0015.html - http://secunia.com/advisories/37172
CVE ID: CVE-2009-2268 State: PUBLISHED Published: 2009-07-01T12:26:00 Last Updated: 2024-08-07T05:44:55.849Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Cross-Domain Controller (CDC) servlet in Sun Java System Access Manager 6 2005Q1, 7 2005Q4, and 7.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://sunsolve.sun.com/search/document.do?assetkey=1-21-126356-03-1 - http://secunia.com/advisories/35651 - http://sunsolve.sun.com/search/document.do?assetkey=1-66-256568-1 - http://sunsolve.sun.com/search/document.do?assetkey=1-
tp://sunsolve.sun.com/search/document.do?assetkey=1-66-256568-1 - http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020343.1-1
CVE ID: CVE-2009-2269 State: PUBLISHED Published: 2009-07-01T12:26:00 Last Updated: 2024-08-07T05:44:55.637Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Empire CMS 5.1 allows remote attackers to execute arbitrary SQL commands via the bid parameter to the default URI under e/tool/gbook/. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/504652/100/0/threaded
CVE ID: CVE-2009-2270 State: PUBLISHED Published: 2009-07-01T12:26:00 Last Updated: 2024-08-07T05:44:55.592Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in member/uploads_edit.php in dedecms 5.3 allows remote attackers to execute arbitrary code by uploading a file with a double extension in the filename, then accessing this file via unspecified vectors, as demonstrated by a .jpg.php filename. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/504653/100/0/threaded
CVE ID: CVE-2009-2271 State: PUBLISHED Published: 2009-07-01T12:26:00 Last Updated: 2024-08-07T05:44:55.932Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Huawei D100 has (1) a certain default administrator password for the web interface, and does not force a password change; and has (2) a default password of admin for the admin account in the telnet interface; which makes it easier for remote attackers to obtain access. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/504645/100/0/threaded - http://secunia.com/advisories/35638
CVE ID: CVE-2009-2272 State: PUBLISHED Published: 2009-07-01T12:26:00 Last Updated: 2024-08-07T05:44:55.634Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Huawei D100 stores the administrator's account name and password in cleartext in a cookie, which allows context-dependent attackers to obtain sensitive information by (1) reading a cookie file, by (2) sniffing the network for HTTP headers, and possibly by using unspecified other vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/504645/100/0/threaded