Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
s.moodle.org/en/Moodle_1.8.11_release_notes - http://moodle.org/mod/forum/discuss.php?d=139106 - http://cvs.moodle.org/moodle/mnet/lib.php?r1=1.9.2.7&r2=1.9.2.8 - http://www.vupen.com/english/advisories/2009/3455 - http://secunia.com/advisories/37614 - https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00730.html - https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00704.html - https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00751.html - http://www.securityfocus.com/bid/37244
CVE ID: CVE-2009-4302 State: PUBLISHED Published: 2009-12-16T01:00:00Z Last Updated: 2024-09-16T19:25:34.504Z Vendors: n/a Products: n/a Problem Types: n/a Description: login/index_form.html in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 links to an index page on the HTTP port even when the page is served from an HTTPS port, which might cause login credentials to be sent in cleartext, even when SSL is intended, and allows remote attackers to obtain these credentials by sniffing. Additional Analyst Notes: - CVE Program Container: References: - http://moodle.org/mod/forum/discuss.php?d=139107 - http://docs.moodle.org/en/Moodle_1.9.7_release_notes - http://docs.moodle.org/en/Moodle_1.8.11_rel
iscuss.php?d=139107 - http://docs.moodle.org/en/Moodle_1.9.7_release_notes - http://docs.moodle.org/en/Moodle_1.8.11_release_notes - http://www.vupen.com/english/advisories/2009/3455 - http://secunia.com/advisories/37614 - https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00730.html - https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00704.html - https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00751.html - http://www.securityfocus.com/bid/37244
CVE ID: CVE-2009-4303 State: PUBLISHED Published: 2009-12-16T01:00:00Z Last Updated: 2024-09-17T02:05:56.538Z Vendors: n/a Products: n/a Problem Types: n/a Description: Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 stores (1) password hashes and (2) unspecified "secrets" in backup files, which might allow attackers to obtain sensitive information. Additional Analyst Notes: - CVE Program Container: References: - http://docs.moodle.org/en/Moodle_1.9.7_release_notes - http://docs.moodle.org/en/Moodle_1.8.11_release_notes - http://moodle.org/mod/forum/discuss.php?d=139110 - http://www.vupen.com/english/advisories/2009/3455 - http://secunia.com/advisories/37614 - https://www.redhat.com/archives/f
p://www.vupen.com/english/advisories/2009/3455 - http://secunia.com/advisories/37614 - https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00730.html - https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00704.html - https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00751.html - http://www.securityfocus.com/bid/37244
CVE ID: CVE-2009-4304 State: PUBLISHED Published: 2009-12-16T01:00:00Z Last Updated: 2024-09-17T01:16:08.331Z Vendors: n/a Products: n/a Problem Types: n/a Description: Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 does not use a random password salt in config.php, which makes it easier for attackers to conduct brute-force password guessing attacks. Additional Analyst Notes: - CVE Program Container: References: - http://moodle.org/mod/forum/discuss.php?d=139111 - http://docs.moodle.org/en/Moodle_1.9.7_release_notes - http://docs.moodle.org/en/Moodle_1.8.11_release_notes - http://www.vupen.com/english/advisories/2009/3455 - http://secunia.com/advisories/37614 - https://www.redhat.com/archives
ttp://www.vupen.com/english/advisories/2009/3455 - http://secunia.com/advisories/37614 - https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00730.html - https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00704.html - https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00751.html - http://www.securityfocus.com/bid/37244
CVE ID: CVE-2009-4305 State: PUBLISHED Published: 2009-12-16T01:00:00Z Last Updated: 2024-09-16T23:26:30.631Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the SCORM module in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 allows remote authenticated users to execute arbitrary SQL commands via vectors related to an "escaping issue when processing AICC CRS file (Course_Title)." Additional Analyst Notes: - CVE Program Container: References: - http://docs.moodle.org/en/Moodle_1.9.7_release_notes - http://docs.moodle.org/en/Moodle_1.8.11_release_notes - http://www.vupen.com/english/advisories/2009/3455 - http://secunia.com/advisories/37614 - https://www
11_release_notes - http://www.vupen.com/english/advisories/2009/3455 - http://secunia.com/advisories/37614 - https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00730.html - https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00704.html - https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00751.html - http://www.securityfocus.com/bid/37244 - http://moodle.org/mod/forum/discuss.php?d=139120
CVE ID: CVE-2009-4306 State: PUBLISHED Published: 2009-12-13T01:00:00 Last Updated: 2024-08-07T07:01:19.741Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in the EXT4_IOC_MOVE_EXT (aka move extents) ioctl implementation in the ext4 filesystem in the Linux kernel 2.6.32-git6 and earlier allows local users to cause a denial of service (filesystem corruption) via unknown vectors, a different vulnerability than CVE-2009-4131. Additional Analyst Notes: - CVE Program Container: References: - http://twitter.com/spendergrsec/statuses/6567167692 - http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00000.html - http://grsecurity.org/test/grsecurity-2
2 - http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00000.html - http://grsecurity.org/test/grsecurity-2.1.14-2.6.32-200912112157.patch - http://twitter.com/tytso/statuses/6571730411 - https://bugzilla.redhat.com/show_bug.cgi?id=547263 - http://twitter.com/spendergrsec/statuses/6569596339 - http://twitter.com/spendergrsec/statuses/6572069107 - http://twitter.com/spendergrsec/statuses/6583954567 - http://twitter.com/fotisl/statuses/6568947714 - http://twitter.com/spendergrsec/statuses/6551797457 - http://secunia.com/advisories/38017
CVE ID: CVE-2009-4307 State: PUBLISHED Published: 2009-12-13T01:00:00 Last Updated: 2024-08-07T07:01:19.746Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ext4_fill_flex_info function in fs/ext4/super.c in the Linux kernel before 2.6.32-git6 allows user-assisted remote attackers to cause a denial of service (divide-by-zero error and panic) via a malformed ext4 filesystem containing a super block with a large FLEX_BG group size (aka s_log_groups_per_flex value). Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/38276 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=503358ae01b70ce6909d19dd01287093f6
276 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=503358ae01b70ce6909d19dd01287093f6b6271c - http://lkml.org/lkml/2009/12/9/255 - http://www.redhat.com/support/errata/RHSA-2010-0380.html - http://www.kernel.org/pub/linux/kernel/v2.6/snapshots/patch-2.6.32-git6.log - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9874 - http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00000.html - http://bugzilla.kernel.org/show_bug.cgi?id=14287 - http://secunia.com/advisories/37658 - http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00005.html - http://www.mandriva.com/security/advisories?name=MDVSA-2011:
suse.org/opensuse-security-announce/2010-01/msg00005.html - http://www.mandriva.com/security/advisories?name=MDVSA-2011:029 - http://secunia.com/advisories/38017
CVE ID: CVE-2009-4308 State: PUBLISHED Published: 2009-12-13T01:00:00 Last Updated: 2024-08-07T07:01:19.616Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ext4_decode_error function in fs/ext4/super.c in the ext4 filesystem in the Linux kernel before 2.6.32 allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference), and possibly have unspecified other impact, via a crafted read-only filesystem that lacks a journal. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/38276 - http://www.redhat.com/support/errata/RHSA-2010-0147.html - http://www.mandriva.com/security/advisories?name=MDVSA-2010:198 - h
/www.redhat.com/support/errata/RHSA-2010-0147.html - http://www.mandriva.com/security/advisories?name=MDVSA-2010:198 - http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00000.html - http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.html - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=78f1ddbb498283c2445c11b0dfa666424c301803 - http://secunia.com/advisories/43315 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11103 - http://secunia.com/advisories/37658 - http://www.vmware.com/security/advisories/VMSA-2011-0003.html - http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00005
ware.com/security/advisories/VMSA-2011-0003.html - http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00005.html - http://www.debian.org/security/2010/dsa-2005 - http://www.securityfocus.com/archive/1/516397/100/0/threaded - http://secunia.com/advisories/38017 - http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.32
CVE ID: CVE-2009-4309 State: PUBLISHED Published: 2009-12-13T01:00:00 Last Updated: 2024-08-07T07:01:19.605Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the Intel Indeo41 codec for Windows Media Player in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to execute arbitrary code via a large size value in a movi record in an IV41 stream in a media file, as demonstrated by an AVI file. Additional Analyst Notes: - CVE Program Container: References: - http://support.microsoft.com/kb/955759 - http://www.securityfocus.com/archive/1/508324/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/54642 -
p://www.securityfocus.com/archive/1/508324/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/54642 - http://securitytracker.com/id?1023302 - http://www.securityfocus.com/bid/37251 - http://www.microsoft.com/technet/security/advisory/954157.mspx - http://support.microsoft.com/kb/976138 - http://www.vupen.com/english/advisories/2009/3440 - http://zerodayinitiative.com/advisories/ZDI-09-089/ - http://support.microsoft.com/kb/954157 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12188 - http://www.osvdb.org/60855 - https://exchange.xforce.ibmcloud.com/vulnerabilities/54645 - http://secunia.com/advisories/37592
CVE ID: CVE-2009-4310 State: PUBLISHED Published: 2009-12-13T01:00:00 Last Updated: 2024-08-07T07:01:20.147Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in the Intel Indeo41 codec for Windows Media Player in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to execute arbitrary code via crafted compressed video data in an IV41 stream in a media file, leading to many loop iterations, as demonstrated by data in an AVI file. Additional Analyst Notes: - CVE Program Container: References: - http://support.microsoft.com/kb/955759 - http://securitytracker.com/id?1023302 - http://www.securityfocus.com/bid/37251 - http:/
upport.microsoft.com/kb/955759 - http://securitytracker.com/id?1023302 - http://www.securityfocus.com/bid/37251 - http://www.osvdb.org/60856 - http://www.microsoft.com/technet/security/advisory/954157.mspx - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11596 - http://support.microsoft.com/kb/976138 - https://exchange.xforce.ibmcloud.com/vulnerabilities/54643 - http://www.vupen.com/english/advisories/2009/3440 - http://support.microsoft.com/kb/954157 - http://zerodayinitiative.com/advisories/ZDI-09-090/ - https://exchange.xforce.ibmcloud.com/vulnerabilities/54645 - http://www.securityfocus.com/archive/1/508335/100/0/threaded - http://secunia.com/advis
loud.com/vulnerabilities/54645 - http://www.securityfocus.com/archive/1/508335/100/0/threaded - http://secunia.com/advisories/37592
CVE ID: CVE-2009-4311 State: PUBLISHED Published: 2009-12-13T01:00:00 Last Updated: 2024-08-07T07:01:20.261Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in the Indeo codec in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to execute arbitrary code via crafted media content, as reported to Microsoft by Paul Byrne of NGS Software. NOTE: this might overlap CVE-2008-3615. Additional Analyst Notes: - CVE Program Container: References: - http://support.microsoft.com/kb/955759 - http://securitytracker.com/id?1023302 - http://www.securityfocus.com/bid/37251 - http://www.microsoft.com/technet/security/advisory/954157.ms
r.com/id?1023302 - http://www.securityfocus.com/bid/37251 - http://www.microsoft.com/technet/security/advisory/954157.mspx - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11975 - http://support.microsoft.com/kb/976138 - http://www.vupen.com/english/advisories/2009/3440 - http://support.microsoft.com/kb/954157 - https://exchange.xforce.ibmcloud.com/vulnerabilities/54645 - http://secunia.com/advisories/37592
CVE ID: CVE-2009-4312 State: PUBLISHED Published: 2009-12-13T01:00:00 Last Updated: 2024-08-07T07:01:19.830Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in the Indeo codec in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to execute arbitrary code via crafted media content, as reported to Microsoft by Dave Lenoe of Adobe. Additional Analyst Notes: - CVE Program Container: References: - http://support.microsoft.com/kb/955759 - http://securitytracker.com/id?1023302 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11573 - http://www.securityfocus.com/bid/37251 - http://www.m
repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11573 - http://www.securityfocus.com/bid/37251 - http://www.microsoft.com/technet/security/advisory/954157.mspx - http://support.microsoft.com/kb/976138 - http://www.vupen.com/english/advisories/2009/3440 - http://support.microsoft.com/kb/954157 - https://exchange.xforce.ibmcloud.com/vulnerabilities/54645 - http://secunia.com/advisories/37592
CVE ID: CVE-2009-4313 State: PUBLISHED Published: 2009-12-13T01:00:00 Last Updated: 2024-08-07T07:01:20.289Z Vendors: n/a Products: n/a Problem Types: n/a Description: ir32_32.dll 3.24.15.3 in the Indeo32 codec in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to cause a denial of service (heap corruption) or execute arbitrary code via malformed data in a stream in a media file, as demonstrated by an AVI file. Additional Analyst Notes: - CVE Program Container: References: - http://support.microsoft.com/kb/955759 - http://www.osvdb.org/60858 - http://securitytracker.com/id?1023302 - http://www.securityfocus.com/bid/37251 - https://oval.cisecurity.org/r
g/60858 - http://securitytracker.com/id?1023302 - http://www.securityfocus.com/bid/37251 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12242 - http://www.microsoft.com/technet/security/advisory/954157.mspx - http://support.microsoft.com/kb/976138 - http://www.vupen.com/english/advisories/2009/3440 - http://support.microsoft.com/kb/954157 - http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=835 - https://exchange.xforce.ibmcloud.com/vulnerabilities/54645 - http://secunia.com/advisories/37592
CVE ID: CVE-2009-4314 State: PUBLISHED Published: 2009-12-14T17:00:00Z Last Updated: 2024-09-16T23:50:59.787Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sun Ray Server Software 4.1 on Solaris 10, when Automatic Multi-Group Hotdesking (AMGH) is enabled, responds to a logout action by immediately logging the user in again, which makes it easier for physically proximate attackers to obtain access to a session by going to an unattended DTU device. Additional Analyst Notes: - CVE Program Container: References: - http://sunsolve.sun.com/search/document.do?assetkey=1-21-139548-03-1 - http://sunsolve.sun.com/search/document.do?assetkey=1-66-268228-1
CVE ID: CVE-2009-4315 State: PUBLISHED Published: 2009-12-14T21:00:00 Last Updated: 2024-08-07T07:01:19.904Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in admin/ajaxsave.php in Nuggetz CMS 1.0, when magic_quotes_gpc is disabled, allows remote attackers to create or modify arbitrary files via a .. (dot dot) in the nugget parameter and a modified pagevalue parameter, as demonstrated by creating and accessing a .php file to execute arbitrary PHP code. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.org/0912-exploits/nuggetz-exec.txt - https://exchange.xforce.ibmcloud.com/vulnerabilities/54699 - http://
tstormsecurity.org/0912-exploits/nuggetz-exec.txt - https://exchange.xforce.ibmcloud.com/vulnerabilities/54699 - http://secunia.com/advisories/37664 - http://osvdb.org/60902 - http://www.nuggetz.co.uk/versionhistory.htm
CVE ID: CVE-2009-4316 State: PUBLISHED Published: 2009-12-14T21:00:00Z Last Updated: 2024-09-16T17:23:33.251Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in searchresults_main.php in ZeeLyrics 3x allows remote attackers to inject arbitrary web script or HTML via the keyword parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/37742
CVE ID: CVE-2009-4317 State: PUBLISHED Published: 2009-12-14T21:00:00 Last Updated: 2024-08-07T07:01:19.952Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in index.php in ScriptsEz Ez Cart allows remote attackers to inject arbitrary web script or HTML via the sid parameter in a showcat action. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2009/3510 - http://packetstormsecurity.org/0912-exploits/ezcart-xss.txt - http://www.exploit-db.com/exploits/10405 - http://secunia.com/advisories/37693
CVE ID: CVE-2009-4318 State: PUBLISHED Published: 2009-12-14T21:00:00 Last Updated: 2024-08-07T07:01:20.536Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in index.php in Real Estate Manager 1.0.1 allows remote attackers to inject arbitrary web script or HTML via the lang parameter. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2009/3507 - http://secunia.com/advisories/32049 - http://packetstormsecurity.org/0912-exploits/rem101-xss.txt - http://www.exploit-db.com/exploits/10413
CVE ID: CVE-2009-4319 State: PUBLISHED Published: 2009-12-14T21:00:00 Last Updated: 2024-08-07T07:01:20.892Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in js/bbcodepress/bbcode-form.php in eoCMS 0.9.03 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the BBCODE_path parameter. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/37749 - http://www.exploit-db.com/exploits/10422
CVE ID: CVE-2009-4320 State: PUBLISHED Published: 2009-12-14T23:00:00 Last Updated: 2024-08-07T07:01:19.366Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in searchform.php in The Next Generation of Genealogy Sitebuilding (TNG) 7.1.2 allows remote attackers to inject arbitrary web script or HTML via the msg parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/10387 - https://exchange.xforce.ibmcloud.com/vulnerabilities/54726 - http://secunia.com/advisories/37711
CVE ID: CVE-2009-4321 State: PUBLISHED Published: 2009-12-14T23:00:00 Last Updated: 2024-08-07T07:01:19.699Z Vendors: n/a Products: n/a Problem Types: n/a Description: extras/curltest.php in Zen Cart 1.3.8 and 1.3.8a, and possibly other versions, allows remote attackers to read arbitrary files via a file:// URI. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2009/3474 - http://osvdb.org/60892 - http://www.securityfocus.com/bid/37283 - https://exchange.xforce.ibmcloud.com/vulnerabilities/54687 - http://www.acunetix.com/blog/websecuritynews/acusensor-curl-and-zen-car
ange.xforce.ibmcloud.com/vulnerabilities/54687 - http://www.acunetix.com/blog/websecuritynews/acusensor-curl-and-zen-cart/ - http://www.zen-cart.com/forum/showthread.php?t=142784 - http://www.securityfocus.com/archive/1/508340/100/0/threaded - http://secunia.com/advisories/37630
CVE ID: CVE-2009-4322 State: PUBLISHED Published: 2009-12-14T23:00:00 Last Updated: 2024-08-07T07:01:20.273Z Vendors: n/a Products: n/a Problem Types: n/a Description: extras/ipn_test_return.php in Zen Cart allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message. Additional Analyst Notes: - CVE Program Container: References: - http://www.acunetix.com/blog/websecuritynews/acusensor-curl-and-zen-cart/ - http://www.zen-cart.com/forum/showthread.php?t=142784 - http://www.securityfocus.com/archive/1/508340/100/0/threaded
CVE ID: CVE-2009-4323 State: PUBLISHED Published: 2009-12-14T23:00:00Z Last Updated: 2024-09-17T00:31:24.431Z Vendors: n/a Products: n/a Problem Types: n/a Description: The installation for Zen Cart stores sensitive information and insecure programs under the (1) docs, (2) extras, and (3) zc_install folders, and (4) install.txt, which allows remote attackers to obtain sensitive information, delete the database, and conduct other attacks via a direct request, different vulnerabilities than CVE-2009-4321 and CVE-2009-4322. Additional Analyst Notes: - CVE Program Container: References: - http://www.zen-cart.com/forum/showthread.php?t=142784
CVE ID: CVE-2009-4324 State: PUBLISHED Published: 2009-12-15T02:00:00.000Z Last Updated: 2025-10-22T00:05:53.934Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securityfocus.com/bid/37331 - http://blogs.adobe.com/psirt/2009/12/new_adobe_reader_and_acrobat_v.html - http:
ttp://www.securityfocus.com/bid/37331 - http://blogs.adobe.com/psirt/2009/12/new_adobe_reader_and_acrobat_v.html - http://secunia.com/advisories/37690 - http://secunia.com/advisories/38138 - https://bugzilla.redhat.com/show_bug.cgi?id=547799 - http://osvdb.org/60980 - http://www.kb.cert.org/vuls/id/508357 - https://exchange.xforce.ibmcloud.com/vulnerabilities/54747 - http://www.vupen.com/english/advisories/2009/3518 - http://www.metasploit.com/redmine/projects/framework/repository/revisions/7881/entry/modules/exploits/windows/fileformat/adobe_media_newplayer.rb - http://www.adobe.com/support/security/bulletins/apsb10-02.html - https://oval.cisecurity.org/repository/search/definition/oval%3Ao