deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-4085
Published: 2009-11-29
Description: PHP remote file inclusion vulnerability in assets/plugins/mp3_id/mp3_id.php in PHP Traverser 0.8.0 allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[BASE] parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/60466; http://secunia.com/advisories/37455; https://exchange.xforce.ibmcloud.com/vulnerabilities/54378
CVE: CVE-2009-4086
Published: 2009-11-29
Description: CRLF injection vulnerability in Xerver HTTP Server 4.31 and 4.32 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via certain byte sequences at the end of a URL.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://packetstormsecurity.org/0911-exploits/xerver-split.txt; http://secunia.com/advisories/36681; http://www.securityfocus.com/bid/37064
CVE: CVE-2009-4087
Published: 2009-11-29
Description: Cross-site scripting (XSS) vulnerability in index.php in telepark.wiki 2.4.23 and earlier allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.telepark.com/telepark-web-software/2009/11/09/telepark-wiki-security-fixes/; http://packetstormsecurity.org/0911-exploits/Telepark-fixes-nov09-2.txt; http://secunia.com/advisories/37391
CVE: CVE-2009-4088
Published: 2009-11-29
Description: Multiple directory traversal vulnerabilities in telepark.wiki 2.4.23 and earlier allow remote attackers to read arbitrary files via directory traversal sequences in the css parameter to (1) getjs.php and (2) getcsslocal.php; and include and execute arbitrary local files via the (3) group parameter to upload.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://blog.telepark.com/telepark-web-software/2009/11/09/telepark-wiki-security-fixes/; http://packetstormsecurity.org/0911-exploits/Telepark-fixes-nov09-2.txt; http://secunia.com/advisories/37391
CVE: CVE-2009-4089
Published: 2009-11-29
Description: telepark.wiki 2.4.23 and earlier allows remote attackers to bypass authorization and (1) delete arbitrary pages via a modified pageID parameter to ajax/deletePage.php or (2) delete arbitrary comments via a modified pageID parameter to ajax/deleteComment.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://blog.telepark.com/telepark-web-software/2009/11/09/telepark-wiki-security-fixes/; http://packetstormsecurity.org/0911-exploits/Telepark-fixes-nov09-2.txt; http://secunia.com/advisories/37391
CVE: CVE-2009-4090
Published: 2009-11-29
Description: Unrestricted file upload vulnerability in ajax/addComment.php in telepark.wiki 2.4.23 and earlier script allows remote attackers to execute arbitrary code by uploading a file with a name containing a NULL byte.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://blog.telepark.com/telepark-web-software/2009/11/09/telepark-wiki-security-fixes/; http://packetstormsecurity.org/0911-exploits/Telepark-fixes-nov09-2.txt; http://secunia.com/advisories/37391
CVE: CVE-2009-4091
Published: 2009-11-29
Description: comments.php in Simplog 0.9.3.2, and possibly earlier, does not properly restrict access, which allows remote attackers to edit or delete comments via the (1) edit or (2) del action.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/21390; http://www.exploit-db.com/exploits/10180; http://www.securityfocus.com/bid/37063
CVE: CVE-2009-4092
Published: 2009-11-29
Description: Cross-site request forgery (CSRF) vulnerability in user.php in Simplog 0.9.3.2, and possibly earlier, allows remote attackers to hijack the authentication of administrators and users for requests that change passwords.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/21390; http://www.exploit-db.com/exploits/10180; http://www.securityfocus.com/bid/37063
CVE: CVE-2009-4093
Published: 2009-11-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in comments.php in Simplog 0.9.3.2, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) cname (Name) or (2) email parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/21390; http://www.exploit-db.com/exploits/10180; http://www.securityfocus.com/bid/37063
CVE: CVE-2009-4094
Published: 2009-11-29
Description: PHP remote file inclusion vulnerability in class/php/d4m_ajax_pagenav.php in the D4J eZine (com_ezine) component 2.1 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[mosConfig_absolute_path parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.kamtiez.org/2009/11/joomla-mambo-component-comezine-remote.html; http://www.securityfocus.com/bid/37043; https://exchange.xforce.ibmcloud.com/vulnerabilities/54307
CVE: CVE-2009-4095
Published: 2009-11-29
Description: myPhile 1.2.1 allows remote attackers to bypass authentication via an empty password.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://companionway.net/files/myphile/; http://secunia.com/advisories/37322; http://www.vupen.com/english/advisories/2009/3289
CVE: CVE-2009-4023
Published: 2009-11-29
Description: Argument injection vulnerability in the sendmail implementation of the Mail::Send method (Mail/sendmail.php) in the Mail package 1.1.14 for PEAR allows remote attackers to read and write arbitrary files via a crafted $from parameter, a different vector than CVE-2009-4111.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00001.html; http://pear.php.net/bugs/bug.php?id=16200; http://pear.php.net/bugs/bug.php?id=16200&edit=12&patch=quick-fix&revision=[PII_REDACTED]
CVE: CVE-2009-4024
Published: 2009-11-29
Description: Argument injection vulnerability in the ping function in Ping.php in the Net_Ping package before 2.4.5 for PEAR allows remote attackers to execute arbitrary shell commands via the host parameter.  NOTE: this has also been reported as a shell metacharacter problem.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://blog.pear.php.net/2009/11/14/net_traceroute-and-net_ping-security-advisory/; http://pear.php.net/advisory20091114-01.txt; http://pear.php.net/package/Net_Ping/download/2.4.5
CVE: CVE-2009-4025
Published: 2009-11-29
Description: Argument injection vulnerability in the traceroute function in Traceroute.php in the Net_Traceroute package before 0.21.2 for PEAR allows remote attackers to execute arbitrary shell commands via the host parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 10.0 (HIGH)
CWE: CWE-78
References: http://blog.pear.php.net/2009/11/14/net_traceroute-and-net_ping-security-advisory/; http://osvdb.org/60515; http://pear.php.net/advisory20091114-01.txt
CVE: CVE-2009-3736
Published: 2009-11-29
Description: ltdl.c in libltdl in GNU Libtool 1.5.x, and 2.2.6 before 2.2.6b, as used in Ham Radio Control Libraries, Q, and possibly other products, attempts to open a .la file in the current working directory, which allows local users to gain privileges via a Trojan horse file.
CVSS Score: 6.9 (MEDIUM)
References: ftp://ftp.gnu.org/gnu/libtool/libtool-2.2.6a-2.2.6b.diff.gz; http://git.savannah.gnu.org/cgit/libtool.git/commit/?h=branch-1-5&id=29b48580df75f0c5baa2962548a4c101ec7ed7ec; http://hamlib.svn.sourceforge.net/viewvc/hamlib/trunk/libltdl/Makefile.am?revision=2841&view=markup
CVE: CVE-2009-3894
Published: 2009-11-29
Description: Multiple untrusted search path vulnerabilities in dstat before 0.7.0 allow local users to gain privileges via a Trojan horse Python module in (1) the current working directory or (2) a certain subdirectory of the current working directory.
CVSS Score: 4.4 (MEDIUM)
References: http://bugs.gentoo.org/show_bug.cgi?id=293497; http://osvdb.org/60511; http://secunia.com/advisories/37445
CVE: CVE-2009-4080
Published: 2009-11-29
Description: Multiple unspecified vulnerabilities in ldap_cachemgr (aka the LDAP client configuration cache daemon) in Sun Solaris 9 and 10, and OpenSolaris before snv_78, allow local users to cause a denial of service (daemon crash) via vectors involving multiple serviceSearchDescriptor attributes and a call to the getldap_lookup function, and unspecified other vectors.
CVSS Score: 2.1 (LOW)
References: http://osvdb.org/60514; http://secunia.com/advisories/37505; http://secunia.com/advisories/37506
CVE: CVE-2009-4081
Published: 2009-11-29
Description: Untrusted search path vulnerability in dstat before r3199 allows local users to gain privileges via a Trojan horse Python module in the current working directory, a different vulnerability than CVE-2009-3894.
CVSS Score: 4.4 (MEDIUM)
References: http://bugs.gentoo.org/show_bug.cgi?id=293497; http://www.mandriva.com/security/advisories?name=MDVSA-2009:341; http://bugs.gentoo.org/show_bug.cgi?id=293497
CVE: CVE-2009-4111
Published: 2009-11-29
Description: Argument injection vulnerability in Mail/sendmail.php in the Mail package 1.1.14, 1.2.0b2, and possibly other versions for PEAR allows remote attackers to read and write arbitrary files via a crafted $recipients parameter, and possibly other parameters, a different vulnerability than CVE-2009-4023.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00001.html; http://pear.php.net/bugs/bug.php?id=16200; http://secunia.com/advisories/37458
CVE: CVE-2009-4096
Published: 2009-11-29
Description: RADIO istek scripti 2.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain user credentials via a direct request for estafresgaftesantusyan.inc.
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://osvdb.org/60516; http://packetstormsecurity.org/0911-exploits/istek-disclose.txt; http://secunia.com/advisories/37478
CVE: CVE-2009-4097
Published: 2009-11-29
Description: Stack-based buffer overflow in the MplayInputFile function in Serenity Audio Player 3.2.3 and earlier allows remote attackers to execute arbitrary code via a long URL in an M3U file.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/60503; http://packetstormsecurity.org/0911-exploits/serenityaudio-overflow.txt; http://secunia.com/advisories/37472
CVE: CVE-2009-4098
Published: 2009-11-29
Description: Unrestricted file upload vulnerability in banner-edit.php in OpenX adserver 2.8.1 and earlier allows remote authenticated users with banner / file upload permissions to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an images directory.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/60499; http://secunia.com/advisories/37475; http://www.openx.org/docs/2.8/release-notes/openx-2.8.2
CVE: CVE-2009-4099
Published: 2009-11-29
Description: SQL injection vulnerability in the Google Calendar GCalendar (com_gcalendar) component 1.1.2, 2.1.4, and possibly earlier versions for Joomla! allows remote attackers to execute arbitrary SQL commands via the gcid parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/60517; http://packetstormsecurity.org/0911-exploits/joomlagcalendar-sql.txt; http://secunia.com/advisories/37476
CVE: CVE-2009-4100
Published: 2009-11-29
Description: Yoono extension before 6.1.1 for Firefox performs certain operations with chrome privileges, which allows user-assisted remote attackers to execute arbitrary commands and perform cross-domain scripting attacks via DOM event handlers such as onload.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/37468; http://www.net-security.org/secworld.php?id=8527; http://www.securityfocus.com/bid/37123
CVE: CVE-2009-4101
Published: 2009-11-29
Description: infoRSS 1.1.4.2 and earlier extension for Firefox performs certain operations with chrome privileges, which allows remote attackers to execute arbitrary commands and perform cross-domain scripting attacks via the description tag of an RSS feed.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/37467; http://www.vupen.com/english/advisories/2009/3323; https://addons.mozilla.org/en-US/firefox/addons/versions/361#version-1.2.0
CVE: CVE-2009-4102
Published: 2009-11-29
Description: Sage 1.4.3 and earlier extension for Firefox performs certain operations with chrome privileges, which allows remote attackers to execute arbitrary commands and perform cross-domain scripting attacks via the description tag of an RSS feed.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://forums.mozillazine.org/viewtopic.php?f=48&t=1603515&start=0; http://jvn.jp/en/jp/JVN99203127/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2011-000070
CVE: CVE-2009-4103
Published: 2009-11-29
Description: Buffer overflow in Robo-FTP 3.6.17, and possibly other versions, allows remote FTP servers to cause a denial of service and possibly execute arbitrary code via unspecified FTP server responses.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/60513; http://secunia.com/advisories/37452; http://www.securityfocus.com/bid/37143
CVE: CVE-2009-4104
Published: 2009-11-29
Description: SQL injection vulnerability in Lyften Designs LyftenBloggie (com_lyftenbloggie) component 1.0.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the author parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/60518; http://secunia.com/advisories/37499; http://securityreason.com/exploitalert/7480
CVE: CVE-2009-4105
Published: 2009-11-29
Description: TYPSoft FTP Server 1.10 allows remote authenticated users to cause a denial of service (crash) by sending an APPE (append) command immediately followed by a DELE (delete) command without sending file data in between these two commands.
CVSS Score: 3.5 (LOW)
CWE: CWE-20
References: http://www.securityfocus.com/archive/1/508048/100/0/threaded; http://www.securityfocus.com/bid/37114; http://www.securitytracker.com/id?1023234
CVE: CVE-2009-4106
Published: 2009-11-29
Description: Unrestricted file upload vulnerability in admintools/editpage-2.php in Agoko CMS 0.4 and earlier allows remote attackers to inject and execute arbitrary PHP code via the filename and text parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.exploit-db.com/exploits/9605; http://www.vupen.com/english/advisories/2009/2613; https://exchange.xforce.ibmcloud.com/vulnerabilities/53113
CVE: CVE-2009-4107
Published: 2009-11-29
Description: Buffer overflow in Invisible Browsing 5.0.52 allows user-assisted remote attackers to execute arbitrary code via a crafted .ibkey file containing a long string.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://hjafari.blogspot.com/2009/09/invisible-browsing-5052-ibkey-local.html; http://www.exploit-db.com/exploits/9655; http://hjafari.blogspot.com/2009/09/invisible-browsing-5052-ibkey-local.html
CVE: CVE-2009-4108
Published: 2009-11-29
Description: XM Easy Personal FTP Server 5.8.0 allows remote authenticated users to cause a denial of service (crash) by uploading or creating a large number of files or directories, then performing a LIST command.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/37473; http://www.securityfocus.com/archive/1/508049/100/0/threaded; http://www.securityfocus.com/bid/37112
CVE: CVE-2009-4109
Published: 2009-11-29
Description: The install wizard in DotNetNuke 4.0 through 5.1.4 does not prevent anonymous users from accessing functionality related to determination of the need for an upgrade, which allows remote attackers to access version information and possibly other sensitive information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/60520; http://secunia.com/advisories/37480; http://www.dotnetnuke.com/News/SecurityPolicy/securitybulletinno30/tabid/1449/Default.aspx
CVE: CVE-2009-4110
Published: 2009-11-29
Description: Cross-site scripting (XSS) vulnerability in the search functionality in DotNetNuke 4.8 through 5.1.4 allows remote attackers to inject arbitrary web script or HTML via search terms that are not properly filtered before display in a custom results page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/60519; http://secunia.com/advisories/37480; http://www.dotnetnuke.com/News/SecurityPolicy/securitybulletinno31/tabid/1450/Default.aspx
CVE: CVE-2008-7247
Published: 2009-11-30
Description: sql/sql_table.cc in MySQL 5.0.x through 5.0.88, 5.1.x through 5.1.41, and 6.0 before 6.0.9-alpha, when the data home directory contains a symlink to a different filesystem, allows remote authenticated users to bypass intended access restrictions by calling CREATE TABLE with a (1) DATA DIRECTORY or (2) INDEX DIRECTORY argument referring to a subdirectory that requires following this symlink.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-59
References: http://bugs.mysql.com/bug.php?id=39277; http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://lists.mysql.com/commits/59711
CVE: CVE-2009-4019
Published: 2009-11-30
Description: mysqld in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41 does not (1) properly handle errors during execution of certain SELECT statements with subqueries, and does not (2) preserve certain null_value flags during execution of statements that use the GeomFromWKB function, which allows remote authenticated users to cause a denial of service (daemon crash) via a crafted statement.
CVSS Score: 4.0 (MEDIUM)
References: http://bugs.mysql.com/47780; http://bugs.mysql.com/48291; http://dev.mysql.com/doc/refman/5.0/en/news-5-0-88.html
CVE: CVE-2009-4028
Published: 2009-11-30
Description: The vio_verify_callback function in viosslfactories.c in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41, when OpenSSL is used, accepts a value of zero for the depth of X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary SSL-based MySQL servers via a crafted certificate, as demonstrated by a certificate presented by a server linked against the yaSSL library.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://bugs.mysql.com/47320; http://dev.mysql.com/doc/refman/5.0/en/news-5-0-88.html; http://dev.mysql.com/doc/refman/5.1/en/news-5-1-41.html
CVE: CVE-2009-4030
Published: 2009-11-30
Description: MySQL 5.1.x before 5.1.41 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL data home directory, related to incorrect calculation of the mysql_unpacked_real_data_home value.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4098 and CVE-2008-2079.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-59
References: http://bugs.mysql.com/bug.php?id=32167; http://dev.mysql.com/doc/refman/5.1/en/news-5-1-41.html; http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
CVE: CVE-2009-4112
Published: 2009-11-30
Description: Cacti 0.8.7e and earlier allows remote authenticated administrators to gain privileges by modifying the "Data Input Method" for the "Linux - Get Memory Usage" setting to contain arbitrary commands.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/fulldisclosure/2009-11/0292.html; http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00005.html
CVE: CVE-2009-4113
Published: 2009-11-30
Description: Static code injection vulnerability in the Categories module in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allows remote authenticated users with application administrative privileges to inject arbitrary PHP code into data/category.db.php via the Category Access field.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: http://www.morningstarsecurity.com/advisories/MORNINGSTAR-2009-02-CuteNews.txt; http://www.securityfocus.com/archive/1/507782/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/54243
CVE: CVE-2009-4114
Published: 2009-11-30
Description: kl1.sys in Kaspersky Anti-Virus 2010 9.0.0.463, and possibly other versions before 9.0.0.736, does not properly validate input to IOCTL 0x0022c008, which allows local users to cause a denial of service (system crash) via IOCTL requests using crafted kernel addresses that trigger memory corruption, possibly related to klavemu.kdl.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/60207; http://secunia.com/advisories/37398; http://sysdream.com/article.php?story_id=323&section_id=78
CVE: CVE-2009-4115
Published: 2009-11-30
Description: Multiple static code injection vulnerabilities in the Categories module in CutePHP CuteNews 1.4.6 allow remote authenticated users with application administrative privileges to inject arbitrary PHP code into data/category.db.php via the (1) category and (2) Icon URL fields; or (3) inject arbitrary PHP code into data/ipban.php via the add_ip parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: http://www.morningstarsecurity.com/advisories/MORNINGSTAR-2009-02-CuteNews.txt; http://www.securityfocus.com/archive/1/507782/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/54243
CVE: CVE-2009-4116
Published: 2009-11-30
Description: Multiple directory traversal vulnerabilities in CutePHP CuteNews 1.4.6, when magic_quotes_gpc is disabled, allow remote authenticated users with editor or administrative application access to read arbitrary files via a .. (dot dot) in the source parameter in a (1) list or (2) editnews action to the Editnews module, and (3) the save_con[skin] parameter in the Options module.  NOTE: vector 3 can be leveraged for code execution by using a .. to include and execute arbitrary local files.
CVSS Score: 3.5 (LOW)
CWE: CWE-22
References: http://www.morningstarsecurity.com/advisories/MORNINGSTAR-2009-02-CuteNews.txt; http://www.securityfocus.com/archive/1/507782/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/54244
CVE: CVE-2009-4117
Published: 2009-12-01
Description: Multiple stack-based buffer overflows in pdf_shade4.c in MuPDF before commit[PII_REDACTED]1942, as used in SumatraPDF before 1.0.1, allow remote attackers to cause a denial of service and possibly execute arbitrary code via a /Decode array for certain types of shading that are not properly handled by the (1) pdf_loadtype4shade, (2) pdf_loadtype5shade, (3) pdf_loadtype6shade, and (4) pdf_loadtype7shade functions.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/fulldisclosure/2009-11/0330.html; http://blog.kowalczyk.info/software/sumatrapdf/news.html; http://secunia.com/advisories/37494
CVE: CVE-2009-4118
Published: 2009-12-01
Description: The StartServiceCtrlDispatcher function in the cvpnd service (cvpnd.exe) in Cisco VPN client for Windows before 5.0.06.0100 does not properly handle an ERROR_FAILED_SERVICE_CONTROLLER_CONNECT error, which allows local users to cause a denial of service (service crash and VPN connection loss) via a manual start of cvpnd.exe while the cvpnd service is running.
CVSS Score: 2.1 (LOW)
References: http://packetstormsecurity.org/0911-exploits/sybsec-adv17.txt; http://secunia.com/advisories/37419; http://tools.cisco.com/security/center/viewAlert.x?alertId=19445