deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-4226
Published: 2009-12-08
Description: Race condition in the IP module in the kernel in Sun OpenSolaris snv_106 through snv_124 allows remote attackers to cause a denial of service (NULL pointer dereference and panic) via unspecified vectors related to the (1) tcp_do_getsockname or (2) tcp_do_getpeername function.
CVSS Score: 7.1 (HIGH)
CWE: CWE-362
References: http://opensolaris.org/jive/thread.jspa?messageID=415069&tstart=0; http://sunsolve.sun.com/search/document.do?assetkey=1-66-268189-1; http://www.vupen.com/english/advisories/2009/3413
CVE: CVE-2009-4227
Published: 2009-12-08
Description: Stack-based buffer overflow in the read_1_3_textobject function in f_readold.c in Xfig 3.2.5b and earlier, and in the read_textobject function in read1_3.c in fig2dev in Transfig 3.2.5a and earlier, allows remote attackers to execute arbitrary code via a long string in a malformed .fig file that uses the 1.3 file format.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=559274; http://secunia.com/advisories/37571; http://secunia.com/advisories/37577
CVE: CVE-2009-4228
Published: 2009-12-08
Description: Stack consumption vulnerability in u_bound.c in Xfig 3.2.5b and earlier allows remote attackers to cause a denial of service (application crash) via a long string in a malformed .fig file that uses the 1.3 file format, possibly related to the readfp_fig function in f_read.c.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=559274; http://www.mandriva.com/security/advisories?name=MDVSA-2011:010; http://www.vupen.com/english/advisories/2011/0108
CVE: CVE-2009-4033
Published: 2009-12-08
Description: A certain Red Hat patch for acpid 1.0.4 effectively triggers a call to the open function with insufficient arguments, which might allow local users to leverage weak permissions on /var/log/acpid, and obtain sensitive information by reading this file, cause a denial of service by overwriting this file, or gain privileges by executing this file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://securitytracker.com/id?1023284; http://www.mandriva.com/security/advisories?name=MDVSA-2009:342; http://www.redhat.com/support/errata/RHSA-2009-1642.html
CVE: CVE-2009-4229
Published: 2009-12-08
Description: Multiple SQL injection vulnerabilities in ActiveWebSoftwares Active Bids allow remote attackers to execute arbitrary SQL commands via (1) the catid parameter in the PATH_INFO to the default URI or (2) the catid parameter to default.asp.  NOTE: this might overlap CVE-2009-0429.3.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/37047; https://exchange.xforce.ibmcloud.com/vulnerabilities/54486; http://www.securityfocus.com/bid/37047
CVE: CVE-2009-4230
Published: 2009-12-08
Description: Multiple stack-based buffer overflows in src/Task.cc in the FastCGI program in IIPImage Server before 0.9.8 might allow remote attackers to execute arbitrary code via vectors associated with crafted arguments to the (1) RGN::run, (2) JTLS::run, or (3) SHD::run function.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://freshmeat.net/projects/iipimage/releases/309013; http://iipimage.sourceforge.net/blog/; http://secunia.com/advisories/37565
CVE: CVE-2009-4231
Published: 2009-12-08
Description: Directory traversal vulnerability in as/lib/plugins.php in SweetRice 0.5.3 and earlier allows remote attackers to include and execute arbitrary local files via .. (dot dot) in the plugin parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.org/0911-exploits/sweetrice-rfilfi.txt; http://packetstormsecurity.org/0911-exploits/sweetrice-rfilfi.txt
CVE: CVE-2009-4232
Published: 2009-12-08
Description: The Kide Shoutbox (com_kide) component 0.4.6 for Joomla! does not properly perform authentication, which allows remote attackers to post messages with an arbitrary account name via an insertar action to index.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/37508; http://secunia.com/advisories/37508
CVE: CVE-2009-4233
Published: 2009-12-08
Description: Cross-site scripting (XSS) vulnerability in modules/mod_yj_whois.php in the YJ Whois component 1.0x and 1.5.x for Joomla! allows remote attackers to inject arbitrary web script or HTML via the domain parameter to index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://extensions.joomla.org/extensions/external-contents/domain-search/5774; http://secunia.com/advisories/37525; http://www.youjoomla.com/joomla_support/yj-whois-module/4950-xss-security-patch-yj-whois.html
CVE: CVE-2009-4234
Published: 2009-12-08
Description: Cross-site scripting (XSS) vulnerability in loginpages/error_user.shtml on the Micronet Network Access Controller SP1910 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0911-exploits/micronet-xss.txt; http://secunia.com/advisories/37514; http://packetstormsecurity.org/0911-exploits/micronet-xss.txt
CVE: CVE-2009-4235
Published: 2009-12-08
Description: acpid 1.0.4 sets an unrestrictive umask, which might allow local users to leverage weak permissions on /var/log/acpid, and obtain sensitive information by reading this file or cause a denial of service by overwriting this file, a different vulnerability than CVE-2009-4033.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://securitytracker.com/id?1023284; http://www.debian.org/security/2009/dsa-1960; http://www.mandriva.com/security/advisories?name=MDVSA-2009:342
CVE: CVE-2009-1298
Published: 2009-12-08
Description: The ip_frag_reasm function in net/ipv4/ip_fragment.c in the Linux kernel 2.6.32-rc8, and 2.6.29 and later versions before 2.6.32, calls IP_INC_STATS_BH with an incorrect argument, which allows remote attackers to cause a denial of service (NULL pointer dereference and hang) via long IP packets, possibly related to the ip_defrag function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=bbf31bf18d34caa87dd01f08bf[PII_REDACTED]97f2; http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00000.html; http://secunia.com/advisories/37624
CVE: CVE-2009-1568
Published: 2009-12-08
Description: Stack-based buffer overflow in ienipp.ocx in Novell iPrint Client 5.30, and possibly other versions before 5.32, allows remote attackers to execute arbitrary code via a long target-frame parameter.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://download.novell.com/Download?buildid=29T3EFRky18~; http://secunia.com/advisories/37169; http://secunia.com/secunia_research/2009-40/
CVE: CVE-2009-1569
Published: 2009-12-08
Description: Multiple stack-based buffer overflows in Novell iPrint Client 4.38, 5.30, and possibly other versions before 5.32 allow remote attackers to execute arbitrary code via vectors related to (1) Date and (2) Time.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://download.novell.com/Download?buildid=29T3EFRky18~; http://secunia.com/advisories/35004; http://secunia.com/advisories/37169
CVE: CVE-2009-3844
Published: 2009-12-08
Description: Stack-based buffer overflow in the OmniInet process in HP OpenView Data Protector Application Recovery Manager 5.50 and 6.0 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted MSG_PROTOCOL packet.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4529&w=2; http://secunia.com/advisories/37600; http://securitytracker.com/id?1023288
CVE: CVE-2009-4236
Published: 2009-12-08
Description: The process function in data/class/pages/admin/customer/LC_Page_Admin_Customer_SearchCustomer.php in EC-CUBE Ver2 2.4.0 RC1 through 2.4.1, and Community Edition r18068 through r18428, allows remote attackers to obtain sensitive information (customer data) via unknown vectors related to sessions.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://jvn.jp/en/jp/JVN79762947/index.html; http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000078.html; http://osvdb.org/60685
CVE: CVE-2009-0102
Published: 2009-12-09
Description: Microsoft Project 2000 SR1 and 2002 SP1, and Office Project 2003 SP3, does not properly handle memory allocation for Project files, which allows remote attackers to execute arbitrary code via a malformed file, aka "Project Memory Validation Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.us-cert.gov/cas/techalerts/TA09-342A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-074; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6298
CVE: CVE-2009-2505
Published: 2009-12-09
Description: The Internet Authentication Service (IAS) in Microsoft Windows Vista SP2 and Server 2008 SP2 does not properly validate MS-CHAP v2 Protected Extensible Authentication Protocol (PEAP) authentication requests, which allows remote attackers to execute arbitrary code via crafted structures in a malformed request, aka "Internet Authentication Service Memory Corruption Vulnerability."
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://www.securitytracker.com/id?1023291; http://www.us-cert.gov/cas/techalerts/TA09-342A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-071
CVE: CVE-2009-2506
Published: 2009-12-09
Description: Integer overflow in the text converters in Microsoft Office Word 2002 SP3 and 2003 SP3; Works 8.5; Office Converter Pack; and WordPad in Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to execute arbitrary code via a DOC file with an invalid number of property names in the DocumentSummaryInformation stream, which triggers a heap-based buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=834; http://support.avaya.com/css/P8/documents/100070184; http://www.securityfocus.com/bid/37216
CVE: CVE-2009-2508
Published: 2009-12-09
Description: The single sign-on implementation in Active Directory Federation Services (ADFS) in Microsoft Windows Server 2003 SP2 and Server 2008 Gold and SP2 does not properly remove credentials at the end of a network session, which allows physically proximate attackers to obtain the credentials of a previous user of the same web browser by using data from the browser's cache, aka "Single Sign On Spoofing in ADFS Vulnerability."
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-255
References: http://www.us-cert.gov/cas/techalerts/TA09-342A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-070; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5882
CVE: CVE-2009-2509
Published: 2009-12-09
Description: Active Directory Federation Services (ADFS) in Microsoft Windows Server 2003 SP2 and Server 2008 Gold and SP2 does not properly validate headers in HTTP requests, which allows remote authenticated users to execute arbitrary code via a crafted request to an IIS web server, aka "Remote Code Execution in ADFS Vulnerability."
CVSS Score: 9.0 (HIGH)
CWE: CWE-20
References: http://www.us-cert.gov/cas/techalerts/TA09-342A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-070; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6441
CVE: CVE-2009-3563
Published: 2009-12-09
Description: ntp_request.c in ntpd in NTP before 4.2.4p8, and 4.2.5, allows remote attackers to cause a denial of service (CPU and bandwidth consumption) by using MODE_PRIVATE to send a spoofed (1) request or (2) response packet that triggers a continuous exchange of MODE_PRIVATE error responses between two NTP daemons.
CVSS Score: 6.4 (MEDIUM)
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2010-005.txt.asc; http://aix.software.ibm.com/aix/efixes/security/xntpd_advisory.asc; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560074
CVE: CVE-2009-3671
Published: 2009-12-09
Description: Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "Uninitialized Memory Corruption Vulnerability," a different vulnerability than CVE-2009-3674.
CVSS Score: 8.1 (HIGH)
CWE: CWE-399, CWE-416
References: http://www.securitytracker.com/id?1023293; http://www.us-cert.gov/cas/techalerts/TA09-342A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-072
CVE: CVE-2009-3673
Published: 2009-12-09
Description: Microsoft Internet Explorer 7 and 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "Uninitialized Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.securitytracker.com/id?1023293; http://www.us-cert.gov/cas/techalerts/TA09-342A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-072
CVE: CVE-2009-3674
Published: 2009-12-09
Description: Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "Uninitialized Memory Corruption Vulnerability," a different vulnerability than CVE-2009-3671.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securitytracker.com/id?1023293; http://www.us-cert.gov/cas/techalerts/TA09-342A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-072
CVE: CVE-2009-3675
Published: 2009-12-09
Description: LSASS.exe in the Local Security Authority Subsystem Service (LSASS) in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote authenticated users to cause a denial of service (CPU consumption) via a malformed ISAKMP request over IPsec, aka "Local Security Authority Subsystem Service Resource Exhaustion Vulnerability."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://www.us-cert.gov/cas/techalerts/TA09-342A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-069; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6639
CVE: CVE-2009-3677
Published: 2009-12-09
Description: The Internet Authentication Service (IAS) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold and SP1, and Server 2008 Gold does not properly verify the credentials in an MS-CHAP v2 Protected Extensible Authentication Protocol (PEAP) authentication request, which allows remote attackers to access network resources via a malformed request, aka "MS-CHAP Authentication Bypass Vulnerability."
CVSS Score: 10.0 (HIGH)
CWE: CWE-94, CWE-255
References: http://www.securitytracker.com/id?1023291; http://www.us-cert.gov/cas/techalerts/TA09-342A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-071
CVE: CVE-2009-4149
Published: 2009-12-09
Description: Cross-site scripting (XSS) vulnerability in the web interface in CA Service Desk 12.1 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/37253; https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=223999; http://www.securityfocus.com/bid/37253
CVE: CVE-2009-4239
Published: 2009-12-09
Description: Cross-site scripting (XSS) vulnerability in the Web console in IBM InfoSphere Information Server 8.1 before FP1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/37556; http://www-01.ibm.com/support/docview.wss?uid=swg1JR32573; http://www-01.ibm.com/support/docview.wss?uid=swg21406224
CVE: CVE-2009-4240
Published: 2009-12-09
Description: Multiple buffer overflows in unspecified setuid executables in the DataStage subsystem in IBM InfoSphere Information Server 8.1 before FP1 have unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/37556; http://www-01.ibm.com/support/docview.wss?uid=swg1JR30394; http://www-01.ibm.com/support/docview.wss?uid=swg21406224
CVE: CVE-2009-4249
Published: 2009-12-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in CutePHP CuteNews 1.4.6, when register_globals is enabled and magic_quotes_gpc is disabled, allow remote attackers to inject arbitrary web script or HTML via the (1) lastusername and (2) mod parameters to index.php; and (3) the title parameter to search.php.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://www.morningstarsecurity.com/advisories/MORNINGSTAR-2009-02-CuteNews.txt; http://www.securityfocus.com/archive/1/507782/100/0/threaded; http://www.securityfocus.com/bid/36971
CVE: CVE-2009-4250
Published: 2009-12-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allow remote attackers to inject arbitrary web script or HTML via (1) the result parameter to register.php; (2) the user parameter to search.php; the (3) cat_msg, (4) source_msg, (5) postponed_selected, (6) unapproved_selected, and (7) news_per_page parameters in a list action to the editnews module of index.php; and (8) the link tag in news comments.  NOTE: some of the vulnerabilities require register_globals to be enabled and/or magic_quotes_gpc to be disabled.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.morningstarsecurity.com/advisories/MORNINGSTAR-2009-02-CuteNews.txt; http://www.securityfocus.com/archive/1/507782/100/0/threaded; http://www.securityfocus.com/bid/36971
CVE: CVE-2009-4251
Published: 2009-12-10
Description: Stack-based buffer overflow in Jasc Paint Shop Pro 8.10 (aka Corel Paint Shop Pro) allows user-assisted remote attackers to execute arbitrary code via a crafted PNG file.  NOTE: this might be the same issue as CVE-2007-2366.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://aluigi.freeforums.org/post8780.html; http://osvdb.org/60592; http://secunia.com/advisories/37591
CVE: CVE-2009-4252
Published: 2009-12-10
Description: Cross-site scripting (XSS) vulnerability in images.php in Image Hosting Script DPI 1.1 Final (1.1F) allows remote attackers to inject arbitrary web script or HTML via the date parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/37456; http://www.clixint.com/support/viewtopic.php?f=3&t=542; http://www.exploit-db.com/exploits/10300
CVE: CVE-2009-4253
Published: 2009-12-10
Description: Cross-site scripting (XSS) vulnerability in dspStats.php in PowerPhlogger 2.2.5 allows remote attackers to inject arbitrary web script or HTML via the edit parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30423; http://www.securityfocus.com/bid/37150; http://www.websecurity.com.ua/1845
CVE: CVE-2009-4254
Published: 2009-12-10
Description: PowerPhlogger 2.2.5 allows remote attackers to obtain sensitive information via a direct request to (1) edCss.inc.php, (2) foot.inc.php, (3) get_csscolors.inc.php, (4) head.inc.php, (5) head_stuff.inc.php, (6) loglist.inc.php, and (7) pphlogger_send.inc.php in include/, which reveals the installation path in an error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.websecurity.com.ua/1845; https://exchange.xforce.ibmcloud.com/vulnerabilities/54543; http://www.websecurity.com.ua/1845
CVE: CVE-2009-4255
Published: 2009-12-10
Description: Cross-site scripting (XSS) vulnerability in the You!Hostit! template 1.0.1 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the created_by_alias parameter in index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/37601; http://www.exploit-db.com/exploits/10301; https://exchange.xforce.ibmcloud.com/vulnerabilities/54570
CVE: CVE-2009-4256
Published: 2009-12-10
Description: Multiple SQL injection vulnerabilities in cource.php in AlefMentor 2.0 and 2.2 allow remote attackers to execute arbitrary SQL commands via the (1) cont_id and (2) courc_id parameters in a pregled action.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/37626; http://www.exploit-db.com/exploits/10358; https://exchange.xforce.ibmcloud.com/vulnerabilities/54624
CVE: CVE-2009-4262
Published: 2009-12-10
Description: Harold Bakker's NewsScript (HB-NS) 1.3 allows remote attackers to obtain access to the admin control panel via a direct request to admin.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.packetstormsecurity.org/0912-exploits/hbns-admin.txt; https://exchange.xforce.ibmcloud.com/vulnerabilities/54518; http://www.packetstormsecurity.org/0912-exploits/hbns-admin.txt
CVE: CVE-2009-4263
Published: 2009-12-10
Description: SQL injection vulnerability in main_forum.php in PTCPay GeN3 forum 1.3 allows remote attackers to execute arbitrary SQL commands via the cat parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/10299; https://exchange.xforce.ibmcloud.com/vulnerabilities/54561; http://www.exploit-db.com/exploits/10299
CVE: CVE-2009-4264
Published: 2009-12-10
Description: PHP remote file inclusion vulnerability in components/core/connect.php in AROUNDMe 1.1 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the language_path parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/37567; http://www.exploit-db.com/exploits/10329; http://secunia.com/advisories/37567
CVE: CVE-2009-4265
Published: 2009-12-10
Description: Stack-based buffer overflow in Ideal Administration 2009 9.7.1, and possibly other versions, allows remote attackers to execute arbitrary code via a long Computer value in an .ipj project file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://freetexthost.com/abydoz3jwu; http://pocoftheday.blogspot.com/2009/12/ideal-administration-2009-v97-local.html; http://secunia.com/advisories/37572
CVE: CVE-2009-4266
Published: 2009-12-10
Description: Cross-site scripting (XSS) vulnerability in search.php in YABSoft Advanced Image Hosting (AIH) Script 2.2, and possibly 2.3, allows remote attackers to inject arbitrary web script or HTML via the text parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/34366; http://www.exploit-db.com/exploits/10336; https://exchange.xforce.ibmcloud.com/vulnerabilities/54582
CVE: CVE-2009-3794
Published: 2009-12-10
Description: Heap-based buffer overflow in Adobe Flash Player before 10.0.42.34 and Adobe AIR before 1.5.3 allows remote attackers to execute arbitrary code via crafted dimensions of JPEG data in an SWF file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010/Jan/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00003.html; http://osvdb.org/60885