deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-3393
Published: 2009-10-22
Description: Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html; http://www.securityfocus.com/bid/36757; http://www.securitytracker.com/id?1023059
CVE: CVE-2009-3395
Published: 2009-10-22
Description: Unspecified vulnerability in the AutoVue component in Oracle E-Business Suite 19.3.2 allows remote attackers to affect availability via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html; http://www.securityfocus.com/bid/36761; http://www.securitytracker.com/id?1023059
CVE: CVE-2009-3396
Published: 2009-10-22
Description: Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 9.0, 9.1, 9.2.3, 10.0.1, and 10.3 allows remote attackers to affect integrity, related to WLS Console.
CVSS Score: 4.3 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html; http://www.securityfocus.com/bid/36766; http://www.securitytracker.com/id?1023062
CVE: CVE-2009-3397
Published: 2009-10-22
Description: Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 12.0.6 and 12.1.1 allows remote attackers to affect confidentiality via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html; http://www.securityfocus.com/bid/36762; http://www.securitytracker.com/id?1023059
CVE: CVE-2009-3399
Published: 2009-10-22
Description: Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 7.0.6 and 8.1.5 allows remote attackers to affect integrity, related to WLS Console.
CVSS Score: 4.3 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html; http://www.securityfocus.com/bid/36769; http://www.securitytracker.com/id?1023062
CVE: CVE-2009-3400
Published: 2009-10-22
Description: Unspecified vulnerability in the Oracle Advanced Benefits component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.1 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.
CVSS Score: 5.5 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html; http://www.securityfocus.com/bid/36767; http://www.securitytracker.com/id?1023059
CVE: CVE-2009-3401
Published: 2009-10-22
Description: Unspecified vulnerability in the Oracle Applications Technology Stack component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.1 allows local users to affect confidentiality via unknown vectors.
CVSS Score: 1.7 (LOW)
References: http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html; http://www.securityfocus.com/bid/36768; http://www.securitytracker.com/id?1023059
CVE: CVE-2009-3402
Published: 2009-10-22
Description: Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.1 allows remote authenticated users to affect confidentiality via unknown vectors.
CVSS Score: 2.1 (LOW)
References: http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html; http://www.securityfocus.com/bid/36764; http://www.securitytracker.com/id?1023059
CVE: CVE-2009-3403
Published: 2009-10-22
Description: Unspecified vulnerability in the JRockit component in BEA Product Suite R27.6.4: JRE/JDK, 1.4.2, 5, and, and 6 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: this issue subsumes CVE-2009-2670, CVE-2009-2671, CVE-2009-2672, CVE-2009-2673, CVE-2009-2674, CVE-2009-2675, and CVE-2009-2676.
CVSS Score: 10.0 (HIGH)
References: http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html; http://www.us-cert.gov/cas/techalerts/TA09-294A.html; http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html
CVE: CVE-2009-3404
Published: 2009-10-22
Description: Unspecified vulnerability in the PeopleSoft PeopleTools & Enterprise Portal component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.49.23 allows remote authenticated users to affect integrity via unknown vectors.
CVSS Score: 4.0 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html; http://www.securityfocus.com/bid/36773; http://www.securitytracker.com/id?1023061
CVE: CVE-2009-3405
Published: 2009-10-22
Description: Unspecified vulnerability in the JD Edwards Tools component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.98.1.4 allows remote authenticated users to affect integrity and availability via unknown vectors.
CVSS Score: 4.1 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html; http://www.securityfocus.com/bid/36772; http://www.securitytracker.com/id?1023061
CVE: CVE-2009-3406
Published: 2009-10-22
Description: Unspecified vulnerability in the JD Edwards Tools component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.98.2.1 allows remote authenticated users to affect confidentiality via unknown vectors.
CVSS Score: 2.7 (LOW)
References: http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html; http://www.securityfocus.com/bid/36771; http://www.securitytracker.com/id?1023061
CVE: CVE-2009-3407
Published: 2009-10-22
Description: Unspecified vulnerability in the Portal component in Oracle Application Server 10.1.2.3 and 10.1.4.2 allows remote attackers to affect integrity via unknown vectors, a different vulnerability than CVE-2009-0974 and CVE-2009-0983.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/59116; http://secunia.com/advisories/37099; http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html
CVE: CVE-2009-3408
Published: 2009-10-22
Description: Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
CVSS Score: 5.1 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html; http://www.securitytracker.com/id?1023059; http://www.us-cert.gov/cas/techalerts/TA09-294A.html
CVE: CVE-2009-3409
Published: 2009-10-22
Description: Unspecified vulnerability in the PeopleSoft Enterprise HCM (TAM) component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 9.0 Bundle 10 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.
CVSS Score: 3.6 (LOW)
References: http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html; http://www.securityfocus.com/bid/36776; http://www.securitytracker.com/id?1023061
CVE: CVE-2009-1297
Published: 2009-10-23
Description: iscsi_discovery in open-iscsi in SUSE openSUSE 10.3 through 11.1 and SUSE Linux Enterprise (SLE) 10 SP2 and 11, and other operating systems, allows local users to overwrite arbitrary files via a symlink attack on an unspecified temporary file that has a predictable name.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-59
References: http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html; http://www.mandriva.com/security/advisories?name=MDVSA-2013:109; https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0241
CVE: CVE-2009-2281
Published: 2009-10-23
Description: Multiple heap-based buffer underflows in the readPostBody function in cgiutil.c in mapserv in MapServer 4.x through 4.10.4 and 5.x before 5.4.2 allow remote attackers to execute arbitrary code via (1) a crafted Content-Length HTTP header or (2) a large HTTP request, related to an integer overflow that triggers a heap-based buffer overflow.  NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-0840.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://security.debian.org/pool/updates/main/m/mapserver/mapserver_4.10.0-5.1+etch4.diff.gz; http://security.debian.org/pool/updates/main/m/mapserver/mapserver_5.0.3-3+lenny4.diff.gz; http://trac.osgeo.org/mapserver/browser/tags/rel-5-4-2/mapserver/HISTORY.TXT
CVE: CVE-2009-3616
Published: 2009-10-23
Description: Multiple use-after-free vulnerabilities in vnc.c in the VNC server in QEMU 0.10.6 and earlier might allow guest OS users to execute arbitrary code on the host OS by establishing a connection from a VNC client and then (1) disconnecting during data transfer, (2) sending a message using incorrect integer data types, or (3) using the Fuzzy Screen Mode protocol, related to double free vulnerabilities.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-416
References: http://git.savannah.gnu.org/cgit/qemu.git/commit/?id=198a0039c5; http://git.savannah.gnu.org/cgit/qemu.git/commit/?id=753b405331; http://marc.info/?l=qemu-devel&m=[PII_REDACTED]2915
CVE: CVE-2009-3622
Published: 2009-10-23
Description: Algorithmic complexity vulnerability in wp-trackback.php in WordPress before 2.8.5 allows remote attackers to cause a denial of service (CPU consumption and server hang) via a long title parameter in conjunction with a charset parameter composed of many comma-separated "UTF-8" substrings, related to the mb_convert_encoding function in PHP.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://codes.zerial.org/php/wp-trackbacks_dos.phps; http://marc.info/?l=oss-security&m=[PII_REDACTED]9041&w=2; http://marc.info/?l=oss-security&m=[PII_REDACTED]4825&w=2
CVE: CVE-2009-3765
Published: 2009-10-23
Description: mutt_ssl.c in mutt 1.5.19 and 1.5.20, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-310
References: http://dev.mutt.org/trac/changeset/6016:dc09812e63a3/mutt_ssl.c; http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html; http://marc.info/?l=oss-security&m=[PII_REDACTED]8936&w=2
CVE: CVE-2009-3766
Published: 2009-10-23
Description: mutt_ssl.c in mutt 1.5.16 and other versions before 1.5.19, when OpenSSL is used, does not verify the domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-310
References: http://dev.mutt.org/trac/ticket/3087; http://marc.info/?l=oss-security&m=[PII_REDACTED]8936&w=2; http://www.openwall.com/lists/oss-security/2009/10/26/1
CVE: CVE-2009-3767
Published: 2009-10-23
Description: libraries/libldap/tls_o.c in OpenLDAP 2.2 and 2.4, and possibly other versions, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-295
References: http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-March/036138.html; http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html
CVE: CVE-2009-3611
Published: 2009-10-26
Description: common/snapshots.py in Back In Time (aka backintime) 0.9.26 changes certain permissions to 0777 before deleting the files in an old backup snapshot, which allows local users to obtain sensitive information by reading these files, or interfere with backup integrity by modifying files that are shared across snapshots.
CVSS Score: 7.1 (HIGH)
CWE: CWE-732
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=543785; http://bugs.gentoo.org/show_bug.cgi?id=289047; http://ftp.debian.org/debian/pool/main/b/backintime/backintime_0.9.26-3.diff.gz
CVE: CVE-2009-3625
Published: 2009-10-26
Description: Directory traversal vulnerability in www/index.php in Sahana 0.6.2.2 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the mod parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://sahana.cvs.sourceforge.net/viewvc/sahana/sahana-phase2/www/index.php?r1=1.83&r2=1.84; http://sourceforge.net/mailarchive/forum.php?thread_name=5d9043b[PII_REDACTED]4l4bb0178fs563a5128a0f5db01%40mail.gmail.com&forum_name=sahana-maindev; http://www.openwall.com/lists/oss-security/2009/10/22/3
CVE: CVE-2009-3778
Published: 2009-10-26
Description: SQL injection vulnerability in Moodle Course List 6.x before 6.x-1.2, a module for Drupal, allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://drupal.org/node/610986; http://osvdb.org/59100; http://secunia.com/advisories/37126
CVE: CVE-2009-3779
Published: 2009-10-26
Description: Cross-site scripting (XSS) vulnerability in vCard 5.x before 5.x-1.4 and 6.x before 6.x-1.3, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to the addition of the theme_vcard function to a theme and the use of default content.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/610416; http://drupal.org/node/610420; http://drupal.org/node/610996
CVE: CVE-2009-3780
Published: 2009-10-26
Description: Cross-site scripting (XSS) vulnerability in Abuse 5.x before 5.x-2.1 and 6.x before 6.x-1.1-alpha1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/610784; http://drupal.org/node/610900; http://drupal.org/node/611078
CVE: CVE-2009-3781
Published: 2009-10-26
Description: The filefield_file_download function in FileField 6.x-3.1, a module for Drupal, does not properly check node-access permissions for Drupal core private files, which allows remote attackers to access unauthorized files via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: http://drupal.org/files/issues/filefield-node-access-fix-516104-3.patch; http://drupal.org/node/516104; http://drupal.org/node/609874
CVE: CVE-2009-3782
Published: 2009-10-26
Description: Unspecified vulnerability in Userpoints 6.x before 6.x-1.1, a module for Drupal, allows remote authenticated users with "View own userpoints" permissions to read the userpoint data of arbitrary users via unknown attack vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: http://drupal.org/node/610818; http://drupal.org/node/610828; http://osvdb.org/59124
CVE: CVE-2009-3783
Published: 2009-10-26
Description: Cross-site scripting (XSS) vulnerability in Simplenews Statistics 6.x before 6.x-2.0, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vector.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/590098; http://drupal.org/node/611002; http://secunia.com/advisories/37128
CVE: CVE-2009-3784
Published: 2009-10-26
Description: Open redirect vulnerability in Simplenews Statistics 6.x before 6.x-2.0, a module for Drupal, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/590098; http://drupal.org/node/611002; http://secunia.com/advisories/37128
CVE: CVE-2009-3785
Published: 2009-10-26
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Simplenews Statistics 6.x before 6.x-2.0, a module for Drupal, allow remote attackers to hijack the authentication of arbitrary users via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/590098; http://drupal.org/node/611002; http://secunia.com/advisories/37128
CVE: CVE-2009-3786
Published: 2009-10-26
Description: Cross-site scripting (XSS) vulnerability in Organic Groups (OG) Vocabulary 5.x before 5.x-1.1 and 6.x before 6.x-1.1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via the group title.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/605094; http://drupal.org/node/610948; http://drupal.org/node/621960
CVE: CVE-2009-3787
Published: 2009-10-26
Description: files.php in Vivvo CMS 4.1.5.1 allows remote attackers to conduct directory traversal attacks and read arbitrary files via the file parameter with "logs/" in between two . (dot) characters, which is filtered into a "../" sequence.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/37117; http://www.securityfocus.com/archive/1/507358/100/0/threaded; http://www.securityfocus.com/bid/36783
CVE: CVE-2009-3788
Published: 2009-10-26
Description: SQL injection vulnerability in index.php in OpenDocMan 1.2.5 allows remote attackers to execute arbitrary SQL commands via the frmuser (aka Username) parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/59301; http://secunia.com/advisories/30750; http://www.packetstormsecurity.org/0910-exploits/opendocman-sqlxss.txt
CVE: CVE-2009-3789
Published: 2009-10-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in OpenDocMan 1.2.5 allow remote attackers to inject arbitrary web script or HTML via the last_message parameter to (1) add.php, (2) toBePublished.php, (3) index.php, and (4) admin.php; the PATH_INFO to the default URI to (5) category.php, (6) department.php, (7) profile.php, (8) rejects.php, (9) search.php, (10) toBePublished.php, (11) user.php, and (12) view_file.php; and (13) the caller parameter in a Modify User action to user.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/59302; http://osvdb.org/59303; http://osvdb.org/59304
CVE: CVE-2009-3790
Published: 2009-10-26
Description: Heap-based buffer overflow in FormMax (formerly AcroForm) evaluation 3.5 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted FormMax import (.aim) file.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/59079; http://secunia.com/advisories/36943; https://exchange.xforce.ibmcloud.com/vulnerabilities/53890
CVE: CVE-2009-3801
Published: 2009-10-27
Description: SQL injection vulnerability in index.php in OpenDocMan 1.2.5 allows remote attackers to execute arbitrary SQL commands via the frmpass (aka Password) parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30750; http://secunia.com/advisories/30750
CVE: CVE-2009-3802
Published: 2009-10-27
Description: Amiro.CMS 5.4.0.0 and earlier allows remote attackers to obtain sensitive information via an invalid loginname ("%%%") to _admin/index.php, which reveals the installation path and other information in an error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://packetstormsecurity.org/0910-exploits/ONSEC-09-005.txt; http://secunia.com/advisories/37065; http://www.onsec.ru/vuln?id=12
CVE: CVE-2009-3803
Published: 2009-10-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in Amiro.CMS 5.4.0.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the status_message parameter to (1) /news, (2) /comment, (3) /forum, (4) /blog, and (5) /tags; the status_message parameter to (6) forum.php, (7) discussion.php, (8) guestbook.php, (9) blog.php, (10) news.php, (11) srv_updates.php, (12) srv_backups.php, (13) srv_twist_prevention.php, (14) srv_tags.php, (15) srv_tags_reindex.php, (16) google_sitemap.php, (17) sitemap_history.php, (18) srv_options.php, (19) locales.php and (20) plugins_wizard.php in _admin/; a crafted IMG BBcode tag in the message body of a (21) forum, (22) guestbook, or (23) comment; (24) the content of an avatar file, which is not properly handled by Internet Explorer; and (25) the loginname parameter (aka username) in _admin/index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0910-exploits/ONSEC-09-004.txt; http://secunia.com/advisories/37065; http://www.onsec.ru/vuln?id=11
CVE: CVE-2009-3804
Published: 2009-10-27
Description: Multiple SQL injection vulnerabilities in modules/forum/post.php in RunCMS 2M1 allow remote authenticated users to execute arbitrary SQL commands via (1) the pid parameter, which is not properly handled by the store function in modules/forum/class/class.forumposts.php, or (2) the topic_id parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://retrogod.altervista.org/9sg_runcms_store_sql.html; http://secunia.com/advisories/37137; http://retrogod.altervista.org/9sg_runcms_store_sql.html
CVE: CVE-2009-3805
Published: 2009-10-27
Description: gpg2.exe in Gpg4win 2.0.1, as used in KDE Kleopatra 2.0.11, allows remote attackers to cause a denial of service (application crash) via a long certificate signature.
CVSS Score: 4.3 (MEDIUM)
References: http://www.packetstormsecurity.com/0910-exploits/gpg2kleo-dos.txt; http://www.securityfocus.com/bid/36781; https://exchange.xforce.ibmcloud.com/vulnerabilities/53908
CVE: CVE-2009-3806
Published: 2009-10-27
Description: SQL injection vulnerability in feedback_js.php in DedeCMS 5.1 allows remote attackers to execute arbitrary SQL commands via the arcurl parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/archive/1/507109/100/0/threaded; http://www.securityfocus.com/archive/1/507109/100/0/threaded
CVE: CVE-2009-3807
Published: 2009-10-27
Description: Stack-based buffer overflow in MixVibes 7.043 Pro allows remote attackers to cause a denial of service (crash) via a long string in a .vib file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.exploit-db.com/exploits/9147; https://exchange.xforce.ibmcloud.com/vulnerabilities/51715; http://www.exploit-db.com/exploits/9147
CVE: CVE-2009-3808
Published: 2009-10-27
Description: MixSense DJ Studio 1.0.0.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long string in an .mp3 playlist file.
CVSS Score: 9.3 (HIGH)
References: http://www.exploit-db.com/exploits/9178; https://exchange.xforce.ibmcloud.com/vulnerabilities/51814; http://www.exploit-db.com/exploits/9178
CVE: CVE-2009-3809
Published: 2009-10-27
Description: Acoustica MP3 Audio Mixer 1.0 and possibly 2.471 allows remote attackers to cause a denial of service (crash) via a long string in a .sgp playlist file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://www.exploit-db.com/exploits/9212; http://www.vupen.com/english/advisories/2009/1958; https://exchange.xforce.ibmcloud.com/vulnerabilities/51868
CVE: CVE-2009-3810
Published: 2009-10-27
Description: Heap-based buffer overflow in Acoustica MP3 Audio Mixer 2.471 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a long string in a .M3U playlist file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/56033; http://secunia.com/advisories/35902; http://www.exploit-db.com/exploits/9213
CVE: CVE-2009-3811
Published: 2009-10-27
Description: Stack-based buffer overflow in Music Tag Editor 1.61 build 212 allows remote attackers to execute arbitrary code via an MP3 file with a long ID3 tag.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://liquidworm.blogspot.com/2009/07/music-tag-editor-161-build-212-remote.html; http://osvdb.org/55861; http://secunia.com/advisories/35828