deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-1052
Published: 2009-03-24
Description: FireAnt 1.3 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing user credentials via a direct request for user.tsv.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://e-rdc.org/v1/news.php?readmore=130; http://secunia.com/advisories/34359; http://www.securityfocus.com/archive/1/501905/100/0/threaded
CVE: CVE-2009-1053
Published: 2009-03-24
Description: chaozzDB 1.2 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing user credentials via a direct request for user.tsv.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://e-rdc.org/v1/news.php?readmore=129; http://www.securityfocus.com/archive/1/501901/100/0/threaded; http://e-rdc.org/v1/news.php?readmore=129
CVE: CVE-2009-1054
Published: 2009-03-24
Description: Unspecified vulnerability in JustSystems Ichitaro 13, 2004 through 2008, Lite2, and Ichitaro viewer 5.1.5.0 and earlier allows remote attackers to execute arbitrary code via a crafted file, as exploited in the wild by Trojan.Tarodrop.H in March 2009.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/34405; http://www.justsystems.com/jp/info/js09001.html; http://www.securityfocus.com/bid/34138
CVE: CVE-2009-1055
Published: 2009-03-24
Description: Unspecified vulnerability in the web service in Sitecore CMS 5.3.1 rev. 071114 allows remote authenticated users to gain access to security databases, and obtain administrative and user credentials, via unknown vectors related to SOAP and XML requests.
CVSS Score: 4.0 (MEDIUM)
References: http://sdn5.sitecore.net/Products/Sitecore%20V5/Sitecore%20CMS%205%2C-d-%2C3/ReleaseNotes/V5%2C-d-%2C3%2C-d-%2C2/ChangeLog.aspx; http://secunia.com/advisories/34356; http://www.securityfocus.com/archive/1/501929/100/0/threaded
CVE: CVE-2009-1056
Published: 2009-03-24
Description: IBM Rational AppScan Enterprise before 5.5 FP1 allows remote attackers to read arbitrary exported reports by "forcefully browsing."
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/52764; http://secunia.com/advisories/34349; http://www-01.ibm.com/support/docview.wss?uid=swg1PK79991
CVE: CVE-2009-1057
Published: 2009-03-24
Description: MicroSmarts Enterprise ZipItFast! 3.0 allows remote attackers to execute arbitrary code via a crafted .zip file that triggers memory corruption, related to a "format string buffer overflow." NOTE: CVE has not investigated whether the specified file.zip file can be used for exploitation of this product.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://osvdb.org/52550; http://secunia.com/advisories/34223; https://exchange.xforce.ibmcloud.com/vulnerabilities/49491
CVE: CVE-2009-1058
Published: 2009-03-24
Description: Stack-based buffer overflow in ZipGenius might allow remote attackers to execute arbitrary code via a crafted .zip file that triggers an SEH overwrite.  NOTE: it is possible that this overlaps CVE-2005-3317. NOTE: CVE has not investigated whether the specified file.zip file can be used for exploitation of this product.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/49490; https://www.exploit-db.com/exploits/8180; https://exchange.xforce.ibmcloud.com/vulnerabilities/49490
CVE: CVE-2009-1059
Published: 2009-03-24
Description: Stack-based buffer overflow in Trident PowerZip 7.2 might allow remote attackers to execute arbitrary code via a crafted .zip file.  NOTE: CVE has not investigated whether the specified file.zip file can be used for exploitation of this product.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/49492; https://www.exploit-db.com/exploits/8180; https://exchange.xforce.ibmcloud.com/vulnerabilities/49492
CVE: CVE-2009-1060
Published: 2009-03-24
Description: Unspecified vulnerability in Apple Safari on Mac OS X 10.5.6 allows remote attackers to execute arbitrary code via unknown vectors triggered by clicking on a link, as demonstrated by Charlie Miller during a PWN2OWN competition at CanSecWest 2009.
CVSS Score: 9.3 (HIGH)
References: http://cansecwest.com/index.html; http://dvlabs.tippingpoint.com/blog/2009/02/25/pwn2own-2009; http://dvlabs.tippingpoint.com/blog/2009/03/18/pwn2own-2009-day-1---safari-internet-explorer-and-firefox-taken-down-by-four-zero-day-exploits
CVE: CVE-2009-0193
Published: 2009-03-25
Description: Heap-based buffer overflow in Adobe Acrobat Reader 9 before 9.1, 8 before 8.1.4, and 7 before 7.1.1 allows remote attackers to execute arbitrary code via a PDF file with a malformed JBIG2 symbol dictionary segment, a different vulnerability than CVE-2009-1061 and CVE-2009-1062.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html; http://secunia.com/advisories/34392
CVE: CVE-2009-0207
Published: 2009-03-25
Description: Unspecified vulnerability in HP-UX B.11.11 running VERITAS Oracle Disk Manager (VRTSodm) 3.5, B.11.23 running VRTSodm 4.1 or VERITAS File System (VRTSvxfs) 4.1, B.11.23 running VRTSodm 5.0 or VRTSvxfs 5.0, and B.11.31 running VRTSodm 5.0 allows local users to gain root privileges via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1063&w=2; http://secunia.com/advisories/34419; http://www.securityfocus.com/bid/34226
CVE: CVE-2009-0787
Published: 2009-03-25
Description: The ecryptfs_write_metadata_to_contents function in the eCryptfs functionality in the Linux kernel 2.6.28 before 2.6.28.9 uses an incorrect size when writing kernel memory to an eCryptfs file header, which triggers an out-of-bounds read and allows local users to obtain portions of kernel memory.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-189
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=8faece5f906725c10e7a1f6caf84452abadbdc7b; http://osvdb.org/52860; http://rhn.redhat.com/errata/RHSA-2009-0473.html
CVE: CVE-2009-0891
Published: 2009-03-25
Description: The Web Services Security component in IBM WebSphere Application Server 7.0 before Fix Pack 1 (7.0.0.1), 6.1 before Fix Pack 23 (6.1.0.23),and 6.0.2 before Fix Pack 33 (6.0.2.33) does not properly enforce (1) nonce and (2) timestamp expiration values in WS-Security bindings as stored in the com.ibm.wsspi.wssecurity.core custom property, which allows remote authenticated users to conduct session hijacking attacks.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/34131; http://www-01.ibm.com/support/docview.wss?uid=swg27006876; http://www-01.ibm.com/support/docview.wss?uid=swg27007951
CVE: CVE-2009-0920
Published: 2009-03-25
Description: Stack-based buffer overflow in OvCgi/Toolbar.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via a long OvOSLocale cookie, a variant of CVE-2008-0067.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3871&w=2; http://secunia.com/advisories/34444; http://securityreason.com/securityalert/8308
CVE: CVE-2009-0921
Published: 2009-03-25
Description: Multiple heap-based buffer overflows in OvCgi/Toolbar.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allow remote attackers to execute arbitrary code via (1) a long OvAcceptLang cookie, which triggers the error in ov.dll and ovwww.dll, or (2) a long Accept-Language HTTP header, which triggers the error in ovwww.dll or libovwww.so.4.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3871&w=2; http://secunia.com/advisories/34444; http://www.coresecurity.com/content/openview-buffer-overflows
CVE: CVE-2009-0928
Published: 2009-03-25
Description: Heap-based buffer overflow in Adobe Acrobat Reader and Acrobat Professional 7.1.0, 8.1.3, 9.0.0, and other versions allows remote attackers to execute arbitrary code via a PDF file containing a JBIG2 stream with a size inconsistency related to an unspecified table.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=776; http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html
CVE: CVE-2009-1061
Published: 2009-03-25
Description: Unspecified vulnerability in Adobe Acrobat Reader 9 before 9.1, 8 before 8.1.4, and 7 before 7.1.1 might allow remote attackers to execute arbitrary code via unknown attack vectors related to JBIG2 and "input validation," a different vulnerability than CVE-2009-0193 and CVE-2009-1062.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html; http://secunia.com/advisories/34392
CVE: CVE-2009-1062
Published: 2009-03-25
Description: Adobe Acrobat Reader 9 before 9.1, 8 before 8.1.4, and 7 before 7.1.1 might allow remote attackers to trigger memory corruption and possibly execute arbitrary code via unknown attack vectors related to JBIG2, a different vulnerability than CVE-2009-0193 and CVE-2009-1061.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html; http://secunia.com/advisories/34392
CVE: CVE-2009-1072
Published: 2009-03-25
Description: nfsd in the Linux kernel before 2.6.28.9 does not drop the CAP_MKNOD capability before handling a user request in a thread, which allows local users to create device nodes, as demonstrated on a filesystem that has been exported with the root_squash option.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-16
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=76a67ec6fb79ff3570dcb5342142c[PII_REDACTED]; http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00002.html
CVE: CVE-2009-0215
Published: 2009-03-25
Description: Stack-based buffer overflow in the GetXMLValue method in the IBM Access Support ActiveX control in IbmEgath.dll, as distributed on IBM and Lenovo computers, allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/52958; http://secunia.com/advisories/34470; http://www.kb.cert.org/vuls/id/340420
CVE: CVE-2009-1074
Published: 2009-03-25
Description: Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not use SSL in all expected circumstances, which makes it easier for remote attackers to obtain sensitive information by sniffing the network, related to "ssl termination devices" and lack of support for relative URLs.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://blogs.sun.com/security/entry/sun_alert_253267_sun_java; http://secunia.com/advisories/34380; http://securitytracker.com/id?1021881
CVE: CVE-2009-1075
Published: 2009-03-25
Description: Sun Java System Identity Manager (IdM) 7.0 through 8.0 responds differently to failed use of the Forgot Password feature depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://blogs.sun.com/security/entry/sun_alert_253267_sun_java; http://secunia.com/advisories/34380; http://securitytracker.com/id?1021881
CVE: CVE-2009-1076
Published: 2009-03-25
Description: Sun Java System Identity Manager (IdM) 7.0 through 8.0 responds differently to failed use of the end-user question-based login feature depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://blogs.sun.com/security/entry/sun_alert_253267_sun_java; http://secunia.com/advisories/34380; http://securitytracker.com/id?1021881
CVE: CVE-2009-1077
Published: 2009-03-25
Description: The Change My Password implementation in the admin interface in Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not enforce the RequiresChallenge property setting, which allows remote authenticated users to change the passwords of other users, as demonstrated by changing the administrator's password.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://blogs.sun.com/security/entry/sun_alert_253267_sun_java; http://secunia.com/advisories/34380; http://securitytracker.com/id?1021881
CVE: CVE-2009-1078
Published: 2009-03-25
Description: Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not enforce the expected privilege requirements for (1) deleting audit policies and (2) modifying workflows, which allows remote authenticated users to have an unspecified impact.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://blogs.sun.com/security/entry/sun_alert_253267_sun_java; http://secunia.com/advisories/34380; http://securitytracker.com/id?1021881
CVE: CVE-2009-1079
Published: 2009-03-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Identity Manager (IdM) 7.0 through 8.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug IDs 19659, 19660, and 19683.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blogs.sun.com/security/entry/sun_alert_253267_sun_java; http://secunia.com/advisories/34380; http://securitytracker.com/id?1021881
CVE: CVE-2009-1080
Published: 2009-03-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Identity Manager (IdM) 7.0 through 8.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID 19033.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blogs.sun.com/security/entry/sun_alert_253267_sun_java; http://secunia.com/advisories/34380; http://securitytracker.com/id?1021881
CVE: CVE-2009-1081
Published: 2009-03-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Identity Manager (IdM) 7.0 through 8.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug IDs 19595 and 19661.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blogs.sun.com/security/entry/sun_alert_253267_sun_java; http://secunia.com/advisories/34380; http://securitytracker.com/id?1021881
CVE: CVE-2009-1082
Published: 2009-03-25
Description: Sun Java System Identity Manager (IdM) 7.0 through 8.0 allows remote authenticated users to gain privileges by submitting crafted commands to the Admin Console, as demonstrated by privileges for account creation and other administrative capabilities, related to the saveNoValidate action and saveNoValidateAllowedFormsAndWorkflows IDs.
CVSS Score: 9.0 (HIGH)
CWE: CWE-20
References: http://blogs.sun.com/security/entry/sun_alert_253267_sun_java; http://secunia.com/advisories/34380; http://securitytracker.com/id?1021881
CVE: CVE-2009-1083
Published: 2009-03-25
Description: Sun Java System Identity Manager (IdM) 7.0 through 8.0 on Linux, AIX, Solaris, and HP-UX permits "control characters" in the passwords of user accounts, which allows remote attackers to execute arbitrary commands via vectors involving "resource adapters."
CVSS Score: 9.0 (HIGH)
CWE: CWE-94
References: http://blogs.sun.com/security/entry/sun_alert_253267_sun_java; http://secunia.com/advisories/34380; http://securitytracker.com/id?1021881
CVE: CVE-2009-1084
Published: 2009-03-25
Description: Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not properly restrict access to the System Configuration object, which allows remote authenticated administrators and possibly remote attackers to have an unspecified impact by modifying this object.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://blogs.sun.com/security/entry/sun_alert_253267_sun_java; http://secunia.com/advisories/34380; http://securitytracker.com/id?1021881
CVE: CVE-2008-6516
Published: 2009-03-25
Description: Multiple directory traversal vulnerabilities in phpKF-Portal 1.10 allow remote attackers to include arbitrary files via a .. (dot dot) in the (1) tema_dizin parameter to baslik.php and (2) portal_ayarlarportal_dili parameter to anket_yonetim.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/30566; https://exchange.xforce.ibmcloud.com/vulnerabilities/44263; http://www.securityfocus.com/bid/30566
CVE: CVE-2008-6517
Published: 2009-03-25
Description: SQL injection vulnerability in NewsHOWLER 1.03 Beta allows remote attackers to execute arbitrary SQL commands via the news_user cookie parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/52236; http://www.securityfocus.com/archive/1/495548/100/0/threaded; http://www.securityfocus.com/bid/30732
CVE: CVE-2008-6518
Published: 2009-03-25
Description: Unrestricted file upload vulnerability in the profile feature in VidiScript allows registered remote authenticated users to execute arbitrary code by uploading a PHP file as an Avatar, then accessing the avatar via a direct request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: http://www.securityfocus.com/bid/30721; https://exchange.xforce.ibmcloud.com/vulnerabilities/44525; https://www.exploit-db.com/exploits/6259
CVE: CVE-2008-6519
Published: 2009-03-25
Description: Format string vulnerability in Xitami Web Server 2.2a through 2.5c2, and possibly other versions, allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via format string specifiers in a Long Running Web Process (LRWP) request, which triggers incorrect logging code involving the sendfmt function in the SMT kernel.
CVSS Score: 10.0 (HIGH)
CWE: CWE-134
References: http://www.bratax.be/advisories/b013.html; http://www.securityfocus.com/bid/28603; https://exchange.xforce.ibmcloud.com/vulnerabilities/41644
CVE: CVE-2008-6520
Published: 2009-03-25
Description: Multiple format string vulnerabilities in the SSI filter in Xitami Web Server 2.5c2, and possibly other versions, allow remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via format string specifiers in a URI that ends in (1) .ssi, (2) .shtm, or (3) .shtml, which triggers incorrect logging code involving the sendfmt function in the SMT kernel.
CVSS Score: 10.0 (HIGH)
CWE: CWE-134
References: http://www.bratax.be/advisories/b013.html; http://www.securityfocus.com/bid/28603; https://exchange.xforce.ibmcloud.com/vulnerabilities/41645
CVE: CVE-2008-6521
Published: 2009-03-25
Description: index.php in Terracotta (aka OpenTerracotta) 0.6.1 allows remote attackers to obtain sensitive information via an invalid File parameter, which reveals the installation path in an error message.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/archive/1/490341/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/41571; http://www.securityfocus.com/archive/1/490341/100/0/threaded
CVE: CVE-2008-6522
Published: 2009-03-25
Description: Multiple directory traversal vulnerabilities in the RenderFile function in ContentRender.class.php in Terracotta (aka OpenTerracotta) 0.6.1, and possibly other versions, allow remote attackers to list arbitrary directories and read arbitrary files via a .. (dot dot) in the (1) CurrentDirectory and (2) File parameters to index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/archive/1/490341/100/0/threaded; http://www.securityfocus.com/bid/28550; https://exchange.xforce.ibmcloud.com/vulnerabilities/41572
CVE: CVE-2008-6523
Published: 2009-03-25
Description: auth.php in openInvoice 0.90 beta and earlier allows remote attackers to bypass authentication and gain privileges by setting the oiauth cookie.  NOTE: this can be leveraged with a separate vulnerability in resetpass.php to modify passwords for arbitrary users.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.securityfocus.com/bid/28854; https://exchange.xforce.ibmcloud.com/vulnerabilities/41947; https://www.exploit-db.com/exploits/5466
CVE: CVE-2008-6524
Published: 2009-03-25
Description: resetpass.php in openInvoice 0.90 beta and earlier allows remote authenticated users to change the passwords of arbitrary users via a modified uid parameter.  NOTE: this can be leveraged with a separate vulnerability in auth.php to modify passwords without authentication.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-255
References: http://www.securityfocus.com/bid/28854; https://exchange.xforce.ibmcloud.com/vulnerabilities/41947; https://exchange.xforce.ibmcloud.com/vulnerabilities/49580
CVE: CVE-2008-6525
Published: 2009-03-25
Description: SQL injection vulnerability in the Admin Panel in Nice PHP FAQ Script (Knowledge base Script) allows remote attackers to execute arbitrary SQL commands via the Password parameter (aka the pass field).
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/32150; https://exchange.xforce.ibmcloud.com/vulnerabilities/46402; https://www.exploit-db.com/exploits/7018
CVE: CVE-2008-6526
Published: 2009-03-25
Description: SQL injection vulnerability in index.php in BosDev BosClassifieds allows remote attackers to execute arbitrary SQL commands via the cat_id parameter, a different vector than CVE-2008-1838.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/32075; https://exchange.xforce.ibmcloud.com/vulnerabilities/46308; https://www.exploit-db.com/exploits/6962
CVE: CVE-2008-6527
Published: 2009-03-25
Description: SQL injection vulnerability in forum.asp in GO4I.NET ASP Forum 1.0 allows remote attackers to execute arbitrary SQL commands via the iFor parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/32066; https://exchange.xforce.ibmcloud.com/vulnerabilities/46514; https://www.exploit-db.com/exploits/6930
CVE: CVE-2009-1085
Published: 2009-03-25
Description: Piwik 0.2.32 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the API key and other sensitive information via a direct request for misc/cron/archive.sh.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://dev.piwik.org/trac/ticket/599; http://marco-ziesing.de/archives/35-Schluesselloch-in-Piwik.html; http://www.openwall.com/lists/oss-security/2009/03/23/2
CVE: CVE-2009-1086
Published: 2009-03-25
Description: Heap-based buffer overflow in the ldns_rr_new_frm_str_internal function in ldns 1.4.x allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via a DNS resource record (RR) with a long (1) class field (clas variable) and possibly (2) TTL field.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html; http://secunia.com/advisories/35013; http://secunia.com/advisories/35065
CVE: CVE-2009-1087
Published: 2009-03-25
Description: Multiple argument injection vulnerabilities in PPLive.exe in PPLive 1.9.21 and earlier allow remote attackers to execute arbitrary code via a UNC share pathname in the LoadModule argument to the (1) synacast, (2) Play, (3) pplsv, or (4) ppvod URI handler.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/34327; http://www.vupen.com/english/advisories/2009/0739; https://exchange.xforce.ibmcloud.com/vulnerabilities/49263