deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-0862
Published: 2009-03-10
Description: Cross-site scripting (XSS) vulnerability in the hook_cntrlr_error_output function in modules/page/hooks/listeners.php in the admincp component in TangoCMS 2.2.x (aka Eagle) before 2.2.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/33967; http://tangocms.org/article/view/2.2.4-released; http://tangocms.org/changelog
CVE: CVE-2009-0863
Published: 2009-03-10
Description: SQL injection vulnerability in admin/delete_page.php in S-Cms 1.1 Stable allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/33799; https://exchange.xforce.ibmcloud.com/vulnerabilities/48806; https://www.exploit-db.com/exploits/8071
CVE: CVE-2009-0864
Published: 2009-03-10
Description: S-Cms 1.1 Stable allows remote attackers to bypass authentication and obtain administrative access via an OK value for the login cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.securityfocus.com/bid/33799; https://exchange.xforce.ibmcloud.com/vulnerabilities/48805; https://www.exploit-db.com/exploits/8071
CVE: CVE-2009-0865
Published: 2009-03-10
Description: Directory traversal vulnerability in the SnapShotToFile method in the GeoVision LiveX (aka LiveX_v8200) ActiveX control 8.1.2 and 8.2.0 in LIVEX_~1.OCX allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in the argument, possibly involving the PlayX and SnapShotX methods.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/33969; http://www.securityfocus.com/bid/33782; https://exchange.xforce.ibmcloud.com/vulnerabilities/48773
CVE: CVE-2009-0866
Published: 2009-03-10
Description: pHNews Alpha 1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for extra/genbackup.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/48801; https://www.exploit-db.com/exploits/8073; https://exchange.xforce.ibmcloud.com/vulnerabilities/48801
CVE: CVE-2009-0867
Published: 2009-03-10
Description: The HRM-S service in Fujitsu Enhanced Support Facility 3.0 and 3.0.1 allows remote attackers to obtain (1) hardware and (2) software information via unspecified requests in a client connection.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/33974; http://www.fujitsu.com/global/support/software/security/products-f/esf-200901e.html; http://www.securityfocus.com/bid/33831
CVE: CVE-2009-0868
Published: 2009-03-10
Description: CRLF injection vulnerability in the WebLink template in Fujitsu Jasmine2000 Enterprise Edition allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/33971; http://www.fujitsu.com/global/support/software/security/products-f/jasmine-200901e.html; http://www.securityfocus.com/bid/33832
CVE: CVE-2009-0081
Published: 2009-03-10
Description: The graphics device interface (GDI) implementation in the kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 does not properly validate input received from user mode, which allows remote attackers to execute arbitrary code via a crafted (1) Windows Metafile (aka WMF) or (2) Enhanced Metafile (aka EMF) image file, aka "Windows Kernel Input Validation Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://osvdb.org/52522; http://secunia.com/advisories/34117; http://support.avaya.com/elmodocs2/security/ASA-2009-079.htm
CVE: CVE-2009-0082
Published: 2009-03-10
Description: The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 does not properly validate handles, which allows local users to gain privileges via a crafted application that triggers unspecified "actions," aka "Windows Kernel Handle Validation Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://osvdb.org/52523; http://secunia.com/advisories/34117; http://support.avaya.com/elmodocs2/security/ASA-2009-079.htm
CVE: CVE-2009-0083
Published: 2009-03-10
Description: The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 does not properly handle invalid pointers, which allows local users to gain privileges via an application that triggers use of a crafted pointer, aka "Windows Kernel Invalid Pointer Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://osvdb.org/52524; http://secunia.com/advisories/34117; http://support.avaya.com/elmodocs2/security/ASA-2009-079.htm
CVE: CVE-2009-0085
Published: 2009-03-10
Description: The Secure Channel (aka SChannel) authentication component in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008, when certificate authentication is used, does not properly validate the client's key exchange data in Transport Layer Security (TLS) handshake messages, which allows remote attackers to spoof authentication by crafting a TLS packet based on knowledge of the certificate but not the private key, aka "SChannel Spoofing Vulnerability."
CVSS Score: 7.1 (HIGH)
CWE: CWE-287
References: http://osvdb.org/52521; http://secunia.com/advisories/34215; http://www.securitytracker.com/id?1021828
CVE: CVE-2009-0191
Published: 2009-03-10
Description: Foxit Reader 2.3 before Build 3902 and 3.0 before Build 1506, including 3.0.2009.1301, does not properly handle a JBIG2 symbol dictionary segment with zero new symbols, which allows remote attackers to execute arbitrary code via a crafted PDF file that triggers a dereference of an uninitialized memory location.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/34036; http://secunia.com/secunia_research/2009-11/; http://www.foxitsoftware.com/pdf/reader/security.htm#Processing
CVE: CVE-2009-0836
Published: 2009-03-10
Description: Foxit Reader 2.3 before Build 3902 and 3.0 before Build 1506, including 1120 and 1301, does not require user confirmation before performing dangerous actions defined in a PDF file, which allows remote attackers to execute arbitrary programs and have unspecified other impact via a crafted file, as demonstrated by the "Open/Execute a file" action.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://blog.zoller.lu/2009/03/remote-code-execution-in-pdf-still.html; http://lists.immunitysec.com/pipermail/dailydave/2010-April/006079.html; http://secunia.com/advisories/34036
CVE: CVE-2009-0837
Published: 2009-03-10
Description: Stack-based buffer overflow in Foxit Reader 3.0 before Build 1506, including 1120 and 1301, allows remote attackers to execute arbitrary code via a long (1) relative path or (2) absolute path in the filename argument in an action, as demonstrated by the "Open/Execute a file" action.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/34036; http://www.coresecurity.com/content/foxit-reader-vulnerabilities; http://www.foxitsoftware.com/pdf/reader/security.htm#Stackbased
CVE: CVE-2009-0869
Published: 2009-03-10
Description: Buffer overflow in the client in IBM Tivoli Storage Manager (TSM) HSM 5.3.2.0 through 5.3.5.0, 5.4.0.0 through 5.4.2.5, and 5.5.0.0 through 5.5.1.4 on Windows allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/34189; http://securitytracker.com/id?1021820; http://www-01.ibm.com/support/docview.wss?uid=swg21329223
CVE: CVE-2009-0870
Published: 2009-03-10
Description: The NFSv4 Server module in the kernel in Sun Solaris 10, and OpenSolaris before snv_111, allow local users to cause a denial of service (infinite loop and system hang) by accessing an hsfs filesystem that is shared through NFSv4, related to the rfs4_op_readdir function.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/34193; http://secunia.com/advisories/34371; http://securitytracker.com/id?1021819
CVE: CVE-2008-3547
Published: 2009-03-10
Description: Buffer overflow in the server in OpenTTD 0.6.1 and earlier allows remote authenticated users to cause a denial of service (persistent game disruption) or possibly execute arbitrary code via vectors involving many long names for "companies and clients."
CVSS Score: 9.0 (HIGH)
CWE: CWE-119
References: http://bugs.debian.org/493714; http://bugs.gentoo.org/show_bug.cgi?id=233929; http://marc.info/?l=oss-security&m=[PII_REDACTED]2284&w=2
CVE: CVE-2008-4563
Published: 2009-03-11
Description: Heap-based buffer overflow in adsmdll.dll 5.3.7.7296, as used by the daemon (dsmsvc.exe) in the backup server in IBM Tivoli Storage Manager (TSM) Express 5.3.7.3 and earlier and TSM 5.2, 5.3 before 5.3.6.0, and 5.4.0.0 through 5.4.4.0, allows remote attackers to execute arbitrary code via a crafted length value.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/fulldisclosure/2009-03/0192.html; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=775; http://osvdb.org/52617
CVE: CVE-2009-0093
Published: 2009-03-11
Description: Windows DNS Server in Microsoft Windows 2000 SP4, Server 2003 SP1 and SP2, and Server 2008, when dynamic updates are enabled, does not restrict registration of the "wpad" hostname, which allows remote authenticated users to hijack the Web Proxy Auto-Discovery (WPAD) feature, and conduct man-in-the-middle attacks by spoofing a proxy server, via a Dynamic Update request for this hostname, aka "DNS Server Vulnerability in WPAD Registration Vulnerability," a related issue to CVE-2007-1692.
CVSS Score: 3.5 (LOW)
CWE: CWE-20
References: http://blog.ncircle.com/blogs/vert/archives/2009/03/successful_exploit_renders_mic.html; http://blogs.technet.com/srd/archive/2009/03/13/ms09-008-dns-and-wins-server-security-update-in-more-detail.aspx; http://osvdb.org/52519
CVE: CVE-2009-0094
Published: 2009-03-11
Description: The WINS server in Microsoft Windows 2000 SP4 and Server 2003 SP1 and SP2 does not restrict registration of the (1) "wpad" and (2) "isatap" NetBIOS names, which allows remote authenticated users to hijack the Web Proxy Auto-Discovery (WPAD) and Intra-Site Automatic Tunnel Addressing Protocol (ISATAP) features, and conduct man-in-the-middle attacks by spoofing a proxy server or ISATAP route, by registering one of these names in the WINS database, aka "WPAD WINS Server Registration Vulnerability," a related issue to CVE-2007-1692.
CVSS Score: 5.5 (MEDIUM)
References: http://blogs.technet.com/srd/archive/2009/03/13/ms09-008-dns-and-wins-server-security-update-in-more-detail.aspx; http://osvdb.org/52520; http://secunia.com/advisories/34217
CVE: CVE-2009-0233
Published: 2009-03-11
Description: The DNS Resolver Cache Service (aka DNSCache) in Windows DNS Server in Microsoft Windows 2000 SP4, Server 2003 SP1 and SP2, and Server 2008, when dynamic updates are enabled, does not reuse cached DNS responses in all applicable situations, which makes it easier for remote attackers to predict transaction IDs and poison caches by simultaneously sending crafted DNS queries and responses, aka "DNS Server Query Validation Vulnerability."
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://blogs.technet.com/srd/archive/2009/03/13/ms09-008-dns-and-wins-server-security-update-in-more-detail.aspx; http://osvdb.org/52517; http://secunia.com/advisories/34217
CVE: CVE-2009-0234
Published: 2009-03-11
Description: The DNS Resolver Cache Service (aka DNSCache) in Windows DNS Server in Microsoft Windows 2000 SP4, Server 2003 SP1 and SP2, and Server 2008 does not properly cache crafted DNS responses, which makes it easier for remote attackers to predict transaction IDs and poison caches by sending many crafted DNS queries that trigger "unnecessary lookups," aka "DNS Server Response Validation Vulnerability."
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: http://blogs.technet.com/srd/archive/2009/03/13/ms09-008-dns-and-wins-server-security-update-in-more-detail.aspx; http://osvdb.org/52518; http://secunia.com/advisories/34217
CVE: CVE-2009-0660
Published: 2009-03-11
Description: Multiple cross-site scripting (XSS) vulnerabilities in Mahara 1.0 before 1.0.10 and 1.1 before 1.1.2 allow remote attackers to inject arbitrary web script or HTML via a (1) profile and (2) blog, a different vulnerability than CVE-2009-0487.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://mahara.org/interaction/forum/topic.php?id=350; http://secunia.com/advisories/34222; http://secunia.com/advisories/34231
CVE: CVE-2009-0712
Published: 2009-03-11
Description: Unspecified vulnerability in WMI Mapper for HP Systems Insight Manager before 2.5.2.0 allows local users to gain privileges via unknown vectors.
CVSS Score: 7.2 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01655638; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7193&w=2; http://osvdb.org/52592
CVE: CVE-2009-0713
Published: 2009-03-11
Description: Unspecified vulnerability in WMI Mapper for HP Systems Insight Manager before 2.5.2.0 allows remote attackers to obtain sensitive information via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01655638; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7193&w=2; http://osvdb.org/52591
CVE: CVE-2009-0848
Published: 2009-03-11
Description: Untrusted search path vulnerability in GTK2 in OpenSUSE 11.0 and 11.1 allows local users to execute arbitrary code via a Trojan horse GTK module in an unspecified "relative search path."
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-78
References: http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.html; http://secunia.com/advisories/34259; https://exchange.xforce.ibmcloud.com/vulnerabilities/49228
CVE: CVE-2009-0854
Published: 2009-03-11
Description: Untrusted search path vulnerability in dash 0.5.4, when used as a login shell, allows local users to execute arbitrary code via a Trojan horse .profile file in the current working directory.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-78
References: http://secunia.com/advisories/34205; http://www.securityfocus.com/bid/34092; http://www.ubuntu.com/usn/USN-732-1
CVE: CVE-2009-0871
Published: 2009-03-11
Description: The SIP channel driver in Asterisk Open Source 1.4.22, 1.4.23, and 1.4.23.1; 1.6.0 before 1.6.0.6; 1.6.1 before 1.6.1.0-rc2; and Asterisk Business Edition C.2.3, with the pedantic option enabled, allows remote authenticated users to cause a denial of service (crash) via a SIP INVITE request without any headers, which triggers a NULL pointer dereference in the (1) sip_uri_headers_cmp and (2) sip_uri_params_cmp functions.
CVSS Score: 3.5 (LOW)
CWE: CWE-20
References: http://bugs.digium.com/view.php?id=13547; http://bugs.digium.com/view.php?id=14417; http://downloads.digium.com/pub/security/AST-2009-002.html
CVE: CVE-2009-0872
Published: 2009-03-11
Description: The NFS server in Sun Solaris 10, and OpenSolaris before snv_111, does not properly implement the AUTH_NONE (aka sec=none) security mode in combination with other security modes, which allows remote attackers to bypass intended access restrictions and read or modify files, as demonstrated by a combination of the AUTH_NONE and AUTH_SYS security modes.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/52559; http://secunia.com/advisories/34213; http://secunia.com/advisories/34429
CVE: CVE-2009-0873
Published: 2009-03-11
Description: The NFS daemon (aka nfsd) in Sun Solaris 10 and OpenSolaris before snv_106, when NFSv3 is used, does not properly implement combinations of security modes, which allows remote attackers to bypass intended access restrictions and read or modify files, as demonstrated by a combination of the sec=sys and sec=krb5 security modes, related to modes that "override each other."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/52560; http://secunia.com/advisories/34225; http://secunia.com/advisories/34435
CVE: CVE-2009-0366
Published: 2009-03-12
Description: The uncompress_buffer function in src/server/simple_wml.cpp in Wesnoth before r33069 allows remote attackers to cause a denial of service via a large compressed WML document.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://launchpad.net/bugs/335089; http://launchpad.net/bugs/336396; http://launchpad.net/bugs/cve/2009-0366
CVE: CVE-2009-0632
Published: 2009-03-12
Description: The IP Phone Personal Address Book (PAB) Synchronizer feature in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 4.1, 4.2 before 4.2(3)SR4b, 4.3 before 4.3(2)SR1b, 5.x before 5.1(3e), 6.x before 6.1(3), and 7.0 before 7.0(2) sends privileged directory-service account credentials to the client in cleartext, which allows remote attackers to modify the CUCM configuration and perform other privileged actions by intercepting these credentials, and then using them in requests unrelated to the intended synchronization task, as demonstrated by (1) DC Directory account credentials in CUCM 4.x and (2) TabSyncSysUser account credentials in CUCM 5.x through 7.x.
CVSS Score: 9.0 (HIGH)
CWE: CWE-255
References: http://osvdb.org/52589; http://secunia.com/advisories/34238; http://www.cisco.com/en/US/products/products_applied_mitigation_bulletin09186a0080a86434.html
CVE: CVE-2009-0778
Published: 2009-03-12
Description: The icmp_send function in net/ipv4/icmp.c in the Linux kernel before 2.6.25, when configured as a router with a REJECT route, does not properly manage the Protocol Independent Destination Cache (aka DST) in some situations involving transmission of an ICMP Host Unreachable message, which allows remote attackers to cause a denial of service (connectivity outage) by sending a large series of packets to many destination IP addresses within this REJECT route, related to an "rt_cache leak."
CVSS Score: 7.1 (HIGH)
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=7c0ecc4c4f8fd90988aab8a95297b9c0038b6160; http://openwall.com/lists/oss-security/2009/03/11/2; http://secunia.com/advisories/33758
CVE: CVE-2009-0874
Published: 2009-03-12
Description: Multiple unspecified vulnerabilities in the Doors subsystem in the kernel in Sun Solaris 8 through 10, and OpenSolaris before snv_94, allow local users to cause a denial of service (process hang), or possibly bypass file permissions or gain kernel-context privileges, via vectors including ones related to (1) an argument handling deadlock in a door server and (2) watchpoint problems in the door_call function.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/34227; http://secunia.com/advisories/34375; http://sunsolve.sun.com/search/document.do?assetkey=1-21-117350-61-1
CVE: CVE-2009-0875
Published: 2009-03-12
Description: Race condition in the Doors subsystem in the kernel in Sun Solaris 8 through 10, and OpenSolaris before snv_94, allows local users to cause a denial of service (process hang), or possibly bypass file permissions or gain kernel-context privileges, via vectors involving the time at which control is transferred from a caller to a door server.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-362
References: http://osvdb.org/52561; http://secunia.com/advisories/34227; http://secunia.com/advisories/34375
CVE: CVE-2009-0876
Published: 2009-03-12
Description: Sun xVM VirtualBox 2.0.0, 2.0.2, 2.0.4, 2.0.6r39760, 2.1.0, 2.1.2, and 2.1.4r42893 on Linux allows local users to gain privileges via a hardlink attack, which preserves setuid/setgid bits on Linux, related to DT_RPATH:$ORIGIN.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://osvdb.org/52580; http://secunia.com/advisories/34232; http://sunsolve.sun.com/search/document.do?assetkey=1-66-254568-1
CVE: CVE-2009-0877
Published: 2009-03-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Communications Express allow remote attackers to inject arbitrary web script or HTML via the (1) Full Name or (2) Subject field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/52718; http://sosoblood.freehostia.com/SJSC/html_injection.gif; http://www.securityfocus.com/archive/1/501672/100/0/threaded
CVE: CVE-2009-0878
Published: 2009-03-12
Description: The read_game_map function in src/terrain_translation.cpp in Wesnoth before r32987 allows remote attackers to cause a denial of service (memory consumption and daemon hang) via a map with a large (1) width or (2) height.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://launchpad.net/bugs/335089; http://launchpad.net/bugs/336396; http://packages.debian.org/changelogs/pool/main/w/wesnoth/wesnoth_1.4.7-4/changelog
CVE: CVE-2009-0879
Published: 2009-03-12
Description: The CIM server in IBM Director before 5.20.3 Service Update 2 on Windows allows remote attackers to cause a denial of service (daemon crash) via a long consumer name, as demonstrated by an M-POST request to a long /CIMListener/ URI.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/52615; http://secunia.com/advisories/34212; http://securitytracker.com/id?1021825
CVE: CVE-2009-0880
Published: 2009-03-12
Description: Directory traversal vulnerability in the CIM server in IBM Director before 5.20.3 Service Update 2 on Windows allows remote attackers to load and execute arbitrary local DLL code via a .. (dot dot) in a /CIMListener/ URI in an M-POST request.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/52616; http://secunia.com/advisories/34212; http://www.securityfocus.com/archive/1/501639/100/0/threaded
CVE: CVE-2009-0881
Published: 2009-03-12
Description: SQL injection vulnerability in ejemplo/paises.php in isiAJAX 1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/49113; https://www.exploit-db.com/exploits/8167; https://exchange.xforce.ibmcloud.com/vulnerabilities/49113
CVE: CVE-2009-0882
Published: 2009-03-12
Description: Multiple SQL injection vulnerabilities in nForum 1.5 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to showtheme.php and the (2) user parameter to userinfo.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/archive/1/501560/100/0/threaded; http://www.securityfocus.com/bid/34030; http://www.securityfocus.com/archive/1/501560/100/0/threaded
CVE: CVE-2009-0883
Published: 2009-03-12
Description: SQL injection vulnerability in Blue Eye CMS 1.0.0 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the BlueEyeCMS_login cookie parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://www.securityfocus.com/bid/34022; https://exchange.xforce.ibmcloud.com/vulnerabilities/49104; https://www.exploit-db.com/exploits/8165
CVE: CVE-2009-0884
Published: 2009-03-12
Description: Buffer overflow in FileZilla Server before 0.9.31 allows remote attackers to cause a denial of service via unspecified vectors related to SSL/TLS packets.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-120
References: http://filezilla-project.org/index.php; http://secunia.com/advisories/34089; http://sourceforge.net/project/shownotes.php?release_id=665428
CVE: CVE-2009-0885
Published: 2009-03-12
Description: Multiple heap-based buffer overflows in Media Commands 1.0 allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a long string in a (1) M3U, (2) M3l, (3) TXT, and (4) LRC playlist file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/52346; http://secunia.com/advisories/34122; http://www.securityfocus.com/bid/33958