rainbutterfly/cve_corpus huggingface dataset:
CVE-2009-3843 
HP Operations Manager 8.10 on Windows contains a "hidden account" in the XML file that specifies Tomcat users, which allows remote attackers to conduct unrestricted file upload attacks, and thereby execute arbitrary code, by using the org.apache.catalina.manager.HTMLManagerServlet class to make requests to manager/html/upload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-24T00:00:00.000Z
CVE-2009-3844 
Stack-based buffer overflow in the OmniInet process in HP OpenView Data Protector Application Recovery Manager 5.50 and 6.0 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted MSG_PROTOCOL packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-08T23:00:00.000Z
CVE-2009-3845 
The port-3443 HTTP server in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary commands via shell metacharacters in the hostname parameter to unspecified Perl scripts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-10T22:00:00.000Z
CVE-2009-3846 
Multiple heap-based buffer overflows in ovlogin.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allow remote attackers to execute arbitrary code via a long (1) userid or (2) passwd parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-10T22:00:00.000Z
CVE-2009-3847 
Unspecified vulnerability in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-10T22:00:00.000Z
CVE-2009-3848 
Stack-based buffer overflow in nnmRptConfig.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via a long Template parameter, related to the vsprintf function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-10T22:00:00.000Z
CVE-2009-3849 
Multiple stack-based buffer overflows in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allow remote attackers to execute arbitrary code via (1) a long Template parameter to nnmRptConfig.exe, related to the strcat function; or (2) a long Oid parameter to snmp.exe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-10T22:00:00.000Z
CVE-2009-3850 
Blender 2.34, 2.35a, 2.40, and 2.49b allows remote attackers to execute arbitrary code via a .blend file that contains Python statements in the onLoad action of a ScriptLink SDNA.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-06T15:00:00.000Z
CVE-2009-3851 
Trusted Extensions in Sun Solaris 10 interferes with the operation of the xscreensaver-demo command for the XScreenSaver application, which makes it easier for physically proximate attackers to access an unattended workstation for which the intended screen locking did not occur, related to the "restart daemon."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-03T16:00:00.000Z
CVE-2009-3852 
Unspecified vulnerability in the XML component in IBM Runtimes for Java Technology 5.0.0 before SR10 has unknown impact and attack vectors, related to the "updated version of XML4J 4.4.17."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-03T16:00:00.000Z
CVE-2009-3853 
Stack-based buffer overflow in the client acceptor daemon (CAD) scheduler in the client in IBM Tivoli Storage Manager (TSM) 5.3 before 5.3.6.7, 5.4 before 5.4.3, 5.5 before 5.5.2.2, and 6.1 before 6.1.0.2, and TSM Express 5.3.3.0 through 5.3.6.6, allows remote attackers to execute arbitrary code via crafted data in a TCP packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-04T15:00:00.000Z
CVE-2009-3854 
Buffer overflow in the traditional client scheduler in the client in IBM Tivoli Storage Manager (TSM) 5.3 before 5.3.6.7 and 5.4 before 5.4.2 allows remote attackers to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-04T15:00:00.000Z
CVE-2009-3855 
Multiple unspecified vulnerabilities in the (1) UNIX and (2) Linux backup-archive clients, and the (3) OS/400 API client, in IBM Tivoli Storage Manager (TSM) 5.3 before 5.3.6.6, 5.4 before 5.4.2, and 5.5 before 5.5.1, when the MAILPROG option is enabled, allow attackers to read, modify, or delete arbitrary files via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-04T15:00:00.000Z
CVE-2009-3856 
Cross-site scripting (XSS) vulnerability in the default URI in news/ in Twilight CMS before 4.1 allows remote attackers to inject arbitrary web script or HTML via the calendar parameter.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-04T17:00:00.000Z
CVE-2009-3857 
Buffer overflow in Softonic International SciTE 1.72 allows user-assisted remote attackers to cause a denial of service (application crash) via a Ruby (.rb) file containing a long string, which triggers the crash when a scroll bar is used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-04T17:00:00.000Z
CVE-2009-3858 
Cross-site scripting (XSS) vulnerability in GejoSoft allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI in photos/tags.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-04T17:00:00.000Z
CVE-2009-3859 
Buffer overflow in eEye Retina WiFi Scanner 1.0.8.68, as used in Retina Network Security Scanner 5.10.14, allows user-assisted remote attackers to cause a denial of service (application crash) or execute arbitrary code via a .rws file with a long RWS010 entry.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-04T17:00:00.000Z
CVE-2009-3860 
Multiple insecure method vulnerabilities in Idefense Labs COMRaider allow remote attackers to create or overwrite arbitrary files via the (1) CreateFolder and (2) Copy methods.  NOTE: this might only be a vulnerability in certain insecure configurations of Internet Explorer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-04T17:00:00.000Z
CVE-2009-3861 
Stack-based buffer overflow in SafeNet SoftRemote 10.8.5 (Build 2) and 10.3.5 (Build 6), and possibly other versions before 10.8.9, allows local users to execute arbitrary code via a long string in a (1) TREENAME or (2) GROUPNAME Policy file (spd).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-04T17:00:00.000Z
CVE-2009-3862 
The NDSD process in Novell eDirectory 8.7.3 before 8.7.3.10 ftf2 and eDirectory 8.8 before 8.8.5 ftf1 does not properly handle certain LDAP search requests, which allows remote attackers to cause a denial of service (application hang) via a search request with a NULL BaseDN value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-04T18:00:00.000Z
CVE-2009-3863 
Buffer overflow in the gxmim1.dll ActiveX control in Novell Groupwise Client 7.0.3.1294 allows remote attackers to cause a denial of service (application crash) via a long argument to the SetFontFace method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-04T18:00:00.000Z
CVE-2009-3864 
The Java Update functionality in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22 and JDK and JRE 6 before Update 17, when a non-English version of Windows is used, does not retrieve available new JRE versions, which allows remote attackers to leverage vulnerabilities in older releases of this software, aka Bug Id 6869694.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-05T16:00:00.000Z
CVE-2009-3865 
The launch method in the Deployment Toolkit plugin in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 6 before Update 17 allows remote attackers to execute arbitrary commands via a crafted web page, aka Bug Id 6869752.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-05T16:00:00.000Z
CVE-2009-3866 
The Java Web Start Installer in Sun Java SE in JDK and JRE 6 before Update 17 does not properly use security model permissions when removing installer extensions, which allows remote attackers to execute arbitrary code by modifying a certain JNLP file to have a URL field that points to an unintended trusted application, aka Bug Id 6872824.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-05T16:00:00.000Z
CVE-2009-3867 
Stack-based buffer overflow in the HsbParser.getSoundBank function in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via a long file: URL in an argument, aka Bug Id 6854303.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-05T16:00:00.000Z
CVE-2009-3868 
Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 does not properly parse color profiles, which allows remote attackers to gain privileges via a crafted image file, aka Bug Id 6862970.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-05T16:00:00.000Z
CVE-2009-3869 
Stack-based buffer overflow in the setDiffICM function in the Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via a crafted argument, aka Bug Id 6872357.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-05T16:00:00.000Z
CVE-2009-3871 
Heap-based buffer overflow in the setBytePixels function in the Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via crafted arguments, aka Bug Id 6872358.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-05T16:00:00.000Z
CVE-2009-3872 
Unspecified vulnerability in the JPEG JFIF Decoder in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to gain privileges via a crafted image file, aka Bug Id 6862969.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-05T16:00:00.000Z
CVE-2009-3873 
The JPEG Image Writer in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to gain privileges via a crafted image file, related to a "quantization problem," aka Bug Id 6862968.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-05T16:00:00.000Z
CVE-2009-3874 
Integer overflow in the JPEGImageReader implementation in the ImageI/O component in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via large subsample dimensions in a JPEG file that triggers a heap-based buffer overflow, aka Bug Id 6874643.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-05T16:00:00.000Z
CVE-2009-3875 
The MessageDigest.isEqual function in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to spoof HMAC-based digital signatures, and possibly bypass authentication, via unspecified vectors related to "timing attack vulnerabilities," aka Bug Id 6863503.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-05T16:00:00.000Z
CVE-2009-3876 
Unspecified vulnerability in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to cause a denial of service (memory consumption) via crafted DER encoded data, which is not properly decoded by the ASN.1 DER input stream parser, aka Bug Id 6864911.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-05T16:00:00.000Z
CVE-2009-3877 
Unspecified vulnerability in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to cause a denial of service (memory consumption) via crafted HTTP headers, which are not properly parsed by the ASN.1 DER input stream parser, aka Bug Id 6864911.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-05T16:00:00.000Z
CVE-2009-3878 
Buffer overflow in Sun Java System Web Server 7.0 Update 6 has unspecified impact and remote attack vectors, as demonstrated by the vd_sjws module in VulnDisco Pack Professional 8.12.  NOTE: as of 20091105, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-05T16:00:00.000Z
CVE-2009-3879 
Multiple unspecified vulnerabilities in the (1) X11 and (2) Win32GraphicsDevice subsystems in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, have unknown impact and attack vectors, related to failure to clone arrays that are returned by the getConfigurations function, aka Bug Id 6822057.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-09T19:00:00.000Z
CVE-2009-3880 
The Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, does not properly restrict the objects that may be sent to loggers, which allows attackers to obtain sensitive information via vectors related to the implementation of Component, KeyboardFocusManager, and DefaultKeyboardFocusManager, aka Bug Id 6664512.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-09T19:00:00.000Z
CVE-2009-3881 
Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, does not prevent the existence of children of a resurrected ClassLoader, which allows remote attackers to gain privileges via unspecified vectors, related to an "information leak vulnerability," aka Bug Id 6636650.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-09T19:00:00.000Z
CVE-2009-3882 
Multiple unspecified vulnerabilities in the Swing implementation in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, have unknown impact and remote attack vectors, related to "information leaks in mutable variables," aka Bug Id 6657026.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-09T19:00:00.000Z
CVE-2009-3883 
Multiple unspecified vulnerabilities in the Windows Pluggable Look and Feel (PL&F) feature in the Swing implementation in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, have unknown impact and remote attack vectors, related to "information leaks in mutable variables," aka Bug Id 6657138.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-09T19:00:00.000Z
CVE-2009-3884 
The TimeZone.getTimeZone method in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, allows remote attackers to determine the existence of local files via vectors related to handling of zoneinfo (aka tz) files, aka Bug Id 6824265.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-09T19:00:00.000Z
CVE-2009-3885 
Sun Java SE 5.0 before Update 22 and 6 before Update 17 on Windows allows remote attackers to cause a denial of service via a BMP file containing a link to a UNC share pathname for an International Color Consortium (ICC) profile file, probably a related issue to CVE-2007-2789, aka Bug Id 6632445.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-09T19:00:00.000Z
CVE-2009-3886 
The Java Web Start implementation in Sun Java SE 6 before Update 17 does not properly handle the interaction between a signed JAR file and a JNLP (1) application or (2) applet, which has unspecified impact and attack vectors, related to a "regression," aka Bug Id 6870531.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-09T19:00:00.000Z
CVE-2009-3887 
ytnef has directory traversal
Problem types: description: path traversal
Affected products: vendor: ytnef
product: ytnef
Published: 2019-10-29T12:37:48.000Z
CVE-2009-3888 
The do_mmap_pgoff function in mm/nommu.c in the Linux kernel before 2.6.31.6, when the CPU lacks a memory management unit, allows local users to cause a denial of service (OOPS) via an application that attempts to allocate a large amount of memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-16T19:00:00.000Z
CVE-2009-3889 
The dbg_lvl file for the megaraid_sas driver in the Linux kernel before 2.6.27 has world-writable permissions, which allows local users to change the (1) behavior and (2) logging level of the driver by modifying this file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-16T19:00:00.000Z
CVE-2009-3890 
Unrestricted file upload vulnerability in the wp_check_filetype function in wp-includes/functions.php in WordPress before 2.8.6, when a certain configuration of the mod_mime module in the Apache HTTP Server is enabled, allows remote authenticated users to execute arbitrary code by posting an attachment with a multiple-extension filename, and then accessing this attachment via a direct request to a wp-content/uploads/ pathname, as demonstrated by a .php.jpg filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-17T18:00:00.000Z
CVE-2009-3891 
Cross-site scripting (XSS) vulnerability in wp-admin/press-this.php in WordPress before 2.8.6 allows remote authenticated users to inject arbitrary web script or HTML via the s parameter (aka the selection variable).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-17T18:00:00.000Z
CVE-2009-3892 
Cross-site scripting (XSS) vulnerability in Best Practical Solutions RT 3.6.x before 3.6.9, 3.8.x before 3.8.5, and other 3.4.6 through 3.8.4 versions allows remote attackers to inject arbitrary web script or HTML via certain Custom Fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-17T18:00:00.000Z
CVE-2009-3894 
Multiple untrusted search path vulnerabilities in dstat before 0.7.0 allow local users to gain privileges via a Trojan horse Python module in (1) the current working directory or (2) a certain subdirectory of the current working directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-27T20:00:00.000Z
CVE-2009-3895 
Heap-based buffer overflow in the exif_entry_fix function (aka the tag fixup routine) in libexif/exif-entry.c in libexif 0.6.18 allows remote attackers to cause a denial of service or possibly execute arbitrary code via an invalid EXIF image.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-20T18:00:00.000Z
CVE-2009-3896 
src/http/ngx_http_parse.c in nginx (aka Engine X) 0.1.0 through 0.4.14, 0.5.x before 0.5.38, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.14 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a long URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-24T17:00:00.000Z
CVE-2009-3897 
Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain directories at installation time, which allows local users to access arbitrary user accounts by replacing the auth socket, related to the parent directories of the base_dir directory, and possibly the base_dir directory itself.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-24T17:00:00.000Z
CVE-2009-3898 
Directory traversal vulnerability in src/http/modules/ngx_http_dav_module.c in nginx (aka Engine X) before 0.7.63, and 0.8.x before 0.8.17, allows remote authenticated users to create or overwrite arbitrary files via a .. (dot dot) in the Destination HTTP header for the WebDAV (1) COPY or (2) MOVE method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-24T17:00:00.000Z
CVE-2009-3899 
Memory leak in the Sockets Direct Protocol (SDP) driver in Sun Solaris 10, and OpenSolaris snv_57 through snv_94, allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-06T15:00:00.000Z
CVE-2009-3900 
Unspecified vulnerability in the Cluster Management component in IBM PowerHA 5.4, 5.4.1, 5.5, and 6.1 on AIX allows remote attackers to modify the operating-system configuration via packets to the godm port (6177/tcp).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-06T15:00:00.000Z
CVE-2009-3901 
Multiple cross-site scripting (XSS) vulnerabilities in e-Courier CMS allow remote attackers to inject arbitrary web script or HTML via the UserGUID parameter to home/index.asp and other unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-06T15:00:00.000Z
CVE-2009-3902 
Directory traversal vulnerability in Cherokee Web Server 0.5.4 and earlier for Windows allows remote attackers to read arbitrary files via a /\.. (slash backslash dot dot) in the URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-06T15:00:00.000Z
CVE-2009-3903 
Multiple cross-site scripting (XSS) vulnerabilities in jspui/index.jsp in ManageEngine Netflow Analyzer 7.5 build 7500 allow remote attackers to inject arbitrary web script or HTML via the (1) view and (2) section parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-06T15:00:00.000Z
CVE-2009-3904 
classes/session/cc_admin_session.php in CubeCart 4.3.4 does not properly restrict administrative access permissions, which allows remote attackers to bypass restrictions and gain administrative access via a HTTP request that contains an empty (1) sessID (ccAdmin cookie), (2) X_CLUSTER_CLIENT_IP header, or (3) User-Agent header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-06T15:00:00.000Z