rainbutterfly/cve_corpus huggingface dataset:
CVE-2009-3115 
SolarWinds TFTP Server 9.2.0.111 and earlier allows remote attackers to cause a denial of service (service stop) via a crafted Option Acknowledgement (OACK) request.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-09T22:00:00.000Z
CVE-2009-3116 
SQL injection vulnerability in index.php in Uiga Church Portal allows remote attackers to execute arbitrary SQL commands via the year parameter in a calendar action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-09T22:00:00.000Z
CVE-2009-3117 
SQL injection vulnerability in category.php in Snow Hall Silurus System 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-09T22:00:00.000Z
CVE-2009-3118 
SQL injection vulnerability in mod/poll/comment.php in the vote module in Danneo CMS 0.5.2 and earlier allows remote attackers to execute arbitrary SQL commands via the comtext parameter, in conjunction with crafted comname and comtitle parameters, in a poll action to index.php, related to incorrect input sanitization in base/danneo.function.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-09T22:00:00.000Z
CVE-2009-3119 
SQL injection vulnerability in screen.php in the Download System mSF (dsmsf) module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the view_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-09T22:00:00.000Z
CVE-2009-3120 
Cross-site scripting (XSS) vulnerability in public/index.php in BIGACE Web CMS 2.6 allows remote attackers to inject arbitrary web script or HTML via the id parameter.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-09T22:00:00.000Z
CVE-2009-3121 
Cross-site scripting (XSS) vulnerability in the Ajax Table module 5.x for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-09T22:00:00.000Z
CVE-2009-3122 
The Ajax Table module 5.x for Drupal does not perform access control, which allows remote attackers to delete arbitrary users and nodes via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-09T22:00:00.000Z
CVE-2009-3123 
Directory traversal vulnerability in gallery/gallery.php in Wap-Motor before 18.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the image parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-09T22:00:00.000Z
CVE-2009-3124 
Directory traversal vulnerability in get_message.cgi in QuarkMail allows remote attackers to read arbitrary files via a .. (dot dot) in the tf parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-09T22:00:00.000Z
CVE-2009-3125 
SQL injection vulnerability in the Bug.search WebService function in Bugzilla 3.3.2 through 3.4.1, and 3.5, allows remote attackers to execute arbitrary SQL commands via unspecified parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-15T22:00:00.000Z
CVE-2009-3126 
Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio 2002 SP2, Office Word Viewer, Word Viewer 2003 Gold and SP3, Office Excel Viewer 2003 Gold and SP3, Office Excel Viewer, Office PowerPoint Viewer 2007 Gold, SP1, and SP2, Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2, Expression Web, Expression Web 2, Groove 2007 Gold and SP1, Works 8.5, SQL Server 2000 Reporting Services SP2, SQL Server 2005 SP2 and SP3, Report Viewer 2005 SP1, Report Viewer 2008 Gold and SP1, and Forefront Client Security 1.0 allows remote attackers to execute arbitrary code via a crafted PNG image file, aka "GDI+ PNG Integer Overflow Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-14T10:00:00.000Z
CVE-2009-3127 
Microsoft Office Excel 2002 SP3 and 2003 SP3, Office 2004 and 2008 for Mac, Open XML File Format Converter for Mac, and Office Excel Viewer 2003 SP3 do not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a crafted spreadsheet, aka "Excel Cache Memory Corruption Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-11T19:00:00.000Z
CVE-2009-3128 
Microsoft Office Excel 2002 SP3 and 2003 SP3, and Office Excel Viewer 2003 SP3, does not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a spreadsheet with a malformed record object, aka "Excel SxView Memory Corruption Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-11T19:00:00.000Z
CVE-2009-3129 
Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a spreadsheet with a FEATHEADER record containing an invalid cbHdrData size element that affects a pointer offset, aka "Excel Featheader Record Memory Corruption Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-11T19:00:00.000Z
CVE-2009-3130 
Heap-based buffer overflow in Microsoft Office Excel 2002 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via a spreadsheet containing a malformed Binary File Format (aka BIFF) record that triggers memory corruption, aka "Excel Document Parsing Heap Overflow Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-11T20:00:00.000Z
CVE-2009-3131 
Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allow remote attackers to execute arbitrary code via a spreadsheet with a crafted formula embedded in a cell, aka "Excel Formula Parsing Memory Corruption Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-11T20:00:00.000Z
CVE-2009-3132 
Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allow remote attackers to execute arbitrary code via a spreadsheet containing a malformed formula, related to a "pointer corruption" issue, aka "Excel Index Parsing Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-11T20:00:00.000Z
CVE-2009-3133 
Microsoft Office Excel 2002 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via a spreadsheet containing a malformed object that triggers memory corruption, related to "loading Excel records," aka "Excel Document Parsing Memory Corruption Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-11T20:00:00.000Z
CVE-2009-3134 
Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 do not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a spreadsheet with a malformed record object, aka "Excel Field Sanitization Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-11T20:00:00.000Z
CVE-2009-3135 
Stack-based buffer overflow in Microsoft Office Word 2002 SP3 and 2003 SP3, Office 2004 and 2008 for Mac, Open XML File Format Converter for Mac, Office Word Viewer 2003 SP3, and Office Word Viewer allow remote attackers to execute arbitrary code via a Word document with a malformed File Information Block (FIB) structure, aka "Microsoft Office Word File Information Memory Corruption Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-11T19:00:00.000Z
CVE-2009-3146 
Cross-site scripting (XSS) vulnerability in search_advance.php in ArticleFriend Script allows remote attackers to inject arbitrary web script or HTML via the SearchWd parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-10T18:00:00.000Z
CVE-2009-3147 
Cross-site scripting (XSS) vulnerability in showproduct.php in ReviewPost Pro vB3 allows remote attackers to inject arbitrary web script or HTML via the date parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-10T18:00:00.000Z
CVE-2009-3148 
Multiple SQL injection vulnerabilities in PortalXP Teacher Edition 1.2 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) calendar.php, (2) news.php, and (3) links.php; and the (4) assignment_id parameter to assignments.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-10T18:00:00.000Z
CVE-2009-3149 
Directory traversal vulnerability in _css/js.php in Elgg 1.5, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the js parameter.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-10T18:00:00.000Z
CVE-2009-3150 
SQL injection vulnerability in index.php in Multi Website 1.5 allows remote attackers to execute arbitrary SQL commands via the Browse parameter in a vote action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-10T18:00:00.000Z
CVE-2009-3151 
Directory traversal vulnerability in actions/downloadFile.php in Ultrize TimeSheet 1.2.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the fileName parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-10T18:00:00.000Z
CVE-2009-3152 
Multiple cross-site scripting (XSS) vulnerabilities in becommunity/community/index.php in NTSOFT BBS E-Market Professional allow remote attackers to inject arbitrary web script or HTML via the (1) page, (2) bt_code, and (3) b_no parameters in a board view action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-10T18:00:00.000Z
CVE-2009-3153 
Multiple cross-site scripting (XSS) vulnerabilities in x10 MP3 Search engine 1.6.5 allow remote attackers to inject arbitrary web script or HTML via the (1) pic_id parameter to includes/video_ad.php, (2) category parameter to linkvideos_listing.php, id parameter to (3) templates/header1.php and (4) mp3/lyrics.php, key parameter to (5) video_listing.php and (6) adult/video_listing.php, and name parameter to (7) mp3/embed.php and (8) mp3/info.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-10T18:00:00.000Z
CVE-2009-3154 
SQL injection vulnerability in the Almond Classifieds (com_aclassf) component 7.5 for Joomla! allows remote attackers to execute arbitrary SQL commands via the replid parameter in a manw_repl add_form action to index.php, a different vector than CVE-2009-2567.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-10T18:00:00.000Z
CVE-2009-3155 
Cross-site scripting (XSS) vulnerability in gmap.php in the Almond Classifieds (com_aclassf) component 7.5 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the addr parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-10T18:00:00.000Z
CVE-2009-3156 
Cross-site scripting (XSS) vulnerability in the Date Tools sub-module in the Date module 6.x before 6.x-2.3 for Drupal allows remote authenticated users, with "use date tools" or "administer content types" privileges, to inject arbitrary web script or HTML via a "Content type label" field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-10T18:00:00.000Z
CVE-2009-3157 
Cross-site scripting (XSS) vulnerability in the Calendar module 6.x before 6.x-2.2 for Drupal allows remote authenticated users, with "create new content types" privileges, to inject arbitrary web script or HTML via the title of a content type.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-10T18:00:00.000Z
CVE-2009-3158 
admin/files.php in simplePHPWeb 0.2 does not require authentication, which allows remote attackers to perform unspecified administrative actions via unknown vectors.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-10T18:00:00.000Z
CVE-2009-3159 
Unspecified vulnerability in the rriDecompress function in IBM WebSphere MQ 7.0.0.0, 7.0.0.1, and 7.0.0.2 allows remote attackers to cause a denial of service via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-10T18:00:00.000Z
CVE-2009-3160 
IBM WebSphere MQ 6.x through 6.0.2.7, 7.0.0.0, 7.0.0.1, 7.0.0.2, and 7.0.1.0, when read ahead or asynchronous message consumption is enabled, allows attackers to have an unspecified impact via unknown vectors, related to a "memory overwrite" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-10T18:00:00.000Z
CVE-2009-3161 
The server in IBM WebSphere MQ 7.0.0.1, 7.0.0.2, and 7.0.1.0 allows attackers to cause a denial of service (trap) or possibly have unspecified other impact via malformed data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-10T18:00:00.000Z
CVE-2009-3162 
Cross-site scripting (XSS) vulnerability in Multi Website 1.5 allows remote attackers to inject arbitrary web script or HTML via the search parameter in a search action to the default URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-10T18:00:00.000Z
CVE-2009-3163 
Multiple format string vulnerabilities in lib/silcclient/command.c in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.10, and SILC Client 1.1.8 and earlier, allow remote attackers to execute arbitrary code via format string specifiers in a channel name, related to (1) silc_client_command_topic, (2) silc_client_command_kick, (3) silc_client_command_leave, and (4) silc_client_command_users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-10T21:00:00.000Z
CVE-2009-3164 
Unspecified vulnerability in the IPv6 networking stack in Sun Solaris 10, and OpenSolaris snv_01 through snv_82 and snv_111 through snv_122, when a Cassini GigaSwift Ethernet Adapter (aka CE) interface is used, allows remote attackers to cause a denial of service (panic) via vectors involving jumbo frames.  NOTE: this issue exists because of an incomplete fix for CVE-2009-2136.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-10T22:00:00.000Z
CVE-2009-3165 
SQL injection vulnerability in the Bug.create WebService function in Bugzilla 2.23.4 through 3.0.8, 3.1.1 through 3.2.4, and 3.3.1 through 3.4.1 allows remote attackers to execute arbitrary SQL commands via unspecified parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-15T22:00:00.000Z
CVE-2009-3166 
token.cgi in Bugzilla 3.4rc1 through 3.4.1 places a password in a URL at the beginning of a login session that occurs immediately after a password reset, which allows context-dependent attackers to discover passwords by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-15T22:00:00.000Z
CVE-2009-3167 
Directory traversal vulnerability in index.php in Anantasoft Gazelle CMS 1.0, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the template parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-11T18:00:00.000Z
CVE-2009-3168 
Mevin Productions Basic PHP Events Lister 2.0 does not properly restrict access to (1) admin/reset.php and (2) admin/user_add.php, which allows remote authenticated users to reset administrative passwords or add administrators via a direct request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-11T20:00:00.000Z
CVE-2009-3169 
Multiple unspecified vulnerabilities in Hitachi JP1/File Transmission Server/FTP before 09-00 allow remote attackers to execute arbitrary code via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-11T20:00:00.000Z
CVE-2009-3170 
Stack-based buffer overflow in AIMP2 Audio Converter 2.53 (build 330) and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long File1 argument in a (1) .pls or (2) .m3u playlist file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-11T20:00:00.000Z
CVE-2009-3171 
Multiple cross-site scripting (XSS) vulnerabilities in Anantasoft Gazelle CMS 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) user parameter to user.php or (2) lookup parameter to search.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-11T20:00:00.000Z
CVE-2009-3172 
Unspecified vulnerability in Hitachi Groupmax Groupware Server 07-00 through 07-50-/A, Groupmax Server Set 03-00 through 06-52, Groupware Server Set 03-00 through 06-52, and Scheduler Server Set 03-00 through 06-52 has unknown impact and attack vectors related to invalid access rights.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-11T20:00:00.000Z
CVE-2009-3173 
Unrestricted file upload vulnerability in admin/add_album.php in The Rat CMS Alpha 2 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in images/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-11T20:00:00.000Z
CVE-2009-3174 
PHP remote file inclusion vulnerability in fonctions_racine.php in OBOphiX 2.7.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the chemin_lib parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-11T20:00:00.000Z
CVE-2009-3175 
Multiple SQL injection vulnerabilities in Model Agency Manager PRO (formerly Modeling Agency Content Management Script) allow remote attackers to execute arbitrary SQL commands via the user_id parameter to (1) view.php, (2) photos.php, and (3) motm.php; and the (4) id parameter to forum_message.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-11T20:00:00.000Z
CVE-2009-3176 
Buffer overflow in the ActiveX control in Novell iPrint Client 4.38 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown attack vectors, as demonstrated by a certain module in VulnDisco Pack Professional 8.1, "Novell iPrint Client 4.38 ActiveX exploit." NOTE: as of 20090909, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-11T20:00:00.000Z
CVE-2009-3177 
Unspecified vulnerability in Kaspersky Online Scanner 7.0 has unknown impact and attack vectors, as demonstrated by a certain module in VulnDisco Pack Professional 8.8, (1) "Kaspersky Online Antivirus Scanner 7.0 exploit (Linux)" and (2) "Kaspersky Online Antivirus Scanner 7.0 exploit (Windows)." NOTE: as of 20090909, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-11T20:00:00.000Z
CVE-2009-3178 
Unspecified vulnerability in mm.exe in Symantec Altiris Deployment Solution 6.9 allows remote attackers to cause a denial of service via unknown attack vectors, as demonstrated by a certain module in VulnDisco Pack Professional 7.18, "Symantec Altiris Deployment Solution 6.9 DoS." NOTE: as of 20090909, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-11T20:00:00.000Z
CVE-2009-3179 
Multiple unspecified vulnerabilities in Symantec Altiris Deployment Solution 6.9 might allow remote attackers to execute arbitrary code via unknown client-side attack vectors, as demonstrated by a certain module in VulnDisco Pack Professional 7.17, as identified by (1) "Symantec Altiris Deployment Solution 6.9 exploit, (2) "Symantec Altiris Deployment Solution 6.9 exploit (II)," and (3) "Symantec Altiris Deployment Solution 6.9 exploit (III)." NOTE: as of 20090909, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-11T20:00:00.000Z
CVE-2009-3180 
Anantasoft Gazelle CMS 1.0 allows remote attackers to conduct a password reset for other users via a modified user parameter to renew.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-11T20:00:00.000Z
CVE-2009-3181 
Directory traversal vulnerability in Anantasoft Gazelle CMS 1.0 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in the customizetemplate parameter in a direct request to admin/settemplate.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-11T20:00:00.000Z
CVE-2009-3182 
Unrestricted file upload vulnerability in admin/editor/filemanager/browser.html in Anantasoft Gazelle CMS 1.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in user/File/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-11T20:00:00.000Z