rainbutterfly/cve_corpus huggingface dataset:
CVE-2009-0880 
Directory traversal vulnerability in the CIM server in IBM Director before 5.20.3 Service Update 2 on Windows allows remote attackers to load and execute arbitrary local DLL code via a .. (dot dot) in a /CIMListener/ URI in an M-POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-12T15:00:00.000Z
CVE-2009-0881 
SQL injection vulnerability in ejemplo/paises.php in isiAJAX 1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-12T15:00:00.000Z
CVE-2009-0882 
Multiple SQL injection vulnerabilities in nForum 1.5 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to showtheme.php and the (2) user parameter to userinfo.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-12T15:00:00.000Z
CVE-2009-0883 
SQL injection vulnerability in Blue Eye CMS 1.0.0 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the BlueEyeCMS_login cookie parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-12T15:00:00.000Z
CVE-2009-0884 
Buffer overflow in FileZilla Server before 0.9.31 allows remote attackers to cause a denial of service via unspecified vectors related to SSL/TLS packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-12T15:00:00.000Z
CVE-2009-0885 
Multiple heap-based buffer overflows in Media Commands 1.0 allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a long string in a (1) M3U, (2) M3l, (3) TXT, and (4) LRC playlist file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-12T15:00:00.000Z
CVE-2009-0886 
Directory traversal vulnerability in login.php in OneOrZero Helpdesk 1.6.5.7 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the default_language parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-12T15:00:00.000Z
CVE-2009-0887 
Integer signedness error in the _pam_StrTok function in libpam/pam_misc.c in Linux-PAM (aka pam) 1.0.3 and earlier, when a configuration file contains non-ASCII usernames, might allow remote attackers to cause a denial of service, and might allow remote authenticated users to obtain login access with a different user's non-ASCII username, via a login attempt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-12T15:00:00.000Z
CVE-2009-0888 
Heap-based buffer overflow in the JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 might allow remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2009-0510, CVE-2009-0511, CVE-2009-0512, and CVE-2009-0889.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-11T15:00:00.000Z
CVE-2009-0889 
Heap-based buffer overflow in the JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 might allow remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2009-0510, CVE-2009-0511, CVE-2009-0512, and CVE-2009-0888.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-11T15:00:00.000Z
CVE-2009-0891 
The Web Services Security component in IBM WebSphere Application Server 7.0 before Fix Pack 1 (7.0.0.1), 6.1 before Fix Pack 23 (6.1.0.23),and 6.0.2 before Fix Pack 33 (6.0.2.33) does not properly enforce (1) nonce and (2) timestamp expiration values in WS-Security bindings as stored in the com.ibm.wsspi.wssecurity.core custom property, which allows remote authenticated users to conduct session hijacking attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-25T01:00:00.000Z
CVE-2009-0892 
The administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.23 and 7.0 before 7.0.0.3 allows attackers to hijack user sessions in "specific scenarios" related to a forced logout.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-31T10:00:00.000Z
CVE-2009-0893 
Multiple heap-based buffer overflows in xvidcore/src/decoder.c in the xvidcore library in Xvid before 1.2.2, as used by Windows Media Player and other applications, allow remote attackers to execute arbitrary code by providing a crafted macroblock (aka MBlock) number in a video stream in a crafted movie file that triggers heap memory corruption, related to a "missing resync marker range check" and the (1) decoder_iframe, (2) decoder_pframe, and (3) decoder_bframe functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-02T18:00:00.000Z
CVE-2009-0894 
Heap-based buffer overflow in the decoder_create function in the initialization functionality in xvidcore/src/decoder.c in Xvid before 1.2.2, as used by Windows Media Player and other applications, allows remote attackers to execute arbitrary code via vectors involving the DirectShow (aka DShow) frontend and improper handling of the XVID_ERR_MEMORY return code during processing of a crafted movie file. NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-02T18:00:00.000Z
CVE-2009-0895 
Integer overflow in Novell eDirectory 8.7.3.x before 8.7.3.10 ftf2 and 8.8.x before 8.8.5.2 allows remote attackers to execute arbitrary code via an NDS Verb 0x1 request containing a large integer value that triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-03T17:00:00.000Z
CVE-2009-0896 
Buffer overflow in the queue manager in IBM WebSphere MQ 6.x before 6.0.2.7 and 7.x before 7.0.1.0 allows remote attackers to execute arbitrary code via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-03T16:33:00.000Z
CVE-2009-0897 
IBM WebSphere Partner Gateway (WPG) 6.1.0 before 6.1.0.1 and 6.1.1 before 6.1.1.1 allows remote authenticated users to obtain sensitive information via vectors related to the "schema DB2 instance id" and the bcgarchive (aka the archiver script).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-21T15:00:00.000Z
CVE-2009-0898 
Stack-based buffer overflow in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via a crafted HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-10T23:00:00.000Z
CVE-2009-0899 
IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.24 and 7.0 through 7.0.0.4, IBM WebSphere Portal Server 5.1 through 6.0, and IBM Integrated Solutions Console (ISC) 6.0.1 do not properly set the IsSecurityEnabled security flag during migration of WebSphere Member Manager (WMM) to Virtual Member Manager (VMM) and a Federated Repository, which allows attackers to obtain sensitive information from repositories via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-03T16:33:00.000Z
CVE-2009-0900 
Heap-based buffer overflow in the client in IBM WebSphere MQ 6.0 before 6.0.2.7 and 7.0 before 7.0.1.0 allows local users to gain privileges via crafted SSL information in a Client Channel Definition Table (CCDT) file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-30T19:00:00.000Z
CVE-2009-0901 
The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2; does not prevent VariantClear calls on an uninitialized VARIANT, which allows remote attackers to execute arbitrary code via a malformed stream to an ATL (1) component or (2) control, related to ATL headers and error handling, aka "ATL Uninitialized Object Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-29T17:00:00.000Z
CVE-2009-0903 
IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.3, and the Feature Pack for Web Services for WAS 6.1 before 6.1.0.25, when a WS-Security policy is established at the operation level, does not properly handle inbound requests that lack a SOAPAction or WS-Addressing Action, which allows remote attackers to bypass intended access restrictions via a crafted request to a JAX-WS application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-24T22:00:00.000Z
CVE-2009-0904 
The IBM Stax XMLStreamWriter in the Web Services component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 does not properly process XML encoding, which allows remote attackers to bypass intended access restrictions and possibly modify data via "XML fuzzing attacks" sent through SOAP requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-05T16:00:00.000Z
CVE-2009-0905 
IBM WebSphere MQ 6.0 before 6.0.2.8 and 7.0 before 7.0.1.0 does not properly handle long group names, which might allow local users to gain privileges by leveraging combinations of group names with the same initial substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-30T19:00:00.000Z
CVE-2009-0906 
The Service Component Architecture (SCA) feature pack for IBM WebSphere Application Server (WAS) SCA 1.0 before 1.0.0.3 allows remote authenticated users to bypass intended authentication.transport access restrictions and obtain unspecified access via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-13T18:00:00.000Z
CVE-2009-0908 
Unspecified vulnerability in the ACE shared folders implementation in the VMware Host Guest File System (HGFS) shared folders feature in VMware ACE 2.5.1 and earlier allows attackers to enable a disabled shared folder.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-06T15:00:00.000Z
CVE-2009-0909 
Heap-based buffer overflow in the VNnc Codec in VMware Workstation 6.5.x before 6.5.2 build 156735, VMware Player 2.5.x before 2.5.2 build 156735, VMware ACE 2.5.x before 2.5.2 build 156735, and VMware Server 2.0.x before 2.0.1 build 156745 allows remote attackers to execute arbitrary code via a crafted web page or video file, aka ZDI-CAN-435.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-06T15:00:00.000Z
CVE-2009-0910 
Heap-based buffer overflow in the VNnc Codec in VMware Workstation 6.5.x before 6.5.2 build 156735, VMware Player 2.5.x before 2.5.2 build 156735, VMware ACE 2.5.x before 2.5.2 build 156735, and VMware Server 2.0.x before 2.0.1 build 156745 allows remote attackers to execute arbitrary code via a crafted web page or video file, aka ZDI-CAN-436.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-06T15:00:00.000Z
CVE-2009-0912 
perl-MDK-Common 1.1.11 and 1.1.24, 1.2.9 through 1.2.14, and possibly other versions, in Mandriva Linux does not properly handle strings when writing them to configuration files, which allows attackers to gain privileges via "special characters" in unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-16T17:00:00.000Z
CVE-2009-0913 
Unspecified vulnerability in the keysock kernel module in Solaris 10 and OpenSolaris builds snv_01 through snv_108 allows local users to cause a denial of service (system panic) via unknown vectors related to PF_KEY socket, probably related to setting socket options.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-16T17:00:00.000Z
CVE-2009-0914 
Opera before 9.64 allows remote attackers to execute arbitrary code via a crafted JPEG image that triggers memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-16T19:00:00.000Z
CVE-2009-0915 
Opera before 9.64 allows remote attackers to conduct cross-domain scripting attacks via unspecified vectors related to plug-ins.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-16T19:00:00.000Z
CVE-2009-0916 
Unspecified vulnerability in Opera before 9.64 has unknown impact and attack vectors, related to a "moderately severe issue."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-16T19:00:00.000Z
CVE-2009-0917 
Cross-site scripting (XSS) vulnerability in DFLabs PTK 1.0.0 through 1.0.4 allows remote attackers to inject arbitrary web script or HTML by providing a forensic image containing HTML documents, which are rendered in web browsers during inspection by PTK.  NOTE: the vendor states that the product is intended for use in a laboratory with "no contact from / to internet."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-16T19:00:00.000Z
CVE-2009-0918 
Multiple unspecified vulnerabilities in DFLabs PTK 1.0.0 through 1.0.4 allow remote attackers to execute arbitrary commands in processes launched by PTK's Apache HTTP Server via (1) "external tools" or (2) a crafted forensic image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-16T19:00:00.000Z
CVE-2009-0919 
XAMPP installs multiple packages with insecure default passwords, which makes it easier for remote attackers to obtain access via (1) the "lampp" default password for the "nobody" account within the included ProFTPD installation, (2) a blank default password for the "root" account within the included MySQL installation, (3) a blank default password for the "pma" account within the phpMyAdmin installation, and possibly other unspecified passwords.  NOTE: this was originally reported as a problem in DFLabs PTK, but this issue affects any product that is installed within the XAMPP environment, and should not be viewed as a vulnerability within that product. NOTE: DFLabs states that PTK is intended for use in a laboratory with "no contact from / to internet."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-16T19:00:00.000Z
CVE-2009-0920 
Stack-based buffer overflow in OvCgi/Toolbar.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via a long OvOSLocale cookie, a variant of CVE-2008-0067.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-25T01:00:00.000Z
CVE-2009-0921 
Multiple heap-based buffer overflows in OvCgi/Toolbar.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allow remote attackers to execute arbitrary code via (1) a long OvAcceptLang cookie, which triggers the error in ov.dll and ovwww.dll, or (2) a long Accept-Language HTTP header, which triggers the error in ovwww.dll or libovwww.so.4.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-25T01:00:00.000Z
CVE-2009-0922 
PostgreSQL before 8.3.7, 8.2.13, 8.1.17, 8.0.21, and 7.4.25 allows remote authenticated users to cause a denial of service (stack consumption and crash) by triggering a failure in the conversion of a localized error message to a client-specified encoding, as demonstrated using mismatched encoding conversion requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-17T17:00:00.000Z
CVE-2009-0923 
Unspecified vulnerability in Kerberos Incremental Propagation in Solaris 10 and OpenSolaris snv_01 through snv_110 allows remote attackers to cause a denial of service (loss of incremental propagation requests to slave KDC servers) via unknown vectors related to the master Key Distribution Center (KDC) server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-17T19:12:00.000Z
CVE-2009-0924 
Unspecified vulnerability in Sun OpenSolaris snv_39 through snv_45, when running in 64-bit mode on x86 architectures, allows local users to cause a denial of service (hang of UFS filesystem write) via unknown vectors related to the (1) ufs_getpage and (2) ufs_putapage routines, aka CR 6442712.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-17T19:12:00.000Z
CVE-2009-0925 
Unspecified vulnerability in Sun Solaris 10 on SPARC sun4v systems, and OpenSolaris snv_47 through snv_85, allows local users to cause a denial of service (hang of UFS filesystem write) via unknown vectors related to the (1) ufs_getpage and (2) ufs_putapage routines, aka CR 6425723.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-17T19:12:00.000Z
CVE-2009-0926 
Unspecified vulnerability in the UFS filesystem functionality in Sun OpenSolaris snv_86 through snv_91, when running in 32-bit mode on x86 systems, allows local users to cause a denial of service (panic) via unknown vectors related to the (1) ufs_getpage and (2) ufs_putapage routines, aka CR 6679732.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-17T19:12:00.000Z
CVE-2009-0927 
Stack-based buffer overflow in Adobe Reader and Adobe Acrobat 9 before 9.1, 8 before 8.1.3 , and 7 before 7.1.1 allows remote attackers to execute arbitrary code via a crafted argument to the getIcon method of a Collab object, a different vulnerability than CVE-2009-0658.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-19T10:00:00.000Z
CVE-2009-0928 
Heap-based buffer overflow in Adobe Acrobat Reader and Acrobat Professional 7.1.0, 8.1.3, 9.0.0, and other versions allows remote attackers to execute arbitrary code via a PDF file containing a JBIG2 stream with a size inconsistency related to an unspecified table.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-25T01:00:00.000Z
CVE-2009-0929 
Directory traversal vulnerability in the media manager in Nucleus CMS before 3.40 allows remote attackers to read arbitrary files via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-17T21:00:00.000Z
CVE-2009-0930 
Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP before 4.2.2 and 4.3.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) smime.php, (2) pgp.php, and (3) message.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-17T21:00:00.000Z
CVE-2009-0931 
Cross-site scripting (XSS) vulnerability in the tag cloud search script (horde/services/portal/cloud_search.php) in Horde before 3.2.4 and 3.3.3, and Horde Groupware before 1.1.5, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-17T21:00:00.000Z
CVE-2009-0932 
Directory traversal vulnerability in framework/Image/Image.php in Horde before 3.2.4 and 3.3.3 and Horde Groupware before 1.1.5 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the Horde_Image driver name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-17T21:00:00.000Z
CVE-2009-0933 
Cross-site scripting (XSS) vulnerability in the administrative interface in Dotclear before 2.1.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-17T22:00:00.000Z
CVE-2009-0934 
Cross-site scripting (XSS) vulnerability in ejabberd before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to links and MUC logs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-18T01:00:00.000Z
CVE-2009-0935 
The inotify_read function in the Linux kernel 2.6.27 to 2.6.27.13, 2.6.28 to 2.6.28.2, and 2.6.29-rc3 allows local users to cause a denial of service (OOPS) via a read with an invalid address to an inotify instance, which causes the device's event list mutex to be unlocked twice and prevents proper synchronization of a data structure for the inotify instance.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-18T01:00:00.000Z
CVE-2009-0936 
Unspecified vulnerability in Tor before 0.2.0.34 allows attackers to cause a denial of service (infinite loop) via "corrupt votes."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-18T01:00:00.000Z
CVE-2009-0937 
Unspecified vulnerability in Tor before 0.2.0.34 allows directory mirrors to cause a denial of service via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-18T01:00:00.000Z
CVE-2009-0938 
Unspecified vulnerability in Tor before 0.2.0.34 allows directory mirrors to cause a denial of service (exit node crash) via "malformed input."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-18T01:00:00.000Z
CVE-2009-0939 
Tor before 0.2.0.34 treats incomplete IPv4 addresses as valid, which has unknown impact and attack vectors related to "Spec conformance," as demonstrated using 192.168.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-18T01:00:00.000Z
CVE-2009-0940 
Multiple cross-site request forgery (CSRF) vulnerabilities in the HP Embedded Web Server (EWS) on HP LaserJet Printers, Edgeline Printers, and Digital Senders allow remote attackers to hijack the intranet connectivity of arbitrary users for requests that (1) print documents via unknown vectors, (2) modify the network configuration via a NetIPChange request to hp/device/config_result_YesNo.html/config, or (3) change the password via the Password and ConfirmPassword parameters to hp/device/set_config_password.html/config.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-18T20:35:00.000Z
CVE-2009-0941 
The HP Embedded Web Server (EWS) on HP LaserJet Printers, Edgeline Printers, and Digital Senders has no management password by default, which makes it easier for remote attackers to obtain access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-18T20:35:00.000Z
CVE-2009-0942 
Help Viewer in Apple Mac OS X 10.4.11 and 10.5 before 10.5.7 does not verify that certain Cascading Style Sheets (CSS) are located in a registered help book, which allows remote attackers to execute arbitrary code via a help: URL that triggers invocation of AppleScript files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-13T15:14:00.000Z
CVE-2009-0943 
Help Viewer in Apple Mac OS X 10.4.11 and 10.5 before 10.5.7 does not verify that HTML pathnames are located in a registered help book, which allows remote attackers to execute arbitrary code via a help: URL that triggers invocation of AppleScript files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-13T15:14:00.000Z