CVSS: 10.0EPSS: 3%CPEs: 102EXPL: 0CVE-2009-3956 – acroread: script injection vulnerability (APSB10-02)
https://notcve.org/view.php?id=CVE-2009-3956
The default configuration of Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, does not enable the Enhanced Security feature, which has unspecified impact and attack vectors, related to a "script injection vulnerability," as demonstrated by Acrobat Forms Data Format (FDF) behavior that allows cross-site scripting (XSS) by user-assisted remote attackers. La configuración por defecto en Adobe Reader y Acrobat v9.x anterior a v9.3, y 8.x anterior a v8.2, sobre Windows y Mac OS X, no soporta adecuadamente la funcionalidad Enhanced Security, que tiene un impacto y vectores de ataque desconocidos relacionados con "una vulnerabilidad de inyección de secuencias de comandos". • http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html http://secunia.com/advisories/38138 http://secunia.com/advisories/38215 http://www.adobe.com/support/security/bulletins/apsb10-02.html http://www.packetstormsecurity.org/1001-exploits/SS-2010-001.txt http://www.redhat.com/support/errata/RHSA-2010-0060.html http://www.securityfocus.com/bid/37763 http://www.securitytracker.com/id?1023446 http://www.stratsec.net/files/SS-2010-001_Stratsec_Acrobat_Script_Injection_ • CWE-16: Configuration •
CVSS: 10.0EPSS: 58%CPEs: 102EXPL: 0CVE-2009-3959 – acroread: multiple code execution flaws (APSB10-02)
https://notcve.org/view.php?id=CVE-2009-3959
Integer overflow in the U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a malformed PDF document. Desbordamiento de entero en la implementación U3D en Adobe Reader y Acrobat v9.x anterior a v9.3, y 8.x anterior a v8.2, sobre Windows y Mac OS X, podría permitir a atacantes ejecutar código de su elección a través de vectores no especificados. • http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html http://secunia.com/advisories/38138 http://secunia.com/advisories/38215 http://www.adobe.com/support/security/bulletins/apsb10-02.html http://www.redhat.com/support/errata/RHSA-2010-0060.html http://www.securityfocus.com/archive/1/508949 http://www.securityfocus.com/bid/37756 http://www.securitytracker.com/id?1023446 http://www.us-cert.gov/cas/techalerts/TA10-013A.html http://www.vupen.com/english/ • CWE-189: Numeric Errors •
CVSS: 5.0EPSS: 1%CPEs: 12EXPL: 2CVE-2009-2166 – OCS Inventory NG 1.02 - Remote File Disclosure
https://notcve.org/view.php?id=CVE-2009-2166
Absolute path traversal vulnerability in cvs.php in OCS Inventory NG before 1.02.1 on Unix allows remote attackers to read arbitrary files via a full pathname in the log parameter. Vulnerabilidad de salto de directorio absoluto en cvs.php en OCS Inventory NG versiones anteriores a v1.02.1 para Unix permite a atacantes remotos leer ficheros de su elección indicando la ruta de directorio completa en el parámetro "log". • https://www.exploit-db.com/exploits/8868 http://www.leidecker.info/advisories/2009-05-30-ocs_inventory_ng_directory_traversal.shtml http://www.securityfocus.com/archive/1/504047/100/0/threaded https://exchange.xforce.ibmcloud.com/vulnerabilities/50946 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 2.1EPSS: 0%CPEs: 12EXPL: 0CVE-2009-1292
https://notcve.org/view.php?id=CVE-2009-1292
UCM-CQ in IBM Rational ClearCase 7.0.0.x before 7.0.0.5, 7.0.1.x before 7.0.1.4, and 7.1.x before 7.1.0.1 on Linux and AIX places a username and password on the command line, which allows local users to obtain credentials by listing the process. UCM-CQ en IBM Rational ClearCase 7.0.0.x versiones anteriores a v7.0.0.5, 7.0.1.x versiones anteriores a v7.0.1.4, y 7.1.x versiones anteriores a v7.1.0.1 en Linux y AIX sitúa un nombre de usuario y una contraseña en la línea de comandos, lo cual permite a usuarios locales obtener credenciales listando el proceso. • http://secunia.com/advisories/34689 http://www-01.ibm.com/support/docview.wss?uid=swg1PK75832 http://www.securityfocus.com/bid/34483 http://www.securitytracker.com/id?1022035 http://www.vupen.com/english/advisories/2009/1017 https://exchange.xforce.ibmcloud.com/vulnerabilities/49836 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 16%CPEs: 72EXPL: 0CVE-2009-1251
https://notcve.org/view.php?id=CVE-2009-1251
Heap-based buffer overflow in the cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58 on Unix platforms allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via an RX response containing more data than specified in a request, related to use of XDR arrays. Desbordamiento de búfer basado en montículo en el gestor de caché en el cliente OpenAFS v1.0 hasta la v1.4.8 y v1.5.0 hasta la 1.5.58 de las plataformas Unix, permite a atacantes remotos provocar una denegación de servicio (caída del sistema) o posiblemente ejecutar código de su elección a través de una respuesta RX que contenga más datos que los especificados en la petición, relativo al uso de las tablas XDR. • http://secunia.com/advisories/34655 http://secunia.com/advisories/34684 http://secunia.com/advisories/42896 http://security.gentoo.org/glsa/glsa-201101-05.xml http://www.debian.org/security/2009/dsa-1768 http://www.mandriva.com/security/advisories?name=MDVSA-2009:099 http://www.openafs.org/security/OPENAFS-SA-2009-001.txt http://www.openafs.org/security/openafs-sa-2009-001.patch http://www.securityfocus.com/bid/34407 http://www.vupen.com/english/advisories/2009/0984 ht • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •