cbcvebase.
CVE-2009-1064
published 2009-03-26

CVE-2009-1064: Argument injection vulnerability in orbitmxt.dll 2.1.0.2 in the Orbit Downloader 2.8.7 and earlier ActiveX control allows remote attackers to overwrite…

PriorityP434medium5.8CVSS 2.0
AVNACMAuNCNIPAP
EXPLOIT
EPSS
3.72%
88.4th percentile
Argument injection vulnerability in orbitmxt.dll 2.1.0.2 in the Orbit Downloader 2.8.7 and earlier ActiveX control allows remote attackers to overwrite arbitrary files via whitespace and a command-line switch, followed by a full pathname, in the third argument to the download method.

Affected

19 ranges
VendorProductVersion rangeFixed in
orbit_downloaderorbit_downloader——
orbit_downloaderorbit_downloader——
orbitdownloaderorbit_downloader<= 2.8.7—
orbitdownloaderorbit_downloader——
orbitdownloaderorbit_downloader——
orbitdownloaderorbit_downloader——
orbitdownloaderorbit_downloader——
orbitdownloaderorbit_downloader——
orbitdownloaderorbit_downloader——
orbitdownloaderorbit_downloader——
orbitdownloaderorbit_downloader——
orbitdownloaderorbit_downloader——
orbitdownloaderorbit_downloader——
orbitdownloaderorbit_downloader——
orbitdownloaderorbit_downloader——
orbitdownloaderorbit_downloader——
orbitdownloaderorbit_downloader——
orbitdownloaderorbit_downloader——
orbitdownloaderorbit_downloader——
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.