CVE-2009-1289
published 2009-04-13CVE-2009-1289: private/login.ssi in the Advanced Management Module (AMM) on the IBM BladeCenter, including the BladeCenter H with BPET36H 54, allows remote attackers to…
PriorityP421medium4CVSS 2.0
AVNACLAuSCPINAN
EPSS
1.09%
61.5th percentile
private/login.ssi in the Advanced Management Module (AMM) on the IBM BladeCenter, including the BladeCenter H with BPET36H 54, allows remote attackers to discover the access roles and scopes of arbitrary user accounts via a modified WEBINDEX parameter.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | advanced_management_module | — | — |
| ibm | bladecenter | — | — |
| ibm | bladecenter | — | — |
| ibm | bladecenter | — | — |
| ibm | bladecenter | — | — |
| ibm | bladecenter | — | — |
| ibm | bladecenter | — | — |
| ibm | bladecenter | — | — |
| ibm | bladecenter | — | — |
| ibm | bladecenter | — | — |
| ibm | bladecenter | — | — |
| ibm | bladecenter | — | — |
| ibm | bladecenter | — | — |
| ibm | bladecenter | — | — |
| ibm | bladecenter | — | — |
| ibm | bladecenter | — | — |
| ibm | bladecenter | — | — |
| ibm | bladecenter | — | — |
| ibm | bladecenter | — | — |
CVSS provenance
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
vendor_redhat4.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-7gjh-8xw7-vwcv: private/login
ghsa_unreviewed·2022-05-02
CVE-2009-1289 [MEDIUM] CWE-200 GHSA-7gjh-8xw7-vwcv: private/login
private/login.ssi in the Advanced Management Module (AMM) on the IBM BladeCenter, including the BladeCenter H with BPET36H 54, allows remote attackers to discover the access roles and scopes of arbitrary user accounts via a modified WEBINDEX parameter.
Red Hat
mysql: incomplete upstream fix for CVE-2008-2079
vendor_redhat·2008-07-03·CVSS 4.6
CVE-2008-4098 [MEDIUM] mysql: incomplete upstream fix for CVE-2008-2079
mysql: incomplete upstream fix for CVE-2008-2079
MySQL before 5.0.67 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL home data directory. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4097.
Statement: In Red Hat Enterprise Linux 5, issue CVE-2008-2079 was fixed without introducing CVE-2008-4098 in RHSA-2009:1289.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://osvdb.org/53659http://securitytracker.com/id?1022025http://www.louhinetworks.fi/advisory/ibm_090409.txthttp://www.securityfocus.com/archive/1/502582/100/0/threadedhttp://www.securityfocus.com/bid/34447http://osvdb.org/53659http://securitytracker.com/id?1022025http://www.louhinetworks.fi/advisory/ibm_090409.txthttp://www.securityfocus.com/archive/1/502582/100/0/threadedhttp://www.securityfocus.com/bid/34447
2009-04-13
Published