CVE-2009-1741
published 2009-05-20CVE-2009-1741: Multiple SQL injection vulnerabilities in login.php in DM FileManager 3.9.2, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL…
PriorityP344medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EXPLOIT
EPSS
1.94%
77.6th percentile
Multiple SQL injection vulnerabilities in login.php in DM FileManager 3.9.2, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) Username and (2) Password fields.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dutchmonkey | dm_filemanager | — | — |
CVSS provenance
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
vendor_redhat9.3CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-fpw9-w78g-pvvx: Multiple SQL injection vulnerabilities in login
ghsa_unreviewed·2022-05-02
CVE-2009-1741 [MEDIUM] CWE-89 GHSA-fpw9-w78g-pvvx: Multiple SQL injection vulnerabilities in login
Multiple SQL injection vulnerabilities in login.php in DM FileManager 3.9.2, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) Username and (2) Password fields.
Red Hat
RealPlayer: multiple security issues (01192010_player)
vendor_redhat·2010-01-19·CVSS 9.3
CVE-2009-4246 [CRITICAL] RealPlayer: multiple security issues (01192010_player)
RealPlayer: multiple security issues (01192010_player)
Stack-based buffer overflow in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and Helix Player 10.x allows user-assisted remote attackers to execute arbitrary code via a malformed .RJS skin file that contains a web.xmb file with crafted length values.
Red Hat
RealPlayer: multiple security issues (01192010_player)
vendor_redhat·2010-01-19·CVSS 9.3
CVE-2009-0375 [CRITICAL] RealPlayer: multiple security issues (01192010_player)
RealPlayer: multiple security issues (01192010_player)
Buffer overflow in a DLL file in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and Helix Player 10.x allows remote attackers to execute arbitrary code via a crafted Internet Video Recording (IVR) file with a filename length field containing a large integer, which triggers overwrite of an arbitrary memory location with a 0x00 byte value, related to use of RealPlayer through a Windows Explorer plugin.
Red Hat
RealPlayer: multiple security issues (01192010_player)
vendor_redhat·2010-01-19·CVSS 9.3
CVE-2009-4241 [CRITICAL] RealPlayer: multiple security issues (01192010_player)
RealPlayer: multiple security issues (01192010_player)
Heap-based buffer overflow in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and Helix Player 10.x allows remote attackers to execute arbitrary code via a file with invalid ASMRuleBook structures that trigger heap memory corruption.
Red Hat
RealPlayer: multiple security issues (01192010_player)
vendor_redhat·2010-01-19·CVSS 9.3
CVE-2009-0376 [CRITICAL] RealPlayer: multiple security issues (01192010_player)
RealPlayer: multiple security issues (01192010_player)
Heap-based buffer overflow in a DLL file in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and Helix Player 10.x allows remote attackers to execute arbitrary code via a crafted Internet Video Recording (IVR) file with a modified field that controls an unspecified structure length and triggers heap corruption, related to use of RealPlayer through a Windows Explorer plugin.
Red Hat
RealPlayer: multiple security issues (01192010_player)
vendor_redhat·2010-01-19·CVSS 9.3
CVE-2009-4244 [CRITICAL] RealPlayer: multiple security issues (01192010_player)
RealPlayer: multiple security issues (01192010_player)
Heap-based buffer overflow in RealNetworks RealPlayer 10; RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741; RealPlayer 11 11.0.0 through 11.0.4; RealPlayer Enterprise; Mac RealPlayer 10, 10.1, and 11.0; Linux RealPlayer 10; and Helix Player 10.x allows remote attackers to execute arbitrary code via an SIPR codec field with a small length value that triggers incorrect memory allocation.
Red Hat
RealPlayer: RTSP client ASM RuleBook stack buffer overflow
vendor_redhat·2009-08-28·CVSS 9.3
CVE-2009-4247 [CRITICAL] CWE-121 RealPlayer: RTSP client ASM RuleBook stack buffer overflow
RealPlayer: RTSP client ASM RuleBook stack buffer overflow
Stack-based buffer overflow in protocol/rtsp/rtspclnt.cpp in RealNetworks RealPlayer 10; RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741; RealPlayer 11 11.0.x; RealPlayer SP 1.0.0 and 1.0.1; RealPlayer Enterprise; Mac RealPlayer 10, 10.1, 11.0, and 11.0.1; Linux RealPlayer 10, 11.0.0, and 11.0.1; and Helix Player 10.x, 11.0.0, and 11.0.1 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an ASM RuleBook with a large number of rules, related to an "array overflow."
Red Hat
RealPlayer: SMIL getAtom heap buffer overflow
vendor_redhat·2008-09-16·CVSS 9.3
CVE-2009-4257 [CRITICAL] CWE-122 RealPlayer: SMIL getAtom heap buffer overflow
RealPlayer: SMIL getAtom heap buffer overflow
Heap-based buffer overflow in datatype/smil/common/smlpkt.cpp in smlrender.dll in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10 and 11.0.0, and Helix Player 10.x and 11.0.0 allows remote attackers to execute arbitrary code via an SMIL file with crafted string lengths.
Red Hat
RealPlayer: GIF file heap overflow
vendor_redhat·2008-09-10·CVSS 9.3
CVE-2009-4242 [CRITICAL] RealPlayer: GIF file heap overflow
RealPlayer: GIF file heap overflow
Heap-based buffer overflow in the CGIFCodec::GetPacketBuffer function in datatype/image/gif/common/gifcodec.cpp in RealNetworks RealPlayer 10; RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741; RealPlayer 11 11.0.0 through 11.0.4; RealPlayer Enterprise; Mac RealPlayer 10, 10.1, and 11.0; Linux RealPlayer 10; and Helix Player 10.x allows remote attackers to execute arbitrary code via a GIF file with crafted chunk sizes that trigger improper memory allocation.
Red Hat
RealPlayer: compressed GIF heap overflow
vendor_redhat·2008-07-23·CVSS 9.3
CVE-2009-4245 [CRITICAL] RealPlayer: compressed GIF heap overflow
RealPlayer: compressed GIF heap overflow
Heap-based buffer overflow in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and Helix Player 10.x allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a compressed GIF file, related to gifcodec.cpp and gifimage.cpp.
Red Hat
RealPlayer: RTSP SET_PARAMETER buffer overflow
vendor_redhat·2008-01-17·CVSS 9.3
CVE-2009-4248 [CRITICAL] RealPlayer: RTSP SET_PARAMETER buffer overflow
RealPlayer: RTSP SET_PARAMETER buffer overflow
Buffer overflow in the RTSPProtocol::HandleSetParameterRequest function in client/core/rtspprotocol.cpp in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and Helix Player 10.x allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted RTSP SET_PARAMETER request.
Red Hat
RealPlayer: HTTP chunk encoding overflow
vendor_redhat·2008-01-17·CVSS 9.3
CVE-2009-4243 [CRITICAL] RealPlayer: HTTP chunk encoding overflow
RealPlayer: HTTP chunk encoding overflow
RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and Helix Player 10.x allow remote attackers to have an unspecified impact via a crafted media file that uses HTTP chunked transfer coding, related to an "overflow."
No detection rules found.
Bugzilla
CVE-2009-4257 HelixPlayer / RealPlayer: SMIL getAtom heap buffer overflow
bugzilla·2010-02-03·CVSS 9.3
CVE-2009-4257 [CRITICAL] CVE-2009-4257 HelixPlayer / RealPlayer: SMIL getAtom heap buffer overflow
CVE-2009-4257 HelixPlayer / RealPlayer: SMIL getAtom heap buffer overflow
Common Vulnerabilities and Exposures assigned an identifier CVE-2009-4257 to the following vulnerability:
Heap-based buffer overflow in smlrender.dll in RealNetworks RealPlayer 10,
RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through
11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10
and 11.0.0, and Helix Player 10.x and 11.0.0 allows remote attackers to execute
arbitrary code via an SMIL file with crafted string lengths.
References:
http://service.real.com/realplayer/security/01192010_player/en/
http://www.zerodayinitiative.com/advisories/ZDI-10-007/
http://www.securityfocus.com/archive/1/509105/100/0/threaded
http://xforce.iss.net/xforce/xfdb/55798
Discussio
Bugzilla
CVE-2009-4242 HelixPlayer / RealPlayer: GIF file heap overflow
bugzilla·2010-02-03·CVSS 9.3
CVE-2009-4242 [CRITICAL] CVE-2009-4242 HelixPlayer / RealPlayer: GIF file heap overflow
CVE-2009-4242 HelixPlayer / RealPlayer: GIF file heap overflow
Common Vulnerabilities and Exposures assigned an identifier CVE-2009-4242 to the following vulnerability:
Heap-based buffer overflow in RealNetworks RealPlayer 10; RealPlayer 10.5
6.0.12.1040 through 6.0.12.1741; RealPlayer 11 11.0.0 through 11.0.4;
RealPlayer Enterprise; Mac RealPlayer 10, 10.1, and 11.0; Linux RealPlayer 10;
and Helix Player 10.x allows remote attackers to execute arbitrary code via a
GIF file with crafted chunk sizes that trigger improper memory allocation.
References:
http://service.real.com/realplayer/security/01192010_player/en/
http://www.zerodayinitiative.com/advisories/ZDI-10-006/
http://www.securityfocus.com/archive/1/509096/100/0/threaded
http://xforce.iss.net/xforce/xfdb/55795
Discussion:
Accor
Bugzilla
CVE-2009-4245 HelixPlayer / RealPlayer: compressed GIF heap overflow
bugzilla·2010-02-03·CVSS 9.3
CVE-2009-4245 [CRITICAL] CVE-2009-4245 HelixPlayer / RealPlayer: compressed GIF heap overflow
CVE-2009-4245 HelixPlayer / RealPlayer: compressed GIF heap overflow
Common Vulnerabilities and Exposures assigned an identifier CVE-2009-4245 to the following vulnerability:
Heap-based buffer overflow in RealNetworks RealPlayer 10, RealPlayer 10.5
6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4,
RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and
Helix Player 10.x allows remote attackers to have an unspecified impact via a
compressed GIF file.
References:
http://service.real.com/realplayer/security/01192010_player/en/
http://xforce.iss.net/xforce/xfdb/55800
Discussion:
According to upstream, this is:
http://lists.helixcommunity.org/pipermail/datatype-cvs/2008-July/008455.html
https://helixcommunity.org/viewcvs/datatype/image/gif/common/gif
Bugzilla
CVE-2009-4243 HelixPlayer / RealPlayer: HTTP chunk encoding overflow
bugzilla·2010-02-03·CVSS 9.3
CVE-2009-4243 [CRITICAL] CVE-2009-4243 HelixPlayer / RealPlayer: HTTP chunk encoding overflow
CVE-2009-4243 HelixPlayer / RealPlayer: HTTP chunk encoding overflow
Common Vulnerabilities and Exposures assigned an identifier CVE-2009-4243 to the following vulnerability:
RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741,
RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10
and 10.1, Linux RealPlayer 10, and Helix Player 10.x allow remote attackers to
have an unspecified impact via a crafted media file that uses HTTP chunked
transfer coding, related to an "overflow."
References:
http://service.real.com/realplayer/security/01192010_player/en/
http://xforce.iss.net/xforce/xfdb/55796
Discussion:
Upstream patch:
http://lists.helixcommunity.org/pipermail/filesystem-cvs/2008-January/000676.html
https://helixcommunity.org/viewcvs/filesys
Bugzilla
CVE-2009-4247 HelixPlayer / RealPlayer: RTSP client ASM RuleBook stack buffer overflow
bugzilla·2010-02-03·CVSS 9.3
CVE-2009-4247 [CRITICAL] CVE-2009-4247 HelixPlayer / RealPlayer: RTSP client ASM RuleBook stack buffer overflow
CVE-2009-4247 HelixPlayer / RealPlayer: RTSP client ASM RuleBook stack buffer overflow
Common Vulnerabilities and Exposures assigned an identifier CVE-2009-4247 to the following vulnerability:
RealNetworks RealPlayer 10; RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741;
RealPlayer 11 11.0.x; RealPlayer SP 1.0.0 and 1.0.1; RealPlayer Enterprise; Mac
RealPlayer 10, 10.1, 11.0, and 11.0.1; Linux RealPlayer 10, 11.0.0, and 11.0.1;
and Helix Player 10.x, 11.0.0, and 11.0.1 allow remote attackers to have an
unspecified impact via a crafted ASM RuleBook, related to an "array overflow."
References:
http://service.real.com/realplayer/security/01192010_player/en/
http://xforce.iss.net/xforce/xfdb/55802
Discussion:
Upstream patch:
http://lists.helixcommunity.org/pipermail/protocol-cvs/2009-August
2009-05-20
Published