CVE-2009-4830

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Unspecified vulnerability in OpenX 2.8.1 and 2.8.2 allows remote attackers to bypass authentication and obtain access to an Administrator account via unknown vectors, possibly related to www/admin/install.php, www/admin/install-plugins.php, and other www/admin/ files.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://blog.openx.org/12/security-matters-2/Patch, Vendor Advisory
http://forum.openx.org/index.php?showtopic=503454011Patch
http://osvdb.org/61300
http://secunia.com/advisories/37914Vendor Advisory
http://www.securityfocus.com/bid/37457
http://blog.openx.org/12/security-matters-2/Patch, Vendor Advisory
http://forum.openx.org/index.php?showtopic=503454011Patch
http://osvdb.org/61300
http://secunia.com/advisories/37914Vendor Advisory
http://www.securityfocus.com/bid/37457

Timeline

Published: Apr 27, 2010
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-48315.8Cerulean Studios Trillian 3.1 Basic does not check SSL certificates during MSN authentication, which allows remote attackers to obtain MSN c CVE-2009-48327.2The dlpcrypt.sys kernel driver 0.1.1.27 in DESlock+ 4.0.2 allows local users to gain privileges via a crafted IOCTL 0x80012010 request to th CVE-2009-48335.8MySQL Connector/NET before 6.0.4, when using encryption, does not verify SSL certificates during connection, which allows remote attackers t CVE-2009-48346.8lib.php in Zeroboard 4.1 pl7 allows remote attackers to execute arbitrary PHP code via a crafted parameter name, possibly related to now_con CVE-2009-48354.3The (1) htk_read_header, (2) alaw_init, (3) ulaw_init, (4) pcm_init, (5) float32_init, and (6) sds_read_header functions in libsndfile 1.0.2 CVE-2009-48367.5Eval injection vulnerability in system/services/init.php in Movie PHP Script 2.0 allows remote attackers to execute arbitrary PHP code via t CVE-2009-48374.3Multiple cross-site scripting (XSS) vulnerabilities in Basic Analysis and Security Engine (BASE) before 1.4.3.1 allow remote attackers to in CVE-2009-48387.5SQL injection vulnerability in base_ag_common.php in Basic Analysis and Security Engine (BASE) before 1.4.3.1 allows remote attackers to exe CVE-2009-48394.3Multiple cross-site scripting (XSS) vulnerabilities in Basic Analysis and Security Engine (BASE), possibly 1.4.4 and earlier, allow remote a CVE-2009-48409.3Heap-based buffer overflow in the IAManager ActiveX control in IAManager.dll in Roxio CinePlayer 3.2 allows remote attackers to execute arbi CVE-2009-48419.3Heap-based buffer overflow in the SonicMediaPlayer ActiveX control in SonicMediaPlayer.dll in Roxio CinePlayer 3.2 allows remote attackers t CVE-2009-48424.3Multiple cross-site scripting (XSS) vulnerabilities in ToutVirtual VirtualIQ Pro 3.5 build 8691 allow remote attackers to inject arbitrary w