Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
9.3
CVSSv2

CVE-2009-2011

Published: 16/06/2009 Updated: 14/02/2024
CVSS v2 Base Score: 9.3 | Impact Score: 10 | Exploitability Score: 8.6
VMScore: 940
Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Subscribe to Dxstudio

Vulnerability Summary

Worldweaver DX Studio Player 3.0.29.0, 3.0.22.0, 3.0.12.0, and probably other versions prior to 3.0.29.1, when used as a plug-in for Firefox, does not restrict access to the shell.execute JavaScript API method, which allows remote malicious users to execute arbitrary commands via a .dxstudio file that invokes this method.

Vulnerable Product Search on Vulmon Subscribe to Product

dxstudio dx_studio_player

dxstudio dx_studio_player 3.0.12.0

dxstudio dx_studio_player 3.0.22.0

Exploits

Exploit DB: Worldweaver DX Studio Player < 3.0.29.1 Firefox plugin - Command Injection
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory wwwcoresecuritycom/corelabs/ DX Studio Player Firefox plug-in command injection 1 *Advisory Information* Title: DX Studio Player Firefox plug-in command injection Advisory ID: CORE-2009-0521 Advisory URL: wwwcore ...
Exploit DB: Worldweaver DX Studio Player 3.0.29 - 'shell.execute()' Command Execution (Metasploit)
## # $Id: dxstudio_player_execrb 9375 2010-05-26 22:39:56Z jduck $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions Please see the Metasploit # Framework web site for more information on licensing and terms of use # metasploitcom/framework/ ## require 'msf/core' re ...

References

CWE-78http://www.dxstudio.com/forumtopic.aspx?topicid=b4152459-fb5f-4933-b700-b3fbd54f6bfdhttp://secunia.com/advisories/35402http://www.securityfocus.com/bid/35273http://www.coresecurity.com/content/DXStudio-player-firefox-pluginhttp://www.vupen.com/english/advisories/2009/1561https://exchange.xforce.ibmcloud.com/vulnerabilities/51035https://www.exploit-db.com/exploits/8922http://www.securityfocus.com/archive/1/504195/100/0/threadedhttps://nvd.nist.govhttps://www.exploit-db.com/exploits/8922/
VMScore
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2020-4463CVE-2024-29895injectCVE-2023-52689CVE-2024-5049CVE-2024-5051privilege escalationphysicalCVE-2023-52676
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook