CVE-2009-3735

{"id": "CVE-2009-3735", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2010-02-11T17:30:00.610", "references": [{"url": "http://secunia.com/advisories/38485", "tags": ["Vendor Advisory"], "source": "cret@cert.org"}, {"url": "http://www.kb.cert.org/vuls/id/869993", "tags": ["US Government Resource"], "source": "cret@cert.org"}, {"url": "http://www.kb.cert.org/vuls/id/MAPG-7QPKL3", "source": "cret@cert.org"}, {"url": "http://www.securityfocus.com/bid/38067", "source": "cret@cert.org"}, {"url": "http://www.vupen.com/english/advisories/2010/0354", "tags": ["Vendor Advisory"], "source": "cret@cert.org"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-008", "source": "cret@cert.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "The ActiveScan Installer ActiveX control in as2stubie.dll before 1.3.3.0 in PandaActiveScan Installer 2.0 in Panda ActiveScan downloads software in an as2guiie.cab archive located at an arbitrary URL, and does not verify the archive's digital signature before installation, which allows remote attackers to execute arbitrary code via a URL argument to an unspecified method."}, {"lang": "es", "value": "El control ActiveScan Installer ActiveX en as2stubie.dll anterior a v1.3.3.0 en PandaActiveScan Installer v2.0 y en Panda ActiveScan downloads software en un archivo as2guiie.cab ubicado en una URL cualquiera, y con la firma digital del archivo sin verificar antes de la instalaci\u00f3n, permite a atacantes remotos ejecutar c\u00f3digo de su elecci\u00f3n a trav\u00e9s de un argumento en una URL sobre un m\u00e9todo sin especificar."}], "lastModified": "2018-10-12T21:56:09.770", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:panda:panda_activescan:2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7E63FFD6-C269-40BE-AE85-1E3D3E7A2C16"}], "operator": "OR"}]}], "sourceIdentifier": "cret@cert.org"}