https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2010-2104.htmlhttps://patchthecve.com/cve/CVE-2010-2104.htmlTue, 16 Jun 2026 23:19:59 +0000MEDIUM 4.3: Directory traversal vulnerability in Orbit Downloader 3.0.0.4 and 3.0.0.5 allows user-assisted remote attackers to write arbitrary files via a metalink file containing directory traversal sequences in the name attribute of a file element.https://patchthecve.com/cve/CVE-2009-1064.htmlhttps://patchthecve.com/cve/CVE-2009-1064.htmlTue, 16 Jun 2026 23:06:25 +0000MEDIUM 5.8: Argument injection vulnerability in orbitmxt.dll 2.1.0.2 in the Orbit Downloader 2.8.7 and earlier ActiveX control allows remote attackers to overwrite arbitrary files via whitespace and a command-line switch, followed by a full pathname, in the third argument to the download method.https://patchthecve.com/cve/CVE-2009-0187.htmlhttps://patchthecve.com/cve/CVE-2009-0187.htmlTue, 16 Jun 2026 23:04:27 +0000HIGH 9.3: Stack-based buffer overflow in Orbit Downloader 2.8.2 and 2.8.3, and possibly other versions before 2.8.5, allows remote attackers to execute arbitrary code via a crafted HTTP URL with a long host name, which is not properly handled when constructing a "Connecting" log message.