Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
vdb.org/51780 - http://secunia.com/advisories/33835 - http://www.securityfocus.com/bid/33642 - http://archives.neohapsis.com/archives/fulldisclosure/2009-02/0036.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/48553
CVE ID: CVE-2009-0604 State: PUBLISHED Published: 2009-02-16T20:00:00 Last Updated: 2024-08-07T04:40:05.018Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in index.php in PHP Director 0.21 and earlier allows remote attackers to execute arbitrary SQL commands via the searching parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/8014 - http://www.vupen.com/english/advisories/2009/0379 - http://www.securityfocus.com/bid/33694
CVE ID: CVE-2009-0605 State: PUBLISHED Published: 2009-02-17T17:00:00 Last Updated: 2024-08-07T04:40:05.121Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack consumption vulnerability in the do_page_fault function in arch/x86/mm/fault.c in the Linux kernel before 2.6.28.5 allows local users to cause a denial of service (memory corruption) or possibly gain privileges via unspecified vectors that trigger page faults on a machine that has a registered Kprobes probe. Additional Analyst Notes: - CVE Program Container: References: - http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.28.5 - http://www.securityfocus.com/bid/33758 - http://www.ubuntu.com/usn/usn-751-1 - http://git.
nel/v2.6/ChangeLog-2.6.28.5 - http://www.securityfocus.com/bid/33758 - http://www.ubuntu.com/usn/usn-751-1 - http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.27.y.git%3Ba=commit%3Bh=9be260a646bf76fa418ee519afa10196b3164681
CVE ID: CVE-2009-0606 State: PUBLISHED Published: 2009-02-17T17:00:00 Last Updated: 2024-08-07T04:40:05.010Z Vendors: n/a Products: n/a Problem Types: n/a Description: The link_image function in linker/linker.c in the dynamic linker in Bionic in Open Handset Alliance Android 1.0 on the T-Mobile G1 phone does not properly handle file descriptors 0, 1, and 2 for a setgid program, which allows local users to create arbitrary files owned by certain groups, possibly a related issue to CVE-2002-0820. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/48840 - http://www.securityfocus.com/bid/33695 - http://www.securityfocus.com/arch
e.xforce.ibmcloud.com/vulnerabilities/48840 - http://www.securityfocus.com/bid/33695 - http://www.securityfocus.com/archive/1/500753/100/0/threaded
CVE ID: CVE-2009-0607 State: PUBLISHED Published: 2009-02-17T17:00:00 Last Updated: 2024-08-07T04:40:04.984Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple integer overflows in malloc_leak.c in Bionic in Open Handset Alliance Android 1.0 have unknown impact and attack vectors, related to the (1) chk_calloc and (2) leak_calloc functions. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/33695 - http://www.securityfocus.com/archive/1/500753/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/48841
CVE ID: CVE-2009-0608 State: PUBLISHED Published: 2009-02-17T17:00:00 Last Updated: 2024-08-07T04:40:04.247Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in the showLog function in fake_log_device.c in liblog in Open Handset Alliance Android 1.0 allows attackers to trigger a buffer overflow and possibly have unspecified other impact by sending a large number of input lines. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/33695 - http://www.securityfocus.com/archive/1/500753/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/48842
CVE ID: CVE-2009-0609 State: PUBLISHED Published: 2009-02-17T17:00:00Z Last Updated: 2024-09-16T16:18:25.883Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sun Java System Directory Proxy Server in Sun Java System Directory Server Enterprise Edition 6.0 through 6.3, when a JDBC data source is used, does not properly handle (1) a long value in an ADD or (2) long string attributes, which allows remote attackers to cause a denial of service (JDBC backend outage) via crafted LDAP requests. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/33761 - http://sunsolve.sun.com/search/document.do?assetkey=1-66-251086-1 - http://secunia.com/adv
securityfocus.com/bid/33761 - http://sunsolve.sun.com/search/document.do?assetkey=1-66-251086-1 - http://secunia.com/advisories/33923 - http://sunsolve.sun.com/search/document.do?assetkey=1-21-125276-08-1
CVE ID: CVE-2009-0610 State: PUBLISHED Published: 2009-02-17T17:00:00Z Last Updated: 2024-09-16T21:04:13.168Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple static code injection vulnerabilities in post.php in Simple PHP News 1.0 final allow remote attackers to inject arbitrary PHP code into news.txt via the (1) title or (2) date parameter, and then execute the code via a direct request to display.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/51816 - http://secunia.com/advisories/33814
CVE ID: CVE-2009-0611 State: PUBLISHED Published: 2009-02-17T17:00:00 Last Updated: 2024-08-07T04:40:05.082Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in qfsearch/AdminServlet in QuickFinder Server in Novell Open Enterprise Server 1.x allow remote attackers to inject arbitrary web script or HTML via (1) the siteloc parameter in a displayaddsite action, the site parameter in a (2) generalproperties or (3) clusterserviceproperties action, (4) the adminurl parameter in a global action, or (5) the print-list parameter. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/33886 - http://
arameter. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/33886 - http://www.securityfocus.com/bid/33708 - http://osvdb.org/51941 - http://www.vupen.com/english/advisories/2009/0421 - https://exchange.xforce.ibmcloud.com/vulnerabilities/48619 - http://packetstormsecurity.org/0902-exploits/nqfs-xss.txt - http://www.securitytracker.com/id?1021695
CVE ID: CVE-2009-0612 State: PUBLISHED Published: 2009-02-17T17:00:00 Last Updated: 2024-08-07T04:40:05.116Z Vendors: n/a Products: n/a Problem Types: n/a Description: Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 3.x and InterScan Web Security Suite (IWSS) 3.x, when basic authorization is enabled on the standalone proxy, forwards the Proxy-Authorization header from Windows Media Player, which allows remote web servers to obtain credentials by offering a media stream and then capturing this header. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/48681 - http://secunia.com/advisories/33891 - http://www.securi
: - https://exchange.xforce.ibmcloud.com/vulnerabilities/48681 - http://secunia.com/advisories/33891 - http://www.securityfocus.com/bid/33687 - http://www.securitytracker.com/id?1021716 - http://www.securityfocus.com/archive/1/500760/100/0/threaded
CVE ID: CVE-2009-0613 State: PUBLISHED Published: 2009-02-17T17:00:00 Last Updated: 2024-08-07T04:40:05.034Z Vendors: n/a Products: n/a Problem Types: n/a Description: Trend Micro InterScan Web Security Suite (IWSS) 3.1 before build 1237 allows remote authenticated Auditor and Report Only users to bypass intended permission settings, and modify the system configuration, via requests to unspecified JSP pages. Additional Analyst Notes: - CVE Program Container: References: - http://www.trendmicro.com/ftp/documentation/readme/iwss_31_win_en_readme_CP_1237_EN.txt - http://secunia.com/advisories/33867 - http://www.vupen.com/english/advisories/2009/0369 - http://www.securitytracker.com/id?1021694
CVE ID: CVE-2009-0614 State: PUBLISHED Published: 2009-02-26T16:00:00 Last Updated: 2024-08-07T04:40:05.049Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in the Web Server in Cisco Unified MeetingPlace Web Conferencing 6.0 before 6.0(517.0) (aka 6.0 MR4) and 7.0 before 7.0(2) (aka 7.0 MR1) allows remote attackers to bypass authentication and obtain administrative access via a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc86.shtml - http://www.securityfocus.com/bid/33901 - https://exchange.xforce.ibmcloud.com/vulnerabilities/48888
CVE ID: CVE-2009-0615 State: PUBLISHED Published: 2009-02-26T16:00:00Z Last Updated: 2024-09-16T22:31:24.097Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in Cisco Application Networking Manager (ANM) before 2.0 and Application Control Engine (ACE) Device Manager before A3(2.1) allows remote authenticated users to read or modify arbitrary files via unspecified vectors, related to "invalid directory permissions." Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/33903 - http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc84.shtml - http://www.securitytracker.com/id?1021770
CVE ID: CVE-2009-0616 State: PUBLISHED Published: 2009-02-26T16:00:00Z Last Updated: 2024-09-16T20:57:19.147Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cisco Application Networking Manager (ANM) before 2.0 uses default usernames and passwords, which makes it easier for remote attackers to access the application, or cause a denial of service via configuration changes, related to "default user credentials during installation." Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/33903 - http://www.securitytracker.com/id?1021771 - http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc84.shtml
CVE ID: CVE-2009-0617 State: PUBLISHED Published: 2009-02-26T16:00:00Z Last Updated: 2024-09-17T00:46:01.450Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cisco Application Networking Manager (ANM) before 2.0 uses a default MySQL root password, which makes it easier for remote attackers to execute arbitrary operating-system commands or change system files. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/33903 - http://www.securitytracker.com/id?1021771 - http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc84.shtml
CVE ID: CVE-2009-0618 State: PUBLISHED Published: 2009-02-26T16:00:00Z Last Updated: 2024-09-17T00:30:35.369Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in the Java agent in Cisco Application Networking Manager (ANM) before 2.0 Update A allows remote attackers to gain privileges, and cause a denial of service (service outage) by stopping processes, or obtain sensitive information by reading configuration files. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id?1021772 - http://www.securityfocus.com/bid/33903 - http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc84.shtml
CVE ID: CVE-2009-0619 State: PUBLISHED Published: 2009-03-05T02:00:00 Last Updated: 2024-08-07T04:40:05.093Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in the Session Border Controller (SBC) before 3.0(2) for Cisco 7600 series routers allows remote attackers to cause a denial of service (SBC card reload) via crafted packets to TCP port 2000. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id?1021787 - http://www.cisco.com/en/US/products/products_security_advisory09186a0080a80faa.shtml - https://exchange.xforce.ibmcloud.com/vulnerabilities/49055 - http://www.securityfocus.com/bid/33975
CVE ID: CVE-2009-0620 State: PUBLISHED Published: 2009-02-26T16:00:00Z Last Updated: 2024-09-16T19:37:10.451Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers before A2(1.1) uses default (1) usernames and (2) passwords for (a) the administrator and (b) web management, which makes it easier for remote attackers to perform configuration changes or obtain operating-system access. Additional Analyst Notes: - CVE Program Container: References: - http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc82.shtml - http://www.securityfocus.com/bid/33900
CVE ID: CVE-2009-0621 State: PUBLISHED Published: 2009-02-26T16:00:00Z Last Updated: 2024-09-17T01:50:51.750Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cisco ACE 4710 Application Control Engine Appliance before A1(8a) uses default (1) usernames and (2) passwords for (a) the administrator, (b) web management, and (c) device management, which makes it easier for remote attackers to perform configuration changes to the Device Manager and other components, or obtain operating-system access. Additional Analyst Notes: - CVE Program Container: References: - http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc82.shtml - http://www.securityfocus.com/bid/33900
CVE ID: CVE-2009-0622 State: PUBLISHED Published: 2009-02-26T16:00:00Z Last Updated: 2024-09-16T20:07:30.144Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers before A2(1.2) and Cisco ACE 4710 Application Control Engine Appliance before A1(8a) allows remote authenticated users to execute arbitrary operating-system commands through a command line interface (CLI). Additional Analyst Notes: - CVE Program Container: References: - http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc82.shtml - http://www.securityfocus.com/bid/33900
CVE ID: CVE-2009-0623 State: PUBLISHED Published: 2009-02-26T16:00:00Z Last Updated: 2024-09-16T23:46:36.574Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers before A2(1.3) and Cisco ACE 4710 Application Control Engine Appliance before A3(2.1) allows remote attackers to cause a denial of service (device reload) via a crafted SSH packet. Additional Analyst Notes: - CVE Program Container: References: - http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc82.shtml - http://www.securityfocus.com/bid/33900
CVE ID: CVE-2009-0624 State: PUBLISHED Published: 2009-02-26T16:00:00Z Last Updated: 2024-09-16T19:10:24.295Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in the SNMPv2c implementation in Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers before A2(1.3) and Cisco ACE 4710 Application Control Engine Appliance before A3(2.1) allows remote attackers to cause a denial of service (device reload) via a crafted SNMPv1 packet. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id?1021769 - http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc82.shtml - http
ritytracker.com/id?1021769 - http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc82.shtml - http://www.securityfocus.com/bid/33900
CVE ID: CVE-2009-0625 State: PUBLISHED Published: 2009-02-26T16:00:00Z Last Updated: 2024-09-16T22:20:28.202Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers before A2(1.2) and Cisco ACE 4710 Application Control Engine Appliance before A1(8.0) allows remote attackers to cause a denial of service (device reload) via a crafted SNMPv3 packet. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id?1021769 - http://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc82.shtml - http://www.securityfocus.com/bid/3
ttp://www.cisco.com/en/US/products/products_security_advisory09186a0080a7bc82.shtml - http://www.securityfocus.com/bid/33900
CVE ID: CVE-2009-0626 State: PUBLISHED Published: 2009-03-27T16:00:00 Last Updated: 2024-08-07T04:40:05.100Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SSLVPN feature in Cisco IOS 12.3 through 12.4 allows remote attackers to cause a denial of service (device reload or hang) via a crafted HTTPS packet. Additional Analyst Notes: - CVE Program Container: References: - http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90469.shtml - http://www.securityfocus.com/bid/34239 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6919 - http://secunia.com/advisories/34438 - http://securitytracker.com/id?1021896 - http://www.c
org.mitre.oval%3Adef%3A6919 - http://secunia.com/advisories/34438 - http://securitytracker.com/id?1021896 - http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90424.shtml - https://exchange.xforce.ibmcloud.com/vulnerabilities/49425 - http://www.vupen.com/english/advisories/2009/0851
CVE ID: CVE-2009-0627 State: PUBLISHED Published: 2009-09-08T23:00:00Z Last Updated: 2024-09-17T04:29:11.720Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in Cisco NX-OS before 4.0(1a)N2(1), when running on Nexus 5000 platforms, allows remote attackers to cause a denial of service (crash) via an unspecified "sequence of TCP packets" related to "TCP State manipulation," possibly related to separate attacks against CVE-2008-4609. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id?1022847 - http://www.cisco.com/en/US/products/products_security_advisory09186a0080af511d.shtml
CVE ID: CVE-2009-0628 State: PUBLISHED Published: 2009-03-27T16:00:00 Last Updated: 2024-08-07T04:40:05.091Z Vendors: n/a Products: n/a Problem Types: n/a Description: Memory leak in the SSLVPN feature in Cisco IOS 12.3 through 12.4 allows remote attackers to cause a denial of service (memory consumption and device crash) by disconnecting an SSL session in an abnormal manner, leading to a Transmission Control Block (TCB) leak. Additional Analyst Notes: - CVE Program Container: References: - http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90469.shtml - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12092 - http://www.securityfoc
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12092 - http://www.securityfocus.com/bid/34239 - http://secunia.com/advisories/34438 - http://securitytracker.com/id?1021896 - https://exchange.xforce.ibmcloud.com/vulnerabilities/49427 - http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90424.shtml - http://www.vupen.com/english/advisories/2009/0851
CVE ID: CVE-2009-0629 State: PUBLISHED Published: 2009-03-27T16:00:00 Last Updated: 2024-08-07T04:40:05.364Z Vendors: n/a Products: n/a Problem Types: n/a Description: The (1) Airline Product Set (aka ALPS), (2) Serial Tunnel Code (aka STUN), (3) Block Serial Tunnel Code (aka BSTUN), (4) Native Client Interface Architecture (NCIA) support, (5) Data-link switching (aka DLSw), (6) Remote Source-Route Bridging (RSRB), (7) Point to Point Tunneling Protocol (PPTP), (8) X.25 for Record Boundary Preservation (RBP), (9) X.25 over TCP (XOT), and (10) X.25 Routing features in Cisco IOS 12.2 and 12.4 allows remote attackers to cause a denial of service (device reload) via a series of crafted TCP packet
OS 12.2 and 12.4 allows remote attackers to cause a denial of service (device reload) via a series of crafted TCP packets. Additional Analyst Notes: - CVE Program Container: References: - http://www.cisco.com/en/US/products/products_security_advisory09186a0080a904cb.shtml - http://securitytracker.com/id?1021903 - http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90469.shtml - https://exchange.xforce.ibmcloud.com/vulnerabilities/49420 - http://secunia.com/advisories/34438 - http://www.securityfocus.com/bid/34238 - http://www.vupen.com/english/advisories/2009/0851
CVE ID: CVE-2009-0630 State: PUBLISHED Published: 2009-03-27T16:00:00 Last Updated: 2024-08-07T04:40:05.078Z Vendors: n/a Products: n/a Problem Types: n/a Description: The (1) Cisco Unified Communications Manager Express; (2) SIP Gateway Signaling Support Over Transport Layer Security (TLS) Transport; (3) Secure Signaling and Media Encryption; (4) Blocks Extensible Exchange Protocol (BEEP); (5) Network Admission Control HTTP Authentication Proxy; (6) Per-user URL Redirect for EAPoUDP, Dot1x, and MAC Authentication Bypass; (7) Distributed Director with HTTP Redirects; and (8) TCP DNS features in Cisco IOS 12.0 through 12.4 do not properly handle IP sockets, which allows remote attackers to ca
) TCP DNS features in Cisco IOS 12.0 through 12.4 do not properly handle IP sockets, which allows remote attackers to cause a denial of service (outage or resource consumption) via a series of crafted TCP packets. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/34242 - http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90469.shtml - http://secunia.com/advisories/34438 - http://www.cisco.com/en/US/products/products_security_advisory09186a0080a904c6.shtml - https://exchange.xforce.ibmcloud.com/vulnerabilities/49418 - http://www.vupen.com/english/advisories/2009/0851 - http://securitytracker.com/id?1021897
CVE ID: CVE-2009-0631 State: PUBLISHED Published: 2009-03-27T15:00:00 Last Updated: 2024-08-07T04:40:05.058Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in Cisco IOS 12.0 through 12.4, when configured with (1) IP Service Level Agreements (SLAs) Responder, (2) Session Initiation Protocol (SIP), (3) H.323 Annex E Call Signaling Transport, or (4) Media Gateway Control Protocol (MGCP) allows remote attackers to cause a denial of service (blocked input queue on the inbound interface) via a crafted UDP packet. Additional Analyst Notes: - CVE Program Container: References: - http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90469.shtml
VE Program Container: References: - http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90469.shtml - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6720 - http://www.securityfocus.com/bid/34245 - http://www.securitytracker.com/id?1021904 - https://exchange.xforce.ibmcloud.com/vulnerabilities/49419 - http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90426.shtml
CVE ID: CVE-2009-0632 State: PUBLISHED Published: 2009-03-12T15:00:00 Last Updated: 2024-08-07T04:40:05.122Z Vendors: n/a Products: n/a Problem Types: n/a Description: The IP Phone Personal Address Book (PAB) Synchronizer feature in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 4.1, 4.2 before 4.2(3)SR4b, 4.3 before 4.3(2)SR1b, 5.x before 5.1(3e), 6.x before 6.1(3), and 7.0 before 7.0(2) sends privileged directory-service account credentials to the client in cleartext, which allows remote attackers to modify the CUCM configuration and perform other privileged actions by intercepting these credentials, and then using them in requests unrelated to the intended synchroni