deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-3884
Published: 2008-09-02
Description: Cross-site scripting (XSS) vulnerability in Blogn (BURO GUN) 1.9.7 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different issue than CVE-2006-6176.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN03859837/index.html; http://secunia.com/advisories/31662; http://www.blogn.org/index.php?e=172
CVE: CVE-2008-3885
Published: 2008-09-02
Description: Cross-site request forgery (CSRF) vulnerability in Blogn (BURO GUN) 1.9.7 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that make content modifications. NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://jvn.jp/en/jp/JVN84125369/index.html; http://secunia.com/advisories/31662; http://www.blogn.org/index.php?e=172
CVE: CVE-2008-3886
Published: 2008-09-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in dotProject 2.1.2 allow remote attackers to inject arbitrary web script or HTML via (1) the inactive parameter in a tasks action, (2) the date parameter in a calendar day_view action, (3) the callback parameter in a public calendar action, or (4) the type parameter in a ticketsmith action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstorm.linuxsecurity.com/0808-exploits/dotproject-sqlxss.txt; http://secunia.com/advisories/31681; http://www.securityfocus.com/bid/30924
CVE: CVE-2008-3887
Published: 2008-09-02
Description: Multiple SQL injection vulnerabilities in index.php in dotProject 2.1.2 allow (1) remote authenticated users to execute arbitrary SQL commands via the tab parameter in a projects action, and (2) remote authenticated administrators to execute arbitrary SQL commands via the user_id parameter in a viewuser action.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-89
References: http://packetstorm.linuxsecurity.com/0808-exploits/dotproject-sqlxss.txt; http://secunia.com/advisories/31681; http://www.securityfocus.com/bid/30924
CVE: CVE-2008-3888
Published: 2008-09-02
Description: SQL injection vulnerability in members.asp in Mini-NUKE Freehost 2.3 allows remote attackers to execute arbitrary SQL commands via the uid parameter in a member_details action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/archive/1/495743/100/0/threaded; http://www.securityfocus.com/archive/1/495743/100/0/threaded
CVE: CVE-2008-2101
Published: 2008-09-03
Description: The VMware Consolidated Backup (VCB) command-line utilities in VMware ESX 3.0.1 through 3.0.3 and ESX 3.5 place a password on the command line, which allows local users to obtain sensitive information by listing the process.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-August/064118.html; http://secunia.com/advisories/31713; http://security.gentoo.org/glsa/glsa-201209-25.xml
CVE: CVE-2008-3101
Published: 2008-09-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in vtiger CRM 5.0.4 allow remote attackers to inject arbitrary web script or HTML via (1) the parenttab parameter in an index action to the Products module, as reachable through index.php; (2) the user_password parameter in an Authenticate action to the Users module, as reachable through index.php; or (3) the query_string parameter in a UnifiedSearch action to the Home module, as reachable through index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/31679; http://securityreason.com/securityalert/4208; http://www.datensalat.eu/~fabian/cve/CVE-2008-3101-vtigerCRM.html
CVE: CVE-2008-3525
Published: 2008-09-03
Description: The sbni_ioctl function in drivers/net/wan/sbni.c in the wan subsystem in the Linux kernel 2.6.26.3 does not check for the CAP_NET_ADMIN capability before processing a (1) SIOCDEVRESINSTATS, (2) SIOCDEVSHWSTATE, (3) SIOCDEVENSLAVE, or (4) SIOCDEVEMANSIPATE ioctl request, which allows local users to bypass intended capability restrictions.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f2455eb176ac87081bbfc9a44b21c7cd2bc1967e; http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00003.html
CVE: CVE-2008-3536
Published: 2008-09-03
Description: Unspecified vulnerability in ovalarmsrv in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to cause a denial of service via unknown vectors, a different vulnerability than CVE-2008-3537.
CVSS Score: 7.8 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0549&w=2; http://secunia.com/advisories/31688; http://securityreason.com/securityalert/4209
CVE: CVE-2008-3537
Published: 2008-09-03
Description: Unspecified vulnerability in ovalarmsrv in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to cause a denial of service via unknown vectors, a different vulnerability than CVE-2008-3536.
CVSS Score: 7.8 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0549&w=2; http://secunia.com/advisories/31688; http://securityreason.com/securityalert/4209
CVE: CVE-2008-3691
Published: 2008-09-03
Description: Unspecified vulnerability in a certain ActiveX control in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x before 6.0.5 build 109488, VMware Player 1.x before 1.0.8 build 108000, VMware Player 2.x before 2.0.5 build 109488, VMware ACE 1.x before 1.0.7 build 108880, VMware ACE 2.x before 2.0.5 build 109488, and VMware Server before 1.0.7 build 108231 has unknown impact and remote attack vectors, a different vulnerability than CVE-2008-3692, CVE-2008-3693, CVE-2008-3694, CVE-2008-3695, and CVE-2008-3696.
CVSS Score: 10.0 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-August/064118.html; http://secunia.com/advisories/31707; http://secunia.com/advisories/31708
CVE: CVE-2008-3692
Published: 2008-09-03
Description: Unspecified vulnerability in a certain ActiveX control in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x before 6.0.5 build 109488, VMware Player 1.x before 1.0.8 build 108000, VMware Player 2.x before 2.0.5 build 109488, VMware ACE 1.x before 1.0.7 build 108880, VMware ACE 2.x before 2.0.5 build 109488, and VMware Server before 1.0.7 build 108231 has unknown impact and remote attack vectors, a different vulnerability than CVE-2008-3691, CVE-2008-3693, CVE-2008-3694, CVE-2008-3695, and CVE-2008-3696.
CVSS Score: 10.0 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-August/064118.html; http://secunia.com/advisories/31707; http://secunia.com/advisories/31708
CVE: CVE-2008-3693
Published: 2008-09-03
Description: Unspecified vulnerability in a certain ActiveX control in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x before 6.0.5 build 109488, VMware Player 1.x before 1.0.8 build 108000, VMware Player 2.x before 2.0.5 build 109488, VMware ACE 1.x before 1.0.7 build 108880, VMware ACE 2.x before 2.0.5 build 109488, and VMware Server before 1.0.7 build 108231 has unknown impact and remote attack vectors, a different vulnerability than CVE-2008-3691, CVE-2008-3692, CVE-2008-3694, CVE-2008-3695, and CVE-2008-3696.
CVSS Score: 10.0 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-August/064118.html; http://secunia.com/advisories/31707; http://secunia.com/advisories/31708
CVE: CVE-2008-3694
Published: 2008-09-03
Description: Unspecified vulnerability in a certain ActiveX control in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x before 6.0.5 build 109488, VMware Player 1.x before 1.0.8 build 108000, VMware Player 2.x before 2.0.5 build 109488, VMware ACE 1.x before 1.0.7 build 108880, VMware ACE 2.x before 2.0.5 build 109488, and VMware Server before 1.0.7 build 108231 has unknown impact and remote attack vectors, a different vulnerability than CVE-2008-3691, CVE-2008-3692, CVE-2008-3693, CVE-2008-3695, and CVE-2008-3696.
CVSS Score: 10.0 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-August/064118.html; http://secunia.com/advisories/31707; http://secunia.com/advisories/31708
CVE: CVE-2008-3695
Published: 2008-09-03
Description: Unspecified vulnerability in a certain ActiveX control in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x before 6.0.5 build 109488, VMware Player 1.x before 1.0.8 build 108000, VMware Player 2.x before 2.0.5 build 109488, VMware ACE 1.x before 1.0.7 build 108880, VMware ACE 2.x before 2.0.5 build 109488, and VMware Server before 1.0.7 build 108231 has unknown impact and remote attack vectors, a different vulnerability than CVE-2008-3691, CVE-2008-3692, CVE-2008-3693, CVE-2008-3694, and CVE-2008-3696.
CVSS Score: 10.0 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-August/064118.html; http://secunia.com/advisories/31707; http://secunia.com/advisories/31708
CVE: CVE-2008-3696
Published: 2008-09-03
Description: Unspecified vulnerability in a certain ActiveX control in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x before 6.0.5 build 109488, VMware Player 1.x before 1.0.8 build 108000, VMware Player 2.x before 2.0.5 build 109488, VMware ACE 1.x before 1.0.7 build 108880, VMware ACE 2.x before 2.0.5 build 109488, and VMware Server before 1.0.7 build 108231 has unknown impact and remote attack vectors, a different vulnerability than CVE-2008-3691, CVE-2008-3692, CVE-2008-3693, CVE-2008-3694, and CVE-2008-3695.
CVSS Score: 10.0 (HIGH)
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-August/064118.html; http://secunia.com/advisories/31707; http://secunia.com/advisories/31708
CVE: CVE-2008-3697
Published: 2008-09-03
Description: An unspecified ISAPI extension in VMware Server before 1.0.7 build 108231 allows remote attackers to cause a denial of service (IIS crash) via a malformed request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-August/064118.html; http://secunia.com/advisories/31708; http://securityreason.com/securityalert/4202
CVE: CVE-2008-3698
Published: 2008-09-03
Description: Unspecified vulnerability in the OpenProcess function in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x before 6.0.5 build 109488, VMware Player 1.x before 1.0.8 build 108000, VMware Player 2.x before 2.0.5 build 109488, VMware ACE 1.x before 1.0.7 build 108880, VMware ACE 2.x before 2.0.5 build 109488, and VMware Server before 1.0.7 build 108231 on Windows allows local host OS users to gain privileges on the host OS via unknown vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-August/064118.html; http://secunia.com/advisories/31707; http://securityreason.com/securityalert/4202
CVE: CVE-2008-3791
Published: 2008-09-03
Description: src/main-win.c in GPicView 0.1.9 in Lightweight X11 Desktop Environment (LXDE) allows local users to overwrite arbitrary files via a symlink attack on the /tmp/rot.jpg temporary file.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=495968; http://lxde.svn.sourceforge.net/viewvc/lxde?view=rev&sortby=date&revision=845; http://sourceforge.net/tracker/index.php?func=detail&aid=2019481&group_id=180858&atid=894869
CVE: CVE-2008-3792
Published: 2008-09-03
Description: net/sctp/socket.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux kernel before 2.6.26.4 does not verify that the SCTP-AUTH extension is enabled before proceeding with SCTP-AUTH API functions, which allows attackers to cause a denial of service (NULL pointer dereference and panic) via vectors that result in calls to (1) sctp_setsockopt_auth_chunk, (2) sctp_setsockopt_hmac_ident, (3) sctp_setsockopt_auth_key, (4) sctp_setsockopt_active_key, (5) sctp_setsockopt_del_key, (6) sctp_getsockopt_maxburst, (7) sctp_getsockopt_active_key, (8) sctp_getsockopt_peer_auth_chunks, or (9) sctp_getsockopt_local_auth_chunks.
CVSS Score: 7.1 (HIGH)
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=5e739d1752aca4e8f3e794d431503bfca3162df4; http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00010.html; http://lkml.org/lkml/2008/8/23/49
CVE: CVE-2008-3891
Published: 2008-09-03
Description: The SAML Single Sign-On (SSO) Service for Google Apps allows remote service providers to impersonate users at arbitrary service providers via vectors related to authentication responses that lack a request identifier and recipient field.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.kb.cert.org/vuls/id/612636; http://www.kb.cert.org/vuls/id/MIMG-7FQGWU; http://www.kb.cert.org/vuls/id/612636
CVE: CVE-2008-3892
Published: 2008-09-03
Description: Buffer overflow in a certain ActiveX control in the COM API in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x before 6.0.5 build 109488, VMware Player 1.x before 1.0.8 build 108000, VMware Player 2.x before 2.0.5 build 109488, VMware ACE 1.x before 1.0.7 build 108880, VMware ACE 2.x before 2.0.5 build 109488, and VMware Server before 1.0.7 build 108231 allows remote attackers to cause a denial of service (browser crash) or possibly execute arbitrary code via a call to the GuestInfo method in which there is a long string argument, and an assignment of a long string value to the result of this call.  NOTE: this may overlap CVE-2008-3691, CVE-2008-3692, CVE-2008-3693, CVE-2008-3694, CVE-2008-3695, or CVE-2008-3696.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-August/064118.html; http://secunia.com/advisories/31707; http://secunia.com/advisories/31708
CVE: CVE-2008-3893
Published: 2008-09-03
Description: Microsoft Bitlocker in Windows Vista before SP1 stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer during boot, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200, CWE-200
References: http://secunia.com/advisories/31619; http://www.ivizsecurity.com/security-advisory-iviz-sr-0801.html; http://secunia.com/advisories/31619
CVE: CVE-2008-3894
Published: 2008-09-03
Description: IBM Lenovo firmware 7CETB5WW 2.05 stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://securityreason.com/securityalert/4207; http://www.ivizsecurity.com/preboot-patch.html; http://www.ivizsecurity.com/research/preboot/preboot_whitepaper.pdf
CVE: CVE-2008-3895
Published: 2008-09-03
Description: LILO 22.6.1 and earlier stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer before and after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://securityreason.com/securityalert/4211; http://www.ivizsecurity.com/preboot-patch.html; http://www.ivizsecurity.com/research/preboot/preboot_whitepaper.pdf
CVE: CVE-2008-3896
Published: 2008-09-03
Description: Grub Legacy 0.97 and earlier stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer before and after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://securityreason.com/securityalert/4204; http://securityreason.com/securityalert/4206; http://www.ivizsecurity.com/preboot-patch.html
CVE: CVE-2008-3897
Published: 2008-09-03
Description: DiskCryptor 0.2.6 on Windows stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer before and after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://securityreason.com/securityalert/4212; http://www.ivizsecurity.com/preboot-patch.html; http://www.ivizsecurity.com/research/preboot/preboot_whitepaper.pdf
CVE: CVE-2008-3898
Published: 2008-09-03
Description: Secu Star DriveCrypt Plus Pack 3.9 stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer before and after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://secunia.com/advisories/31605; http://securityreason.com/securityalert/4213; http://www.ivizsecurity.com/preboot-patch.html
CVE: CVE-2008-3899
Published: 2008-09-03
Description: TrueCrypt 5.0 stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer before and after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer.  NOTE: the researcher mentions a response from the vendor denying the vulnerability.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://securityreason.com/securityalert/4203; http://www.ivizsecurity.com/preboot-patch.html; http://www.ivizsecurity.com/research/preboot/preboot_whitepaper.pdf
CVE: CVE-2008-3900
Published: 2008-09-03
Description: Intel firmware PE94510M.86A.0050.2007.0710.1559 stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://securityreason.com/securityalert/4205; http://securitytracker.com/id?1020738; http://www.ivizsecurity.com/preboot-patch.html
CVE: CVE-2008-3901
Published: 2008-09-03
Description: Software suspend 2 2-2.2.1, when used with the Linux kernel 2.6.16, stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://www.ivizsecurity.com/research/preboot/preboot_whitepaper.pdf; http://www.ivizsecurity.com/research/preboot/preboot_whitepaper.pdf
CVE: CVE-2008-1739
Published: 2008-09-03
Description: Apple QuickTime before 7.4.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted ftyp atoms in a movie file, which triggers memory corruption.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://support.apple.com/kb/HT1241; https://exchange.xforce.ibmcloud.com/vulnerabilities/45144; http://support.apple.com/kb/HT1241
CVE: CVE-2008-3902
Published: 2008-09-03
Description: HP firmware 68DTT F.0D stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer, aka SSRT080104.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://securityreason.com/securityalert/4214; http://www.ivizsecurity.com/preboot-patch.html; http://www.ivizsecurity.com/research/preboot/preboot_whitepaper.pdf
CVE: CVE-2008-1389
Published: 2008-09-04
Description: libclamav/chmunpack.c in the chm-parser in ClamAV before 0.94 allows remote attackers to cause a denial of service (application crash) via a malformed CHM file, related to an "invalid memory access."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://int21.de/cve/CVE-2008-1389-clamav-chd.html; http://kolab.org/security/kolab-vendor-notice-22.txt; http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html
CVE: CVE-2008-2441
Published: 2008-09-04
Description: Cisco Secure ACS 3.x before 3.3(4) Build 12 patch 7, 4.0.x, 4.1.x before 4.1(4) Build 13 Patch 11, and 4.2.x before 4.2(0) Build 124 Patch 4 does not properly handle an EAP Response packet in which the value of the length field exceeds the actual packet length, which allows remote authenticated users to cause a denial of service (CSRadius and CSAuth service crash) or possibly execute arbitrary code via a crafted RADIUS (1) EAP-Response/Identity, (2) EAP-Response/MD5, or (3) EAP-Response/TLS Message Attribute packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/31731; http://securityreason.com/securityalert/4216; http://www.cisco.com/warp/public/707/cisco-sr-20080903-csacs.shtml
CVE: CVE-2008-2732
Published: 2008-09-04
Description: Multiple unspecified vulnerabilities in the SIP inspection functionality in Cisco PIX and Adaptive Security Appliance (ASA) 5500 devices 7.0 before 7.0(7)16, 7.1 before 7.1(2)71, 7.2 before 7.2(4)7, 8.0 before 8.0(3)20, and 8.1 before 8.1(1)8 allow remote attackers to cause a denial of service (device reload) via unknown vectors, aka Bug IDs CSCsq07867, CSCsq57091, CSCsk60581, and CSCsq39315.
CVSS Score: 7.8 (HIGH)
References: http://secunia.com/advisories/31730; http://tools.cisco.com/security/center/content/CiscoAppliedMitigationBulletin/cisco-amb-20080903-asa; http://www.cisco.com/en/US/products/products_security_advisory09186a00809f138a.shtml
CVE: CVE-2008-2733
Published: 2008-09-04
Description: Cisco PIX and Adaptive Security Appliance (ASA) 5500 devices 7.2 before 7.2(4)2, 8.0 before 8.0(3)14, and 8.1 before 8.1(1)4, when configured as a client VPN endpoint, do not properly process IPSec client authentication, which allows remote attackers to cause a denial of service (device reload) via a crafted authentication attempt, aka Bug ID CSCso69942.
CVSS Score: 7.1 (HIGH)
References: http://secunia.com/advisories/31730; http://tools.cisco.com/security/center/content/CiscoAppliedMitigationBulletin/cisco-amb-20080903-asa; http://www.cisco.com/en/US/products/products_security_advisory09186a00809f138a.shtml
CVE: CVE-2008-2734
Published: 2008-09-04
Description: Memory leak in the crypto functionality in Cisco Adaptive Security Appliance (ASA) 5500 devices 7.2 before 7.2(4)2, 8.0 before 8.0(3)14, and 8.1 before 8.1(1)4, when configured as a clientless SSL VPN endpoint, allows remote attackers to cause a denial of service (memory consumption and VPN hang) via a crafted SSL or HTTP packet, aka Bug ID CSCso66472.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/31730; http://tools.cisco.com/security/center/content/CiscoAppliedMitigationBulletin/cisco-amb-20080903-asa; http://www.cisco.com/en/US/products/products_security_advisory09186a00809f138a.shtml
CVE: CVE-2008-2735
Published: 2008-09-04
Description: The HTTP server in Cisco Adaptive Security Appliance (ASA) 5500 devices 8.0 before 8.0(3)15 and 8.1 before 8.1(1)5, when configured as a clientless SSL VPN endpoint, does not properly process URIs, which allows remote attackers to cause a denial of service (device reload) via a URI in a crafted SSL or HTTP packet, aka Bug ID CSCsq19369.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/31730; http://tools.cisco.com/security/center/content/CiscoAppliedMitigationBulletin/cisco-amb-20080903-asa; http://www.cisco.com/en/US/products/products_security_advisory09186a00809f138a.shtml