deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-5181
Published: 2008-11-20
Description: Microsoft Communicator allows remote attackers to cause a denial of service (application or device outage) via instant messages containing large numbers of emoticons.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://www.securitytracker.com/id?1021294; http://www.voipshield.com/research-details.php?id=131; https://exchange.xforce.ibmcloud.com/vulnerabilities/46671
CVE: CVE-2008-5182
Published: 2008-11-21
Description: The inotify functionality in Linux kernel 2.6 before 2.6.28-rc5 might allow local users to gain privileges via unknown vectors related to race conditions in inotify watch removal and umount.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-362
References: http://kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.28-rc5; http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00010.html
CVE: CVE-2008-5183
Published: 2008-11-21
Description: cupsd in CUPS 1.3.9 and earlier allows local users, and possibly remote attackers, to cause a denial of service (daemon crash) by adding a large number of RSS Subscriptions, which triggers a NULL pointer dereference.  NOTE: this issue can be triggered remotely by leveraging CVE-2008-5184.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://lab.gnucitizen.org/projects/cups-0day; http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html
CVE: CVE-2008-5184
Published: 2008-11-21
Description: The web interface (cgi-bin/admin.c) in CUPS before 1.3.8 uses the guest username when a user is not logged on to the web server, which makes it easier for remote attackers to bypass intended policy and conduct CSRF attacks via the (1) add and (2) cancel RSS subscription functions.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html; http://www.cups.org/str.php?L2774; http://www.gnucitizen.org/blog/pwning-ubuntu-via-cups/
CVE: CVE-2008-5185
Published: 2008-11-21
Description: The highlighting functionality in geshi.php in GeSHi before 1.0.8 allows remote attackers to cause a denial of service (infinite loop) via an XML sequence containing an opening delimiter without a closing delimiter, as demonstrated using "<".
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://geshi.svn.sourceforge.net/viewvc/geshi/trunk/geshi-1.0.X/src/geshi.php?r1=1321&r2=1322&view=patch; http://www.openwall.com/lists/oss-security/2008/11/20/4; http://www.securityfocus.com/bid/32377
CVE: CVE-2008-5186
Published: 2008-11-21
Description: The set_language_path function in geshi.php in Generic Syntax Highlighter (GeSHi) before 1.0.8.1 might allow remote attackers to conduct file inclusion attacks via crafted inputs that influence the default language path ($path variable).  NOTE: this issue has been disputed by a vendor, stating that only a static value is used, so this is not a vulnerability in GeSHi. Separate CVE identifiers would be created for web applications that integrate GeSHi in a way that allows control of the default language path
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://osvdb.org/49488; http://secunia.com/advisories/32559; http://sourceforge.net/project/shownotes.php?release_id=637321
CVE: CVE-2008-5187
Published: 2008-11-21
Description: The load function in the XPM loader for imlib2 1.4.2, and possibly other versions, allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted XPM file that triggers a "pointer arithmetic error" and a heap-based buffer overflow, a different vulnerability than CVE-2008-2426.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505714#15; http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00004.html; http://osvdb.org/49970
CVE: CVE-2008-5188
Published: 2008-11-21
Description: The (1) ecryptfs-setup-private, (2) ecryptfs-setup-confidential, and (3) ecryptfs-setup-pam-wrapped.sh scripts in ecryptfs-utils 45 through 61 in eCryptfs place cleartext passwords on command lines, which allows local users to obtain sensitive information by listing the process.
CVSS Score: 7.2 (HIGH)
CWE: CWE-255
References: http://git.kernel.org/?p=linux/kernel/git/mhalcrow/ecryptfs-utils.git%3Ba=commit%3Bh=06de99afd53f03fe07eda0ad9d61ac6d5d4d9f53; http://osvdb.org/49334; http://osvdb.org/50353
CVE: CVE-2008-5189
Published: 2008-11-21
Description: CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL to the redirect_to function.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-352
References: http://github.com/rails/rails/commit/7282ed863ca7e6f928bae9162c9a63a98775a19d; http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.html; http://weblog.rubyonrails.org/2008/10/19/rails-2-0-5-redirect_to-and-offset-limit-sanitizing
CVE: CVE-2008-5190
Published: 2008-11-21
Description: SQL injection vulnerability in index.php in eSHOP100 allows remote attackers to execute arbitrary SQL commands via the SUB parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30712; http://securityreason.com/securityalert/4619; http://www.securityfocus.com/bid/30002
CVE: CVE-2008-5191
Published: 2008-11-21
Description: Multiple SQL injection vulnerabilities in SePortal 2.4 allow remote attackers to execute arbitrary SQL commands via the (1) poll_id parameter to poll.php and the (2) sp_id parameter to staticpages.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30865; http://securityreason.com/securityalert/4623; http://www.securityfocus.com/bid/29996
CVE: CVE-2008-5192
Published: 2008-11-21
Description: SQL injection vulnerability in forum.asp in W1L3D4 Philboard 1.14 and 1.2 allows remote attackers to execute arbitrary SQL commands via the forumid parameter.  NOTE: this might overlap CVE-2008-2334, CVE-2008-1939, CVE-2007-2641, or CVE-2007-0920.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30874; http://securityreason.com/securityalert/4621; http://www.securityfocus.com/bid/29998
CVE: CVE-2008-5193
Published: 2008-11-21
Description: Cross-site scripting (XSS) vulnerability in search.asp in W1L3D4 Philboard 1.14 and 1.2 allows remote attackers to inject arbitrary web script or HTML via the searchterms parameter.  NOTE: this might overlap CVE-2007-4024.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30874; http://securityreason.com/securityalert/4621; http://www.securityfocus.com/bid/29998
CVE: CVE-2008-5194
Published: 2008-11-21
Description: SQL injection vulnerability in checkavail.php in SoftVisions Software Online Booking Manager (obm) 2.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30842; http://securityreason.com/securityalert/4622; http://www.securityfocus.com/bid/30004
CVE: CVE-2008-5195
Published: 2008-11-21
Description: Multiple SQL injection vulnerabilities in SebracCMS (sbcms) 0.4 allow remote attackers to execute arbitrary SQL commands via (1) the recid parameter to cms/form/read.php, (2) the uname parameter to cms/index.php, and other unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4620; http://www.securityfocus.com/bid/30003; http://www.vupen.com/english/advisories/2008/1973/references
CVE: CVE-2008-5196
Published: 2008-11-21
Description: SQL injection vulnerability in kroax.php in the Kroax (the_kroax) 4.42 and earlier module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the category parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4639; http://www.securityfocus.com/bid/29976; https://exchange.xforce.ibmcloud.com/vulnerabilities/43462
CVE: CVE-2008-5197
Published: 2008-11-21
Description: SQL injection vulnerability in classifieds.php in PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the lid parameter in a detail_adverts action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4640; http://www.securityfocus.com/bid/29995; https://exchange.xforce.ibmcloud.com/vulnerabilities/43561
CVE: CVE-2008-5198
Published: 2008-11-21
Description: SQL injection vulnerability in memberlist.php in Acmlmboard 1.A2 allows remote attackers to execute arbitrary SQL commands via the pow parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4641; http://www.securityfocus.com/bid/30007; http://www.vupen.com/english/advisories/2008/1972/references
CVE: CVE-2008-5199
Published: 2008-11-21
Description: PHP remote file inclusion vulnerability in include.php in PHPOutsourcing IdeaBox (aka IdeBox) 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the gorumDir parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6293&w=2; http://securityreason.com/securityalert/4642; http://securityvulns.ru/Ndocument286.html
CVE: CVE-2008-5200
Published: 2008-11-21
Description: SQL injection vulnerability in the Xe webtv (com_xewebtv) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4643; http://www.securityfocus.com/bid/30006; http://www.vupen.com/english/advisories/2008/1974/references
CVE: CVE-2008-5201
Published: 2008-11-21
Description: Directory traversal vulnerability in index.php in OTManager CMS 24a allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the conteudo parameter.  NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC share pathname or an ftp, ftps, or ssh2.sftp URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://securityreason.com/securityalert/4644; http://www.securityfocus.com/bid/29992; https://exchange.xforce.ibmcloud.com/vulnerabilities/43459
CVE: CVE-2008-5202
Published: 2008-11-21
Description: Cross-site scripting (XSS) vulnerability in index.php in OTManager CMS 24a allows remote attackers to inject arbitrary web script or HTML via the conteudo parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/4644; http://www.securityfocus.com/bid/29992; https://exchange.xforce.ibmcloud.com/vulnerabilities/43457
CVE: CVE-2008-5203
Published: 2008-11-21
Description: Cross-site scripting (XSS) vulnerability in external_vote.php in PowerAward 1.1.0 RC1 allows remote attackers to inject arbitrary web script or HTML via the l_vote_done parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/29993; https://exchange.xforce.ibmcloud.com/vulnerabilities/43464; https://www.exploit-db.com/exploits/5962
CVE: CVE-2008-5204
Published: 2008-11-21
Description: Multiple directory traversal vulnerabilities in PowerAward 1.1.0 RC1, when register_globals is enabled, allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the lang parameter to (1) agb.php, (2) angemeldet.php, (3) anmelden.php, (4) charts.php, (5) external_vote.php, (6) guestbook.php, (7) impressum.php, (8) index.php, (9) rss-reader.php, (10) statistic.php, (11) teilnehmer.php, (12) topsites.php, (13) votecode.php, (14) voting.php, and (15) winner.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/29993; https://exchange.xforce.ibmcloud.com/vulnerabilities/43463; https://www.exploit-db.com/exploits/5962
CVE: CVE-2008-5205
Published: 2008-11-21
Description: Cross-site scripting (XSS) vulnerability in edit.php in wellyblog allows remote attackers to inject arbitrary web script or HTML via the articleid parameter in an add action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/4645; http://www.securityfocus.com/archive/1/493710/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/43433
CVE: CVE-2008-5206
Published: 2008-11-21
Description: PHP remote file inclusion vulnerability in modules/mod_mainmenu.php in MosXML 1 Alpha allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/29952; https://exchange.xforce.ibmcloud.com/vulnerabilities/43430; http://www.securityfocus.com/bid/29952
CVE: CVE-2008-5207
Published: 2008-11-21
Description: Multiple directory traversal vulnerabilities in Jonascms 1.2 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the taal parameter to (1) backup.php and (2) gb_voegtoe.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/29950; https://exchange.xforce.ibmcloud.com/vulnerabilities/43435; http://www.securityfocus.com/bid/29950
CVE: CVE-2008-5208
Published: 2008-11-24
Description: SQL injection vulnerability in sub_votepic.php in the Datsogallery (com_datsogallery) module 1.6 for Joomla! allows remote attackers to execute arbitrary SQL commands via the User-Agent HTTP header.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30139; http://securityreason.com/securityalert/4624; http://www.securityfocus.com/bid/29138
CVE: CVE-2008-5209
Published: 2008-11-24
Description: Directory traversal vulnerability in modules/download/get_file.php in Admidio 1.4.8 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://securityreason.com/securityalert/4625; http://www.securityfocus.com/bid/29127; https://exchange.xforce.ibmcloud.com/vulnerabilities/42304
CVE: CVE-2008-5210
Published: 2008-11-24
Description: Multiple PHP remote file inclusion vulnerabilities in PhpBlock A8.5 allow remote attackers to execute arbitrary PHP code via a URL in the PATH_TO_CODE parameter to (1) script/init/createallimagecache.php, (2) allincludefortick.php and (3) test.php in script/tick/, and (4) modules/dungeon/tick/allincludefortick.php, different vectors than CVE-2008-1776.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/29143; https://exchange.xforce.ibmcloud.com/vulnerabilities/42319; https://www.exploit-db.com/exploits/5586
CVE: CVE-2008-5211
Published: 2008-11-24
Description: Cross-site scripting (XSS) vulnerability in search.php in Sphider 1.3.4, when the search suggestion feature is enabled, allows remote attackers to inject arbitrary web script or HTML via the query parameter, a different vector than CVE-2006-2506.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/30082; http://securityreason.com/securityalert/4629; http://users.own-hero.net/~decoder/advisories/sphider134-xss.txt
CVE: CVE-2008-5212
Published: 2008-11-24
Description: SQL injection vulnerability in classifide_ad.php in AJ Auction 6.2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the item_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4627; http://www.securityfocus.com/bid/29150; https://exchange.xforce.ibmcloud.com/vulnerabilities/42328
CVE: CVE-2008-5213
Published: 2008-11-24
Description: SQL injection vulnerability in featured_article.php in AJ Article 1.0 allows remote attackers to execute arbitrary SQL commands via the artid parameter in a search detail action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4632; http://www.securityfocus.com/bid/29149; https://exchange.xforce.ibmcloud.com/vulnerabilities/42329
CVE: CVE-2008-5214
Published: 2008-11-24
Description: Cross-site scripting (XSS) vulnerability in service/calendrier.php in ClanLite 2.2006.05.20 allows remote attackers to inject arbitrary web script or HTML via the annee parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/4628; http://www.securityfocus.com/bid/29156; https://exchange.xforce.ibmcloud.com/vulnerabilities/42331
CVE: CVE-2008-5215
Published: 2008-11-24
Description: SQL injection vulnerability in service/profil.php in ClanLite 2.2006.05.20 allows remote attackers to execute arbitrary SQL commands via the link parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4628; http://www.securityfocus.com/bid/29156; https://exchange.xforce.ibmcloud.com/vulnerabilities/42330
CVE: CVE-2008-5216
Published: 2008-11-24
Description: SQL injection vulnerability in category_list.php in AJ Square ZeusCart 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the cid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4636; http://www.securityfocus.com/bid/29155; https://exchange.xforce.ibmcloud.com/vulnerabilities/42333
CVE: CVE-2008-5217
Published: 2008-11-24
Description: Directory traversal vulnerability in index.php in txtCMS 0.3, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the id parameter.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-22
References: http://securityreason.com/securityalert/4626; http://www.securityfocus.com/bid/29131; https://exchange.xforce.ibmcloud.com/vulnerabilities/42313
CVE: CVE-2008-5218
Published: 2008-11-25
Description: ScriptsEz FREEze Greetings 1.0 stores pwd.txt under the web root with insufficient access control, which allows remote attackers to obtain cleartext passwords.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/49883; http://secunia.com/advisories/32744; http://securityreason.com/securityalert/4633
CVE: CVE-2008-5219
Published: 2008-11-25
Description: The password change feature (admin/cp.php) in VideoScript 4.0.1.50 and earlier does not check for administrative authentication and does not require knowledge of the original password, which allows remote attackers to change the admin account password via modified npass and npass1 parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://osvdb.org/49885; http://secunia.com/advisories/32718; http://securityreason.com/securityalert/4634
CVE: CVE-2008-5220
Published: 2008-11-25
Description: Unrestricted file upload vulnerability in admin/upload_form.php in wPortfolio 0.3 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in admin/tmp/.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/32367; http://www.vupen.com/english/advisories/2008/3219; https://exchange.xforce.ibmcloud.com/vulnerabilities/46745
CVE: CVE-2008-5221
Published: 2008-11-25
Description: The account_save action in admin/userinfo.php in wPortfolio 0.3 and earlier does not require authentication and does not require knowledge of the original password, which allows remote attackers to change the admin account password via modified password and password_retype parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://securityreason.com/securityalert/4631; http://www.securityfocus.com/bid/32384; http://www.vupen.com/english/advisories/2008/3219
CVE: CVE-2008-5222
Published: 2008-11-25
Description: SQL injection vulnerability in login.asp in Dvbbs 8.2.0 allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30455; http://securityreason.com/securityalert/4635; http://www.securityfocus.com/archive/1/492753/100/0/threaded
CVE: CVE-2008-5223
Published: 2008-11-25
Description: SQL injection vulnerability in index.php in Airvae Commerce 3.0 allows remote attackers to execute arbitrary SQL commands via the pid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30440; http://securityreason.com/securityalert/4637; http://www.securityfocus.com/bid/29423
CVE: CVE-2008-5224
Published: 2008-11-25
Description: Cross-site scripting (XSS) vulnerability in Kent Web Mart 1.61 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN43906021/index.html; http://secunia.com/advisories/30444; http://www.kent-web.com/cart/mart.html
CVE: CVE-2008-5225
Published: 2008-11-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in Xerox DocuShare 6 and earlier allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI under (1) SearchResults/ and (2) Services/ in dsdn/dsweb/, and (3) the default URI under unspecified docushare/dsweb/ServicesLib/Group-#/ directories.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30426; http://securityreason.com/securityalert/4638; http://www.securityfocus.com/archive/1/492766/100/0/threaded
CVE: CVE-2008-5226
Published: 2008-11-25
Description: SQL injection vulnerability in the MambAds (com_mambads) component 1.0 RC1 Beta and 1.0 RC1 for Mambo allows remote attackers to execute arbitrary SQL commands via the ma_cat parameter in a view action to index.php, a different vector than CVE-2007-5177.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4630; http://www.securityfocus.com/bid/29433; https://exchange.xforce.ibmcloud.com/vulnerabilities/42747
CVE: CVE-2008-1586
Published: 2008-11-25
Description: ImageIO in Apple iPhone OS 1.0 through 2.1 and iPhone OS for iPod touch 1.1 through 2.1 allow remote attackers to cause a denial of service (memory consumption and device reset) via a crafted TIFF image.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2008/Nov/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html; http://osvdb.org/50023
CVE: CVE-2008-4225
Published: 2008-11-25
Description: Integer overflow in the xmlBufferResize function in libxml2 2.7.2 allows context-dependent attackers to cause a denial of service (infinite loop) via a large XML document.
CVSS Score: 7.8 (HIGH)
CWE: CWE-189
References: http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html; http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html; http://secunia.com/advisories/32762
CVE: CVE-2008-4226
Published: 2008-11-25
Description: Integer overflow in the xmlSAX2Characters function in libxml2 2.7.2 allows context-dependent attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a large XML document.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02029444; http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html; http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html
CVE: CVE-2008-4227
Published: 2008-11-25
Description: Apple iPhone OS 1.0 through 2.1 and iPhone OS for iPod touch 1.1 through 2.1 changes the encryption level of PPTP VPN connections to a lower level than was previously used, which makes it easier for remote attackers to obtain sensitive information or hijack a connection by decrypting network traffic.
CVSS Score: 7.5 (HIGH)
CWE: CWE-310
References: http://lists.apple.com/archives/security-announce/2008/Nov/msg00002.html; http://osvdb.org/50024; http://secunia.com/advisories/32756