deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-0115
Published: 2009-03-30
Description: The Device Mapper multipathing driver (aka multipath-tools or device-mapper-multipath) 0.4.8, as used in SUSE openSUSE, SUSE Linux Enterprise Server (SLES), Fedora, and possibly other operating systems, uses world-writable permissions for the socket file (aka /var/run/multipathd.sock), which allows local users to send arbitrary commands to the multipath daemon.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: http://download.opensuse.org/update/10.3-test/repodata/patch-kpartx-6082.xml; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10691; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
CVE: CVE-2009-1170
Published: 2009-03-30
Description: Unspecified vulnerability in Sun OpenSolaris snv_100 through snv_101 allows local users, with privileges in a non-global zone, to execute arbitrary code in the global zone when a global-zone user is using mdb on a non-global zone process.
CVSS Score: 6.9 (MEDIUM)
References: http://sunsolve.sun.com/search/document.do?assetkey=1-66-255608-1; http://www.securityfocus.com/bid/34272; http://www.securitytracker.com/id?1021944
CVE: CVE-2008-6554
Published: 2009-03-30
Description: cgi-bin/script in Aztech ADSL2/2+ 4-port router 3.7.0 build 070426 allows remote attackers to execute arbitrary commands via shell metacharacters in the query string.
CVSS Score: 10.0 (HIGH)
CWE: CWE-78
References: http://core.ifconfig.se/~core/?p=21; http://osvdb.org/44267; http://secunia.com/advisories/29551
CVE: CVE-2008-6555
Published: 2009-03-30
Description: cgi-bin/webutil.pl in The Puppet Master WebUtil allows remote attackers to execute arbitrary commands via shell metacharacters in the dig command.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://osvdb.org/51181; http://www.securityfocus.com/archive/1/489961/100/0/threaded; http://www.securityfocus.com/bid/28393
CVE: CVE-2008-6556
Published: 2009-03-30
Description: cgi-bin/webutil.pl in The Puppet Master WebUtil 2.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the whois command.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://osvdb.org/51181; http://www.securityfocus.com/archive/1/489961/100/0/threaded; http://www.securityfocus.com/bid/28393
CVE: CVE-2008-6557
Published: 2009-03-30
Description: cgi-bin/webutil.pl in The Puppet Master WebUtil 2.7 allows remote attackers to execute arbitrary commands via shell metacharacters in the details command.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://osvdb.org/51181; http://www.securityfocus.com/archive/1/489961/100/0/threaded; http://www.securityfocus.com/bid/28393
CVE: CVE-2008-6558
Published: 2009-03-30
Description: Untrusted search path vulnerability in (1) hvdisp and (2) rcvm in ReliantHA 1.1.4 in SCO UnixWare 7.1.4 allows local users to gain root privileges by modifying the RELIANT_PATH environment variable to point to a malicious bin/hvenv program.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: ftp://ftp.sco.com/pub/unixware7/714/security/p534850/p534850.txt; http://osvdb.org/46706; http://osvdb.org/46707
CVE: CVE-2008-6559
Published: 2009-03-30
Description: Merge mcd in ReliantHA 1.1.4 in SCO UnixWare 7.1.4 allows local users to gain root privileges via a crafted -d argument that contains .. (dot dot) sequences that point to a directory containing a file whose name includes shell metacharacters.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: ftp://ftp.sco.com/pub/unixware7/714/security/p534850/p534850.txt; http://secunia.com/advisories/30921; http://www.osvdb.org/51234
CVE: CVE-2009-1171
Published: 2009-03-30
Description: The TeX filter in Moodle 1.6 before 1.6.9+, 1.7 before 1.7.7+, 1.8 before 1.8.9, and 1.9 before 1.9.5 allows user-assisted attackers to read arbitrary files via an input command in a "$$" sequence, which causes LaTeX to include the contents of the file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://cvs.moodle.org/moodle/filter/tex/filter.php?r1=1.18.4.4&r2=1.18.4.5; http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html; http://secunia.com/advisories/34517
CVE: CVE-2008-6560
Published: 2009-03-31
Description: Buffer overflow in CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9 and Red Hat Enterprise Linux (RHEL) 5 allows attackers to cause a denial of service (CPU consumption and memory corruption) via a cluster.conf file with many lines.  NOTE: it is not clear whether this issue crosses privilege boundaries in realistic uses of the product.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://git.fedorahosted.org/git/cluster.git?p=cluster.git%3Ba=commitdiff%3Bh=67fee9128e54c6c3fc3eae306b5b501f3029c3be; http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00163.html; http://www.redhat.com/archives/fedora-package-announce/2008-November/msg00164.html
CVE: CVE-2009-0892
Published: 2009-03-31
Description: The administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.23 and 7.0 before 7.0.0.3 allows attackers to hijack user sessions in "specific scenarios" related to a forced logout.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/34131; http://www-01.ibm.com/support/docview.wss?uid=swg1PK74966; http://www-01.ibm.com/support/docview.wss?uid=swg27007951
CVE: CVE-2009-1172
Published: 2009-03-31
Description: The JAX-RPC WS-Security runtime in the Web Services Security component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.23 and 7.0 before 7.0.0.3, when APAR PK41002 is installed, does not properly validate UsernameToken objects, which has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/34131; http://secunia.com/advisories/34461; http://www-01.ibm.com/support/docview.wss?uid=swg1PK75992
CVE: CVE-2009-1173
Published: 2009-03-31
Description: IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.3 uses weak permissions (777) for files associated with unspecified "interim fixes," which allows attackers to modify files that would not have been accessible if the intended 755 permissions were used.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://secunia.com/advisories/34131; http://secunia.com/advisories/34461; http://www-01.ibm.com/support/docview.wss?uid=swg1PK77590
CVE: CVE-2009-1174
Published: 2009-03-31
Description: The Web Services Security component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.35 and 7.0 before 7.0.0.3 has an unspecified "security problem" in the XML digital-signature specification, which has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-310
References: http://secunia.com/advisories/34131; http://secunia.com/advisories/34461; http://secunia.com/advisories/35301
CVE: CVE-2009-1175
Published: 2009-03-31
Description: Cross-site scripting (XSS) vulnerability in apps/web/vs_diag.cgi in the DAAP extension in Banshee 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the server parameter, which is not properly handled in an error message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugzilla.gnome.org/show_bug.cgi?id=577270; http://www.openwall.com/lists/oss-security/2009/03/30/2; http://bugzilla.gnome.org/show_bug.cgi?id=577270
CVE: CVE-2005-4879
Published: 2009-03-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in jax_guestbook.php in Jax Guestbook 3.1 and 3.31 allow remote attackers to inject arbitrary web script or HTML via the (1) gmt_ofs and (2) language parameters.  NOTE: the page parameter is already covered by CVE-2006-1913.  NOTE: it was later reported that 3.50 is also affected.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://downloads.securityfocus.com/vulnerabilities/exploits/28523.html; http://lostmon.blogspot.com/2005/08/jax-php-scripts-multiple.html; http://secunia.com/advisories/16337
CVE: CVE-2005-4880
Published: 2009-03-31
Description: Jax Guestbook 3.1 and 3.31 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain IP addresses of users via a direct request to (1) guestbook, (2) guestbook_ips2block, (3) ips2block, and (4) formmailer/logfile.csv.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://lostmon.blogspot.com/2005/08/jax-php-scripts-multiple.html; http://secunia.com/advisories/16337; http://lostmon.blogspot.com/2005/08/jax-php-scripts-multiple.html
CVE: CVE-2006-7237
Published: 2009-03-31
Description: PHP remote file inclusion vulnerability in mod/nc_phpmyadmin/core/libraries/Theme_Manager.class.php in Ixprim 2.0 allows remote attackers to execute arbitrary PHP code via a URL in an unspecified parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://downloads.securityfocus.com/vulnerabilities/exploits/19816.html; http://www.securityfocus.com/bid/19816; https://exchange.xforce.ibmcloud.com/vulnerabilities/42471
CVE: CVE-2007-6722
Published: 2009-03-31
Description: Vidalia bundle before 0.1.2.18, when running on Windows and Mac OS X, installs Privoxy with a configuration file (config.txt or config) that contains insecure (1) enable-remote-toggle and (2) enable-edit-actions settings, which allows remote attackers to bypass intended access restrictions and modify configuration.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-16
References: http://archives.seul.org/or/talk/Oct-2007/msg00291.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/50066; http://archives.seul.org/or/talk/Oct-2007/msg00291.html
CVE: CVE-2007-6723
Published: 2009-03-31
Description: TorK before 0.22, when running on Windows and Mac OS X, installs Privoxy with a configuration file (config.txt or config) that contains insecure (1) enable-remote-toggle and (2) enable-edit-actions settings, which allows remote attackers to bypass intended access restrictions and modify configuration.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-16
References: http://archives.seul.org/or/talk/Oct-2007/msg00291.html; http://archives.seul.org/or/talk/Oct-2007/msg00296.html; http://sourceforge.net/project/shownotes.php?release_id=551544&group_id=159836
CVE: CVE-2007-6724
Published: 2009-03-31
Description: Vidalia bundle before 0.1.2.18, when running on Windows, installs Privoxy with a configuration file (config.txt or config) that contains an insecure enable-remote-http-toggle setting, which allows remote attackers to bypass intended access restrictions and modify configuration.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-16
References: http://archives.seul.org/or/talk/Oct-2007/msg00291.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/50474; http://archives.seul.org/or/talk/Oct-2007/msg00291.html
CVE: CVE-2008-6561
Published: 2009-03-31
Description: Citrix Presentation Server Client for Windows before 10.200 does not clear "credential information" from process memory in unspecified circumstances, which might allow local users to gain privileges.
CVSS Score: 1.9 (LOW)
CWE: CWE-200
References: http://support.citrix.com/article/CTX116227; http://www.securitytracker.com/id?1019605; http://www.vupen.com/english/advisories/2008/0845
CVE: CVE-2008-6562
Published: 2009-03-31
Description: Cross-site scripting (XSS) vulnerability in jax_linklists.php in Jack (tR) Jax LinkLists 1.00 allows remote attackers to inject arbitrary web script or HTML via the cat parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/28518; https://exchange.xforce.ibmcloud.com/vulnerabilities/41573; http://www.securityfocus.com/bid/28518
CVE: CVE-2008-6563
Published: 2009-03-31
Description: Buffer overflow in the XML parser in Trillian 3.1.9.0, and possibly earlier, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DTD file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/51130; http://www.securityfocus.com/archive/1/490772/100/0/threaded; http://www.securityfocus.com/bid/28747
CVE: CVE-2008-6564
Published: 2009-03-31
Description: Nortel UNIStim protocol, as used in Communication Server 1000 and other products, uses predictable sequence numbers, which allows remote attackers to hijack sessions via sniffing or brute force attacks.
CVSS Score: 7.6 (HIGH)
References: http://osvdb.org/44379; http://secunia.com/advisories/29747; http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=713455
CVE: CVE-2008-6565
Published: 2009-03-31
Description: Cross-site scripting (XSS) vulnerability in Invision Power Board 2.3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via an IFRAME tag in the signature.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/490115/100/0/threaded; http://www.securityfocus.com/bid/28466; https://exchange.xforce.ibmcloud.com/vulnerabilities/41502
CVE: CVE-2008-6566
Published: 2009-03-31
Description: Unspecified vulnerability in Octopussy before 0.9.5.8 has unknown impact and attack vectors related to a "major security" vulnerability.
CVSS Score: 10.0 (HIGH)
References: http://freshmeat.net/projects/octopussy/releases/275561; http://osvdb.org/48839; http://freshmeat.net/projects/octopussy/releases/275561
CVE: CVE-2008-6567
Published: 2009-03-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in Gallarific Free Edition allow remote attackers to inject arbitrary web script or HTML via (1) the e-mail address, (2) a comment, which is not properly handled during moderation, and (3) the tag parameter to gallery/tags.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2008-04/0398.html; http://osvdb.org/51166; http://osvdb.org/51167
CVE: CVE-2008-6568
Published: 2009-03-31
Description: Unrestricted file upload vulnerability in Yehe 2.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the envoyer feature.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/28355; https://exchange.xforce.ibmcloud.com/vulnerabilities/42279; http://www.securityfocus.com/bid/28355
CVE: CVE-2008-6569
Published: 2009-03-31
Description: Session fixation vulnerability in Cybozu Garoon 2.0.0 through 2.1.3 allows remote attackers to hijack web sessions via the session ID in the login page.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://cybozu.co.jp/products/dl/notice/detail/0021.html; http://jvn.jp/en/jp/JVN18700809/index.html; http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000034.html
CVE: CVE-2008-6570
Published: 2009-03-31
Description: Cross-site scripting (XSS) vulnerability in the RSS reader in Cybozu Garoon 2.0.0 through 2.1.3 allows remote attackers to inject arbitrary web script or HTML via a crafted RSS feed.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://cybozu.co.jp/products/dl/notice/detail/0023.html; http://jvn.jp/en/jp/JVN52363223/index.html; http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000035.html
CVE: CVE-2008-6571
Published: 2009-03-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in LinPHA before 1.3.4 might allow remote attackers to inject arbitrary web script or HTML via (1) new_images.php, (2) login.php, and unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://linpha.cvs.sourceforge.net/linpha/linpha/ChangeLog?view=markup; http://osvdb.org/50225; http://osvdb.org/50226
CVE: CVE-2003-1570
Published: 2009-03-31
Description: The server in IBM Tivoli Storage Manager (TSM) 5.1.x, 5.2.x before 5.2.1.2, and 6.x before 6.1 does not require credentials to observe the server console in some circumstances, which allows remote authenticated administrators to monitor server operations by establishing a console mode session, related to "session exposure."
CVSS Score: 3.5 (LOW)
CWE: CWE-287
References: http://secunia.com/advisories/34498; http://securitytracker.com/id?1021947; http://www-01.ibm.com/support/docview.wss?uid=swg21375360
CVE: CVE-2004-2762
Published: 2009-03-31
Description: The server in IBM Tivoli Storage Manager (TSM) 4.2.x on MVS, 5.1.9.x before 5.1.9.1, 5.1.x before 5.1.10, 5.2.2.x before 5.2.2.3, 5.2.x before 5.2.3, 5.3.x before 5.3.0, and 6.x before 6.1, when the HTTP communication method is enabled, allows remote attackers to cause a denial of service (daemon crash or hang) via unspecified HTTP traffic, as demonstrated by the IBM port scanner 1.3.1.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/34498; http://securitytracker.com/id?1021946; http://www-01.ibm.com/support/docview.wss?uid=swg21246076
CVE: CVE-2009-0839
Published: 2009-03-31
Description: Stack-based buffer overflow in mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2, when the server has a map with a long IMAGEPATH or NAME attribute, allows remote attackers to execute arbitrary code via a crafted id parameter in a query action.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.html; http://secunia.com/advisories/34520; http://secunia.com/advisories/34603
CVE: CVE-2009-0840
Published: 2009-03-31
Description: Heap-based buffer underflow in the readPostBody function in cgiutil.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to have an unknown impact via a negative value in the Content-Length HTTP header.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.html; http://secunia.com/advisories/34520; http://secunia.com/advisories/34603
CVE: CVE-2009-0841
Published: 2009-03-31
Description: Directory traversal vulnerability in mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2, when running on Windows with Cygwin, allows remote attackers to create arbitrary files via a .. (dot dot) in the id parameter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-22
References: http://lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.html; http://secunia.com/advisories/34520; http://secunia.com/advisories/34603
CVE: CVE-2009-0842
Published: 2009-03-31
Description: mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to read arbitrary invalid .map files via a full pathname in the map parameter, which triggers the display of partial file contents within an error message, as demonstrated by a /tmp/sekrut.map symlink.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.html; http://secunia.com/advisories/34520; http://secunia.com/advisories/34603
CVE: CVE-2009-0843
Published: 2009-03-31
Description: The msLoadQuery function in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to determine the existence of arbitrary files via a full pathname in the queryfile parameter, which triggers different error messages depending on whether this pathname exists.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.html; http://secunia.com/advisories/34520; http://secunia.com/advisories/34603
CVE: CVE-2009-1073
Published: 2009-03-31
Description: nss-ldapd before 0.6.8 uses world-readable permissions for the /etc/nss-ldapd.conf file, which allows local users to obtain a cleartext password for the LDAP server by reading the bindpw field.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-732
References: http://arthurenhella.demon.nl/viewvc/nss-ldapd/nss-ldapd/debian/libnss-ldapd.postinst?r1=795&r2=813; http://arthurenhella.demon.nl/viewvc/nss-ldapd/nss-ldapd/man/nss-ldapd.conf.5.xml?r1=805&r2=806; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=520476
CVE: CVE-2009-1176
Published: 2009-03-31
Description: mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 does not ensure that the string holding the id parameter ends in a '\0' character, which allows remote attackers to conduct buffer-overflow attacks or have unspecified other impact via a long id parameter in a query action.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.html; http://secunia.com/advisories/34603; http://www.positronsecurity.com/advisories/2009-000.html
CVE: CVE-2009-1177
Published: 2009-03-31
Description: Multiple stack-based buffer overflows in maptemplate.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 have unknown impact and remote attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.html; http://secunia.com/advisories/34603; http://trac.osgeo.org/mapserver/ticket/2944
CVE: CVE-2009-1178
Published: 2009-03-31
Description: Unspecified vulnerability in the server in IBM Tivoli Storage Manager (TSM) 5.3.x before 5.3.2 and 6.x before 6.1 has unknown impact and attack vectors related to the "admin command line."
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/34498; http://securitytracker.com/id?1021945; http://www-01.ibm.com/support/docview.wss?uid=swg21246076
CVE: CVE-2008-6572
Published: 2009-03-31
Description: SQL injection vulnerability in search_results.php in ABK-Soft AbleDating 2.4 allows remote attackers to execute arbitrary SQL commands via the keyword parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/45605; http://secunia.com/advisories/30366; http://www.securityfocus.com/archive/1/492478/100/0/threaded
CVE: CVE-2009-1204
Published: 2009-04-01
Description: Cross-site scripting (XSS) vulnerability in TikiWiki (Tiki) CMS/Groupware 2.2 allows remote attackers to inject arbitrary web script or HTML via the PHP_SELF portion of a URI to (1) tiki-galleries.php, (2) tiki-list_file_gallery.php, (3) tiki-listpages.php, and (4) tiki-orphan_pages.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://dev.tikiwiki.org/tiki-view_tracker_item.php?itemId=2359&trackerId=5&show=view&reloff=3&cant=1229&status=o&trackerId=5&sort_mode=created_desc; http://info.tikiwiki.org/tiki-read_article.php?articleId=51; http://secunia.com/advisories/34273
CVE: CVE-2009-0686
Published: 2009-04-01
Description: The TrendMicro Activity Monitor Module (tmactmon.sys) 2.52.0.1002 in Trend Micro Internet Pro 2008 and 2009, and Security Pro 2008 and 2009, allows local users to gain privileges via a crafted IRP in a METHOD_NEITHER IOCTL request to \Device\tmactmon that overwrites memory.
CVSS Score: 7.2 (HIGH)
CWE: CWE-399
References: http://en.securitylab.ru/lab/PT-2009-09; http://milw0rm.com/sploits/2009-trendmicro_local_expl_0day.zip; http://www.securityfocus.com/archive/1/502314/100/0/threaded
CVE: CVE-2009-0790
Published: 2009-04-01
Description: The pluto IKE daemon in Openswan and Strongswan IPsec 2.6 before 2.6.21 and 2.4 before 2.4.14, and Strongswan 4.2 before 4.2.14 and 2.8 before 2.8.9, allows remote attackers to cause a denial of service (daemon crash and restart) via a crafted (1) R_U_THERE or (2) R_U_THERE_ACK Dead Peer Detection (DPD) IPsec IKE Notification message that triggers a NULL pointer dereference related to inconsistent ISAKMP state and the lack of a phase2 state association in DPD.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://download.strongswan.org/CHANGES4.txt; http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html; http://secunia.com/advisories/34472
CVE: CVE-2009-1205
Published: 2009-04-01
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2007-4475.  Reason: This candidate is a duplicate of CVE-2007-4475.  Notes: All CVE users should reference CVE-2007-4475 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage