deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-2190
Published: 2009-08-06
Description: launchd in Apple Mac OS X 10.5 before 10.5.8 allows remote attackers to cause a denial of service (individual service outage) by making many connections to an inetd-based launchd service.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2009/Aug/msg00001.html; http://osvdb.org/56841; http://secunia.com/advisories/36096
CVE: CVE-2009-2191
Published: 2009-08-06
Description: Format string vulnerability in Login Window in Apple Mac OS X 10.4.11 and 10.5 before 10.5.8 allows attackers to execute arbitrary code or cause a denial of service (application crash) via format string specifiers in an application name.
CVSS Score: 7.5 (HIGH)
CWE: CWE-134
References: http://lists.apple.com/archives/security-announce/2009/Aug/msg00001.html; http://osvdb.org/56840; http://secunia.com/advisories/36096
CVE: CVE-2009-2192
Published: 2009-08-06
Description: MobileMe in Apple Mac OS X 10.5 before 10.5.8 does not properly delete credentials upon signout from the preference pane, which makes it easier for attackers to hijack a MobileMe session via unspecified vectors, related to a "logic issue."
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://lists.apple.com/archives/security-announce/2009/Aug/msg00001.html; http://osvdb.org/56839; http://secunia.com/advisories/36096
CVE: CVE-2009-2193
Published: 2009-08-06
Description: Buffer overflow in the kernel in Apple Mac OS X 10.5 before 10.5.8 allows remote attackers to execute arbitrary code or cause a denial of service (system crash) via a crafted AppleTalk response packet.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2009/Aug/msg00001.html; http://osvdb.org/56838; http://secunia.com/advisories/36096
CVE: CVE-2009-2194
Published: 2009-08-06
Description: Apple Mac OS X 10.5 before 10.5.8 does not properly share file descriptors over local sockets, which allows local users to cause a denial of service (system crash) by placing file descriptors in messages sent to a socket that has no receiver, related to a "synchronization issue."
CVSS Score: 4.9 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2009/Aug/msg00001.html; http://osvdb.org/56836; http://secunia.com/advisories/36096
CVE: CVE-2008-6905
Published: 2009-08-06
Description: Cross-site request forgery (CSRF) vulnerability in index.php in BabbleBoard 1.1.6 allows remote authenticated users to hijack the authentication of administrators for requests that delete (1) categories or (2) groups; (3) ban users; or (4) delete users via the admin page.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/50721; http://secunia.com/advisories/33174; https://exchange.xforce.ibmcloud.com/vulnerabilities/47396
CVE: CVE-2008-6906
Published: 2009-08-06
Description: Cross-site scripting (XSS) vulnerability in index.php in BabbleBoard 1.1.6 allows remote attackers to inject arbitrary web script or HTML via the username.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/32840; https://exchange.xforce.ibmcloud.com/vulnerabilities/47403; https://www.exploit-db.com/exploits/7475
CVE: CVE-2008-6907
Published: 2009-08-06
Description: Multiple SQL injection vulnerabilities in checkuser.php in 2532designs 2532|Gigs 1.2.2 Stable, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters, as accessible from a form generated by index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/26585; http://www.securityfocus.com/bid/32913; https://exchange.xforce.ibmcloud.com/vulnerabilities/47491
CVE: CVE-2008-6908
Published: 2009-08-06
Description: Services 5.x before 5.x-0.92 and 6.x before 6.x-0.13, a module for Drupal, uses an insecure hash when signing requests, which allows remote attackers to impersonate other users and gain privileges.
CVSS Score: 7.5 (HIGH)
CWE: CWE-310
References: http://drupal.org/node/348295; http://osvdb.org/50743; http://www.securityfocus.com/bid/32894
CVE: CVE-2008-6909
Published: 2009-08-06
Description: Services 5.x before 5.x-0.92 and 6.x before 6.x-0.13, a module for Drupal, does not sign all required data in requests, which has unspecified impact, probably related to man-in-the-middle attacks that modify critical data and allow remote attackers to impersonate other users and gain privileges.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-310
References: http://drupal.org/node/348295; http://osvdb.org/50743; http://www.securityfocus.com/bid/32894
CVE: CVE-2008-6910
Published: 2009-08-06
Description: Services 5.x before 5.x-0.92 and 6.x before 6.x-0.13, a module for Drupal, does not use timeouts for signed requests, which allows remote attackers to impersonate other users and gain privileges via a replay attack that sends the same request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-310
References: http://drupal.org/node/348295; http://osvdb.org/50743; http://www.securityfocus.com/bid/32894
CVE: CVE-2008-6911
Published: 2009-08-06
Description: SQL injection vulnerability in the authenticateUser function in includes/authentication.inc.php in BrewBlogger (BB) 2.1.0.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the loginUsername parameter to includes/logincheck.inc.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/46863; http://secunia.com/advisories/30983; http://www.securityfocus.com/bid/30133
CVE: CVE-2008-6912
Published: 2009-08-07
Description: Zeeways SHAADICLONE 2.0 allows remote attackers to bypass authentication and gain administrative privileges via a direct request to admin/home.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://osvdb.org/49746; http://www.securityfocus.com/bid/32222; http://www.vupen.com/english/advisories/2008/3069
CVE: CVE-2008-6913
Published: 2009-08-07
Description: Unrestricted file upload vulnerability in editresume_next.php in Zeeways ZEEJOBSITE 2.0 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a photo in a profile edit action, then accessing the file via a direct request to jobseekers/logos/.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/32225; http://www.vupen.com/english/advisories/2008/3072; https://exchange.xforce.ibmcloud.com/vulnerabilities/46505
CVE: CVE-2008-6914
Published: 2009-08-07
Description: Unrestricted file upload vulnerability in viewprofile.php in Zeeways ZEEPROPERTY 1.0 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a photo in a profile modification, then accessing a related file via a direct request to the file in companylogo/.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/bid/32224; https://exchange.xforce.ibmcloud.com/vulnerabilities/46503; https://www.exploit-db.com/exploits/7058
CVE: CVE-2008-6915
Published: 2009-08-07
Description: Cross-site scripting (XSS) vulnerability in view_prop_details.php in Zeeways ZEEPROPERTY 1.0 allows remote attackers to inject arbitrary web script or HTML via the propid parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/32224; https://exchange.xforce.ibmcloud.com/vulnerabilities/46504; https://www.exploit-db.com/exploits/7058
CVE: CVE-2008-6916
Published: 2009-08-07
Description: Siemens SpeedStream 5200 with NetPort Software 1.1 allows remote attackers to bypass authentication via an invalid Host header, possibly involving a trailing dot in the hostname.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://osvdb.org/49870; http://secunia.com/advisories/32635; http://www.securityfocus.com/bid/32203
CVE: CVE-2008-6917
Published: 2009-08-07
Description: SQL injection vulnerability in admin.php in Exocrew ExoPHPDesk 1.2 Final allows remote attackers to execute arbitrary SQL commands via the username (user parameter).
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/27638; http://www.securityfocus.com/bid/32220; http://www.vupen.com/english/advisories/2008/3064
CVE: CVE-2009-2666
Published: 2009-08-07
Description: socket.c in fetchmail before 6.3.11 does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-310
References: http://fetchmail.berlios.de/fetchmail-SA-2009-01.txt; http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html; http://marc.info/?l=oss-security&m=[PII_REDACTED]7156&w=2
CVE: CVE-2009-2711
Published: 2009-08-07
Description: XScreenSaver in Sun Solaris 9 and 10, OpenSolaris before snv_120, and X11 6.4.1 for Solaris 8, when the Xorg or Xnewt server is used, allows physically proximate attackers to obtain sensitive information by reading popup windows, which are displayed even when the screen is locked, a different vulnerability than CVE-2009-1276.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/36170; http://sunsolve.sun.com/search/document.do?assetkey=1-21-115298-02-1; http://sunsolve.sun.com/search/document.do?assetkey=1-66-258928-1
CVE: CVE-2009-2712
Published: 2009-08-07
Description: Sun Java System Access Manager 6.3 2005Q1, 7.0 2005Q4, and 7.1; and OpenSSO Enterprise 8.0; when AMConfig.properties enables the debug flag, allows local users to discover cleartext passwords by reading debug files.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://osvdb.org/56815; http://secunia.com/advisories/36169; http://sunsolve.sun.com/search/document.do?assetkey=1-21-119465-16-1
CVE: CVE-2009-2713
Published: 2009-08-07
Description: The CDCServlet component in Sun Java System Access Manager 7.0 2005Q4 and 7.1, when Cross Domain Single Sign On (CDSSO) is enabled, does not ensure that "policy advice" is presented to the correct client, which allows remote attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/36167; http://sunsolve.sun.com/search/document.do?assetkey=1-21-126356-03-1; http://sunsolve.sun.com/search/document.do?assetkey=1-66-255968-1
CVE: CVE-2009-2714
Published: 2009-08-07
Description: Unspecified vulnerability in Sun VirtualBox 3.0.0 and 3.0.2 allows guest OS users to cause a denial of service (host OS reboot) via unknown vectors.
CVSS Score: 4.9 (MEDIUM)
References: http://secunia.com/advisories/36080; http://sunsolve.sun.com/search/document.do?assetkey=1-66-265268-1; http://www.securityfocus.com/bid/35960
CVE: CVE-2009-2715
Published: 2009-08-07
Description: Sun VirtualBox 2.2 through 3.0.2 r49928 allows guest OS users to cause a denial of service (Linux host OS reboot) via a sysenter instruction.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://www.exploit-db.com/exploits/9323; http://www.securityfocus.com/bid/35915; https://exchange.xforce.ibmcloud.com/vulnerabilities/52211
CVE: CVE-2009-0668
Published: 2009-08-07
Description: Unspecified vulnerability in Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to execute arbitrary Python code via vectors involving the ZEO network protocol.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: http://mail.zope.org/pipermail/zope-announce/2009-August/002220.html; http://osvdb.org/56827; http://pypi.python.org/pypi/ZODB3/3.8.2#whats-new-in-zodb-3-8-2
CVE: CVE-2009-0669
Published: 2009-08-07
Description: Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to bypass authentication via vectors involving the ZEO network protocol.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://mail.zope.org/pipermail/zope-announce/2009-August/002220.html; http://osvdb.org/56826; http://pypi.python.org/pypi/ZODB3/3.8.2#whats-new-in-zodb-3-8-2
CVE: CVE-2009-2411
Published: 2009-08-07
Description: Multiple integer overflows in the libsvn_delta library in Subversion before 1.5.7, and 1.6.x before 1.6.4, allow remote authenticated users and remote Subversion servers to execute arbitrary code via an svndiff stream with large windows that trigger a heap-based buffer overflow, a related issue to CVE-2009-2412.
CVSS Score: 8.5 (HIGH)
CWE: CWE-189
References: http://archives.neohapsis.com/archives/bugtraq/2009-08/0056.html; http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html; http://osvdb.org/56856
CVE: CVE-2008-6918
Published: 2009-08-10
Description: Unrestricted file upload vulnerability in admin/galeria.php in ThePortal2 2.2 allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a direct request to the file in galeria/.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/51143; http://secunia.com/advisories/33321; http://www.securityfocus.com/bid/33057
CVE: CVE-2008-6919
Published: 2009-08-10
Description: profileedit.php TaskDriver 1.3 and earlier allows remote attackers to bypass authentication and gain administrative access by setting the auth cookie to "fook!admin."
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/25221; http://www.securityfocus.com/bid/33030; https://exchange.xforce.ibmcloud.com/vulnerabilities/47608
CVE: CVE-2008-6920
Published: 2009-08-10
Description: Unrestricted file upload vulnerability in auth.php in phpEmployment 1.8 allows remote attackers to execute arbitrary code by uploading a file with an executable extension during a regnew action, then accessing it via a direct request to the file in photoes/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://osvdb.org/50981; http://secunia.com/advisories/33268; http://www.securityfocus.com/bid/33000
CVE: CVE-2008-6921
Published: 2009-08-10
Description: Unrestricted file upload vulnerability in index.php in phpAdBoard 1.8 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in photoes/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://osvdb.org/50996; http://secunia.com/advisories/33300; http://www.securityfocus.com/bid/32998
CVE: CVE-2008-6922
Published: 2009-08-10
Description: Multiple stack-based buffer overflows in CMailCOM.dll in CMailServer 5.4.6 allow remote attackers to execute arbitrary code via a long argument to the (1) CreateUserPath, (2) Logout, (3) DeleteMailByUID, (4) MoveToInbox, (5) MoveToFolder, (6) DeleteMailEx, (7) GetMailDataEx, (8) SetReplySign, (9) SetForwardSign, and (10) SetReadSign methods, which are not properly handled by (a) the POP3 Class ActiveX control (CMailCom.POP3); or a long argument to the (11) AddAttach, (12) SetSubject, (13) SetBcc, (14) SetBody, (15) SetCc, (16) SetFrom, (17) SetTo, and (18) SetFromUID methods, which are not properly handled by the Class ActiveX control (CMailCOM.SMTP), as demonstrated via the indexOfMail parameter to mwmail.asp.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/46750; http://secunia.com/advisories/30940; http://www.securityfocus.com/bid/30098
CVE: CVE-2008-6923
Published: 2009-08-10
Description: SQL injection vulnerability in the content component (com_content) 1.0.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter in a blogcategory action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/52455; https://www.exploit-db.com/exploits/6025; https://exchange.xforce.ibmcloud.com/vulnerabilities/52455
CVE: CVE-2009-1896
Published: 2009-08-10
Description: The Java Web Start framework in IcedTea in OpenJDK before 1.6.0.0-20.b16.fc10 on Fedora 10, and before 1.6.0.0-27.b16.fc11 on Fedora 11, trusts an entire application when at least one of the listed jar files is trusted, which allows context-dependent attackers to execute arbitrary code without the untrusted-code restrictions via a crafted application, related to NetX.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/36162; http://www.mandriva.com/security/advisories?name=MDVSA-2009:209; https://bugzilla.redhat.com/show_bug.cgi?id=512101
CVE: CVE-2009-2026
Published: 2009-08-10
Description: Stack-based buffer overflow in a token searching function in the dtscore library in Data Transport Services in CA Software Delivery r11.2 C1, C2, C3, and SP4; Unicenter Software Delivery 4.0 C3; CA Advantage Data Transport 3.0 C1; and CA IT Client Manager r12 allows remote attackers to execute arbitrary code via crafted data.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://osvdb.org/56834; http://secunia.com/advisories/36142; http://securitytracker.com/id?1022688
CVE: CVE-2009-2415
Published: 2009-08-10
Description: Multiple integer overflows in memcached 1.1.12 and 1.2.2 allow remote attackers to execute arbitrary code via vectors involving length attributes that trigger heap-based buffer overflows.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://osvdb.org/56906; http://secunia.com/advisories/36133; http://secunia.com/advisories/37729
CVE: CVE-2009-2475
Published: 2009-08-10
Description: Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, might allow context-dependent attackers to obtain sensitive information via vectors involving static variables that are declared without the final keyword, related to (1) LayoutQueue, (2) Cursor.predefined, (3) AccessibleResourceBundle.getContents, (4) ImageReaderSpi.STANDARD_INPUT_TYPE, (5) ImageWriterSpi.STANDARD_OUTPUT_TYPE, (6) the imageio plugins, (7) DnsContext.debug, (8) RmfFileReader/StandardMidiFileWriter.types, (9) AbstractSaslImpl.logger, (10) Synth.Region.uiToRegionMap/lowerCaseNameMap, (11) the Introspector class and a cache of BeanInfo, and (12) JAX-WS, a different vulnerability than CVE-2009-2673.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://java.sun.com/j2se/1.5.0/ReleaseNotes.html; http://java.sun.com/javase/6/webnotes/6u15.html; http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html
CVE: CVE-2009-2476
Published: 2009-08-10
Description: The Java Management Extensions (JMX) implementation in Sun Java SE 6 before Update 15, and OpenJDK, does not properly enforce OpenType checks, which allows context-dependent attackers to bypass intended access restrictions by leveraging finalizer resurrection to obtain a reference to a privileged object.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://java.sun.com/javase/6/webnotes/6u15.html; http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html
CVE: CVE-2009-2689
Published: 2009-08-10
Description: JDK13Services.getProviders in Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, grants full privileges to instances of unspecified object types, which allows context-dependent attackers to bypass intended access restrictions via an untrusted (1) applet or (2) application.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://java.sun.com/j2se/1.5.0/ReleaseNotes.html; http://java.sun.com/javase/6/webnotes/6u15.html; http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html
CVE: CVE-2009-2690
Published: 2009-08-10
Description: The encoder in Sun Java SE 6 before Update 15, and OpenJDK, grants read access to private variables with unspecified names, which allows context-dependent attackers to obtain sensitive information via an untrusted (1) applet or (2) application.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://java.sun.com/javase/6/webnotes/6u15.html; http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html
CVE: CVE-2008-6924
Published: 2009-08-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in register.php in eSyndiCat Directory 2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) username, (2) email, (3) password, (4) password2, (5) security_code, and (6) register parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstorm.linuxsecurity.com/0807-exploits/esyndicat-xss.txt; http://secunia.com/advisories/31041; http://www.osvdb.org/46908
CVE: CVE-2008-6925
Published: 2009-08-10
Description: Cross-site scripting (XSS) vulnerability in function.php in Zenphoto 1.1.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in the "request logging" feature.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/30172; https://exchange.xforce.ibmcloud.com/vulnerabilities/43864; http://www.securityfocus.com/bid/30172
CVE: CVE-2008-6926
Published: 2009-08-10
Description: Directory traversal vulnerability in autoinstall4imagesgalleryupgrade.php in the Fantastico De Luxe Module for cPanel allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the scriptpath_show parameter in a GoAhead action.  NOTE: this issue only crosses privilege boundaries when security settings such as disable_functions and safe_mode are active, since exploitation requires uploading of executable code to a home directory.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://www.netenberg.com/forum/index.php?topic=6832; http://www.securityfocus.com/archive/1/497964/100/0/threaded; http://www.securityfocus.com/archive/1/498519
CVE: CVE-2008-6927
Published: 2009-08-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in autoinstall4imagesgalleryupgrade.php in the Fantastico De Luxe Module for cPanel allow remote attackers to inject arbitrary web script or HTML via the (1) localapp, (2) updatedir, (3) scriptpath_show, (4) domain_show, (5) thispage, (6) thisapp, and (7) currentversion parameters in an Upgrade action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/32423; http://www.netenberg.com/forum/index.php?topic=6832; http://www.osvdb.org/49518
CVE: CVE-2009-2716
Published: 2009-08-10
Description: The plugin functionality in Sun Java SE 6 before Update 15 does not properly implement version selection, which allows context-dependent attackers to leverage vulnerabilities in "old zip and certificate handling" and have unspecified other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://java.sun.com/javase/6/webnotes/6u15.html; http://secunia.com/advisories/37386; http://secunia.com/advisories/37460
CVE: CVE-2009-2717
Published: 2009-08-10
Description: The Abstract Window Toolkit (AWT) implementation in Sun Java SE 6 before Update 15 on Windows 2000 Professional does not provide a Security Warning Icon, which makes it easier for context-dependent attackers to trick a user into interacting unsafely with an untrusted applet.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://java.sun.com/javase/6/webnotes/6u15.html; http://java.sun.com/javase/6/webnotes/6u15.html
CVE: CVE-2009-2718
Published: 2009-08-10
Description: The Abstract Window Toolkit (AWT) implementation in Sun Java SE 6 before Update 15 on X11 does not impose the intended constraint on distance from the window border to the Security Warning Icon, which makes it easier for context-dependent attackers to trick a user into interacting unsafely with an untrusted applet.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://java.sun.com/javase/6/webnotes/6u15.html; http://secunia.com/advisories/37386; http://secunia.com/advisories/37460