deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-0840
Published: 2010-04-01
Description: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information was obtained from the March 2010 CPU.  Oracle has not commented on claims from a reliable researcher that this is related to improper checks when executing privileged methods in the Java Runtime Environment (JRE), which allows attackers to execute arbitrary code via (1) an untrusted object that extends the trusted class but has not modified a certain method, or (2) "a similar trust issue with interfaces," aka "Trusted Methods Chaining Remote Code Execution Vulnerability."
CVSS Score: 9.8 (CRITICAL)
References: http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751; http://lists.apple.com/archives/security-announce/2010//May/msg00001.html; http://lists.apple.com/archives/security-announce/2010//May/msg00002.html
CVE: CVE-2010-0841
Published: 2010-04-01
Description: Unspecified vulnerability in the ImageIO component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information was obtained from the March 2010 CPU.  Oracle has not commented on claims from a reliable researcher that this is an integer overflow in the Java Runtime Environment that allows remote attackers to execute arbitrary code via a JPEG image that contains subsample dimensions with large values, related to JPEGImageReader and "stepX".
CVSS Score: 7.5 (HIGH)
References: http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751; http://lists.apple.com/archives/security-announce/2010//May/msg00001.html; http://lists.apple.com/archives/security-announce/2010//May/msg00002.html
CVE: CVE-2010-0842
Published: 2010-04-01
Description: Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information was obtained from the March 2010 CPU.  Oracle has not commented on claims from a reliable researcher that this is an uncontrolled array index that allows remote attackers to execute arbitrary code via a MIDI file with a crafted MixerSequencer object, related to the GM_Song structure.
CVSS Score: 7.5 (HIGH)
References: http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751; http://lists.apple.com/archives/security-announce/2010//May/msg00001.html; http://lists.apple.com/archives/security-announce/2010//May/msg00002.html
CVE: CVE-2010-0843
Published: 2010-04-01
Description: Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information was obtained from the March 2010 CPU.  Oracle has not commented on claims from a reliable researcher that this is related to XNewPtr and improper handling of an integer parameter when allocating heap memory in the com.sun.media.sound libraries, which allows remote attackers to execute arbitrary code.
CVSS Score: 7.5 (HIGH)
References: http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751; http://lists.apple.com/archives/security-announce/2010//May/msg00001.html; http://lists.apple.com/archives/security-announce/2010//May/msg00002.html
CVE: CVE-2010-0844
Published: 2010-04-01
Description: Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information was obtained from the March 2010 CPU.  Oracle has not commented on claims from a reliable researcher that this is for improper parsing of a crafted MIDI stream when creating a MixerSequencer object, which causes a pointer to be corrupted and allows a NULL byte to be written to arbitrary memory.
CVSS Score: 7.5 (HIGH)
References: http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751; http://lists.apple.com/archives/security-announce/2010//May/msg00001.html; http://lists.apple.com/archives/security-announce/2010//May/msg00002.html
CVE: CVE-2010-0845
Published: 2010-04-01
Description: Unspecified vulnerability in the HotSpot Server component in Oracle Java SE and Java for Business 6 Update 18, 5.0, Update, and 23 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
CVSS Score: 5.1 (MEDIUM)
References: http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751; http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html
CVE: CVE-2010-0846
Published: 2010-04-01
Description: Unspecified vulnerability in the ImageIO component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information was obtained from the March 2010 CPU.  Oracle has not commented on claims from a reliable researcher that this is a heap-based buffer overflow that allows remote attackers to execute arbitrary code, related to an "invalid assignment" and inconsistent length values in a JPEG image encoder (JPEGImageEncoderImpl).
CVSS Score: 7.5 (HIGH)
References: http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751; http://lists.apple.com/archives/security-announce/2010//May/msg00001.html; http://lists.apple.com/archives/security-announce/2010//May/msg00002.html
CVE: CVE-2010-0847
Published: 2010-04-01
Description: Unspecified vulnerability in the Java 2D component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information was obtained from the March 2010 CPU.  Oracle has not commented on claims from a reliable researcher that this is a heap-based buffer overflow that allows arbitrary code execution via a crafted image.
CVSS Score: 7.5 (HIGH)
References: http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=865; http://lists.apple.com/archives/security-announce/2010//May/msg00001.html
CVE: CVE-2010-0848
Published: 2010-04-01
Description: Unspecified vulnerability in the Java 2D component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751; http://lists.apple.com/archives/security-announce/2010//May/msg00001.html; http://lists.apple.com/archives/security-announce/2010//May/msg00002.html
CVE: CVE-2010-0849
Published: 2010-04-01
Description: Unspecified vulnerability in the Java 2D component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information was obtained from the March 2010 CPU.  Oracle has not commented on claims from a reliable researcher that this is a heap-based buffer overflow in a decoding routine used by the JPEGImageDecoderImpl interface, which allows code execution via a crafted JPEG image.
CVSS Score: 7.5 (HIGH)
References: http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751; http://lists.apple.com/archives/security-announce/2010//May/msg00001.html; http://lists.apple.com/archives/security-announce/2010//May/msg00002.html
CVE: CVE-2010-0850
Published: 2010-04-01
Description: Unspecified vulnerability in the Java 2D component in Oracle Java SE and Java for Business 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751; http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2253&w=2
CVE: CVE-2009-2277
Published: 2010-04-01
Description: Cross-site scripting (XSS) vulnerability in WebAccess in VMware VirtualCenter 2.0.2 and 2.5 and VMware ESX 3.0.3 and 3.5 allows remote attackers to inject arbitrary web script or HTML via vectors related to "context data."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.vmware.com/pipermail/security-announce/2010/000086.html; http://www.securityfocus.com/bid/39037; http://www.vmware.com/security/advisories/VMSA-2010-0005.html
CVE: CVE-2010-0686
Published: 2010-04-01
Description: WebAccess in VMware VirtualCenter 2.0.2 and 2.5, VMware Server 2.0, and VMware ESX 3.0.3 and 3.5 allows remote attackers to leverage proxy-server functionality to spoof the origin of requests via unspecified vectors, related to a "URL forwarding vulnerability."
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.vmware.com/pipermail/security-announce/2010/000086.html; http://www.securityfocus.com/bid/39037; http://www.securitytracker.com/id?1023769
CVE: CVE-2010-0768
Published: 2010-04-01
Description: Cross-site scripting (XSS) vulnerability in the Administration Console in IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.41, 6.1 before 6.1.0.31, and 7.0 before 7.0.0.9 allows remote attackers to inject arbitrary web script or HTML via the URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/39140; http://www-01.ibm.com/support/docview.wss?uid=swg1PK97376; http://www.securityfocus.com/bid/39051
CVE: CVE-2010-0769
Published: 2010-04-01
Description: IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.41, 6.1 before 6.1.0.31, and 7.0 before 7.0.0.9 does not properly define wsadmin scripting J2CConnectionFactory objects, which allows local users to discover a KeyRingPassword password by reading a cleartext field in the resources.xml file.
CVSS Score: 1.9 (LOW)
CWE: CWE-255
References: http://secunia.com/advisories/39140; http://www-01.ibm.com/support/docview.wss?uid=swg1PK95089; https://exchange.xforce.ibmcloud.com/vulnerabilities/57185
CVE: CVE-2010-0770
Published: 2010-04-01
Description: IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.41, 6.1 before 6.1.0.31, and 7.0 before 7.0.0.9 allows remote authenticated users to cause a denial of service (ORB ListenerThread hang) by aborting an SSL handshake.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/39140; http://www-01.ibm.com/support/docview.wss?uid=swg1PK93653; http://www.securityfocus.com/bid/39056
CVE: CVE-2010-1031
Published: 2010-04-01
Description: Unspecified vulnerability in HP Insight Control for Linux (aka IC-Linux or ICE-LX) 2.11 and earlier allows local users to gain privileges via unknown vectors.
CVSS Score: 6.9 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6964&w=2; http://secunia.com/advisories/39227; http://securitytracker.com/id?1023771
CVE: CVE-2010-1137
Published: 2010-04-01
Description: Cross-site scripting (XSS) vulnerability in WebAccess in VMware VirtualCenter 2.0.2 and 2.5 and VMware ESX 3.0.3 and 3.5, and the Server Console in VMware Server 1.0, allows remote attackers to inject arbitrary web script or HTML via the name of a virtual machine.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.vmware.com/pipermail/security-announce/2010/000086.html; http://security.gentoo.org/glsa/glsa-201209-25.xml; http://www.securityfocus.com/bid/39037
CVE: CVE-2010-1193
Published: 2010-04-01
Description: Cross-site scripting (XSS) vulnerability in WebAccess in VMware Server 2.0 allows remote attackers to inject arbitrary web script or HTML via vectors related to JSON error messages.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.vmware.com/pipermail/security-announce/2010/000086.html; http://www.securityfocus.com/bid/39037; http://www.securitytracker.com/id?1023769
CVE: CVE-2010-1224
Published: 2010-04-01
Description: main/acl.c in Asterisk Open Source 1.6.0.x before 1.6.0.25, 1.6.1.x before 1.6.1.17, and 1.6.2.x before 1.6.2.5 does not properly enforce remote host access controls when CIDR notation "/0" is used in permit= and deny= configuration rules, which causes an improper arithmetic shift and might allow remote attackers to bypass ACL rules and access services from unauthorized hosts.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.0.diff; http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.1.diff; http://downloads.asterisk.org/pub/security/AST-2010-003-1.6.2.diff
CVE: CVE-2010-1225
Published: 2010-04-01
Description: The memory-management implementation in the Virtual Machine Monitor (aka VMM or hypervisor) in Microsoft Virtual PC 2007 Gold and SP1, Virtual Server 2005 Gold and R2 SP1, and Windows Virtual PC does not properly restrict access from the guest OS to memory locations in the VMM work area, which allows context-dependent attackers to bypass certain anti-exploitation protection mechanisms on the guest OS via crafted input to a vulnerable application.  NOTE: the vendor reportedly found that only systems with an otherwise vulnerable application are affected, because "the memory areas accessible from the guest cannot be leveraged to achieve either remote code execution or elevation of privilege and ... no data from the host is exposed to the guest OS."
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://securitytracker.com/id?1023720; http://www.coresecurity.com/content/virtual-pc-2007-hypervisor-memory-protection-bug; http://www.securityfocus.com/archive/1/510154/100/0/threaded
CVE: CVE-2010-1226
Published: 2010-04-01
Description: The HTTP client functionality in Apple iPhone OS 3.1 on the iPhone 2G and 3.1.3 on the iPhone 3GS allows remote attackers to cause a denial of service (Safari, Mail, or Springboard crash) via a crafted innerHTML property of a DIV element, related to a "malformed character" issue.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.exploit-db.com/exploits/11769; http://www.securityfocus.com/bid/38758; http://www.exploit-db.com/exploits/11769
CVE: CVE-2010-1227
Published: 2010-04-01
Description: Cross-site scripting (XSS) vulnerability in Sun Java System Communications Express 6.2 and 6.3 allows remote attackers to inject arbitrary web script or HTML via the subject field of a message, as demonstrated by a subject containing an IMG element with a SRC attribute that performs a cross-site request forgery (CSRF) attack involving the cmd and argv parameters to cmd.msc.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/42990; http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html; http://www.securityfocus.com/archive/1/510154/100/0/threaded
CVE: CVE-2010-1228
Published: 2010-04-01
Description: Multiple race conditions in the sandbox infrastructure in Google Chrome before 4.1.249.1036 have unspecified impact and attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-362
References: http://code.google.com/p/chromium/issues/detail?id=28804; http://code.google.com/p/chromium/issues/detail?id=31880; http://googlechromereleases.blogspot.com/2010/03/stable-channel-update.html
CVE: CVE-2010-1229
Published: 2010-04-01
Description: The sandbox infrastructure in Google Chrome before 4.1.249.1036 does not properly use pointers, which has unspecified impact and attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://code.google.com/p/chromium/issues/detail?id=28804; http://code.google.com/p/chromium/issues/detail?id=31880; http://googlechromereleases.blogspot.com/2010/03/stable-channel-update.html
CVE: CVE-2010-1230
Published: 2010-04-01
Description: Google Chrome before 4.1.249.1036 does not have the expected behavior for attempts to delete Web SQL Databases and clear the Strict Transport Security (STS) state, which has unspecified impact and attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-200
References: http://code.google.com/p/chromium/issues/detail?id=30801; http://code.google.com/p/chromium/issues/detail?id=33445; http://googlechromereleases.blogspot.com/2010/03/stable-channel-update.html
CVE: CVE-2010-1231
Published: 2010-04-01
Description: Google Chrome before 4.1.249.1036 processes HTTP headers before invoking the SafeBrowsing feature, which allows remote attackers to have an unspecified impact via crafted headers.
CVSS Score: 7.5 (HIGH)
References: http://code.google.com/p/chromium/issues/detail?id=33572; http://googlechromereleases.blogspot.com/2010/03/stable-channel-update.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14332
CVE: CVE-2010-1232
Published: 2010-04-01
Description: Google Chrome before 4.1.249.1036 allows remote attackers to cause a denial of service (memory error) or possibly have unspecified other impact via a malformed SVG document.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://code.google.com/p/chromium/issues/detail?id=34978; http://googlechromereleases.blogspot.com/2010/03/stable-channel-update.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14000
CVE: CVE-2010-1233
Published: 2010-04-01
Description: Multiple integer overflows in Google Chrome before 4.1.249.1036 allow remote attackers to have an unspecified impact via vectors involving WebKit JavaScript objects.
CVSS Score: 10.0 (HIGH)
CWE: CWE-190
References: http://code.google.com/p/chromium/issues/detail?id=35724; http://googlechromereleases.blogspot.com/2010/03/stable-channel-update.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
CVE: CVE-2010-1234
Published: 2010-04-01
Description: Unspecified vulnerability in Google Chrome before 4.1.249.1036 allows remote attackers to truncate the URL shown in the HTTP Basic Authentication dialog via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://code.google.com/p/chromium/issues/detail?id=36772; http://googlechromereleases.blogspot.com/2010/03/stable-channel-update.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14275
CVE: CVE-2010-1235
Published: 2010-04-01
Description: Unspecified vulnerability in Google Chrome before 4.1.249.1036 allows remote attackers to trigger the omission of a download warning dialog via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://code.google.com/p/chromium/issues/detail?id=37007; http://googlechromereleases.blogspot.com/2010/03/stable-channel-update.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14297
CVE: CVE-2010-1236
Published: 2010-04-01
Description: The protocolIs function in platform/KURLGoogle.cpp in WebCore in WebKit before r55822, as used in Google Chrome before 4.1.249.1036 and Flock Browser 3.x before 3.0.0.4112, does not properly handle whitespace at the beginning of a URL, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted javascript: URL, as demonstrated by a \x00javascript:alert sequence.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://code.google.com/p/chromium/issues/detail?id=37383; http://codereview.chromium.org/858001; http://flock.com/security/
CVE: CVE-2010-1237
Published: 2010-04-01
Description: Google Chrome 4.1 BETA before 4.1.249.1036 allows remote attackers to cause a denial of service (memory error) or possibly have unspecified other impact via an empty SVG element.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://code.google.com/p/chromium/issues/detail?id=37061; http://googlechromereleases.blogspot.com/2010/03/stable-channel-update.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14374
CVE: CVE-2000-1245
Published: 2010-04-05
Description: Multiple unspecified vulnerabilities in NWFTPD.nlm before 5.01o in the FTP server in Novell NetWare 5.1 SP3 allow remote attackers to bypass intended restrictions on anonymous access via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.novell.com/support/viewContent.do?externalId=3238588&sliceId=1; http://www.novell.com/support/viewContent.do?externalId=3238588&sliceId=1
CVE: CVE-2000-1246
Published: 2010-04-05
Description: NWFTPD.nlm before 5.01o in the FTP server in Novell NetWare 5.1 SP3 allows remote authenticated users to cause a denial of service (abend) by sending an RNTO command after a failed RNFR command.
CVSS Score: 3.5 (LOW)
CWE: CWE-119
References: http://www.novell.com/support/viewContent.do?externalId=3238588&sliceId=1; http://www.novell.com/support/viewContent.do?externalId=3238588&sliceId=1
CVE: CVE-2001-1587
Published: 2010-04-05
Description: NWFTPD.nlm before 5.01w in the FTP server in Novell NetWare allows remote attackers to cause a denial of service (abend) via an anonymous STOU command.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://www.novell.com/support/viewContent.do?externalId=3238588&sliceId=1; http://www.novell.com/support/viewContent.do?externalId=3238588&sliceId=1
CVE: CVE-2002-2432
Published: 2010-04-05
Description: Unspecified vulnerability in NWFTPD.nlm before 5.03b in the FTP server in Novell NetWare allows remote attackers to cause a denial of service (abend) via a crafted username.
CVSS Score: 5.0 (MEDIUM)
References: http://www.novell.com/support/viewContent.do?externalId=3238588&sliceId=1; http://www.novell.com/support/viewContent.do?externalId=3238588&sliceId=1
CVE: CVE-2002-2433
Published: 2010-04-05
Description: NWFTPD.nlm before 5.03b in the FTP server in Novell NetWare allows remote authenticated users to cause a denial of service (abend) via a crafted ABOR command.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://www.novell.com/support/viewContent.do?externalId=3238588&sliceId=1; http://www.novell.com/support/viewContent.do?externalId=3238588&sliceId=1
CVE: CVE-2002-2434
Published: 2010-04-05
Description: NWFTPD.nlm before 5.02i in the FTP server in Novell NetWare does not properly listen for data connections, which allows remote attackers to cause a denial of service (abend) via multiple FTP sessions.
CVSS Score: 5.0 (MEDIUM)
References: http://www.novell.com/support/viewContent.do?externalId=3238588&sliceId=1; http://www.novell.com/support/viewContent.do?externalId=3238588&sliceId=1
CVE: CVE-2003-1591
Published: 2010-04-05
Description: NWFTPD.nlm in the FTP server in Novell NetWare 6.0 before SP4 and 6.5 before SP1 allows user-assisted remote attackers to cause a denial of service (console hang) via a large number of FTP sessions, which are not properly handled during an NLM unload.
CVSS Score: 4.3 (MEDIUM)
References: http://www.novell.com/support/viewContent.do?externalId=3238588&sliceId=1; http://www.novell.com/support/viewContent.do?externalId=3238588&sliceId=1
CVE: CVE-2003-1592
Published: 2010-04-05
Description: Multiple buffer overflows in NWFTPD.nlm in the FTP server in Novell NetWare 6.0 before SP4 and 6.5 before SP1 allow remote attackers to cause a denial of service (abend) via a long (1) username or (2) password.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://www.novell.com/support/viewContent.do?externalId=3238588&sliceId=1; http://www.novell.com/support/viewContent.do?externalId=3238588&sliceId=1
CVE: CVE-2003-1593
Published: 2010-04-05
Description: NWFTPD.nlm in the FTP server in Novell NetWare 6.0 before SP4 and 6.5 before SP1 does not enforce domain-name login restrictions, which allows remote attackers to bypass intended access control via an FTP connection.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.novell.com/support/viewContent.do?externalId=3238588&sliceId=1; http://www.novell.com/support/viewContent.do?externalId=3238588&sliceId=1