deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-4196
Published: 2008-09-27
Description: Cross-site scripting (XSS) vulnerability in Opera before 9.52 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.gentoo.org/show_bug.cgi?id=235298; http://secunia.com/advisories/31549; http://secunia.com/advisories/32538
CVE: CVE-2008-4197
Published: 2008-09-27
Description: Opera before 9.52 on Windows, Linux, FreeBSD, and Solaris, when processing custom shortcut and menu commands, can produce argument strings that contain uninitialized memory, which might allow user-assisted remote attackers to execute arbitrary code or conduct other attacks via vectors related to activation of a shortcut.
CVSS Score: 8.8 (HIGH)
CWE: CWE-908
References: http://bugs.gentoo.org/show_bug.cgi?id=235298; http://secunia.com/advisories/31549; http://secunia.com/advisories/32538
CVE: CVE-2008-4198
Published: 2008-09-27
Description: Opera before 9.52, when rendering an http page that has loaded an https page into a frame, displays a padlock icon and offers a security information dialog reporting a secure connection, which might allow remote attackers to trick a user into performing unsafe actions on the http page.
CVSS Score: 5.0 (MEDIUM)
References: http://bugs.gentoo.org/show_bug.cgi?id=235298; http://secunia.com/advisories/31549; http://secunia.com/advisories/32538
CVE: CVE-2008-4199
Published: 2008-09-27
Description: Opera before 9.52 does not prevent use of links from web pages to feed source files on the local disk, which might allow remote attackers to determine the validity of local filenames via vectors involving "detection of JavaScript events and appropriate manipulation."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://bugs.gentoo.org/show_bug.cgi?id=235298; http://secunia.com/advisories/31549; http://secunia.com/advisories/32538
CVE: CVE-2008-4200
Published: 2008-09-27
Description: Opera before 9.52 does not ensure that the address field of a news feed represents the feed's actual URL, which allows remote attackers to change this field to display the URL of a page containing web script controlled by the attacker.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: http://bugs.gentoo.org/show_bug.cgi?id=235298; http://secunia.com/advisories/31549; http://secunia.com/advisories/32538
CVE: CVE-2008-4292
Published: 2008-09-27
Description: Opera before 9.52 does not check the CRL override upon encountering a certificate that lacks a CRL, which has unknown impact and attack vectors.  NOTE: it is not clear whether this is a vulnerability, but the vendor included it in a security section of the advisory.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://bugs.gentoo.org/show_bug.cgi?id=235298; http://my.opera.com/community/forums/topic.dml?id=241988&t=[PII_REDACTED]&page=1; http://my.opera.com/yngve/blog/2008/06/27/nobody-checks-the-padlock-debunked-by-opera-users
CVE: CVE-2008-4293
Published: 2008-09-27
Description: Unspecified vulnerability in Opera before 9.52 on Windows, when registered as a protocol handler, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors in which Opera is launched by other applications.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/31549; http://www.opera.com/docs/changelogs/windows/952/; http://www.opera.com/support/search/view/892/
CVE: CVE-2008-4294
Published: 2008-09-27
Description: IBM Tivoli Netcool/Webtop 2.1 before 2.1.0.5 preserves cached user privileges after logout, which allows physically proximate attackers to hijack a session by visiting an unattended workstation, as demonstrated by a root session that is still valid after a subsequent read-only session has begun.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/32036; http://www-01.ibm.com/support/docview.wss?uid=swg24018932; http://www-1.ibm.com/support/docview.wss?uid=swg1IZ21888
CVE: CVE-2008-4295
Published: 2008-09-27
Description: Microsoft Windows Mobile 6.0 on HTC Wiza 200 and HTC MDA 8125 devices does not properly handle the first attempt to establish a Bluetooth connection to a peer with a long name, which allows remote attackers to cause a denial of service (device reboot) by configuring a Bluetooth device with a long hci name and (1) connecting directly to the Windows Mobile system or (2) waiting for the Windows Mobile system to scan for nearby devices.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/32066; http://www.securityfocus.com/bid/31420; https://exchange.xforce.ibmcloud.com/vulnerabilities/45463
CVE: CVE-2008-4296
Published: 2008-09-27
Description: The Cisco Linksys WRT350N with firmware 1.0.3.7 has "admin" as its default password for the "admin" account, which makes it easier for remote attackers to obtain access.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://securityreason.com/securityalert/4319; http://www.securityfocus.com/archive/1/496756/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/45588
CVE: CVE-2008-4297
Published: 2008-09-27
Description: Mercurial before 1.0.2 does not enforce the allowpull permission setting for a pull operation from hgweb, which allows remote attackers to read arbitrary files from a repository via an "hg pull" request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00004.html; http://marc.info/?l=oss-security&m=[PII_REDACTED]3798&w=2; http://secunia.com/advisories/32182
CVE: CVE-2008-4298
Published: 2008-09-27
Description: Memory leak in the http_request_parse function in request.c in lighttpd before 1.4.20 allows remote attackers to cause a denial of service (memory consumption) via a large number of requests with duplicate request headers.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://bugs.gentoo.org/show_bug.cgi?id=238180; http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html; http://secunia.com/advisories/32069
CVE: CVE-2008-2474
Published: 2008-09-29
Description: Buffer overflow in x87 before 3.5.5 in ABB Process Communication Unit 400 (PCU400) 4.4 through 4.6 allows remote attackers to execute arbitrary code via a crafted packet using the (1) IEC60870-5-101 or (2) IEC60870-5-104 communication protocol to the X87 web interface.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/32047; http://securityreason.com/securityalert/4320; http://www.kb.cert.org/vuls/id/343971
CVE: CVE-2008-3524
Published: 2008-09-29
Description: rc.sysinit in initscripts before 8.76.3-1 on Fedora 9 and other Linux platforms allows local users to delete arbitrary files via a symlink attack on a file or directory under (1) /var/lock or (2) /var/run.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-59
References: http://secunia.com/advisories/32037; http://secunia.com/advisories/32710; http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0318
CVE: CVE-2008-4120
Published: 2008-09-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in FlatPress 0.804 allow remote attackers to inject arbitrary web script or HTML via the (1) user or (2) pass parameter to login.php, or the (3) name parameter to contact.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/4324; http://sourceforge.net/project/shownotes.php?group_id=157089&release_id=628765_id=628765; http://www.datensalat.eu/~fabian/cve/CVE-2008-4120-flatpress.html
CVE: CVE-2008-4192
Published: 2008-09-29
Description: The pserver_shutdown function in fence_egenera in cman 2.20080629 and 2.20080801 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/eglog temporary file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496410; http://dev.gentoo.org/~rbu/security/debiantemp/cman; http://secunia.com/advisories/31887
CVE: CVE-2008-4210
Published: 2008-09-29
Description: fs/open.c in the Linux kernel before 2.6.22 does not properly strip setuid and setgid bits when there is a write to a file, which allows local users to gain the privileges of a different group, and obtain sensitive information or possibly have unspecified other impact, by creating an executable file in a setgid directory through the (1) truncate or (2) ftruncate function in conjunction with memory-mapped I/O.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://bugzilla.kernel.org/show_bug.cgi?id=8420; http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.26.y.git%3Ba=commit%3Bh=7b82dc0e64e93f430182f36b46b79fcee87d3532; http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.22
CVE: CVE-2008-4299
Published: 2008-09-29
Description: A certain ActiveX control in the Microsoft Internet Authentication Service (IAS) Helper COM Component in iashlpr.dll allows remote attackers to cause a denial of service (browser crash) via a large integer value in the first argument to the PutProperty method.  NOTE: this issue was disclosed by an unreliable researcher, so it might be incorrect.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://securityreason.com/securityalert/4323; http://www.securityfocus.com/archive/1/496695/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/45556
CVE: CVE-2008-4300
Published: 2008-09-29
Description: A certain ActiveX control in adsiis.dll in Microsoft Internet Information Services (IIS) allows remote attackers to cause a denial of service (browser crash) via a long string in the second argument to the GetObject method.  NOTE: this issue was disclosed by an unreliable researcher, so it might be incorrect.
CVSS Score: 5.0 (MEDIUM)
References: http://securityreason.com/securityalert/4325; http://www.securityfocus.com/archive/1/496696/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/45584
CVE: CVE-2008-4301
Published: 2008-09-29
Description: A certain ActiveX control in iisext.dll in Microsoft Internet Information Services (IIS) allows remote attackers to set a password via a string argument to the SetPassword method.  NOTE: this issue could not be reproduced by a reliable third party.  In addition, the original researcher is unreliable.  Therefore the original disclosure is probably erroneous
CVSS Score: 10.0 (HIGH)
References: http://www.attrition.org/pipermail/vim/2008-October/002081.html; http://www.securityfocus.com/archive/1/496694/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/45587
CVE: CVE-2008-4302
Published: 2008-09-29
Description: fs/splice.c in the splice subsystem in the Linux kernel before 2.6.22.2 does not properly handle a failure of the add_to_page_cache_lru function, and subsequently attempts to unlock a page that was not locked, which allows local users to cause a denial of service (kernel BUG and system crash), as demonstrated by the fio I/O tool.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.26.y.git%3Ba=commit%3Bh=6a860c979b35469e4d77da781a96bdb2ca05ae64; http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.22.2; http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html
CVE: CVE-2008-4318
Published: 2008-09-29
Description: Observer 0.3.2.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the query parameter to (1) whois.php or (2) netcmd.php.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://securityreason.com/securityalert/4322; https://exchange.xforce.ibmcloud.com/vulnerabilities/45398; https://www.exploit-db.com/exploits/6559
CVE: CVE-2008-4319
Published: 2008-09-29
Description: fileadmin.php in Libra File Manager (aka Libra PHP File Manager) 1.18 and earlier allows remote attackers to bypass authentication, and read arbitrary files, modify arbitrary files, and list arbitrary directories, by inserting certain user and isadmin parameters in the query string.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-287
References: http://www.securityfocus.com/archive/1/496742; http://www.securityfocus.com/bid/31415; https://exchange.xforce.ibmcloud.com/vulnerabilities/45423
CVE: CVE-2008-4320
Published: 2008-09-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in OpenNMS before 1.5.94 allow remote attackers to inject arbitrary web script or HTML via (1) the j_username parameter to j_acegi_security_check, (2) the username parameter to notification/list.jsp, and (3) the filter parameter to event/list.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugzilla.opennms.org/show_bug.cgi?id=2631; http://bugzilla.opennms.org/show_bug.cgi?id=2633; http://bugzilla.opennms.org/show_bug.cgi?id=2634
CVE: CVE-2008-3827
Published: 2008-09-29
Description: Multiple integer underflows in the Real demuxer (demux_real.c) in MPlayer 1.0_rc2 and earlier allow remote attackers to cause a denial of service (process termination) and possibly execute arbitrary code via a crafted video file that causes the stream_read function to read or write arbitrary memory.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://secunia.com/advisories/32045; http://secunia.com/advisories/32153; http://securityreason.com/securityalert/4326
CVE: CVE-2008-4321
Published: 2008-09-29
Description: Buffer overflow in FlashGet (formerly JetCar) FTP 1.9 allows remote FTP servers to execute arbitrary code via a long response to the PWD command.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/31481; http://securityreason.com/securityalert/4327; http://www.securityfocus.com/bid/30685
CVE: CVE-2008-4322
Published: 2008-09-29
Description: Stack-based buffer overflow in RealFlex Technologies Ltd. RealWin Server 2.0, as distributed by DATAC, allows remote attackers to execute arbitrary code via a crafted FC_INFOTAG/SET_CONTROL packet.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://reversemode.com/index.php?option=com_content&task=view&id=55&Itemid=1; http://secunia.com/advisories/32055; http://www.kb.cert.org/vuls/id/976484
CVE: CVE-2008-4323
Published: 2008-09-29
Description: Windows Explorer in Microsoft Windows XP SP3 allows user-assisted attackers to cause a denial of service (application crash) via a crafted .ZIP file.
CVSS Score: 4.3 (MEDIUM)
References: https://www.exploit-db.com/exploits/6616; https://www.exploit-db.com/exploits/6616
CVE: CVE-2008-4324
Published: 2008-09-29
Description: The user interface event dispatcher in Mozilla Firefox 3.0.3 on Windows XP SP2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a series of keypress, click, onkeydown, onkeyup, onmousedown, and onmouseup events.  NOTE: it was later reported that Firefox 3.0.2 on Mac OS X 10.5 is also affected.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://evilfingers.com/advisory/Firefox_User_Interface_Null_Pointer_Dereference_Dispatcher_Crash_n_Remote_DoS.php; http://secunia.com/advisories/32040; http://securityreason.com/securityalert/4321
CVE: CVE-2008-4325
Published: 2008-09-30
Description: lib/viewvc.py in ViewVC 1.0.5 uses the content-type parameter in the HTTP request for the Content-Type header in the HTTP response, which allows remote attackers to cause content to be misinterpreted by the browser via a content-type parameter that is inconsistent with the requested object.  NOTE: this issue might not be a vulnerability, since it requires attacker access to the repository that is being viewed.
CVSS Score: 5.8 (MEDIUM)
References: http://viewvc.tigris.org/issues/show_bug.cgi?id=354; http://viewvc.tigris.org/source/browse/viewvc/trunk/lib/viewvc.py?rev=2011&r1=1968&r2=1978; http://viewvc.tigris.org/source/browse/viewvc?rev=1978&view=rev
CVE: CVE-2008-4326
Published: 2008-09-30
Description: The PMA_escapeJsString function in libraries/js_escape.lib.php in phpMyAdmin before 2.11.9.2, when Internet Explorer is used, allows remote attackers to bypass cross-site scripting (XSS) protection mechanisms and conduct XSS attacks via a NUL byte inside a "</script" sequence.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN54824688/index.html; http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000061.html; http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html
CVE: CVE-2008-4327
Published: 2008-09-30
Description: gdiplus.dll in GDI+ in Microsoft Windows XP SP3 does not properly handle crafted .ico files, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a certain crash.ico file on a web site, and allows user-assisted attackers to cause a denial of service (divide-by-zero error and persistent application crash) via this crash.ico file on the desktop, a different vulnerability than CVE-2007-2237.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://www.securityfocus.com/bid/31432; https://exchange.xforce.ibmcloud.com/vulnerabilities/45464; https://www.exploit-db.com/exploits/6588
CVE: CVE-2008-4094
Published: 2008-09-30
Description: Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) :limit and (2) :offset parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://blog.innerewut.de/2008/6/16/why-you-should-upgrade-to-rails-2-1; http://gist.github.com/8946; http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.html
CVE: CVE-2008-4328
Published: 2008-09-30
Description: SQL injection vulnerability in site_search.php in EasyRealtorPRO 2008 allows remote attackers to execute arbitrary SQL commands via the (1) item, (2) search_ordermethod, and (3) search_order parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4337; http://www.davidsopas.com/2008/09/sql-injection-in-easyrealtorpro/; http://www.securityfocus.com/archive/1/496744/100/0/threaded
CVE: CVE-2008-4329
Published: 2008-09-30
Description: PHP remote file inclusion vulnerability in cms/system/openengine.php in openEngine 2.0 beta4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the oe_classpath parameter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/31413; https://exchange.xforce.ibmcloud.com/vulnerabilities/45435; https://www.exploit-db.com/exploits/6571
CVE: CVE-2008-4330
Published: 2008-09-30
Description: Directory traversal vulnerability in index.php in LanSuite 3.3.2 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the design parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/31402; https://exchange.xforce.ibmcloud.com/vulnerabilities/45583; https://www.exploit-db.com/exploits/6562
CVE: CVE-2008-4331
Published: 2008-09-30
Description: Directory traversal vulnerability in library/pagefunctions.inc.php in phpOCS 0.1 beta3 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the act parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/31392; https://exchange.xforce.ibmcloud.com/vulnerabilities/45424; https://www.exploit-db.com/exploits/6563
CVE: CVE-2008-4332
Published: 2008-09-30
Description: SQL injection vulnerability in the showjavatopic function in func.php in PHP infoBoard V.7 Plus allows remote attackers to execute arbitrary SQL commands via the idcat parameter to showtopic.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31977; http://www.securityfocus.com/bid/31405; https://exchange.xforce.ibmcloud.com/vulnerabilities/45440
CVE: CVE-2008-4333
Published: 2008-09-30
Description: Cross-site scripting (XSS) vulnerability in PHP infoBoard V.7 Plus allows remote attackers to inject arbitrary web script or HTML via the isname parameter in a newtopic action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/31977; http://www.securityfocus.com/bid/31405; https://exchange.xforce.ibmcloud.com/vulnerabilities/45442
CVE: CVE-2008-4334
Published: 2008-09-30
Description: PHP infoBoard V.7 Plus allows remote attackers to bypass authentication and gain administrative access by setting the infouser cookie to 1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/31404; https://www.exploit-db.com/exploits/6568; http://www.securityfocus.com/bid/31404
CVE: CVE-2008-4335
Published: 2008-09-30
Description: SQL injection vulnerability in album.php in Atomic Photo Album (APA) 1.1.0pre4 allows remote attackers to execute arbitrary SQL commands via the apa_album_ID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/31409; http://www.vupen.com/english/advisories/2008/2691; https://exchange.xforce.ibmcloud.com/vulnerabilities/45433
CVE: CVE-2008-4336
Published: 2008-09-30
Description: Cross-site scripting (XSS) vulnerability in album.php in Atomic Photo Album (APA) 1.1.0pre4 allows remote attackers to inject arbitrary web script or HTML via the apa_album_ID parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/31409; https://exchange.xforce.ibmcloud.com/vulnerabilities/45432; https://www.exploit-db.com/exploits/6572
CVE: CVE-2008-4337
Published: 2008-09-30
Description: Cross-site scripting (XSS) vulnerability in Bitweaver 2.0.2 allows remote attackers to inject arbitrary web script or HTML via the URL parameter to (1) edit.php and (2) list.php in articles/; (3) list_blogs.php and (4) rankings.php in blogs/; (5) calendar/index.php; (6) calendar.php, (7) index.php, and (8) list_events.php in events/; (9) index.php and (10) list_galleries.php in fisheye/; (11) liberty/list_content.php; (12) newsletters/edition.php; (13) pigeonholes/list.php; (14) recommends/index.php; (15) rss/index.php; (16) stars/index.php; (17) users/remind_password.php; (18) wiki/orphan_pages.php; and (19) stats/index.php, different vectors than CVE-2007-0526 and CVE-2005-4379.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/32014; http://www.securityfocus.com/bid/31395; https://exchange.xforce.ibmcloud.com/vulnerabilities/45409
CVE: CVE-2008-4338
Published: 2008-09-30
Description: SQL injection vulnerability in the brilliant_gallery_checklist_save function in the bgchecklist/save script in Brilliant Gallery 5.x and 6.x, a module for Drupal, allows remote authenticated users with "access brilliant_gallery" permissions to execute arbitrary SQL commands via the (1) nid, (2) qid, (3) state, and possibly (4) user parameters.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-89
References: http://drupal.org/node/313054; http://lists.grok.org.uk/pipermail/full-disclosure/2008-September/064662.html; http://secunia.com/advisories/32015
CVE: CVE-2008-4339
Published: 2008-09-30
Description: Unspecified vulnerability in the Java Administration GUI (jnbSA) in Symantec Veritas NetBackup Server and NetBackup Enterprise Server 5.1 before MP7, 6.0 before MP7, and 6.5 before 6.5.2 allows remote authenticated users to gain privileges via unknown attack vectors related to "bpjava* binaries."
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://sunsolve.sun.com/search/document.do?assetkey=1-26-239908-1; http://www.securityfocus.com/bid/31221; http://www.securitytracker.com/id?1020928
CVE: CVE-2008-4340
Published: 2008-09-30
Description: Google Chrome 0.2.149.29 and 0.2.149.30 allows remote attackers to cause a denial of service (memory consumption) via an HTML document containing a carriage return ("\r\n\r\n") argument to the window.open function.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://secniche.org/gcrds.html; http://securityreason.com/securityalert/4339; http://www.securityfocus.com/archive/1/496688/100/0/threaded