deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-2124
Published: 2008-05-09
Description: SQL injection vulnerability in modules/print.asp in fipsASP fipsCMS allows remote attackers to execute arbitrary SQL commands via the lg parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30103; http://www.securityfocus.com/bid/29095; https://exchange.xforce.ibmcloud.com/vulnerabilities/42257
CVE: CVE-2008-2125
Published: 2008-05-09
Description: SQL injection vulnerability in viewalbums.php in Musicbox 2.3.6 and 2.3.7 allows remote attackers to execute arbitrary SQL commands via the artistId parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30107; http://www.securityfocus.com/bid/29100; https://exchange.xforce.ibmcloud.com/vulnerabilities/42259
CVE: CVE-2008-2126
Published: 2008-05-09
Description: Multiple cross-site scripting (XSS) vulnerabilities in Tux CMS 0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) q parameter to index.php and the (2) returnURL parameter to tux-login.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8967&w=2; http://osvdb.org/44917; http://secunia.com/advisories/30121
CVE: CVE-2008-2127
Published: 2008-05-09
Description: Cross-site scripting (XSS) vulnerability in search.php in CMS Faethon 2.2 Ultimate allows remote attackers to inject arbitrary web script or HTML via the what parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30098; http://www.securityfocus.com/bid/29099; https://exchange.xforce.ibmcloud.com/vulnerabilities/42258
CVE: CVE-2008-2128
Published: 2008-05-09
Description: PHP remote file inclusion vulnerability in templates/header.php in CMS Faethon 2.2 Ultimate allows remote attackers to execute arbitrary PHP code via a URL in the mainpath parameter, a different vulnerability than CVE-2006-5588 and CVE-2006-3185.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/42376; https://www.exploit-db.com/exploits/5558; https://exchange.xforce.ibmcloud.com/vulnerabilities/42376
CVE: CVE-2008-2129
Published: 2008-05-09
Description: SQL injection vulnerability in index.php in Galleristic 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the cat parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/30123; http://www.securityfocus.com/bid/29096; https://exchange.xforce.ibmcloud.com/vulnerabilities/42253
CVE: CVE-2008-2130
Published: 2008-05-09
Description: SQL injection vulnerability in poll_vote.php in iGaming CMS 1.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://downloads.securityfocus.com/vulnerabilities/exploits/29059.pl; http://www.securityfocus.com/bid/29059; https://exchange.xforce.ibmcloud.com/vulnerabilities/42229
CVE: CVE-2008-2131
Published: 2008-05-09
Description: Cross-site scripting (XSS) vulnerability in mvnForum 1.1 GA allows remote authenticated users to inject arbitrary web script or HTML via the topic field, which is later displayed by user/viewthread.jsp through use of the "quick reply button."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://mvnforum.cvs.sourceforge.net/mvnforum/mvnforum/srcweb/mvnplugin/mvnforum/user/viewthread.jsp?r1=1.316&r2=1.317; http://secunia.com/advisories/30091; http://securityreason.com/securityalert/3862
CVE: CVE-2008-2132
Published: 2008-05-09
Description: SQL injection vulnerability in step1.asp in Systementor PostcardMentor allows remote attackers to execute arbitrary SQL commands via the cat_fldAuto parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30127; http://www.securityfocus.com/bid/29094; https://exchange.xforce.ibmcloud.com/vulnerabilities/42256
CVE: CVE-2008-2133
Published: 2008-05-09
Description: Cross-site scripting (XSS) vulnerability in the Journal module in Tru-Zone Nuke ET 3.x allows remote attackers to inject arbitrary web script or HTML via the title parameter in a new entry, as demonstrated by a CSS property in the STYLE attribute of a DIV element, a different vulnerability than CVE-2008-1873.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30061; http://truzone.org/modules.php?name=Forums&file=viewtopic&t=55141; http://www.mrzayas.es/2008/05/04/multiples-vulnerabilidades-en-nuket-3x/
CVE: CVE-2008-2134
Published: 2008-05-09
Description: The Journal module in Tru-Zone Nuke ET 3.x allows remote attackers to obtain access to arbitrary user accounts, and alter or delete data, via a modified username in an unspecified cookie.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/30061; http://truzone.org/modules.php?name=Forums&file=viewtopic&p=332746; http://www.mrzayas.es/2008/05/04/multiples-vulnerabilidades-en-nuket-3x/
CVE: CVE-2008-2135
Published: 2008-05-09
Description: Multiple SQL injection vulnerabilities in VisualShapers ezContents 2.0.0 allow remote attackers to execute arbitrary SQL commands via the (1) contentname parameter to showdetails.php and the (2) article parameter to printer.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/3865; http://www.securityfocus.com/archive/1/491813/100/0/threaded; http://www.securityfocus.com/bid/29098
CVE: CVE-2008-1677
Published: 2008-05-12
Description: Buffer overflow in the regular expression handler in Red Hat Directory Server 8.0 and 7.1 before SP6 allows remote attackers to cause a denial of service (slapd crash) and possibly execute arbitrary code via a crafted LDAP query that triggers the overflow during translation to a regular expression.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: http://secunia.com/advisories/30181; http://secunia.com/advisories/30185; http://www.redhat.com/support/errata/RHSA-2008-0268.html
CVE: CVE-2008-1801
Published: 2008-05-12
Description: Integer underflow in the iso_recv_msg function (iso.c) in rdesktop 1.5.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a Remote Desktop Protocol (RDP) request with a small length field.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=696; http://rdesktop.cvs.sourceforge.net/rdesktop/rdesktop/iso.c?r1=1.19&r2=1.20&pathrev=HEAD; http://secunia.com/advisories/30118
CVE: CVE-2008-1802
Published: 2008-05-12
Description: Buffer overflow in the process_redirect_pdu (rdp.c) function in rdesktop 1.5.0 allows remote attackers to execute arbitrary code via a Remote Desktop Protocol (RDP) redirect request with modified length fields.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=697; http://rdesktop.cvs.sourceforge.net/rdesktop/rdesktop/rdp.c?r1=1.101&r2=1.102&pathrev=HEAD; http://secunia.com/advisories/30118
CVE: CVE-2008-1880
Published: 2008-05-12
Description: The default configuration of Firebird before 2.0.3.12981.0-r6 on Gentoo Linux sets the ISC_PASSWORD environment variable before starting Firebird, which allows remote attackers to bypass SYSDBA authentication and obtain sensitive database information via an empty password.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://bugs.gentoo.org/show_bug.cgi?id=216158; http://secunia.com/advisories/30162; http://security.gentoo.org/glsa/glsa-200805-06.xml
CVE: CVE-2008-2070
Published: 2008-05-12
Description: The WHM interface 11.15.0 for cPanel 11.18 before 11.18.4 and 11.22 before 11.22.3 allows remote attackers to bypass XSS protection and inject arbitrary script or HTML via repeated, improperly-ordered "<" and ">" characters in the (1) issue parameter to scripts2/knowlegebase, (2) user parameter to scripts2/changeip, (3) search parameter to scripts2/listaccts, and other unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://changelog.cpanel.net/?revision=0%3Btree=%3Btreeview=%3Bshow=html%3Bpp=25%3Bte=1314%3Bpg=2; http://lists.grok.org.uk/pipermail/full-disclosure/2008-May/062197.html; http://secunia.com/advisories/30166
CVE: CVE-2008-2071
Published: 2008-05-12
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the WHM interface 11.15.0 for cPanel 11.18 before 11.18.4 and 11.22 before 11.22.3 allow remote attackers to perform unauthorized actions as cPanel administrators via requests to cpanel/whm/webmail and other unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://changelog.cpanel.net/?revision=0%3Btree=%3Btreeview=%3Bshow=html%3Bpp=25%3Bte=1314%3Bpg=2; http://lists.grok.org.uk/pipermail/full-disclosure/2008-May/062197.html; http://secunia.com/advisories/30166
CVE: CVE-2008-2085
Published: 2008-05-12
Description: Multiple stack-based buffer overflows in the (1) get_remote_ip_media and (2) get_remote_ipv6_media functions in call.cpp in SIPp 3.1 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted SIP message.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=479039; http://secunia.com/advisories/30095; http://secunia.com/advisories/30993
CVE: CVE-2008-2138
Published: 2008-05-12
Description: Oracle Application Server (OracleAS) Portal 10g allows remote attackers to bypass intended access restrictions and read the contents of /dav_portal/portal/ by sending a request containing a trailing "%0A" (encoded line feed), then using the session ID that is generated from that request.  NOTE: as of 20080512, Oracle has not commented on the accuracy of this report.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/30140; http://securityreason.com/securityalert/3867; http://www.securityfocus.com/archive/1/491865/100/0/threaded
CVE: CVE-2008-2139
Published: 2008-05-12
Description: The rootpw plugin in rPath Appliance Platform Agent 2 and 3 does not re-validate requests from a browser with a valid administrator session, including requests to change the password, which makes it easier for physically proximate attackers to gain privileges and maintain control over the administrator account.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0148; https://exchange.xforce.ibmcloud.com/vulnerabilities/42393; https://exchange.xforce.ibmcloud.com/vulnerabilities/42394
CVE: CVE-2008-2140
Published: 2008-05-12
Description: Cross-site request forgery (CSRF) vulnerability in the rootpw plugin in rPath Appliance Platform Agent 2 and 3 allows remote attackers to reset the root password as the administrator via a crafted URL.
CVSS Score: 2.6 (LOW)
CWE: CWE-352
References: http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0148; https://exchange.xforce.ibmcloud.com/vulnerabilities/42393; http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0148
CVE: CVE-2008-2142
Published: 2008-05-12
Description: Emacs 21 and XEmacs automatically load and execute .flc (fast lock) files that are associated with other files that are edited within Emacs, which allows user-assisted attackers to execute arbitrary code.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.gnu.org/archive/html/emacs-devel/2008-05/msg00645.html; http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00001.html; http://secunia.com/advisories/30199
CVE: CVE-2008-2143
Published: 2008-05-12
Description: Unspecified versions of Microsoft Outlook Web Access (OWA) use the Cache-Control: no-cache HTTP directive instead of no-store, which might cause web browsers that follow RFC-2616 to cache sensitive information.
CVSS Score: 1.9 (LOW)
References: http://www.kb.cert.org/vuls/id/829876; http://www.securityfocus.com/bid/29121; https://exchange.xforce.ibmcloud.com/vulnerabilities/42301
CVE: CVE-2008-2144
Published: 2008-05-12
Description: Multiple unspecified vulnerabilities in Solaris print service for Sun Solaris 8, 9, and 10 allow remote attackers to cause a denial of service or execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/30184; http://secunia.com/advisories/30473; http://sunsolve.sun.com/search/document.do?assetkey=1-26-236884-1
CVE: CVE-2008-2145
Published: 2008-05-12
Description: Stack-based buffer overflow in Novell Client 4.91 SP4 and earlier allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long username in the "forgotten password" dialog.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/30126; http://securityreason.com/securityalert/3868; http://www.securityfocus.com/archive/1/491814/100/0/threaded
CVE: CVE-2008-2146
Published: 2008-05-12
Description: wp-includes/vars.php in Wordpress before 2.2.3 does not properly extract the current path from the PATH_INFO ($PHP_SELF), which allows remote attackers to bypass intended access restrictions for certain pages.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://osvdb.org/45188; http://trac.wordpress.org/changeset/6029; http://trac.wordpress.org/changeset?old_path=tags%2F2.2.2&old=6063&new_path=tags%2F2.2.3&new=6063#file10
CVE: CVE-2008-2147
Published: 2008-05-12
Description: Untrusted search path vulnerability in VideoLAN VLC before 0.9.0 allows local users to execute arbitrary code via a malicious library under the modules/ or plugins/ subdirectories of the current working directory.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://git.videolan.org/?p=vlc.git%3Ba=commit%3Bh=c7cef4fdd8dd72ce0a45be3cda8ba98df5e83181; http://secunia.com/advisories/31317; http://security.gentoo.org/glsa/glsa-200807-13.xml
CVE: CVE-2008-2148
Published: 2008-05-12
Description: The utimensat system call (sys_utimensat) in Linux kernel 2.6.22 and other versions before 2.6.25.3 does not check file permissions when certain UTIME_NOW and UTIME_OMIT combinations are used, which allows local users to modify file times of arbitrary files, possibly leading to a denial of service.
CVSS Score: 3.6 (LOW)
CWE: CWE-264
References: http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.25.y.git%3Ba=commit%3Bh=f9dfda1ad0637a89a64d001cf81478bd8d9b6306; http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.25.3; http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00006.html
CVE: CVE-2008-2149
Published: 2008-05-12
Description: Stack-based buffer overflow in the searchwn function in Wordnet 2.0, 2.1, and 3.0 might allow context-dependent attackers to execute arbitrary code via a long command line option.  NOTE: this issue probably does not cross privilege boundaries except in cases in which Wordnet is used as a back end.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/30242; http://secunia.com/advisories/31654; http://secunia.com/advisories/32184
CVE: CVE-2008-1803
Published: 2008-05-12
Description: Integer signedness error in the xrealloc function (rdesktop.c) in RDesktop 1.5.0 allows remote attackers to execute arbitrary code via unknown parameters that trigger a heap-based overflow.  NOTE: the role of the channel_process function was not specified by the original researcher.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=698; http://rdesktop.cvs.sourceforge.net/rdesktop/rdesktop/rdesktop.c?r1=1.161&r2=1.162&pathrev=HEAD; http://secunia.com/advisories/30118
CVE: CVE-2008-2004
Published: 2008-05-12
Description: The drive_init function in QEMU 0.9.1 determines the format of a raw disk image based on the header, which allows local guest users to read arbitrary files on the host by modifying the header to identify a different format, which is used when the guest is restarted.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: http://lists.gnu.org/archive/html/qemu-devel/2008-04/msg00675.html; http://secunia.com/advisories/29129; http://secunia.com/advisories/29963
CVE: CVE-2008-2159
Published: 2008-05-12
Description: Microsoft Internet Explorer 7 can save encrypted pages in the cache even when the DisableCachingOfSSLPages registry setting is enabled, which might allow local users to obtain sensitive information.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://secunia.com/advisories/30145; http://www.kb.cert.org/vuls/id/468843; http://www.securityfocus.com/bid/29120
CVE: CVE-2008-2160
Published: 2008-05-12
Description: Multiple unspecified vulnerabilities in the JPEG (GDI+) and GIF image processing in Microsoft Windows CE 5.0 allow remote attackers to execute arbitrary code via crafted (1) JPEG and (2) GIF images.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/30197; http://support.microsoft.com/kb/948812; http://www.securityfocus.com/bid/29147
CVE: CVE-2008-2161
Published: 2008-05-12
Description: Buffer overflow in TFTP Server SP 1.4 and 1.5 on Windows, and possibly other versions, allows remote attackers to execute arbitrary code via a long TFTP error packet.  NOTE: some of these details are obtained from third party information.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/30147; http://www.securityfocus.com/bid/29111; http://www.vupen.com/english/advisories/2008/1468/references
CVE: CVE-2008-2162
Published: 2008-05-12
Description: Cross-site scripting (XSS) vulnerability in SonicWall Email Security 6.1.1 allows remote attackers to inject arbitrary web script or HTML via the Host header in a request to a non-existent web page, which is not properly sanitized in an error page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2008-05/0226.html; http://www.securityfocus.com/bid/29107; http://www.securitytracker.com/id?1019999
CVE: CVE-2008-0166
Published: 2008-05-13
Description: OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that generates predictable numbers, which makes it easier for remote attackers to conduct brute force guessing attacks against cryptographic keys.
CVSS Score: 7.5 (HIGH)
CWE: CWE-338
References: http://metasploit.com/users/hdm/tools/debian-openssl/; http://secunia.com/advisories/30136; http://secunia.com/advisories/30220
CVE: CVE-2008-2163
Published: 2008-05-13
Description: Cross-site scripting (XSS) vulnerability in IBM Lotus Quickr 8.1 before Hotfix 5 for Windows and AIX, and before Hotfix 3 for i5/OS, allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to "WYSIWYG editors."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30204; http://www-01.ibm.com/support/docview.wss?uid=swg27013341; http://www-1.ibm.com/support/docview.wss?uid=swg24018711
CVE: CVE-2008-0322
Published: 2008-05-13
Description: The I2O Utility Filter driver (i2omgmt.sys) 5.1.2600.2180 for Microsoft Windows XP sets Everyone/Write permissions for the "\\.\I2OExc" device interface, which allows local users to gain privileges.  NOTE: this issue can be leveraged to overwrite arbitrary memory and execute code via an IOCTL call with a crafted DeviceObject pointer.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=699; http://secunia.com/advisories/30203; http://www.securityfocus.com/bid/29171
CVE: CVE-2008-0713
Published: 2008-05-13
Description: Unspecified vulnerability in the FTP server for HP-UX B.11.11, B.11.23, and B.11.31 allows remote authenticated users to cause a denial of service (FTP server outage) via unknown attack vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01446326; http://secunia.com/advisories/30195; http://www.securityfocus.com/bid/29160
CVE: CVE-2008-2166
Published: 2008-05-13
Description: Cross-site scripting (XSS) vulnerability in the search module in Sun Java System Web Server 6.1 before SP9 and 7.0 before Update 2 allows remote attackers to inject arbitrary web script or HTML via unknown parameters in index.jsp.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30133; http://sunsolve.sun.com/search/document.do?assetkey=1-26-231467-1; http://www.securityfocus.com/bid/29087
CVE: CVE-2008-2167
Published: 2008-05-13
Description: Cross-site scripting (XSS) vulnerability in ZyXEL ZyWALL 100 allows remote attackers to inject arbitrary web script or HTML via the Referer header, which is not properly handled in a 404 Error page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-May/062152.html; http://secunia.com/advisories/30142; http://securityreason.com/securityalert/3869
CVE: CVE-2008-2168
Published: 2008-05-13
Description: Cross-site scripting (XSS) vulnerability in Apache 2.2.6 and earlier allows remote attackers to inject arbitrary web script or HTML via UTF-7 encoded URLs that are not properly handled when displaying the 403 Forbidden error page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01539432; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1607&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1762&w=2
CVE: CVE-2008-0119
Published: 2008-05-13
Description: Unspecified vulnerability in Microsoft Publisher in Office 2000 and XP SP3, 2003 SP2 and SP3, and 2007 SP1 and earlier allows remote attackers to execute arbitrary code via a Publisher file with crafted object header data that triggers memory corruption, aka "Publisher Object Handler Validation Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3574&w=2; http://secunia.com/advisories/30150; http://www.securityfocus.com/archive/1/492073/100/0/threaded
CVE: CVE-2008-1091
Published: 2008-05-13
Description: Unspecified vulnerability in Microsoft Word in Office 2000 and XP SP3, 2003 SP2 and SP3, and 2007 Office System SP1 and earlier allows remote attackers to execute arbitrary code via a Rich Text Format (.rtf) file with a malformed string that triggers a "memory calculation error" and a heap-based buffer overflow, aka "Object Parsing Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3574&w=2; http://secunia.com/advisories/30143; http://www.kb.cert.org/vuls/id/543907
CVE: CVE-2008-1434
Published: 2008-05-13
Description: Use-after-free vulnerability in Microsoft Word in Office 2000 and XP SP3, 2003 SP2 and SP3, and 2007 Office System SP1 and earlier allows remote attackers to execute arbitrary code via an HTML document with a large number of Cascading Style Sheets (CSS) selectors, related to a "memory handling error" that triggers memory corruption.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=700; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3574&w=2; http://secunia.com/advisories/30143
CVE: CVE-2008-1437
Published: 2008-05-13
Description: Unspecified vulnerability in Microsoft Malware Protection Engine (mpengine.dll) 1.1.3520.0 and 0.1.13.192, as used in multiple Microsoft products, allows context-dependent attackers to cause a denial of service (engine hang and restart) via a crafted file, a different vulnerability than CVE-2008-1438.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3574&w=2; http://secunia.com/advisories/30172; http://www.securityfocus.com/bid/29060
CVE: CVE-2008-1438
Published: 2008-05-13
Description: Unspecified vulnerability in Microsoft Malware Protection Engine (mpengine.dll) 1.1.3520.0 and 0.1.13.192, as used in multiple Microsoft products, allows context-dependent attackers to cause a denial of service (disk space exhaustion) via a file with "crafted data structures" that trigger the creation of large temporary files, a different vulnerability than CVE-2008-1437.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3574&w=2; http://secunia.com/advisories/30172; http://www.securityfocus.com/bid/29073