deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-3411
Published: 2010-01-13
Description: Unspecified vulnerability in the Oracle Data Pump component in Oracle Database 11.1.0.7, 10.2.0.3, 10.2.0.4, 10.1.0.5, 9.2.0.8, and 9.2.0.8DV allows remote authenticated users to affect confidentiality and integrity via unknown vectors.
CVSS Score: 4.9 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html; http://www.us-cert.gov/cas/techalerts/TA10-012A.html; http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html
CVE: CVE-2009-3412
Published: 2010-01-13
Description: Unspecified vulnerability in the Unzip component in Oracle Database 9.2.0.8, 9.2.0.8DV, and 10.1.0.5; and Oracle Application Server 10.1.2.3; allows local users to affect confidentiality via unknown vectors.
CVSS Score: 1.0 (LOW)
References: http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html; http://www.securitytracker.com/id?1023438; http://www.us-cert.gov/cas/techalerts/TA10-012A.html
CVE: CVE-2009-3413
Published: 2010-01-13
Description: Unspecified vulnerability in the Oracle Spatial component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3 allows remote authenticated users to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2008-3976 and CVE-2009-3414.
CVSS Score: 3.2 (LOW)
References: http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html; http://www.us-cert.gov/cas/techalerts/TA10-012A.html; http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html
CVE: CVE-2009-3414
Published: 2010-01-13
Description: Unspecified vulnerability in the Oracle Spatial component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3 allows remote authenticated users to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2008-3976 and CVE-2009-3413.
CVSS Score: 4.9 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html; http://www.us-cert.gov/cas/techalerts/TA10-012A.html; http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html
CVE: CVE-2009-3415
Published: 2010-01-13
Description: Unspecified vulnerability in the Oracle OLAP component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.
CVSS Score: 9.0 (HIGH)
References: http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html; http://www.us-cert.gov/cas/techalerts/TA10-012A.html; http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html
CVE: CVE-2009-3416
Published: 2010-01-13
Description: Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.1 allows remote attackers to affect integrity via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html; http://www.us-cert.gov/cas/techalerts/TA10-012A.html; http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html
CVE: CVE-2010-0066
Published: 2010-01-13
Description: Unspecified vulnerability in the Access Manager Identity Server component in Oracle Application Server 7.0.4.3 and 10.1.4.2 allows remote attackers to affect integrity via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html; http://www.securitytracker.com/id?1023438; http://www.us-cert.gov/cas/techalerts/TA10-012A.html
CVE: CVE-2010-0067
Published: 2010-01-13
Description: Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Application Server 10.1.2.3 and 10.1.3.4 allows remote attackers to affect confidentiality via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html; http://www.securitytracker.com/id?1023438; http://www.us-cert.gov/cas/techalerts/TA10-012A.html
CVE: CVE-2010-0068
Published: 2010-01-13
Description: Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 9.0, 9.1, 9.2MP2, and 10.0 allows remote attackers to affect confidentiality via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html; http://www.us-cert.gov/cas/techalerts/TA10-012A.html; http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html
CVE: CVE-2010-0069
Published: 2010-01-13
Description: Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 7.0, SP7, 8.1SP6, 9.0, 9.1, 9.2MP3, 10.0MP1, and 10.3.0 allows remote attackers to affect integrity via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html; http://www.us-cert.gov/cas/techalerts/TA10-012A.html; http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html
CVE: CVE-2010-0070
Published: 2010-01-13
Description: Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Application Server 10.1.2.3 and 10.1.3.4 allows remote attackers to affect integrity via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html; http://www.securitytracker.com/id?1023438; http://www.us-cert.gov/cas/techalerts/TA10-012A.html
CVE: CVE-2010-0071
Published: 2010-01-13
Description: Unspecified vulnerability in the Listener component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.4, and 11.1.0.7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html; http://www.us-cert.gov/cas/techalerts/TA10-012A.html; http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html
CVE: CVE-2010-0072
Published: 2010-01-13
Description: Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.2.0.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the January 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is a buffer overflow in observiced.exe that allows remote attackers to execute arbitrary code via vectors related to a "reverse lookup of connections" to TCP port 10000.
CVSS Score: 10.0 (HIGH)
References: http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html; http://www.us-cert.gov/cas/techalerts/TA10-012A.html; http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html
CVE: CVE-2010-0074
Published: 2010-01-13
Description: Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 7.0SP7, 8.1SP6, 9.0, 9.1, 9.2MP3, 10.0MP2, and 10.3.1 allows remote attackers to affect availability via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html; http://www.us-cert.gov/cas/techalerts/TA10-012A.html; http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html
CVE: CVE-2010-0075
Published: 2010-01-13
Description: Unspecified vulnerability in the Oracle HRMS (Self Service) component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.1 allows remote attackers to affect confidentiality via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html; http://www.us-cert.gov/cas/techalerts/TA10-012A.html; http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html
CVE: CVE-2010-0076
Published: 2010-01-13
Description: Unspecified vulnerability in the Application Express Application Builder component in Oracle Database 3.2.1.00.10 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.
CVSS Score: 6.0 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html; http://www.us-cert.gov/cas/techalerts/TA10-012A.html; http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html
CVE: CVE-2010-0077
Published: 2010-01-13
Description: Unspecified vulnerability in the CRM Technical Foundation (mobile) component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.2 allows remote attackers to affect confidentiality and integrity via unknown vectors.
CVSS Score: 6.4 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html; http://www.us-cert.gov/cas/techalerts/TA10-012A.html; http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html
CVE: CVE-2010-0078
Published: 2010-01-13
Description: Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 9.0, 9.1, 9.2MP3, 10.0MP2, and 10.3.1 allows remote attackers to affect availability via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html; http://www.us-cert.gov/cas/techalerts/TA10-012A.html; http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html
CVE: CVE-2010-0079
Published: 2010-01-13
Description: Multiple vulnerabilities in the JRockit component in BEA Product Suite R27.6.5 using JRE/JDK 1.4.2, 5, and 6 allow remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: this CVE identifier overlaps CVE-2009-3867, CVE-2009-3868, CVE-2009-3869, CVE-2009-3871, CVE-2009-3872, CVE-2009-3873, CVE-2009-3874, CVE-2009-3875, CVE-2009-3876, and CVE-2009-3877.
CVSS Score: 10.0 (HIGH)
References: http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html; http://www.us-cert.gov/cas/techalerts/TA10-012A.html; http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html
CVE: CVE-2010-0080
Published: 2010-01-13
Description: Unspecified vulnerability in the PeopleSoft Enterprise HCM - eProfile component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.9 Bundle, #21 and 9.0 Bundle #11 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.
CVSS Score: 4.9 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html; http://www.us-cert.gov/cas/techalerts/TA10-012A.html; http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html
CVE: CVE-2010-0279
Published: 2010-01-13
Description: Unrestricted file upload vulnerability in upload.php in BTS-GI Read excel 1.1 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/61579; http://secunia.com/advisories/38083; http://www.exploit-db.com/exploits/11057
CVE: CVE-2009-3637
Published: 2010-01-13
Description: Stack-based buffer overflow in the M_AddToServerList function in client/menu.c in Red Planet Arena Alien Arena 7.30 allows remote attackers to execute arbitrary code via a packet with a crafted server description to UDP port 27901 followed by a packet with a long print command.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://icculus.org/alienarena/changelogs/7.31.txt; http://secunia.com/advisories/37118; http://secunia.com/advisories/37256
CVE: CVE-2009-4606
Published: 2010-01-13
Description: South River Technologies WebDrive 9.02 build 2232 installs the WebDrive Service without a security descriptor, which allows local users to (1) stop the service via the stop command, (2) execute arbitrary commands as SYSTEM by using the config command to modify the binPath variable, or (3) restart the service via the start command.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://osvdb.org/59080; http://retrogod.altervista.org/9sg_south_river_priv.html; http://secunia.com/advisories/37083
CVE: CVE-2009-4607
Published: 2010-01-13
Description: The command line interface in Overland Storage Snap Server 410 with GuardianOS 5.1.041 runs the "less" utility with a higher-privileged uid than the CLI user and without sufficient restriction on shell escapes, which allows local users to gain privileges using the "!" character within less to access a privileged shell.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www.juniper.net/security/auto/vulnerabilities/vuln36739.html; http://www.securityfocus.com/archive/1/507318/100/0/threaded; http://www.securityfocus.com/bid/36739
CVE: CVE-2009-4608
Published: 2010-01-13
Description: Cross-site scripting (XSS) vulnerability in Canon IT Solutions Inc. ACCESSGUARDIAN 3.0.14 and earlier, and 3.5.6 and earlier, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to authentication.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://canon-its.jp/guardian/topics/200910ag.html; http://jvn.jp/en/jp/JVN33822756/index.html; http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000066.html
CVE: CVE-2009-3953
Published: 2010-01-13
Description: The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration "array boundary issue," a different vulnerability than CVE-2009-2994.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html; http://osvdb.org/61690; http://secunia.com/advisories/38138
CVE: CVE-2009-3954
Published: 2010-01-13
Description: The 3D implementation in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, might allow attackers to execute arbitrary code via unspecified vectors, related to a "DLL-loading vulnerability."
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html; http://secunia.com/advisories/38138; http://secunia.com/advisories/38215
CVE: CVE-2009-3955
Published: 2010-01-13
Description: Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted JPC_MS_RGN marker in the Jp2c stream of a JpxDecode encoded data stream, which triggers an integer sign extension that bypasses a sanity check, leading to memory corruption.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=836; http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html; http://secunia.com/advisories/38138
CVE: CVE-2009-3956
Published: 2010-01-13
Description: The default configuration of Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, does not enable the Enhanced Security feature, which has unspecified impact and attack vectors, related to a "script injection vulnerability," as demonstrated by Acrobat Forms Data Format (FDF) behavior that allows cross-site scripting (XSS) by user-assisted remote attackers.
CVSS Score: 10.0 (HIGH)
CWE: CWE-16
References: http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html; http://secunia.com/advisories/38138; http://secunia.com/advisories/38215
CVE: CVE-2009-3957
Published: 2010-01-13
Description: Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, might allow attackers to cause a denial of service (NULL pointer dereference) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html; http://www.adobe.com/support/security/bulletins/apsb10-02.html; http://www.securityfocus.com/bid/37760
CVE: CVE-2009-3958
Published: 2010-01-13
Description: Multiple stack-based buffer overflows in the NOS Microsystems getPlus Helper ActiveX control before 1.6.2.49 in gp.ocx in the Download Manager in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, might allow remote attackers to execute arbitrary code via unspecified initialization parameters.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html; http://www.adobe.com/support/security/bulletins/apsb10-02.html; http://www.kb.cert.org/vuls/id/773545
CVE: CVE-2009-3959
Published: 2010-01-13
Description: Integer overflow in the U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a malformed PDF document.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html; http://secunia.com/advisories/38138; http://secunia.com/advisories/38215
CVE: CVE-2009-4212
Published: 2010-01-13
Description: Multiple integer underflows in the (1) AES and (2) RC4 decryption functionality in the crypto library in MIT Kerberos 5 (aka krb5) 1.3 through 1.6.3, and 1.7 before 1.7.1, allow remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code by providing ciphertext with a length that is too short to be valid.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-January/033915.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-January/033919.html
CVE: CVE-2010-0018
Published: 2010-01-13
Description: Integer overflow in the Embedded OpenType (EOT) Font Engine (t2embed.dll) in Microsoft Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2003 SP2; Windows Vista Gold, SP1, and SP2; Windows Server 2008 Gold, SP2, and R2; and Windows 7 allows remote attackers to execute arbitrary code via compressed data that represents a crafted EOT font, aka "Microtype Express Compressed Fonts Integer Flaw in the LZCOMP Decompressor Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://blogs.technet.com/srd/archive/2010/01/12/ms10-001-font-file-decompression-vulnerability.aspx; http://osvdb.org/61651; http://secunia.com/advisories/35457
CVE: CVE-2009-4487
Published: 2010-01-13
Description: nginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.
CVSS Score: 6.8 (MEDIUM)
References: http://www.securityfocus.com/archive/1/508830/100/0/threaded; http://www.securityfocus.com/bid/37711; http://www.ush.it/team/ush/hack_httpd_escape/adv.txt
CVE: CVE-2009-4488
Published: 2010-01-13
Description: Varnish 2.0.6 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.  NOTE: the vendor disputes the significance of this report, stating that "This is not a security problem in Varnish or any other piece of software which writes a logfile. The real problem is the mistaken belief that you can cat(1) a random logfile to your terminal safely.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-1284
References: http://www.securityfocus.com/archive/1/508830/100/0/threaded; http://www.securityfocus.com/bid/37713; http://www.ush.it/team/ush/hack_httpd_escape/adv.txt
CVE: CVE-2009-4489
Published: 2010-01-13
Description: header.c in Cherokee before 0.99.32 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/37933; http://svn.cherokee-project.com/changeset/3944; http://svn.cherokee-project.com/changeset/3977
CVE: CVE-2009-4490
Published: 2010-01-13
Description: mini_httpd 1.19 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/archive/1/508830/100/0/threaded; http://www.ush.it/team/ush/hack_httpd_escape/adv.txt; http://www.securityfocus.com/archive/1/508830/100/0/threaded
CVE: CVE-2009-4491
Published: 2010-01-13
Description: thttpd 2.25b0 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-94
References: http://packetstormsecurity.com/files/175949/m-privacy-TightGate-Pro-Code-Execution-Insecure-Permissions.html; http://seclists.org/fulldisclosure/2023/Nov/13; http://www.securityfocus.com/archive/1/508830/100/0/threaded
CVE: CVE-2009-4492
Published: 2010-01-13
Description: WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through patchlevel 248, 1.8.8dev, 1.9.1 through patchlevel 376, and 1.9.2dev writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/37949; http://securitytracker.com/id?1023429; http://www.redhat.com/support/errata/RHSA-2011-0908.html
CVE: CVE-2009-4493
Published: 2010-01-13
Description: Orion Application Server 2.0.7 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/archive/1/508830/100/0/threaded; http://www.ush.it/team/ush/hack_httpd_escape/adv.txt; http://www.securityfocus.com/archive/1/508830/100/0/threaded
CVE: CVE-2009-4494
Published: 2010-01-13
Description: AOLserver 4.5.1 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/archive/1/508830/100/0/threaded; http://www.securityfocus.com/bid/37712; http://www.ush.it/team/ush/hack_httpd_escape/adv.txt
CVE: CVE-2009-4495
Published: 2010-01-13
Description: Yaws 1.85 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/archive/1/508830/100/0/threaded; http://www.securityfocus.com/bid/37716; http://www.ush.it/team/ush/hack_httpd_escape/adv.txt
CVE: CVE-2009-4496
Published: 2010-01-13
Description: Boa 0.94.14rc21 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041271.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041274.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041285.html