deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-2445
Published: 2009-07-13
Description: Oracle iPlanet Web Server (formerly Sun Java System Web Server or Sun ONE Web Server) 6.1 before SP12, and 7.0 through Update 6, when running on Windows, allows remote attackers to read arbitrary JSP files via an alternate data stream syntax, as demonstrated by a .jsp::$DATA URI.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://isowarez.de/SunOne_Webserver.txt; http://jvn.jp/en/jp/JVN47124169/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2009-002069
CVE: CVE-2009-2446
Published: 2009-07-13
Description: Multiple format string vulnerabilities in the dispatch_command function in libmysqld/sql_parse.cc in mysqld in MySQL 4.0.0 through 5.0.83 allow remote authenticated users to cause a denial of service (daemon crash) and possibly have unspecified other impact via format string specifiers in a database name in a (1) COM_CREATE_DB or (2) COM_DROP_DB request.  NOTE: some of these details are obtained from third party information.
CVSS Score: 8.5 (HIGH)
CWE: CWE-134
References: http://archives.neohapsis.com/archives/fulldisclosure/2009-07/0058.html; http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://secunia.com/advisories/35767
CVE: CVE-2009-2447
Published: 2009-07-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in ogp_show.php in Online Guestbook Pro 5.1 allow remote attackers to inject arbitrary web script or HTML via the (1) search or (2) display parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/35762; http://www.packetstormsecurity.com/0907-exploits/ogp51-morexss.txt; http://secunia.com/advisories/35762
CVE: CVE-2009-2448
Published: 2009-07-13
Description: Cross-site scripting (XSS) vulnerability in ogp_show.php in Online Guestbook Pro 5.1 allows remote attackers to inject arbitrary web script or HTML via the search_choice parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/35762; http://secunia.com/advisories/35762
CVE: CVE-2009-2449
Published: 2009-07-13
Description: Directory traversal vulnerability in maillinglist/admin/change_config.php in ADbNewsSender before 1.5.6 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the path_to_lang parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/35845; http://sourceforge.net/apps/mantisbt/adbnewssender/view.php?id=22; http://sourceforge.net/project/shownotes.php?release_id=694644
CVE: CVE-2009-2450
Published: 2009-07-13
Description: The OAmon.sys kernel driver 3.1.0.0 and earlier in Tall Emu Online Armor Personal Firewall AV+ before 3.5.0.12, and Personal Firewall 3.5 before 3.5.0.14, allows local users to gain privileges via crafted METHOD_NEITHER IOCTL requests to \Device\OAmon containing arbitrary kernel addresses, as demonstrated using the 0x830020C3 IOCTL.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://milw0rm.com/sploits/2009-OAmon_Exp.zip; http://www.exploit-db.com/exploits/8875; http://www.ntinternals.org/ntiadv0806/ntiadv0806.html
CVE: CVE-2008-6854
Published: 2009-07-14
Description: Xigla Software Absolute FAQ Manager.NET 6.0 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/32472; http://www.securityfocus.com/bid/32028; https://exchange.xforce.ibmcloud.com/vulnerabilities/46303
CVE: CVE-2008-6855
Published: 2009-07-14
Description: Xigla Software Absolute News Feed 1.0 and possibly 1.5 allows remote attackers to bypass authentication and gain administrative access by setting a certain cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/32472; http://www.securityfocus.com/bid/32027; https://exchange.xforce.ibmcloud.com/vulnerabilities/46302
CVE: CVE-2008-6856
Published: 2009-07-14
Description: Xigla Software Absolute News Manager.NET 5.1 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/32472; http://www.securityfocus.com/bid/32024; https://exchange.xforce.ibmcloud.com/vulnerabilities/46301
CVE: CVE-2008-6857
Published: 2009-07-14
Description: Absolute Podcast .NET 1.0 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://osvdb.org/49467; http://secunia.com/advisories/32472; http://www.securityfocus.com/bid/32003
CVE: CVE-2008-6858
Published: 2009-07-14
Description: Absolute Banner Manager .NET 4.0 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/32472; http://www.securityfocus.com/bid/32023; https://exchange.xforce.ibmcloud.com/vulnerabilities/46244
CVE: CVE-2008-6859
Published: 2009-07-14
Description: Xigla Software Absolute Control Panel XE 1.5 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/32472; http://www.securityfocus.com/bid/32025; https://exchange.xforce.ibmcloud.com/vulnerabilities/46247
CVE: CVE-2008-6860
Published: 2009-07-14
Description: Xigla Software Absolute Poll Manager XE 4.1 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.securityfocus.com/bid/32005; https://exchange.xforce.ibmcloud.com/vulnerabilities/46242; https://www.exploit-db.com/exploits/6883
CVE: CVE-2008-6861
Published: 2009-07-14
Description: Xigla Software Absolute Newsletter 6.0 and 6.1 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/32472; http://www.securityfocus.com/bid/32029; https://exchange.xforce.ibmcloud.com/vulnerabilities/46304
CVE: CVE-2008-6862
Published: 2009-07-14
Description: Absolute Content Rotator 6.0 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/32472; http://www.securityfocus.com/bid/32026; https://exchange.xforce.ibmcloud.com/vulnerabilities/46243
CVE: CVE-2008-6863
Published: 2009-07-14
Description: Xigla Software Absolute Form Processor .NET 4.0 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/32472; http://www.securityfocus.com/bid/32009; https://exchange.xforce.ibmcloud.com/vulnerabilities/46245
CVE: CVE-2008-6864
Published: 2009-07-14
Description: Xigla Software Absolute Live Support .NET 5.1 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/32472; http://www.securityfocus.com/bid/32010; https://exchange.xforce.ibmcloud.com/vulnerabilities/46246
CVE: CVE-2008-6865
Published: 2009-07-14
Description: SQL injection vulnerability in modules.php in the Sectionsnew module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the artid parameter in a printpage action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/51890; http://www.securityfocus.com/archive/1/497939/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/51735
CVE: CVE-2008-6866
Published: 2009-07-14
Description: SQL injection vulnerability in modules.php in the Current_Issue module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the id parameter in a summary action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/51889; http://www.securityfocus.com/archive/1/497944/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/51736
CVE: CVE-2008-6867
Published: 2009-07-14
Description: SQL injection vulnerability in content.php in Scripts For Sites (SFS) EZ Career allows remote attackers to execute arbitrary SQL commands via the topic parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/49486; http://secunia.com/advisories/32527; http://www.securityfocus.com/bid/32037
CVE: CVE-2009-2451
Published: 2009-07-14
Description: Multiple SQL injection vulnerabilities in index.php in MIM:InfiniX 1.2.003 and possibly earlier versions allow remote attackers to execute arbitrary SQL commands via the (1) month and (2) year parameters in a calendar action, or (3) a search term in the search form.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/8558; http://www.securityfocus.com/archive/1/503046/100/0/threaded; http://www.securityfocus.com/archive/1/503480
CVE: CVE-2009-2452
Published: 2009-07-14
Description: Multiple unspecified vulnerabilities in Citrix Licensing 11.5 have unknown impact and attack vectors, related to "underlying components of the License Management Console."
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/34937; http://support.citrix.com/article/CTX120742; http://www.securityfocus.com/bid/34759
CVE: CVE-2009-2453
Published: 2009-07-14
Description: Citrix XenApp (formerly Presentation Server) 4.5 Hotfix Rollup Pack 3 does not apply an access policy when it is defined with the Access Gateway Advanced Edition filters, which allows attackers to bypass intended access restrictions via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://osvdb.org/53900; http://secunia.com/advisories/34865; http://support.citrix.com/article/CTX118792
CVE: CVE-2009-2454
Published: 2009-07-14
Description: Cross-site scripting (XSS) vulnerability in Citrix Web Interface 4.6, 5.0, and 5.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/34868; http://support.citrix.com/article/CTX120697; http://www.securityfocus.com/bid/34761
CVE: CVE-2009-2455
Published: 2009-07-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in webadmin/admin.php in @mail 5.6.1 allow remote attackers to inject arbitrary web script or HTML via the (1) type and (2) func parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/34403; http://secunia.com/advisories/34403
CVE: CVE-2009-0192
Published: 2009-07-14
Description: Off-by-one error in the iMonitor component in Novell eDirectory 8.8 SP3, 8.8 SP3 FTF3, and possibly other versions allows remote attackers to execute arbitrary code via an HTTP request with a crafted Accept-Language header, which triggers a stack-based buffer overflow.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://osvdb.org/55847; http://secunia.com/advisories/34160; http://secunia.com/secunia_research/2009-13/
CVE: CVE-2009-0692
Published: 2009-07-14
Description: Stack-based buffer overflow in the script_write_params method in client/dhclient.c in ISC DHCP dhclient 4.1 before 4.1.0p1, 4.0 before 4.0.1p1, 3.1 before 3.1.2p1, 3.0, and 2.0 allows remote DHCP servers to execute arbitrary code via a crafted subnet-mask option.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-010.txt.asc; http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02286083; http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00003.html
CVE: CVE-2009-1382
Published: 2009-07-14
Description: Multiple stack-based buffer overflows in mimetex.cgi in mimeTeX, when downloaded before 20090713, allow remote attackers to execute arbitrary code via a TeX file with long (1) picture, (2) circle, or (3) input tags.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://groups.google.com/group/comp.text.tex/browse_thread/thread/5d56d3d744351578; http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039314.html; http://scary.beasts.org/security/CESA-2009-009.html
CVE: CVE-2009-1383
Published: 2009-07-14
Description: The getdirective function in mathtex.cgi in mathTeX, when downloaded before 20090713, allows remote attackers to execute arbitrary commands via shell metacharacters in the dpi tag.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://groups.google.com/group/comp.text.tex/browse_thread/thread/5d56d3d744351578; http://secunia.com/advisories/35816; http://www.ocert.org/advisories/ocert-2009-010.html
CVE: CVE-2009-1422
Published: 2009-07-14
Description: Unspecified vulnerability in HP ProCurve Threat Management Services zl Module (J9155A) ST.1.0.090213 and earlier allows remote attackers to gain privileges via unknown vectors, aka PR_41209.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8317&w=2; http://www.securitytracker.com/id?1022536; http://www.vupen.com/english/advisories/2009/1869
CVE: CVE-2009-1423
Published: 2009-07-14
Description: Unspecified vulnerability in HP ProCurve Threat Management Services zl Module (J9155A) ST.1.0.090213 and earlier allows remote attackers to cause a denial of service via unknown vectors, aka PR_39898, a different vulnerability than CVE-2009-1424 and CVE-2009-1425.
CVSS Score: 7.8 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8317&w=2; http://www.securitytracker.com/id?1022536; http://www.vupen.com/english/advisories/2009/1869
CVE: CVE-2009-1424
Published: 2009-07-14
Description: Unspecified vulnerability in HP ProCurve Threat Management Services zl Module (J9155A) ST.1.0.090213 and earlier allows remote attackers to cause a denial of service via unknown vectors, aka PR_39412, a different vulnerability than CVE-2009-1423 and CVE-2009-1425.
CVSS Score: 7.8 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8317&w=2; http://www.securitytracker.com/id?1022536; http://www.vupen.com/english/advisories/2009/1869
CVE: CVE-2009-1425
Published: 2009-07-14
Description: Unspecified vulnerability in HP ProCurve Threat Management Services zl Module (J9155A) ST.1.0.090213 and earlier allows remote attackers to cause a denial of service by triggering a stop or crash in httpd, aka PR_18770, a different vulnerability than CVE-2009-1423 and CVE-2009-1424.
CVSS Score: 7.8 (HIGH)
References: http://cdn.procurve.com/training/Manuals/TMSzlModule-RelNotes-90[PII_REDACTED]4.pdf; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8317&w=2; http://www.securityfocus.com/bid/35653
CVE: CVE-2009-2347
Published: 2009-07-14
Description: Multiple integer overflows in inter-color spaces conversion tools in libtiff 3.8 through 3.8.2, 3.9, and 4.0 allow context-dependent attackers to execute arbitrary code via a TIFF image with large (1) width and (2) height values, which triggers a heap-based buffer overflow in the (a) cvt_whole_image function in tiff2rgba and (b) tiffcvt function in rgb2ycbcr.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://article.gmane.org/gmane.linux.debian.devel.changes.unstable/178563/; http://bugzilla.maptools.org/show_bug.cgi?id=2079; http://osvdb.org/55821
CVE: CVE-2009-2456
Published: 2009-07-14
Description: The DS\NDSD component in Novell eDirectory 8.8 before SP5 allows remote attackers to cause a denial of service (ndsd core dump) via an LDAP request containing multiple . (dot) wildcard characters in the Relative Distinguished Name (RDN).
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/55848; http://secunia.com/advisories/34160; http://www.novell.com/support/viewContent.do?externalId=3426981
CVE: CVE-2009-2457
Published: 2009-07-14
Description: The DS\NDSD component in Novell eDirectory 8.8 before SP5 allows remote attackers to cause a denial of service (crash) via a malformed bind LDAP packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/55849; http://secunia.com/advisories/34160; http://www.novell.com/support/viewContent.do?externalId=3426981
CVE: CVE-2009-2458
Published: 2009-07-14
Description: Unspecified vulnerability in Sun Fire V215 Server, when using XVR-100 graphic cards on system boards with part number 375-3463 and a hardware dash level -04 or later, allows remote attackers to cause a denial of service (panic) via unknown vectors.
CVSS Score: 5.4 (MEDIUM)
References: http://sunsolve.sun.com/search/document.do?assetkey=1-26-257329-1; http://www.securityfocus.com/bid/35661; https://exchange.xforce.ibmcloud.com/vulnerabilities/51695
CVE: CVE-2009-2459
Published: 2009-07-14
Description: Multiple unspecified vulnerabilities in mimeTeX, when downloaded before 20090713, have unknown impact and attack vectors related to the (1) \environ, (2) \input, and (3) \counter TeX directives.
CVSS Score: 10.0 (HIGH)
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039314.html; http://scary.beasts.org/security/CESA-2009-009.html; http://secunia.com/advisories/35752
CVE: CVE-2009-2460
Published: 2009-07-14
Description: Multiple stack-based buffer overflows in mathtex.cgi in mathTeX, when downloaded before 20090713, have unspecified impact and remote attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://groups.google.com/group/comp.text.tex/browse_thread/thread/5d56d3d744351578; http://secunia.com/advisories/35816; http://www.ocert.org/advisories/ocert-2009-010.html
CVE: CVE-2009-2461
Published: 2009-07-14
Description: mathtex.cgi in mathTeX, when downloaded before 20090713, does not securely create temporary files, which has unspecified impact and local attack vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://groups.google.com/group/comp.text.tex/browse_thread/thread/5d56d3d744351578; http://secunia.com/advisories/35816; http://www.ocert.org/advisories/ocert-2009-010.html
CVE: CVE-2009-0217
Published: 2009-07-14
Description: The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; (7) Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.
CVSS Score: 5.0 (MEDIUM)
References: http://blogs.sun.com/security/entry/cert_vulnerability_note_vu_466161; http://git.gnome.org/cgit/xmlsec/commit/?id=34b349675af9f72eb822837a8772cc1ead7115c7; http://git.gnome.org/cgit/xmlsec/patch/?id=34b349675af9f72eb822837a8772cc1ead7115c7
CVE: CVE-2009-0987
Published: 2009-07-14
Description: Unspecified vulnerability in the Upgrade component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.
CVSS Score: 5.5 (MEDIUM)
References: http://osvdb.org/55889; http://secunia.com/advisories/35776; http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html
CVE: CVE-2009-1015
Published: 2009-07-14
Description: Unspecified vulnerability in the Core RDBMS component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.05, and 10.2.04 allows remote authenticated users to affect integrity via unknown vectors.
CVSS Score: 4.0 (MEDIUM)
References: http://osvdb.org/55893; http://secunia.com/advisories/35776; http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html
CVE: CVE-2009-1019
Published: 2009-07-14
Description: Unspecified vulnerability in the Network Authentication component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.4, and 11.1.0.7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/55884; http://secunia.com/advisories/35776; http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html
CVE: CVE-2009-1020
Published: 2009-07-14
Description: Unspecified vulnerability in the Network Foundation component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.4, and 11.1.0.7 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.
CVSS Score: 9.0 (HIGH)
References: http://osvdb.org/55897; http://secunia.com/advisories/35776; http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html
CVE: CVE-2009-1021
Published: 2009-07-14
Description: Unspecified vulnerability in the Advanced Replication component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.
CVSS Score: 5.5 (MEDIUM)
References: http://osvdb.org/55886; http://secunia.com/advisories/35776; http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html
CVE: CVE-2009-1963
Published: 2009-07-14
Description: Unspecified vulnerability in the Network Foundation component in Oracle Database 11.1.0.6 allows remote authenticated users to affect integrity and availability via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/55885; http://secunia.com/advisories/35776; http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html
CVE: CVE-2009-1966
Published: 2009-07-14
Description: Unspecified vulnerability in the Config Management component in (1) Oracle Database 11.1.0.7 and (2) Oracle Enterprise Manager 10.2.0.4 allows remote authenticated users to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2009-1967.
CVSS Score: 5.5 (MEDIUM)
References: http://osvdb.org/55887; http://secunia.com/advisories/35776; http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html
CVE: CVE-2009-1967
Published: 2009-07-14
Description: Unspecified vulnerability in the Config Management component in (1) Oracle Database 11.1.0.7 and (2) Oracle Enterprise Manager 10.2.0.4 allows remote authenticated users to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2009-1966.
CVSS Score: 5.5 (MEDIUM)
References: http://osvdb.org/55888; http://secunia.com/advisories/35776; http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html
CVE: CVE-2009-1968
Published: 2009-07-14
Description: Unspecified vulnerability in the Secure Enterprise Search component in Oracle Database 10.1.8.3 allows remote attackers to affect integrity via unknown vectors.  NOTE: the previous information was obtained from the July 2009 CPU.  Oracle has not commented on claims from an established researcher that this is cross-site scripting (XSS) via the search_p_groups parameter in search/query/search.
CVSS Score: 4.3 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2009-07/0110.html; http://dsecrg.com/pages/vul/show.php?id=125; http://osvdb.org/55892
CVE: CVE-2009-1969
Published: 2009-07-14
Description: Unspecified vulnerability in the Auditing component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.4, and 11.1.0.7 allows remote authenticated users to affect confidentiality via unknown vectors.
CVSS Score: 2.1 (LOW)
References: http://osvdb.org/55894; http://secunia.com/advisories/35776; http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html