deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-5413
Published: 2008-12-10
Description: PerfServlet in the PMI/Performance Tools component in IBM WebSphere Application Server (WAS) 7 before 7.0.0.1 allows attackers to obtain sensitive information by reading the (1) systemout.log and (2) ffdc files.  NOTE: this is probably a duplicate of CVE-2009-0434.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg27014463; http://www-1.ibm.com/support/docview.wss?uid=swg1PK63886; http://www.securityfocus.com/bid/32679
CVE: CVE-2008-5414
Published: 2008-12-10
Description: Unspecified vulnerability in the Feature Pack for Web Services in the Web Services Security component in IBM WebSphere Application Server (WAS) 7 before 7.0.0.1 has unknown impact and attack vectors related to "userNameToken."
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/33022; http://www-01.ibm.com/support/docview.wss?uid=swg27014463; http://www-1.ibm.com/support/docview.wss?uid=swg1PK67282
CVE: CVE-2008-5399
Published: 2008-12-10
Description: Cross-site scripting (XSS) vulnerability in the listonlineusers (aka "Who's online") component in mvnForum before 1.2.1 GA allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/50403; http://secunia.com/advisories/32931; http://security.bkis.vn/?p=286
CVE: CVE-2008-5400
Published: 2008-12-10
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in mvnForum before 1.2.1 GA allow remote attackers to (1) create forums, (2) change account privileges, (3) enable accounts, or (4) disable accounts as a product administrator via unspecified vectors, possibly related to HTTP Referer headers.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://archives.neohapsis.com/archives/fulldisclosure/2008-12/0061.html; http://osvdb.org/50404; http://secunia.com/advisories/32931
CVE: CVE-2008-5401
Published: 2008-12-10
Description: Stack-based buffer overflow in the image tooltip implementation in Trillian before 3.1.12.0 allows remote attackers to execute arbitrary code via a long image filename, related to "AIM IMG Tag Parsing."
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://blog.ceruleanstudios.com/?p=404; http://osvdb.org/50472; http://secunia.com/advisories/33001
CVE: CVE-2008-5402
Published: 2008-12-10
Description: Double free vulnerability in the XML parser in Trillian before 3.1.12.0 allows remote attackers to execute arbitrary code via a crafted XML expression, related to the "IMG SRC ID."
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://blog.ceruleanstudios.com/?p=404; http://osvdb.org/50473; http://secunia.com/advisories/33001
CVE: CVE-2008-5403
Published: 2008-12-10
Description: Heap-based buffer overflow in the XML parser in the AIM plugin in Trillian before 3.1.12.0 allows remote attackers to execute arbitrary code via a malformed XML tag.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://blog.ceruleanstudios.com/?p=404; http://osvdb.org/50474; http://secunia.com/advisories/33001
CVE: CVE-2008-5404
Published: 2008-12-10
Description: Insecure method vulnerability in the FlexCell.Grid ActiveX control in FlexCell.ocx 5.7.0.1 in FlexCell Grid ActiveX Component allows remote attackers to create and overwrite arbitrary files via the HttpDownloadFile method.  NOTE: this could be leveraged for code execution by creating executable files in Startup folders or by accessing files using hcp:// URLs.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/32829; http://www.securityfocus.com/bid/32443; https://exchange.xforce.ibmcloud.com/vulnerabilities/46809
CVE: CVE-2008-5405
Published: 2008-12-10
Description: Stack-based buffer overflow in the RDP protocol password decoder in Cain & Abel 4.9.23 and 4.9.24, and possibly earlier, allows remote attackers to execute arbitrary code via an RDP file containing a long string.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/50342; http://oxid.netsons.org/phpBB2/viewtopic.php?t=2750; http://secunia.com/advisories/32794
CVE: CVE-2008-5406
Published: 2008-12-10
Description: Stack-based buffer overflow in Apple QuickTime Player 7.5.5 and iTunes 8.0.2.20 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a MOV file with "long arguments," related to an "off by one overflow."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://securityreason.com/securityalert/4704; http://www.securityfocus.com/bid/32540; https://exchange.xforce.ibmcloud.com/vulnerabilities/46984
CVE: CVE-2008-5407
Published: 2008-12-10
Description: Multiple unspecified vulnerabilities in the Backup Exec remote-agent logon process in Symantec Backup Exec for Windows Servers 11.0 (aka 11d) builds 6235 and 7170, 12.0 build 1364, and 12.5 build 2213 allow remote attackers to bypass authentication, and read or delete files, via unknown vectors.
CVSS Score: 9.4 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/32810; http://securityresponse.symantec.com/avcenter/security/Content/2008.11.19.html; http://seer.entsupport.symantec.com/docs/314528.htm
CVE: CVE-2008-5408
Published: 2008-12-10
Description: Buffer overflow in the data management protocol in Symantec Backup Exec for Windows Servers 11.0 (aka 11d) builds 6235 and 7170, 12.0 build 1364, and 12.5 build 2213 allows remote authenticated users to cause a denial of service (application crash) and possibly execute arbitrary code via unknown vectors.  NOTE: this can be exploited by unauthenticated remote attackers by leveraging CVE-2008-5407.
CVSS Score: 9.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/32810; http://securityresponse.symantec.com/avcenter/security/Content/2008.11.19.html; http://seer.entsupport.symantec.com/docs/314528.htm
CVE: CVE-2008-5409
Published: 2008-12-10
Description: Unspecified vulnerability in the pdf.xmd module in (1) BitDefender Free Edition 10 and Antivirus Standard 10, (2) BullGuard Internet Security 8.5, and (3) Software602 Groupware Server 6.0.08.1118 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF file, possibly related to included compressed streams that were processed with the ASCIIHexDecode filter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://milw0rm.com/sploits/2008-BitDefenderDOS.zip; http://osvdb.org/50010; http://osvdb.org/50103
CVE: CVE-2008-2249
Published: 2008-12-10
Description: Integer overflow in GDI in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote attackers to execute arbitrary code via a malformed header in a crafted WMF file, which triggers a buffer overflow, aka "GDI Integer Overflow Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=762; http://www.securitytracker.com/id?1021365; http://www.us-cert.gov/cas/techalerts/TA08-344A.html
CVE: CVE-2008-3009
Published: 2008-12-10
Description: Microsoft Windows Media Player 6.4, Windows Media Format Runtime 7.1 through 11, and Windows Media Services 4.1, 9, and 2008 do not properly use the Service Principal Name (SPN) identifier when validating replies to authentication requests, which allows remote servers to execute arbitrary code via vectors that employ NTLM credential reflection, aka "SPN Vulnerability."
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://secunia.com/advisories/33058; http://www.securityfocus.com/bid/32653; http://www.securitytracker.com/id?1021372
CVE: CVE-2008-3010
Published: 2008-12-10
Description: Microsoft Windows Media Player 6.4, Windows Media Format Runtime 7.1 through 11, and Windows Media Services 4.1 and 9 incorrectly associate ISATAP addresses with the Local Intranet zone, which allows remote servers to capture NTLM credentials, and execute arbitrary code through credential-reflection attacks, by sending an authentication request, aka "ISATAP Vulnerability."
CVSS Score: 10.0 (HIGH)
CWE: CWE-200
References: http://secunia.com/advisories/33058; http://www.securityfocus.com/bid/32654; http://www.securitytracker.com/id?1021374
CVE: CVE-2008-3465
Published: 2008-12-10
Description: Heap-based buffer overflow in an API in GDI in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows context-dependent attackers to cause a denial of service or execute arbitrary code via a WMF file with a malformed file-size parameter, which would not be properly handled by a third-party application that uses this API for a copy operation, aka "GDI Heap Overflow Vulnerability."
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securitytracker.com/id?1021365; http://www.us-cert.gov/cas/techalerts/TA08-344A.html; http://www.vupen.com/english/advisories/2008/3383
CVE: CVE-2008-4024
Published: 2008-12-10
Description: Microsoft Office Word 2000 SP3 and 2002 SP3 and Office 2004 for Mac allow remote attackers to execute arbitrary code via a Word document with a crafted lcbPlcfBkfSdt field in the File Information Block (FIB), which bypasses an initialization step and triggers an "arbitrary free," aka "Word Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.coresecurity.com/content/word-arbitrary-free; http://www.coresecurity.com/files/attachments/CORE-2008-0228-Word.pdf; http://www.securityfocus.com/archive/1/499086/100/0/threaded
CVE: CVE-2008-4025
Published: 2008-12-10
Description: Integer overflow in Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Outlook 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via (1) an RTF file or (2) a rich text e-mail message containing an invalid number of points for a polyline or polygon, which triggers a heap-based buffer overflow, aka "Word RTF Object Parsing Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/secunia_research/2008-21/; http://www.securityfocus.com/archive/1/499054/100/0/threaded; http://www.securitytracker.com/id?1021370
CVE: CVE-2008-4026
Published: 2008-12-10
Description: Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via a crafted Word document that contains a malformed value, which triggers memory corruption, aka "Word Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securitytracker.com/id?1021370; http://www.us-cert.gov/cas/techalerts/TA08-344A.html; http://www.vupen.com/english/advisories/2008/3384
CVE: CVE-2008-4027
Published: 2008-12-10
Description: Double free vulnerability in Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Outlook 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1; and Office 2004 for Mac allow remote attackers to execute arbitrary code via a crafted (1) RTF file or (2) rich text e-mail message with multiple consecutive Drawing Object ("\do") tags, which triggers a "memory calculation error" and memory corruption, aka "Word RTF Object Parsing Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/archive/1/499062/100/0/threaded; http://www.securitytracker.com/id?1021370; http://www.us-cert.gov/cas/techalerts/TA08-344A.html
CVE: CVE-2008-4028
Published: 2008-12-10
Description: Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Outlook 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via crafted control words related to multiple Drawing Object tags in (1) an RTF file or (2) a rich text e-mail message, which triggers incorrect memory allocation and a heap-based buffer overflow, aka "Word RTF Object Parsing Vulnerability," a different vulnerability than CVE-2008-4030.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/archive/1/499063/100/0/threaded; http://www.securitytracker.com/id?1021370; http://www.us-cert.gov/cas/techalerts/TA08-344A.html
CVE: CVE-2008-4030
Published: 2008-12-10
Description: Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Outlook 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1 allow remote attackers to execute arbitrary code via crafted control words in (1) an RTF file or (2) a rich text e-mail message, which triggers incorrect memory allocation and memory corruption, aka "Word RTF Object Parsing Vulnerability," a different vulnerability than CVE-2008-4028.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securitytracker.com/id?1021370; http://www.us-cert.gov/cas/techalerts/TA08-344A.html; http://www.vupen.com/english/advisories/2008/3384
CVE: CVE-2008-4031
Published: 2008-12-10
Description: Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Outlook 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via a malformed string in (1) an RTF file or (2) a rich text e-mail message, which triggers incorrect memory allocation and memory corruption, aka "Word RTF Object Parsing Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securitytracker.com/id?1021370; http://www.us-cert.gov/cas/techalerts/TA08-344A.html; http://www.vupen.com/english/advisories/2008/3384
CVE: CVE-2008-4032
Published: 2008-12-10
Description: Microsoft Office SharePoint Server 2007 Gold and SP1 and Microsoft Search Server 2008 do not properly perform authentication and authorization for administrative functions, which allows remote attackers to cause a denial of service (server load), obtain sensitive information, and "create scripts that would run in the context of the site" via requests to administrative URIs, aka "Access Control Vulnerability."
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/33063; http://www.securitytracker.com/id?1021367; http://www.us-cert.gov/cas/techalerts/TA08-344A.html
CVE: CVE-2008-4252
Published: 2008-12-10
Description: The DataGrid ActiveX control in Microsoft Visual Basic 6.0 and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 does not properly handle errors during access to incorrectly initialized objects, which allows remote attackers to execute arbitrary code via a crafted HTML document, related to corruption of the "system state," aka "DataGrid Control Memory Corruption Vulnerability."
CVSS Score: 8.5 (HIGH)
CWE: CWE-264
References: http://support.avaya.com/elmodocs2/security/ASA-2008-473.htm; http://www.securityfocus.com/bid/32591; http://www.securitytracker.com/id?1021369
CVE: CVE-2008-4253
Published: 2008-12-10
Description: The FlexGrid ActiveX control in Microsoft Visual Basic 6.0, Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2, Office FrontPage 2002 SP3, and Office Project 2003 SP3 does not properly handle errors during access to incorrectly initialized objects, which allows remote attackers to execute arbitrary code via a crafted HTML document, related to corruption of the "system state," aka "FlexGrid Control Memory Corruption Vulnerability."
CVSS Score: 8.5 (HIGH)
CWE: CWE-399
References: http://support.avaya.com/elmodocs2/security/ASA-2008-473.htm; http://www.securityfocus.com/bid/32592; http://www.securitytracker.com/id?1021369
CVE: CVE-2008-4254
Published: 2008-12-10
Description: Multiple integer overflows in the Hierarchical FlexGrid ActiveX control (mshflxgd.ocx) in Microsoft Visual Basic 6.0 and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 allow remote attackers to execute arbitrary code via crafted (1) Rows and (2) Cols properties to the (a) ExpandAll and (b) CollapseAll methods, related to access of incorrectly initialized objects and corruption of the "system state," aka "Hierarchical FlexGrid Control Memory Corruption Vulnerability."
CVSS Score: 8.5 (HIGH)
CWE: CWE-189
References: http://secunia.com/secunia_research/2007-72/; http://support.avaya.com/elmodocs2/security/ASA-2008-473.htm; http://www.securityfocus.com/archive/1/499059/100/0/threaded
CVE: CVE-2008-4255
Published: 2008-12-10
Description: Heap-based buffer overflow in mscomct2.ocx (aka Windows Common ActiveX control or Microsoft Animation ActiveX control) in Microsoft Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2, and Office Project 2003 SP3 and 2007 Gold and SP1 allows remote attackers to execute arbitrary code via an AVI file with a crafted stream length, which triggers an "allocation error" and memory corruption, aka "Windows Common AVI Parsing Overflow Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://downloads.securityfocus.com/vulnerabilities/exploits/32613.pl; http://support.avaya.com/elmodocs2/security/ASA-2008-473.htm; http://www.securityfocus.com/archive/1/499061/100/0/threaded
CVE: CVE-2008-4256
Published: 2008-12-10
Description: The Charts ActiveX control in Microsoft Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 does not properly handle errors during access to incorrectly initialized objects, which allows remote attackers to execute arbitrary code via a crafted HTML document, related to corruption of the "system state," aka "Charts Control Memory Corruption Vulnerability."
CVSS Score: 8.5 (HIGH)
CWE: CWE-399
References: http://support.avaya.com/elmodocs2/security/ASA-2008-473.htm; http://www.securityfocus.com/bid/32614; http://www.securitytracker.com/id?1021369
CVE: CVE-2008-4258
Published: 2008-12-10
Description: Microsoft Internet Explorer 5.01 SP4 and 6 SP1 does not properly validate parameters during calls to navigation methods, which allows remote attackers to execute arbitrary code via a crafted HTML document that triggers memory corruption, aka "Parameter Validation Memory Corruption Vulnerability."
CVSS Score: 8.5 (HIGH)
CWE: CWE-399
References: http://www.securitytracker.com/id?1021371; http://www.us-cert.gov/cas/techalerts/TA08-344A.html; http://www.vupen.com/english/advisories/2008/3385
CVE: CVE-2008-4259
Published: 2008-12-10
Description: Microsoft Internet Explorer 7 sometimes attempts to access uninitialized memory locations, which allows remote attackers to execute arbitrary code via a crafted HTML document that triggers memory corruption, related to a WebDAV request for a file with a long name, aka "HTML Objects Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/archive/1/499065/100/0/threaded; http://www.securitytracker.com/id?1021371; http://www.us-cert.gov/cas/techalerts/TA08-344A.html
CVE: CVE-2008-4260
Published: 2008-12-10
Description: Microsoft Internet Explorer 7 sometimes attempts to access a deleted object, which allows remote attackers to execute arbitrary code via a crafted HTML document that triggers memory corruption, aka "Uninitialized Memory Corruption Vulnerability."
CVSS Score: 8.5 (HIGH)
CWE: CWE-399
References: http://www.securitytracker.com/id?1021371; http://www.us-cert.gov/cas/techalerts/TA08-344A.html; http://www.vupen.com/english/advisories/2008/3385
CVE: CVE-2008-4261
Published: 2008-12-10
Description: Stack-based buffer overflow in Microsoft Internet Explorer 5.01 SP4, 6 SP1 on Windows 2000, and 6 on Windows XP and Server 2003 does not properly handle extraneous data associated with an object embedded in a web page, which allows remote attackers to execute arbitrary code via crafted HTML tags that trigger memory corruption, aka "HTML Rendering Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=761; http://www.securitytracker.com/id?1021371; http://www.us-cert.gov/cas/techalerts/TA08-344A.html
CVE: CVE-2008-4264
Published: 2008-12-10
Description: Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via a crafted Excel spreadsheet that contains a malformed formula, which triggers "pointer corruption" during the loading of formulas from this spreadsheet, aka "File Format Parsing Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/32621; http://www.securitytracker.com/id?1021368; http://www.us-cert.gov/cas/techalerts/TA08-344A.html
CVE: CVE-2008-4265
Published: 2008-12-10
Description: Microsoft Office Excel 2000 SP3 allows remote attackers to execute arbitrary code via a crafted Excel spreadsheet that contains a malformed object, which triggers memory corruption during the loading of records from this spreadsheet, aka "File Format Parsing Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=763; http://www.securitytracker.com/id?1021368; http://www.us-cert.gov/cas/techalerts/TA08-344A.html
CVE: CVE-2008-4266
Published: 2008-12-10
Description: Array index vulnerability in Microsoft Office Excel 2000 SP3, 2002 SP3, and 2003 SP3; Excel Viewer 2003 Gold and SP3; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via an Excel spreadsheet with a NAME record that contains an invalid index value, which triggers stack corruption, aka "Excel Global Array Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://secunia.com/secunia_research/2008-36/; http://www.securityfocus.com/archive/1/499055/100/0/threaded; http://www.securitytracker.com/id?1021368
CVE: CVE-2008-4268
Published: 2008-12-10
Description: The Windows Search component in Microsoft Windows Vista Gold and SP1 and Server 2008 does not properly free memory during a save operation for a Windows Search file, which allows remote attackers to execute arbitrary code via a crafted saved-search file, aka "Windows Saved Search Vulnerability."
CVSS Score: 8.5 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/33053; http://www.securitytracker.com/id?1021366; http://www.us-cert.gov/cas/techalerts/TA08-344A.html
CVE: CVE-2008-4269
Published: 2008-12-10
Description: The search-ms protocol handler in Windows Explorer in Microsoft Windows Vista Gold and SP1 and Server 2008 uses untrusted parameter data obtained from incorrect parsing, which allows remote attackers to execute arbitrary code via a crafted HTML document, aka "Windows Search Parsing Vulnerability."
CVSS Score: 8.5 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/33053; http://www.securitytracker.com/id?1021366; http://www.us-cert.gov/cas/techalerts/TA08-344A.html