deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-0774
Published: 2009-03-05
Description: The layout engine in Mozilla Firefox 2 and 3 before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey 1.1.15 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to gczeal, a different vulnerability than CVE-2009-0773.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00009.html; http://secunia.com/advisories/34137
CVE: CVE-2009-0775
Published: 2009-03-05
Description: Double free vulnerability in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 allows remote attackers to execute arbitrary code via "cloned XUL DOM elements which were linked as a parent and child," which are not properly handled during garbage collection.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00002.html; http://secunia.com/advisories/34137; http://secunia.com/advisories/34140
CVE: CVE-2009-0776
Published: 2009-03-05
Description: nsIRDFService in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 allows remote attackers to bypass the same-origin policy and read XML data from another domain via a cross-domain redirect.
CVSS Score: 7.1 (HIGH)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00009.html; http://secunia.com/advisories/34137
CVE: CVE-2009-0777
Published: 2009-03-05
Description: Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 decode invisible characters when they are displayed in the location bar, which causes an incorrect address to be displayed and makes it easier for remote attackers to spoof URLs and conduct phishing attacks.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00002.html; http://secunia.com/advisories/34140; http://secunia.com/advisories/34145
CVE: CVE-2009-0813
Published: 2009-03-05
Description: Insecure method vulnerability in the ImeraIEPlugin ActiveX control (ImeraIEPlugin.dll 1.0.2.54) in Imera TeamLinks Client allows remote attackers to force the download and execution of arbitrary URLs via modified DownloadProtocol, DownloadHost, DownloadPort, and DownloadURI parameters.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/34103; http://www.vupen.com/english/advisories/2009/0591; https://exchange.xforce.ibmcloud.com/vulnerabilities/49028
CVE: CVE-2009-0814
Published: 2009-03-05
Description: Cross-site scripting (XSS) vulnerability in Widgets.aspx in Blogsa 1.0 Beta 3 and earlier allows remote attackers to inject arbitrary web script or HTML via the searchText parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/501382/100/0/threaded; http://www.securityfocus.com/bid/33957; https://exchange.xforce.ibmcloud.com/vulnerabilities/49024
CVE: CVE-2009-0815
Published: 2009-03-05
Description: The jumpUrl mechanism in class.tslib_fe.php in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1 before 4.1.10, 4.2 before 4.2.6, and 4.3alpha1 leaks a hash secret (juHash) in an error message, which allows remote attackers to read arbitrary files by including the hash in a request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-002/; http://www.debian.org/security/2009/dsa-1720; http://www.openwall.com/lists/oss-security/2009/02/10/6
CVE: CVE-2009-0816
Published: 2009-03-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in the backend user interface in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1 before 4.1.10, 4.2 before 4.2.6, and 4.3alpha1 allow remote attackers to inject arbitrary web script or HTML via unspecified fields.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-002/; http://www.debian.org/security/2009/dsa-1720; http://www.openwall.com/lists/oss-security/2009/02/10/6
CVE: CVE-2009-0817
Published: 2009-03-05
Description: Cross-site scripting (XSS) vulnerability in the Protected Node module 5.x before 5.x-1.4 and 6.x before 6.x-1.5, a module for Drupal, allows remote authenticated users with "administer site configuration" permissions to inject arbitrary web script or HTML via the Password page info field, which is not properly handled by the protected_node_enterpassword function in protected_node.module.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/385950; http://drupal.org/node/386604; http://drupal.org/node/386606
CVE: CVE-2009-0818
Published: 2009-03-05
Description: Cross-site scripting (XSS) vulnerability in the taxonomy_theme_admin_table_builder function (taxonomy_theme_admin.inc) in Taxonomy Theme module before 5.x-1.2, a module for Drupal, allows remote authenticated users with the "administer taxonomy" permission, or the ability to create pages when tagging is enabled, to inject arbitrary web script or HTML via the Vocabulary name (name parameter) to index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/386940; http://drupal.org/node/386942; http://osvdb.org/52285
CVE: CVE-2009-0819
Published: 2009-03-05
Description: sql/item_xmlfunc.cc in MySQL 5.1 before 5.1.32 and 6.0 before 6.0.10 allows remote authenticated users to cause a denial of service (crash) via "an XPath expression employing a scalar expression as a FilterExpr with ExtractValue() or UpdateXML()," which triggers an assertion failure.
CVSS Score: 4.0 (MEDIUM)
References: http://bugs.mysql.com/bug.php?id=42495; http://dev.mysql.com/doc/refman/5.1/en/news-5-1-32.html; http://dev.mysql.com/doc/refman/6.0/en/news-6-0-10.html
CVE: CVE-2009-0820
Published: 2009-03-05
Description: Multiple eval injection vulnerabilities in phpScheduleIt before 1.2.11 allow remote attackers to execute arbitrary code via (1) the end_date parameter to reserve.php and (2) the start_date and end_date parameters to check.php.  NOTE: the start_date/reserve.php vector is already covered by CVE-2008-6132.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://phpscheduleit.svn.sourceforge.net/viewvc/phpscheduleit/1.2.11/check.php?r1=318&r2=332; http://phpscheduleit.svn.sourceforge.net/viewvc/phpscheduleit/1.2.11/reserve.php?r1=318&r2=328; http://secunia.com/advisories/33991
CVE: CVE-2009-0821
Published: 2009-03-05
Description: Mozilla Firefox 2.0.0.20 and earlier allows remote attackers to cause a denial of service (application crash) via nested calls to the window.print function, as demonstrated by a window.print(window.print()) in the onclick attribute of an INPUT element.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://downloads.securityfocus.com/vulnerabilities/exploits/33969.html; http://www.securityfocus.com/bid/33969; http://downloads.securityfocus.com/vulnerabilities/exploits/33969.html
CVE: CVE-2008-6399
Published: 2009-03-05
Description: Unspecified vulnerability in DotNetNuke 4.5.2 through 4.9 allows remote attackers to "add additional roles to their user account" via unknown attack vectors.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/51141; http://secunia.com/advisories/33401; http://www.dotnetnuke.com/News/SecurityPolicy/Securitybulletinno24/tabid/1188/Default.aspx
CVE: CVE-2008-6400
Published: 2009-03-05
Description: Cross-site scripting (XSS) vulnerability in refbase before 0.9.5 allows remote attackers to inject arbitrary web script or HTML via the headerMsg parameter to (1) show.php and (2) search.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/32815; http://sourceforge.net/project/shownotes.php?release_id=641612; http://www.securityfocus.com/bid/32372
CVE: CVE-2009-0826
Published: 2009-03-05
Description: BlogHelper stores common_db.inc under the web root with insufficient access control, which allows remote attackers to download the database file containing user credentials via a direct request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/33384; https://exchange.xforce.ibmcloud.com/vulnerabilities/47799; https://www.exploit-db.com/exploits/7689
CVE: CVE-2009-0827
Published: 2009-03-05
Description: PollHelper stores poll.inc under the web root with insufficient access control, which allows remote attackers to download the database file containing user credentials via a direct request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/51185; http://secunia.com/advisories/33378; https://exchange.xforce.ibmcloud.com/vulnerabilities/47797
CVE: CVE-2009-0828
Published: 2009-03-05
Description: QuoteBook stores quotes.inc under the web root with insufficient access control, which allows remote attackers to obtain sensitive database information, including user credentials, via a direct request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/33420; http://www.securityfocus.com/bid/33166; https://www.exploit-db.com/exploits/7699
CVE: CVE-2009-0829
Published: 2009-03-05
Description: Multiple SQL injection vulnerabilities in QuoteBook allow remote attackers to execute arbitrary SQL commands via the (1) MyBox and (2) selectFavorites parameters to (a) quotes.php and the (3) QuoteName and (4) QuoteText parameters to (b) quotesadd.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33420; http://www.securityfocus.com/bid/33166; http://secunia.com/advisories/33420
CVE: CVE-2009-0830
Published: 2009-03-05
Description: Cross-site scripting (XSS) vulnerability in QuoteBook allows remote attackers to inject arbitrary web script or HTML via the (1) QuoteName and (2) QuoteText parameters to quotesadd.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/33420; http://www.securityfocus.com/bid/33166; http://secunia.com/advisories/33420
CVE: CVE-2009-0831
Published: 2009-03-05
Description: SQL injection vulnerability in members.php in the Members CV (job) module 1.0 for PHP-Fusion, when magic_quotes_gpc is disabled, allows remote authenticated users to execute arbitrary SQL commands via the sortby parameter.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/33424; http://www.securityfocus.com/bid/33156; https://www.exploit-db.com/exploits/7697
CVE: CVE-2009-0832
Published: 2009-03-05
Description: SQL injection vulnerability in items.php in the E-Cart module 1.3 for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the CA parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/archive/1/499835/100/0/threaded; http://www.securityfocus.com/bid/33155; https://www.exploit-db.com/exploits/7698
CVE: CVE-2009-0833
Published: 2009-03-05
Description: Heap-based buffer overflow in gen_msn.dll in the gen_msn plugin 0.31 for Winamp 5.541 allows remote attackers to execute arbitrary code via a playlist (.pls) file with a long URL in the File1 field.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/33425; http://www.securityfocus.com/bid/33159; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15659
CVE: CVE-2009-0760
Published: 2009-03-06
Description: Team Board 1.x and 2.x stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing credentials via a direct request for data/team.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://packetstorm.linuxsecurity.com/0902-exploits/teamboard-ddxss.txt; http://secunia.com/advisories/33839; http://www.osvdb.org/51752
CVE: CVE-2009-0761
Published: 2009-03-06
Description: Cross-site scripting (XSS) vulnerability in online.asp in Team Board 1.x allows remote attackers to inject arbitrary web script or HTML via the lookname parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/33614; https://www.exploit-db.com/exploits/7982; http://www.securityfocus.com/bid/33614
CVE: CVE-2009-0762
Published: 2009-03-06
Description: Cross-site scripting (XSS) vulnerability in ScriptsEz Ez PHP Comment allows remote attackers to inject arbitrary web script or HTML via the name parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/51738; http://secunia.com/advisories/33804; http://www.securityfocus.com/bid/33587
CVE: CVE-2009-0763
Published: 2009-03-06
Description: Cross-site scripting (XSS) vulnerability in default.php in Kipper 2.01 allows remote attackers to inject arbitrary web script or HTML via the charm parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/33832; http://www.securityfocus.com/bid/33640; https://www.exploit-db.com/exploits/7993
CVE: CVE-2009-0764
Published: 2009-03-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in Kipper 2.01 allow remote attackers to inject arbitrary web script or HTML via the charm parameter to (1) index.php and (2) kipper.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/33832; http://secunia.com/advisories/33832
CVE: CVE-2009-0765
Published: 2009-03-06
Description: Directory traversal vulnerability in index.php in Kipper 2.01 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the configfile parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/33832; http://www.securityfocus.com/bid/33640; https://exchange.xforce.ibmcloud.com/vulnerabilities/49271
CVE: CVE-2009-0766
Published: 2009-03-06
Description: Directory traversal vulnerability in default.php in Kipper 2.01 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the configfile parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/33832; http://secunia.com/advisories/33832
CVE: CVE-2009-0767
Published: 2009-03-06
Description: Kipper 2.01 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a file containing credentials via a direct request for job/config.data.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/33832; https://www.exploit-db.com/exploits/7993; http://secunia.com/advisories/33832
CVE: CVE-2009-0768
Published: 2009-03-06
Description: SQL injection vulnerability in forumhop.php in YapBB 1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the forumID parameter in a next action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/33620; https://www.exploit-db.com/exploits/7984; http://www.securityfocus.com/bid/33620
CVE: CVE-2009-0769
Published: 2009-03-06
Description: QIP 2005 build 8082 allows remote attackers to cause a denial of service (CPU consumption and application hang) via a crafted Rich Text Format (RTF) ICQ message, as demonstrated by an {\rtf\pict\&&} message.  NOTE: the vulnerability may be in Sergey Tkachenko TRichView. If so, then this should not be treated as a vulnerability in QIP.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/33851; http://www.osvdb.org/51755; http://www.securityfocus.com/archive/1/500656/100/0/threaded
CVE: CVE-2009-0770
Published: 2009-03-06
Description: dkim-milter 2.6.0 through 2.8.0 allows remote attackers to cause a denial of service (crash) by signing a message with a key that has been revoked in DNS, which triggers an assertion error.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/33581; http://secunia.com/advisories/34053; http://sourceforge.net/project/shownotes.php?release_id=654247
CVE: CVE-2008-6401
Published: 2009-03-06
Description: SQL injection vulnerability in sayfa.php in JETIK-WEB allows remote attackers to execute arbitrary SQL commands via the kat parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31932; http://www.securityfocus.com/bid/31343; https://exchange.xforce.ibmcloud.com/vulnerabilities/45392
CVE: CVE-2008-6402
Published: 2009-03-06
Description: PHP remote file inclusion vulnerability in hu/modules/reg-new/modstart.php in Sofi WebGui 0.6.3 PRE and earlier allows remote attackers to execute arbitrary PHP code via a URL in the mod_dir parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/31341; https://exchange.xforce.ibmcloud.com/vulnerabilities/45380; https://www.exploit-db.com/exploits/6539
CVE: CVE-2008-6403
Published: 2009-03-06
Description: PHP remote file inclusion vulnerability in themes/default/include/html/insert.inc.php in OpenRat 0.8-beta4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the tpl_dir parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/31339; https://exchange.xforce.ibmcloud.com/vulnerabilities/45363; https://www.exploit-db.com/exploits/6538
CVE: CVE-2008-6404
Published: 2009-03-06
Description: Cross-site scripting (XSS) vulnerability in add_calendars.php in eXtrovert Software Thyme 1.3 allows remote attackers to inject arbitrary web script or HTML via the callback parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.digitrustgroup.com/advisories/web-application-security-thyme2.html; http://www.securityfocus.com/bid/31287; https://exchange.xforce.ibmcloud.com/vulnerabilities/45302
CVE: CVE-2008-6405
Published: 2009-03-06
Description: SQL injection vulnerability in showcategory.php in Hotscripts Clone allows remote attackers to execute arbitrary SQL commands via the cid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/31345; https://exchange.xforce.ibmcloud.com/vulnerabilities/45362; https://www.exploit-db.com/exploits/6545
CVE: CVE-2008-6406
Published: 2009-03-06
Description: Cross-site scripting (XSS) vulnerability in admin.php in DataLife Engine (DLE) 7.2 allows remote attackers to inject arbitrary web script or HTML via the query string.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/31998; http://www.securityfocus.com/archive/1/496605/100/0/threaded; http://www.securityfocus.com/bid/31335
CVE: CVE-2008-6407
Published: 2009-03-06
Description: Directory traversal vulnerability in frame.php in ol'bookmarks manager 0.7.5 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the framefile parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/31706; http://www.securityfocus.com/bid/31348; https://www.exploit-db.com/exploits/6547
CVE: CVE-2008-6408
Published: 2009-03-06
Description: PHP remote file inclusion vulnerability in frame.php in ol'bookmarks manager 0.7.5 allows remote attackers to execute arbitrary PHP code via a URL in the framefile parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/31706; http://www.securityfocus.com/bid/31348; https://exchange.xforce.ibmcloud.com/vulnerabilities/45367
CVE: CVE-2008-6409
Published: 2009-03-06
Description: SQL injection vulnerability in index.php in ol'bookmarks manager 0.7.5 allows remote attackers to execute arbitrary SQL commands via the id parameter in a brain action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/45368; https://www.exploit-db.com/exploits/6547; https://exchange.xforce.ibmcloud.com/vulnerabilities/45368
CVE: CVE-2008-6410
Published: 2009-03-06
Description: Directory traversal vulnerability in show.php in ol'bookmarks manager 0.7.5 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the show parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/31706; http://www.securityfocus.com/bid/31348; https://www.exploit-db.com/exploits/6543
CVE: CVE-2008-6411
Published: 2009-03-06
Description: Explay CMS 2.1 and earlier allows remote attackers to bypass authentication and gain administrative access by setting the login cookie to 1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.securityfocus.com/bid/31270; https://exchange.xforce.ibmcloud.com/vulnerabilities/45300; https://www.exploit-db.com/exploits/6500
CVE: CVE-2008-6412
Published: 2009-03-06
Description: Unspecified vulnerability in Vignette Content Management 7.3.0.5, 7.3.1, 7.3.1.1, 7.4, and 7.5 allows "low privileged" users to gain administrator privileges via unknown attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://dialog.vignette.com/hm?g=1.2jds7.bky8.rs.0.27gqh.htk8&h=1; http://secunia.com/advisories/31983; http://www.securityfocus.com/bid/31328
CVE: CVE-2008-6413
Published: 2009-03-06
Description: Cross-site scripting (XSS) vulnerability in the Answers module 5.x-1.x-dev and possibly other 5.x versions, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via a Simple Answer to a question.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/310223; http://seclists.org/fulldisclosure/2008/Sep/0202.html; http://www.securityfocus.com/bid/31146
CVE: CVE-2008-6414
Published: 2009-03-06
Description: SQL injection vulnerability in detail.php in AJ Auction Pro Platinum Skin 2 allows remote attackers to execute arbitrary SQL commands via the item_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/31362; https://exchange.xforce.ibmcloud.com/vulnerabilities/45399; https://www.exploit-db.com/exploits/6550
CVE: CVE-2008-6415
Published: 2009-03-06
Description: Buffer overflow in YoungZSoft CCProxy 6.5 might allow remote attackers to execute arbitrary code via a CONNECTION request with a long hostname.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://jbrownsec.blogspot.com/2008/09/ccproxy-near-stealth-patching.html; http://secunia.com/advisories/31997; http://www.securityfocus.com/bid/31416
CVE: CVE-2009-0834
Published: 2009-03-06
Description: The audit_syscall_entry function in the Linux kernel 2.6.28.7 and earlier on the x86_64 platform does not properly handle (1) a 32-bit process making a 64-bit syscall or (2) a 64-bit process making a 32-bit syscall, which allows local users to bypass certain syscall audit configurations via crafted syscalls, a related issue to CVE-2009-0342 and CVE-2009-0343.
CVSS Score: 3.6 (LOW)
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=ccbe495caa5e604b04d5a31d7459a6f6a76a756c; http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00000.html