deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-1076
Published: 2008-02-29
Description: Cross-site scripting (XSS) vulnerability in search.php in Interspire Shopping Cart 1.x allows remote attackers to inject arbitrary web script or HTML via the search_query parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29150; http://www.securityfocus.com/bid/28029; https://exchange.xforce.ibmcloud.com/vulnerabilities/40906
CVE: CVE-2008-1077
Published: 2008-02-29
Description: SQL injection vulnerability in index.php in the Simpleboard (com_simpleboard) 1.0.3 Stable component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in a view action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/28018; https://www.exploit-db.com/exploits/5195; http://www.securityfocus.com/bid/28018
CVE: CVE-2008-0303
Published: 2008-02-29
Description: The FTP print feature in multiple Canon printers, including imageRUNNER and imagePRESS, allow remote attackers to use the server as an inadvertent proxy via a modified PORT command, aka FTP bounce.
CVSS Score: 6.4 (MEDIUM)
References: http://itso.iu.edu/20080229_Canon_MFD_FTP_bounce_attack; http://jvn.jp/en/jp/JVN10056705/index.html; http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000013.html
CVE: CVE-2008-1078
Published: 2008-02-29
Description: expn in the am-utils and net-fs packages for Gentoo, rPath Linux, and other distributions, allows local users to overwrite arbitrary files via a symlink attack on the expn[PID] temporary file.  NOTE: this is the same issue as CVE-2003-0308.1.
CVSS Score: 7.2 (HIGH)
CWE: CWE-59
References: http://bugs.gentoo.org/show_bug.cgi?id=210158; http://secunia.com/advisories/29144; http://secunia.com/advisories/29187
CVE: CVE-2008-1080
Published: 2008-02-29
Description: Opera before 9.26 allows user-assisted remote attackers to read arbitrary files by tricking a user into typing the characters of the target filename into a file input.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00010.html; http://secunia.com/advisories/29029; http://secunia.com/advisories/29152
CVE: CVE-2008-1081
Published: 2008-02-29
Description: Opera before 9.26 allows user-assisted remote attackers to execute arbitrary script via images that contain custom comments, which are treated as script when the user displays the image properties.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00010.html; http://secunia.com/advisories/29029; http://secunia.com/advisories/29152
CVE: CVE-2008-1082
Published: 2008-02-29
Description: Opera before 9.26 allows remote attackers to "bypass sanitization filters" and conduct cross-site scripting (XSS) attacks via crafted attribute values in an XML document, which are not properly handled during DOM presentation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00010.html; http://secunia.com/advisories/29029; http://secunia.com/advisories/29152
CVE: CVE-2008-1095
Published: 2008-02-29
Description: Unspecified vulnerability in the Internet Protocol (IP) implementation in Sun Solaris 8, 9, and 10 allows remote attackers to bypass intended firewall policies or cause a denial of service (panic) via unknown vectors, possibly related to ICMP packets and IP fragment reassembly.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/29100; http://secunia.com/advisories/29379; http://sunsolve.sun.com/search/document.do?assetkey=1-66-200183-1
CVE: CVE-2007-6016
Published: 2008-02-29
Description: Multiple stack-based buffer overflows in the PVATLCalendar.PVCalendar.1 ActiveX control in pvcalendar.ocx in the scheduler component in the Media Server in Symantec Backup Exec for Windows Server (BEWS) 11d 11.0.6235 and 11.0.7170, and 12.0 12.0.1364, allow remote attackers to execute arbitrary code via a long (1) _DOWText0, (2) _DOWText1, (3) _DOWText2, (4) _DOWText3, (5) _DOWText4, (6) _DOWText5, (7) _DOWText6, (8) _MonthText0, (9) _MonthText1, (10) _MonthText2, (11) _MonthText3, (12) _MonthText4, (13) _MonthText5, (14) _MonthText6, (15) _MonthText7, (16) _MonthText8, (17) _MonthText9, (18) _MonthText10, or (19) _MonthText11 property value when executing the Save method. NOTE: the vendor states "Authenticated user involvement required," but authentication is not needed to attack a client machine that loads this control.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/27885; http://secunia.com/secunia_research/2007-101/advisory/; http://securitytracker.com/id?1019524
CVE: CVE-2007-6017
Published: 2008-02-29
Description: The PVATLCalendar.PVCalendar.1 ActiveX control in pvcalendar.ocx in the scheduler component in the Media Server in Symantec Backup Exec for Windows Server (BEWS) 11d 11.0.6235 and 11.0.7170, and 12.0 12.0.1364, exposes the unsafe Save method, which allows remote attackers to cause a denial of service (browser crash), or create or overwrite arbitrary files, via string values of the (1) _DOWText0, (2) _DOWText1, (3) _DOWText2, (4) _DOWText3, (5) _DOWText4, (6) _DOWText5, (7) _DOWText6, (8) _MonthText0, (9) _MonthText1, (10) _MonthText2, (11) _MonthText3, (12) _MonthText4, (13) _MonthText5, (14) _MonthText6, (15) _MonthText7, (16) _MonthText8, (17) _MonthText9, (18) _MonthText10, and (19) _MonthText11 properties. NOTE: the vendor states "Authenticated user involvement required," but authentication is not needed to attack a client machine that loads this control.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/27885; http://secunia.com/secunia_research/2007-101/; http://securitytracker.com/id?1019525
CVE: CVE-2008-0304
Published: 2008-02-29
Description: Heap-based buffer overflow in Mozilla Thunderbird before 2.0.0.12 and SeaMonkey before 1.1.8 might allow remote attackers to execute arbitrary code via a crafted external-body MIME type in an e-mail message, related to an incorrect memory allocation during message preview.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=668; http://secunia.com/advisories/29098; http://secunia.com/advisories/29133
CVE: CVE-2008-0385
Published: 2008-02-29
Description: SQL injection vulnerability in server/widgetallocator.php in Urulu 2.1 allows remote attackers to execute arbitrary SQL commands via the connectionId parameter to index.php with (1) statprt/js/request or (2) dyn/js/request in the PATH_INFO.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29162; http://securityreason.com/securityalert/3707; http://www.csnc.ch/misc/files/advisories/CVE-2008-0385.txt
CVE: CVE-2008-0595
Published: 2008-02-29
Description: dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes in allow directives in the security policy only for fully qualified method calls, which allows local users to bypass intended access restrictions via a method call with a NULL interface.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-863
References: http://lists.freedesktop.org/archives/dbus/2008-February/009401.html; http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00004.html; http://lists.opensuse.org/opensuse-updates/2012-10/msg00094.html
CVE: CVE-2008-0886
Published: 2008-02-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2008-0882.  Reason: This candidate is a duplicate of CVE-2008-0882.  Notes: All CVE users should reference CVE-2008-0882 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2008-1110
Published: 2008-02-29
Description: Buffer overflow in demuxers/demux_asf.c (aka the ASF demuxer) in the xineplug_dmx_asf.so plugin in xine-lib before 1.1.10 allows remote attackers to execute arbitrary code or cause a denial of service (crash) via a crafted ASF header.  NOTE: this issue leads to a crash when an attack uses the CVE-2006-1664 exploit code, but it is different from CVE-2006-1664.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://bugs.gentoo.org/show_bug.cgi?id=208100; http://hg.debian.org/hg/xine-lib/xine-lib?cmd=changeset%3Bnode=fb6d089b520dca199ef16a046da28c50c984c2d2%3Bstyle=gitweb; http://secunia.com/advisories/29141
CVE: CVE-2007-6252
Published: 2008-03-03
Description: Multiple stack-based buffer overflows in the Learn2 Corporation STRunner (aka Street Technologies) ActiveX control in iestm32.dll allow remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/29195; http://www.kb.cert.org/vuls/id/524857; http://www.securityfocus.com/bid/28058
CVE: CVE-2008-1112
Published: 2008-03-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2008-0928.  Reason: This candidate is a duplicate of CVE-2008-0928.  Notes: All CVE users should reference CVE-2008-0928 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CWE: CWE-264
CVE: CVE-2008-1113
Published: 2008-03-03
Description: Cisco Unified Wireless IP Phone 7921, when using Protected Extensible Authentication Protocol (PEAP), does not validate server certificates, which allows remote wireless access points to steal hashed passwords and conduct man-in-the-middle (MITM) attacks.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://blogs.zdnet.com/security/?p=896; http://blogs.zdnet.com/security/?p=901; http://seclists.org/fulldisclosure/2008/Feb/0402.html
CVE: CVE-2008-1114
Published: 2008-03-03
Description: Vocera Communications wireless handsets, when using Protected Extensible Authentication Protocol (PEAP), do not validate server certificates, which allows remote wireless access points to steal hashed passwords and conduct man-in-the-middle (MITM) attacks.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://blogs.zdnet.com/security/?p=896; http://blogs.zdnet.com/security/?p=901; http://seclists.org/fulldisclosure/2008/Feb/0402.html
CVE: CVE-2008-1115
Published: 2008-03-03
Description: Unspecified vulnerability in Sun Solaris 8 directory functions allows local users to cause a denial of service (panic) via an unspecified sequence of system calls or commands.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-78
References: http://secunia.com/advisories/29217; http://sunsolve.sun.com/search/document.do?assetkey=1-66-200163-1; http://www.securityfocus.com/bid/28069
CVE: CVE-2008-1116
Published: 2008-03-03
Description: Insecure method vulnerability in the Web Scan Object ActiveX control (OL2005.dll) in Rising Antivirus Online Scanner allows remote attackers to force the download and execution of arbitrary code by setting the BaseURL property and invoking the UpdateEngine method. NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/29109; http://www.securityfocus.com/bid/27997; http://www.vupen.com/english/advisories/2008/0683/references
CVE: CVE-2008-0928
Published: 2008-03-03
Description: Qemu 0.9.1 and earlier does not perform range checks for block device read or write requests, which allows guest host users with root privileges to access arbitrary memory and escape the virtual machine.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html; http://marc.info/?l=debian-security&m=[PII_REDACTED]7055&w=2; http://secunia.com/advisories/29081
CVE: CVE-2008-1119
Published: 2008-03-03
Description: Directory traversal vulnerability in include/doc/get_image.php in Centreon 1.4.2.3 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the img parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.centreon.com/Product/Changelog-Centreon-1.4.x.html; http://www.securityfocus.com/bid/28022; https://www.exploit-db.com/exploits/5204
CVE: CVE-2008-1120
Published: 2008-03-03
Description: Format string vulnerability in the embedded Internet Explorer component for Mirabilis ICQ 6 build 6043 allows remote servers to execute arbitrary code or cause a denial of service (crash) via unspecified vectors related to HTML code generation.
CVSS Score: 9.3 (HIGH)
CWE: CWE-134
References: http://board.raidrush.ws/showthread.php?t=386983; http://secunia.com/advisories/29138; http://www.securityfocus.com/bid/28027
CVE: CVE-2008-1121
Published: 2008-03-03
Description: SQL injection vulnerability in index.php in eazyPortal 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the session_vars cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29123; http://www.securityfocus.com/bid/28019; https://www.exploit-db.com/exploits/5196
CVE: CVE-2008-1122
Published: 2008-03-03
Description: SQL injection vulnerability in the downloads module in Koobi Pro 5.7 allows remote attackers to execute arbitrary SQL commands via the categ parameter to index.php.  NOTE: it was later reported that this also affects Koobi CMS 4.2.4, 4.2.5, and 4.3.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/archive/1/490886/100/0/threaded; http://www.securityfocus.com/bid/28031; https://exchange.xforce.ibmcloud.com/vulnerabilities/40903
CVE: CVE-2008-1123
Published: 2008-03-03
Description: Multiple PHP remote file inclusion vulnerabilities in SiteBuilder Elite 1.2 allow remote attackers to execute arbitrary PHP code via a URL in the CarpPath parameter to (1) files/carprss.php and (2) files/amazon-bestsellers.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://www.securityfocus.com/bid/28036; https://www.exploit-db.com/exploits/5199; http://www.securityfocus.com/bid/28036
CVE: CVE-2008-1124
Published: 2008-03-03
Description: Multiple PHP remote file inclusion vulnerabilities in Podcast Generator 1.0 BETA 2 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the absoluteurl parameter to (1) components/xmlparser/loadparser.php; (2) admin.php, (3) categories.php, (4) categories_add.php, (5) categories_remove.php, (6) edit.php, (7) editdel.php, (8) ftpfeature.php, (9) login.php, (10) pgRSSnews.php, (11) showcat.php, and (12) upload.php in core/admin/; and (13) archive_cat.php, (14) archive_nocat.php, and (15) recent_list.php in core/.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://www.securityfocus.com/bid/28038; https://www.exploit-db.com/exploits/5200; http://www.securityfocus.com/bid/28038
CVE: CVE-2008-1125
Published: 2008-03-03
Description: Multiple directory traversal vulnerabilities in Podcast Generator 1.0 BETA 2 and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) theme_path parameter to core/themes.php and the (2) filename parameter to download.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/28038; https://www.exploit-db.com/exploits/5200; http://www.securityfocus.com/bid/28038
CVE: CVE-2008-1126
Published: 2008-03-03
Description: PHP remote file inclusion vulnerability in main.php in Barryvan Compo Manager 0.3 allows remote attackers to execute arbitrary PHP code via a URL in the pageURL parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://www.securityfocus.com/bid/28035; https://www.exploit-db.com/exploits/5202; http://www.securityfocus.com/bid/28035
CVE: CVE-2008-1127
Published: 2008-03-03
Description: Format string vulnerability in the cryactio function in Crysis 1.1.1.5879 allows remote authenticated users to execute arbitrary code via format string specifiers in the user name, which is triggered when the game character is killed.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-134
References: http://secunia.com/advisories/29155; http://www.securityfocus.com/bid/28039; http://www.vupen.com/english/advisories/2008/0735
CVE: CVE-2008-1128
Published: 2008-03-03
Description: PHP remote file inclusion vulnerability in tourney/index.php in phpMyTourney 2 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://securityreason.com/securityalert/3708; http://www.securityfocus.com/archive/1/488951/100/0/threaded; http://www.securityfocus.com/bid/28057
CVE: CVE-2008-0930
Published: 2008-03-04
Description: w_editeur.c in XWine 1.0.1 for Debian GNU/Linux allows local users to overwrite or print arbitrary files via a symlink attack on the temporaire temporary file.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.2 (HIGH)
CWE: CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=468050; http://secunia.com/advisories/29125; http://secunia.com/advisories/29452
CVE: CVE-2008-0931
Published: 2008-03-04
Description: w_export.c in XWine 1.0.1 on Debian GNU/Linux sets insecure permissions (0666) for /etc/wine/config, which might allow local users to execute arbitrary commands or cause a denial of service by modifying the file.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-264
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=468050; http://secunia.com/advisories/29125; http://secunia.com/advisories/29452
CVE: CVE-2008-1129
Published: 2008-03-04
Description: Cross-site scripting (XSS) vulnerability in admin/users/self.php in XRMS CRM allows remote attackers to inject arbitrary web script or HTML via the msg parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29177; http://securityreason.com/securityalert/3709; http://www.securityfocus.com/archive/1/488925/100/0/threaded
CVE: CVE-2008-1130
Published: 2008-03-04
Description: Unspecified vulnerability in IBM WebSphere MQ 6.0.x before 6.0.2.2 and 5.3 before Fix Pack 14 allows attackers to bypass access restrictions for a queue manager via a SVRCONN (MQ client) channel.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/29170; http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg1IZ01272; http://www.securityfocus.com/bid/28046
CVE: CVE-2008-1131
Published: 2008-03-04
Description: Cross-site scripting (XSS) vulnerability in Drupal 6.0 allows remote authenticated users to inject arbitrary web script or HTML via titles in content edit forms.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/227608; http://secunia.com/advisories/29118; http://www.securityfocus.com/bid/28026
CVE: CVE-2008-1132
Published: 2008-03-04
Description: Untrusted search path vulnerability in src/mainwindow.c in Net Activity Viewer 0.2.1 allows local users with Net Activity Viewer privileges to execute arbitrary code via a malicious gksu program, which is invoked during the Restart As Root action.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/29097; http://sourceforge.net/project/shownotes.php?release_id=579181; http://secunia.com/advisories/29097
CVE: CVE-2008-1079
Published: 2008-03-04
Description: The outboxWriteUnsent function in FTPThread.class in SendFile.jar for Beehive Software SendFile.NET uses hard-coded credentials for an FTP server, which allows remote attackers to gain privileges.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/29197; http://securityreason.com/securityalert/3711; http://www.securityfocus.com/archive/1/488947/100/0/threaded
CVE: CVE-2008-1133
Published: 2008-03-04
Description: The Drupal.checkPlain function in Drupal 6.0 only escapes the first instance of a character in ECMAScript, which allows remote attackers to conduct cross-site scripting (XSS) attacks.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/227608; http://secunia.com/advisories/29118; http://www.securityfocus.com/bid/28026
CVE: CVE-2007-6702
Published: 2008-03-04
Description: goform/QuickStart_c0 on the GoAhead Web Server on the FS4104-AW (aka rooter) VDSL device contains a password in the typepassword field, which allows remote attackers to obtain this password by reading the HTML source, a different vulnerability than CVE-2002-1603.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/43168; https://exchange.xforce.ibmcloud.com/vulnerabilities/39149; https://www.exploit-db.com/exploits/4744
CVE: CVE-2007-6703
Published: 2008-03-04
Description: Unspecified vulnerability in vdccm before 0.10.1 in SynCE (SynCE-dccm) might allow attackers to cause a denial of service via unspecified vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/29228; http://secunia.com/advisories/29285; http://sourceforge.net/forum/forum.php?forum_id=766440
CVE: CVE-2008-1134
Published: 2008-03-04
Description: OMEGA (aka Omegasoft) INterneSErvicesLosungen (INSEL) 7 supports authentication with a cookie that lacks a shared secret, which allows remote attackers to login as an arbitrary user via a modified cookie.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/28410; http://www.securityfocus.com/archive/1/486009/100/0/threaded; http://www.securityfocus.com/bid/27210
CVE: CVE-2008-1135
Published: 2008-03-04
Description: OMEGA (aka Omegasoft) INterneSErvicesLosungen (INSEL) 7 generates different responses depending on whether or not a username is valid in a failed login attempt, which allows remote attackers to enumerate valid usernames.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/28410; http://www.securityfocus.com/archive/1/486009/100/0/threaded; http://www.securityfocus.com/bid/27210
CVE: CVE-2008-1136
Published: 2008-03-04
Description: The Utils::runScripts function in src/utils.cpp in vdccm 0.92 through 0.10.0 in SynCE (SynCE-dccm) allows remote attackers to execute arbitrary commands via shell metacharacters in a certain string to TCP port 5679.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20, CWE-94
References: http://secunia.com/advisories/29228; http://secunia.com/advisories/29285; http://securityreason.com/securityalert/3710
CVE: CVE-2008-1137
Published: 2008-03-04
Description: SQL injection vulnerability in the Garys Cookbook (com_garyscookbook) 1.1.1 and earlier component for Mambo and Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29090; http://www.securityfocus.com/archive/1/488696/100/100/threaded; http://www.securityfocus.com/bid/27972
CVE: CVE-2008-1138
Published: 2008-03-04
Description: DLMFENC.sys 1.0.0.26 in DESlock+ 3.2.6 and earlier allows local users to cause a denial of service (system crash) via a certain ZERO_MEM DLMFENC_IOCTL request to \\.\DLKPFSD_Device, aka the "ring0 link list zero" vulnerability.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/29005; http://www.vupen.com/english/advisories/2008/0597; https://exchange.xforce.ibmcloud.com/vulnerabilities/41204
CVE: CVE-2008-1139
Published: 2008-03-04
Description: DESlock+ 3.2.6 and earlier, when DLMFENC.sys 1.0.0.26 and DLMFDISK.sys 1.2.0.27 are present, allows local users to gain privileges via a certain DLMFENC_IOCTL request to \\.\DLKPFSD_Device that overwrites a pointer, aka the "ring0 link list zero SYSTEM" vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/29005; http://www.vupen.com/english/advisories/2008/0597; https://www.exploit-db.com/exploits/5143
CVE: CVE-2008-1140
Published: 2008-03-04
Description: DLMFDISK.sys 1.2.0.27 in DESlock+ 3.2.6 and earlier allows local users to gain privileges via a certain DLKFDISK_IOCTL request to \\.\DLKFDisk_Control that overwrites a data structure associated with a mounted pseudo-filesystem, aka the "ring0 SYSTEM" vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/29005; http://www.vupen.com/english/advisories/2008/0597; https://www.exploit-db.com/exploits/5144