deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-2238
Published: 2009-06-27
Description: Unrestricted file upload vulnerability in includes/shared_scripts/wysiwyg_editor/assetmanager/assetmanager.asp in DMXReady Registration Manager 1.1 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in assets/webblogmanager.
CVSS Score: 6.8 (MEDIUM)
References: http://www.exploit-db.com/exploits/8749; http://www.securityfocus.com/archive/1/503648/100/0/threaded; http://www.securityfocus.com/bid/35039
CVE: CVE-2009-2239
Published: 2009-06-27
Description: SQL injection vulnerability in the (1) casinobase (com_casinobase), (2) casino_blackjack (com_casino_blackjack), and (3) casino_videopoker (com_casino_videopoker) components 0.3.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/8743; http://www.securityfocus.com/bid/35041; https://exchange.xforce.ibmcloud.com/vulnerabilities/50645
CVE: CVE-2009-2240
Published: 2009-06-27
Description: Cross-site scripting (XSS) vulnerability in AD2000 free-sw leger (aka Web Conference Room Free) 1.6.4 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN57036470/index.html; http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000031.html; http://secunia.com/advisories/35148
CVE: CVE-2009-2241
Published: 2009-06-27
Description: Cross-site scripting (XSS) vulnerability in search.asp in ASP Inline Corporate Calendar allows remote attackers to inject arbitrary web script or HTML via the keyword parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/35187; http://www.exploit-db.com/exploits/8756; http://www.securityfocus.com/bid/35054
CVE: CVE-2009-2242
Published: 2009-06-27
Description: SQL injection vulnerability in active_appointments.asp in ASP Inline Corporate Calendar allows remote attackers to execute arbitrary SQL commands via the order parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/35187; http://www.exploit-db.com/exploits/8756; http://www.securityfocus.com/bid/35054
CVE: CVE-2009-2243
Published: 2009-06-27
Description: SQL injection vulnerability in active_appointments.asp in ASP Inline Corporate Calendar allows remote attackers to execute arbitrary SQL commands via the sortby parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/35187; https://exchange.xforce.ibmcloud.com/vulnerabilities/50667; http://secunia.com/advisories/35187
CVE: CVE-2009-2254
Published: 2009-06-30
Description: Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/sqlpatch.php, which allows remote attackers to execute arbitrary SQL commands via the query_string parameter in an execute action, in conjunction with a PATH_INFO of password_forgotten.php, related to a "SQL Execution" issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/35550; http://www.exploit-db.com/exploits/9005; http://www.osvdb.org/55343
CVE: CVE-2009-2255
Published: 2009-06-30
Description: Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/record_company.php, which allows remote attackers to execute arbitrary code by uploading a .php file via the record_company_image parameter in conjunction with a PATH_INFO of password_forgotten.php, then accessing this file via a direct request to the file in images/.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/35550; http://www.exploit-db.com/exploits/9004; http://www.osvdb.org/55344
CVE: CVE-2009-2256
Published: 2009-06-30
Description: The administrative web interface on the Netgear DG632 with firmware 3.4.0_ap allows remote attackers to cause a denial of service (web outage) via an HTTP POST request to cgi-bin/firmwarecfg.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://securitytracker.com/id?1022403; http://www.exploit-db.com/exploits/8964; http://www.securityfocus.com/archive/1/504341/100/0/threaded
CVE: CVE-2009-2257
Published: 2009-06-30
Description: The administrative web interface on the Netgear DG632 with firmware 3.4.0_ap allows remote attackers to bypass authentication via a direct request to (1) gateway/commands/saveconfig.html, and (2) stattbl.htm, (3) modemmenu.htm, (4) onload.htm, (5) form.css, (6) utility.js, and possibly (7) indextop.htm in html/.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: http://securitytracker.com/id?1022404; http://www.exploit-db.com/exploits/8963; http://www.securityfocus.com/archive/1/504312/100/0/threaded
CVE: CVE-2009-2258
Published: 2009-06-30
Description: Directory traversal vulnerability in cgi-bin/webcm in the administrative web interface on the Netgear DG632 with firmware 3.4.0_ap allows remote attackers to list arbitrary directories via a .. (dot dot) in the nextpage parameter.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://securitytracker.com/id?1022404; http://www.exploit-db.com/exploits/8963; http://www.securityfocus.com/archive/1/504312/100/0/threaded
CVE: CVE-2009-2259
Published: 2009-06-30
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2009-2608.  Reason: This candidate is a duplicate of CVE-2009-2608.  Notes: All CVE users should reference CVE-2009-2608 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2009-2260
Published: 2009-06-30
Description: stardict 3.0.1, when Enable Net Dict is configured, sends the contents of the clipboard to a dictionary server, which allows remote attackers to obtain sensitive information by sniffing the network.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=534731; http://www.securityfocus.com/archive/1/504583; https://www.redhat.com/archives/fedora-package-announce/2010-January/msg00121.html
CVE: CVE-2009-2261
Published: 2009-06-30
Description: PeaZIP 2.6.1, 2.5.1, and earlier on Windows allows user-assisted remote attackers to execute arbitrary commands via a .zip archive with a .txt file whose name contains | (pipe) characters and a command.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://www.exploit-db.com/exploits/8881; http://www.exploit-db.com/exploits/8881
CVE: CVE-2009-2262
Published: 2009-06-30
Description: PHP remote file inclusion vulnerability in install/di.php in AjaxPortal 3.0 allows remote attackers to execute arbitrary PHP code via a URL in the pathtoserverdata parameter.  NOTE: the installation instructions specify deleting the install/ folder.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/archive/1/504618/100/0/threaded; http://www.securityfocus.com/archive/1/504618/100/0/threaded
CVE: CVE-2009-2263
Published: 2009-06-30
Description: Directory traversal vulnerability in index.php in Awesome PHP Mega File Manager 1.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter.  NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC share pathname or an ftp, ftps, or ssh2.sftp URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/35545; http://www.exploit-db.com/exploits/9025; http://secunia.com/advisories/35545
CVE: CVE-2008-6840
Published: 2009-07-01
Description: Multiple PHP remote file inclusion vulnerabilities in V-webmail 1.6.4 allow remote attackers to execute arbitrary PHP code via a URL in the (1) CONFIG[pear_dir] parameter to (a) Mail/RFC822.php, (b) Net/Socket.php, (c) XML/Parser.php, (d) XML/Tree.php, (e) Mail/mimeDecode.php, (f) Console/Getopt.php, (g) System.php, (h) Log.php, and (i) File.php in includes/pear/; the CONFIG[pear_dir] parameter to (j) includes/prepend.php, and (k) includes/cachedConfig.php; and the (2) CONFIG[includes] parameter to (l) prepend.php and (m) email.list.search.php in includes/.  NOTE: the CONFIG[pear_dir] parameter to includes/mailaccess/pop3.php is already covered by CVE-2006-2666.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://packetstormsecurity.org/0807-exploits/vwebmail-rfi.txt; http://www.securityfocus.com/bid/30162; https://exchange.xforce.ibmcloud.com/vulnerabilities/46680
CVE: CVE-2008-6841
Published: 2009-07-01
Description: PHP remote file inclusion vulnerability in the Green Mountain Information Technology and Consulting Database Query (com_dbquery) component 1.4.1.1 and earlier for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter to classes/DBQ/admin/common.class.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/30093; https://exchange.xforce.ibmcloud.com/vulnerabilities/43615; https://www.exploit-db.com/exploits/6003
CVE: CVE-2009-0689
Published: 2009-07-01
Description: Array index error in the (1) dtoa implementation in dtoa.c (aka pdtoa.c) and the (2) gdtoa (aka new dtoa) implementation in gdtoa/misc.c in libc, as used in multiple operating systems and products including in FreeBSD 6.4 and 7.2, NetBSD 5.0, OpenBSD 4.5, Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4, K-Meleon 1.5.3, SeaMonkey 1.1.8, and other products, allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large precision value in the format argument to a printf function, which triggers incorrect memory allocation and a heap-based buffer overflow during conversion to a floating-point number.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/gdtoa/gdtoaimp.h; http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html
CVE: CVE-2009-1889
Published: 2009-07-01
Description: The OSCAR protocol implementation in Pidgin before 2.5.8 misinterprets the ICQWebMessage message type as the ICQSMS message type, which allows remote attackers to cause a denial of service (application crash) via a crafted ICQ web message that triggers allocation of a large amount of memory.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://developer.pidgin.im/ticket/9483; http://pidgin.im/pipermail/devel/2009-May/008227.html; http://secunia.com/advisories/35693
CVE: CVE-2009-2268
Published: 2009-07-01
Description: Cross-site scripting (XSS) vulnerability in the Cross-Domain Controller (CDC) servlet in Sun Java System Access Manager 6 2005Q1, 7 2005Q4, and 7.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/35651; http://sunsolve.sun.com/search/document.do?assetkey=1-21-126356-03-1; http://sunsolve.sun.com/search/document.do?assetkey=1-66-256568-1
CVE: CVE-2009-2269
Published: 2009-07-01
Description: SQL injection vulnerability in Empire CMS 5.1 allows remote attackers to execute arbitrary SQL commands via the bid parameter to the default URI under e/tool/gbook/.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/archive/1/504652/100/0/threaded; http://www.securityfocus.com/archive/1/504652/100/0/threaded
CVE: CVE-2009-2270
Published: 2009-07-01
Description: Unrestricted file upload vulnerability in member/uploads_edit.php in dedecms 5.3 allows remote attackers to execute arbitrary code by uploading a file with a double extension in the filename, then accessing this file via unspecified vectors, as demonstrated by a .jpg.php filename.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://www.securityfocus.com/archive/1/504653/100/0/threaded; http://www.securityfocus.com/archive/1/504653/100/0/threaded
CVE: CVE-2009-2271
Published: 2009-07-01
Description: The Huawei D100 has (1) a certain default administrator password for the web interface, and does not force a password change; and has (2) a default password of admin for the admin account in the telnet interface; which makes it easier for remote attackers to obtain access.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://secunia.com/advisories/35638; http://www.securityfocus.com/archive/1/504645/100/0/threaded; http://secunia.com/advisories/35638
CVE: CVE-2009-2272
Published: 2009-07-01
Description: The Huawei D100 stores the administrator's account name and password in cleartext in a cookie, which allows context-dependent attackers to obtain sensitive information by (1) reading a cookie file, by (2) sniffing the network for HTTP headers, and possibly by using unspecified other vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: http://www.securityfocus.com/archive/1/504645/100/0/threaded; http://www.securityfocus.com/archive/1/504645/100/0/threaded
CVE: CVE-2009-2273
Published: 2009-07-01
Description: The default configuration of the Wi-Fi component on the Huawei D100 does not use encryption, which makes it easier for remote attackers to obtain sensitive information by sniffing the network.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-327
References: http://www.securityfocus.com/archive/1/504645/100/0/threaded; http://www.securityfocus.com/archive/1/504645/100/0/threaded
CVE: CVE-2009-2274
Published: 2009-07-01
Description: The Huawei D100 allows remote attackers to obtain sensitive information via a direct request to (1) lan_status_adv.asp, (2) wlan_basic_cfg.asp, or (3) lancfg.asp in en/, related to use of JavaScript to protect against reading file contents.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://secunia.com/advisories/35638; http://www.securityfocus.com/archive/1/504645/100/0/threaded; http://secunia.com/advisories/35638
CVE: CVE-2009-2275
Published: 2009-07-01
Description: Directory traversal vulnerability in frontend/x3/stats/lastvisit.html in cPanel allows remote attackers to read arbitrary files via a .. (dot dot) in the domain parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/9039; http://www.securityfocus.com/bid/35518; http://www.securitytracker.com/id?1022490
CVE: CVE-2009-2276
Published: 2009-07-01
Description: SQL injection vulnerability in voteforus.php in the Vote For Us extension 1.0.1 and earlier for PunBB allows remote attackers to execute arbitrary SQL commands via the out parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9058; http://www.exploit-db.com/exploits/9058
CVE: CVE-2009-2282
Published: 2009-07-01
Description: The Virtual Network Terminal Server daemon (vntsd) for Logical Domains (aka LDoms) in Sun Solaris 10, and OpenSolaris snv_41 through snv_108, on SPARC platforms does not check authorization for guest console access, which allows local control-domain users to gain guest-domain privileges via unknown vectors.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-862
References: http://secunia.com/advisories/35547; http://sunsolve.sun.com/search/document.do?assetkey=1-21-141778-01-1; http://sunsolve.sun.com/search/document.do?assetkey=1-66-262708-1
CVE: CVE-2009-2283
Published: 2009-07-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in the help jsp scripts in Sun Java Web Console 3.0.2 through 3.0.5, and Sun Java Web Console in Solaris 10, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/35597; http://sunsolve.sun.com/search/document.do?assetkey=1-21-136987-03-1; http://sunsolve.sun.com/search/document.do?assetkey=1-66-262428-1
CVE: CVE-2009-2284
Published: 2009-07-01
Description: Cross-site scripting (XSS) vulnerability in phpMyAdmin before 3.2.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted SQL bookmark.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/35649; http://secunia.com/advisories/35715; http://www.mandriva.com/security/advisories?name=MDVSA-2009:192
CVE: CVE-2009-2285
Published: 2009-07-01
Description: Buffer underflow in the LZWDecodeCompat function in libtiff 3.8.2 allows context-dependent attackers to cause a denial of service (crash) via a crafted TIFF image, a different vulnerability than CVE-2008-2327.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://bugzilla.maptools.org/show_bug.cgi?id=2065; http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html; http://lists.apple.com/archives/security-announce/2010//Mar/msg00003.html
CVE: CVE-2009-2286
Published: 2009-07-01
Description: Buffer overflow in compface 1.5.2 and earlier allows user-assisted attackers to cause a denial of service (crash) via a long declaration in a .xbm file.  NOTE: this issue only affects compface on distributions that used a certain patch.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=534973; http://www.openwall.com/lists/oss-security/2009/06/29/2; http://www.openwall.com/lists/oss-security/2009/06/29/4
CVE: CVE-2009-2287
Published: 2009-07-01
Description: The kvm_arch_vcpu_ioctl_set_sregs function in the KVM in Linux kernel 2.6 before 2.6.30, when running on x86 systems, does not validate the page table root in a KVM_SET_SREGS call, which allows local users to cause a denial of service (crash or hang) via a crafted cr3 value, which triggers a NULL pointer dereference in the gfn_to_rmap function.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-476
References: http://git.kernel.org/?p=linux/kernel/git/stable/stable-queue.git%3Ba=blob%3Bf=queue-2.6.30/kvm-x86-check-for-cr3-validity-in-ioctl_set_sregs.patch%3Bh=b48a47dad2cf76358b327368f80c0805e6370c68%3Bhb=e7c45b24f298b5d9efd7d401150f64a1b51aaac4; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=59839dfff5eabca01cc4e20b45797a60a80af8cb; http://secunia.com/advisories/35675
CVE: CVE-2009-2288
Published: 2009-07-01
Description: statuswml.cgi in Nagios before 3.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) ping or (2) Traceroute parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6964&w=2; http://secunia.com/advisories/35543; http://secunia.com/advisories/35688
CVE: CVE-2009-2289
Published: 2009-07-01
Description: Cross-site scripting (XSS) vulnerability in index.php in Arcade Trade Script 1.0 beta allows remote attackers to inject arbitrary web script or HTML via the q parameter in a gamelist action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/35197; http://www.davidsopas.com/2009/05/25/arcade-trade-script-xss; http://www.securityfocus.com/archive/1/503801/100/0/threaded
CVE: CVE-2009-2290
Published: 2009-07-01
Description: SQL injection vulnerability in the Boy Scout Advancement (com_bsadv) component 0.3 and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a (1) account or (2) event task to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/archive/1/503794/100/0/threaded; http://www.securityfocus.com/bid/35087; http://www.securityfocus.com/archive/1/503794/100/0/threaded
CVE: CVE-2009-2291
Published: 2009-07-01
Description: Unspecified vulnerability in LoginToboggan 6.x-1.x before 6.x-1.5, a module for Drupal, when "Allow users to login using their e-mail address" is enabled, allows remote blocked users to bypass intended access restrictions via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/461662; http://drupal.org/node/461682; http://secunia.com/advisories/35081
CVE: CVE-2009-2292
Published: 2009-07-01
Description: Cross-site scripting (XSS) vulnerability in Appleple a-News 2.32 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN42927215/index.html; http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000030.html; http://secunia.com/advisories/35171
CVE: CVE-2009-2293
Published: 2009-07-01
Description: Optimum Web Design Tutorial Share 3.5.0 and earlier allows remote attackers to bypass authentication and obtain administrative access by setting the usernamed cookie parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://osvdb.org/54704; http://secunia.com/advisories/35207; http://www.exploit-db.com/exploits/8766
CVE: CVE-2008-6842
Published: 2009-07-02
Description: Directory traversal vulnerability in data/modules/blog/module_pages_site.php in Pluck 4.6.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the post parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/34415; http://www.securityfocus.com/bid/34207; https://exchange.xforce.ibmcloud.com/vulnerabilities/49378
CVE: CVE-2008-6843
Published: 2009-07-02
Description: Directory traversal vulnerability in index.php in Fantastico, as used with cPanel 11.x, allows remote attackers to read arbitrary files via a .. (dot dot) in the sup3r parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/archive/1/498814/100/0/threaded; http://www.securityfocus.com/bid/32578; https://exchange.xforce.ibmcloud.com/vulnerabilities/46991
CVE: CVE-2008-6844
Published: 2009-07-02
Description: The registration view (/user/register) in eZ Publish 3.5.6 and earlier, and possibly other versions before 3.9.5, 3.10.1, and 4.0.1, allows remote attackers to gain privileges as other users via modified ContentObjectAttribute_data_user_login_30, ContentObjectAttribute_data_user_password_30, and other parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://ez.no/developer/security/security_advisories/ez_publish_4_0/ezsa_2008_003_insufficient_form_handling_made_privilege_escalation_possible; http://www.osvdb.org/52708; http://www.securityfocus.com/bid/32762
CVE: CVE-2008-6845
Published: 2009-07-02
Description: The unpack feature in ClamAV 0.93.3 and earlier allows remote attackers to cause a denial of service (segmentation fault) via a corrupted LZH file.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/51963; http://www.ivizsecurity.com/security-advisory-iviz-sr-08011.html; http://www.securityfocus.com/archive/1/499078/100/0/threaded
CVE: CVE-2008-6846
Published: 2009-07-02
Description: Multiple stack-based buffer overflows in avast! Linux Home Edition 1.0.5, 1.0.5-1, and 1.0.8 allow remote attackers to cause a denial of service (application crash) or execute arbitrary code via a malformed (1) ISO or (2) RPM file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/52016; http://www.ivizsecurity.com/security-advisory-iviz-sr-08013.html; http://www.securityfocus.com/archive/1/499080/100/0/threaded
CVE: CVE-2008-6847
Published: 2009-07-02
Description: Cross-site scripting (XSS) vulnerability in Employee/emp_login.asp in Pre ASP Job Board allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0812-exploits/preaspjob-xsscm.txt; http://www.securityfocus.com/bid/32572; https://exchange.xforce.ibmcloud.com/vulnerabilities/47007
CVE: CVE-2009-1421
Published: 2009-07-02
Description: Unspecified vulnerability in NFS / ONCplus B.11.31_06 and B.11.31_07 on HP HP-UX B.11.31 allows local users to cause a denial of service via unknown attack vectors.
CVSS Score: 4.9 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]0944&w=2; http://secunia.com/advisories/35644; http://securitytracker.com/id?1022493
CVE: CVE-2009-2296
Published: 2009-07-02
Description: The NFSv4 server kernel module in Sun Solaris 10, and OpenSolaris before snv_119, does not properly implement the nfs_portmon setting, which allows remote attackers to access shares, and read, create, and modify arbitrary files, via unspecified vectors.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/55519; http://secunia.com/advisories/35672; http://secunia.com/advisories/42550