deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-0259
Published: 2009-01-22
Description: The Word processor in OpenOffice.org 1.1.2 through 1.1.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted (1) .doc, (2) .wri, or (3) .rtf Word 97 file that triggers memory corruption, as exploited in the wild in December 2008, as demonstrated by 2008-crash.doc.rar, and a similar issue to CVE-2008-4841.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://milw0rm.com/sploits/2008-crash.doc.rar; http://www.openwall.com/lists/oss-security/2009/01/21/9; http://www.securityfocus.com/bid/33383
CVE: CVE-2008-5948
Published: 2009-01-23
Description: Directory traversal vulnerability in index.php in BNCwi 1.04 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the newlanguage parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/32981; http://www.securityfocus.com/bid/32644; https://www.exploit-db.com/exploits/7345
CVE: CVE-2008-5949
Published: 2009-01-23
Description: Multiple PHP remote file inclusion vulnerabilities in ccTiddly 1.7.4 and 1.7.6 allow remote attackers to execute arbitrary PHP code via a URL in the cct_base parameter to (1) index.php; (2) handle/proxy.php; (3) header.php, (4) include.php, and (5) workspace.php in includes/; and (6) plugins/RSS/files/rss.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/32995; http://www.securityfocus.com/bid/32631; https://exchange.xforce.ibmcloud.com/vulnerabilities/47072
CVE: CVE-2008-5950
Published: 2009-01-23
Description: SQL injection vulnerability in media/media_level.asp in ASP Template Creature allows remote attackers to execute arbitrary SQL commands via the mcatid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32992; http://www.securityfocus.com/bid/32641; https://exchange.xforce.ibmcloud.com/vulnerabilities/47084
CVE: CVE-2008-5951
Published: 2009-01-23
Description: ASP Template Creature stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for workDB/templatemonster.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/47085; https://www.exploit-db.com/exploits/7339; https://exchange.xforce.ibmcloud.com/vulnerabilities/47085
CVE: CVE-2008-5952
Published: 2009-01-23
Description: SQL injection vulnerability in KTP Computer Customer Database (KTPCCD) CMS, when magic_quotes_gpc is disabled, allows remote authenticated users to execute arbitrary SQL commands via the tid parameter in a vtech action to the default URI.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/32888; http://www.securityfocus.com/bid/32539; http://www.vupen.com/english/advisories/2008/3292
CVE: CVE-2008-5953
Published: 2009-01-23
Description: Directory traversal vulnerability in KTP Computer Customer Database (KTPCCD) CMS, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the p parameter to the default URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/32888; http://www.securityfocus.com/bid/33518; http://www.vupen.com/english/advisories/2008/3292
CVE: CVE-2008-5954
Published: 2009-01-23
Description: SQL injection vulnerability in KTP Computer Customer Database (KTPCCD) CMS, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the lname parameter in a login action to an unspecified component.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/32888; http://www.securityfocus.com/bid/33520; https://exchange.xforce.ibmcloud.com/vulnerabilities/46898
CVE: CVE-2008-5955
Published: 2009-01-23
Description: SQL injection vulnerability in show.php in Wbstreet (aka PHPSTREET Webboard) 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32994; http://www.securityfocus.com/bid/32635; https://exchange.xforce.ibmcloud.com/vulnerabilities/47073
CVE: CVE-2008-5956
Published: 2009-01-23
Description: Wbstreet (aka PHPSTREET Webboard) 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain database credentials via a direct request to connect.inc.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/32994; https://exchange.xforce.ibmcloud.com/vulnerabilities/47074; https://www.exploit-db.com/exploits/7337
CVE: CVE-2008-5957
Published: 2009-01-23
Description: SQL injection vulnerability in the Mydyngallery (com_mydyngallery) component 1.4.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the directory parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/archive/1/498916/100/0/threaded; http://www.securityfocus.com/bid/32639; https://exchange.xforce.ibmcloud.com/vulnerabilities/47087
CVE: CVE-2008-5958
Published: 2009-01-23
Description: Multiple SQL injection vulnerabilities in Active Test 2.1 allow remote attackers to execute arbitrary SQL commands via the QuizID parameter to (1) questions.asp, (2) importquestions.asp, and (3) quiztakers.asp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/50405; http://osvdb.org/50406; http://osvdb.org/50407
CVE: CVE-2008-5959
Published: 2009-01-23
Description: Multiple SQL injection vulnerabilities in start.asp in Active Test 2.1 allow remote attackers to execute arbitrary SQL commands via the (1) useremail parameter (aka username field) or (2) password parameter (aka password field).  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/50408; http://secunia.com/advisories/32902; https://exchange.xforce.ibmcloud.com/vulnerabilities/46921
CVE: CVE-2008-5960
Published: 2009-01-23
Description: SQL injection vulnerability in index.php in Tribiq CMS Community 5.0.10B and 5.0.11E allows remote attackers to execute arbitrary SQL commands via the cID parameter in a document action.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33021; http://www.securityfocus.com/bid/32649; http://secunia.com/advisories/33021
CVE: CVE-2008-5961
Published: 2009-01-23
Description: Cross-site scripting (XSS) vulnerability in index.php in Tribiq CMS Community 5.0.10B and 5.0.11E allows remote attackers to inject arbitrary web script or HTML via the cID parameter in a document action.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/33021; http://www.securityfocus.com/bid/32650; http://secunia.com/advisories/33021
CVE: CVE-2008-5962
Published: 2009-01-23
Description: Directory traversal vulnerability in library/setup/rpc.php in Gravity Getting Things Done (GTD) 0.4.5 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the objectname parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/32982; http://www.securityfocus.com/bid/32646; https://exchange.xforce.ibmcloud.com/vulnerabilities/47090
CVE: CVE-2008-5963
Published: 2009-01-23
Description: Eval injection vulnerability in library/setup/rpc.php in Gravity Getting Things Done (GTD) 0.4.5 and earlier allows remote attackers to execute arbitrary PHP code via the objectname parameter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/32982; http://www.securityfocus.com/bid/32646; https://exchange.xforce.ibmcloud.com/vulnerabilities/47091
CVE: CVE-2008-5964
Published: 2009-01-23
Description: Session fixation vulnerability in Social ImpressCMS before 1.1.1 RC1 allows remote attackers to hijack web sessions by setting the PHPSESSID parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://osvdb.org/50413; http://secunia.com/advisories/32985; http://sourceforge.net/forum/forum.php?forum_id=893767
CVE: CVE-2009-0260
Published: 2009-01-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin before 1.8.1 allow remote attackers to inject arbitrary web script or HTML via an AttachFile action to the WikiSandBox component with (1) the rename parameter or (2) the drawing parameter (aka the basename variable).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://hg.moinmo.in/moin/1.8/rev/8cb4d34ccbc1; http://moinmo.in/SecurityFixes#moin1.8.1; http://osvdb.org/51485
CVE: CVE-2009-0261
Published: 2009-01-23
Description: Stack-based buffer overflow in EffectMatrix Total Video Player 1.31 allows user-assisted attackers to execute arbitrary code via a Skins\DefaultSkin\DefaultSkin.ini file with a large ColumnHeaderSpan value.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/33373; https://exchange.xforce.ibmcloud.com/vulnerabilities/48140; https://www.exploit-db.com/exploits/7839
CVE: CVE-2009-0262
Published: 2009-01-23
Description: Stack-based buffer overflow in Triologic Media Player 7 and 8.0.0.0 allows user-assisted remote attackers to execute arbitrary code via a long string in a .m3u playlist file.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/33496; http://www.securityfocus.com/bid/33221; http://www.vupen.com/english/advisories/2009/0097
CVE: CVE-2009-0263
Published: 2009-01-23
Description: Multiple buffer overflows in Winamp 5.541 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) a large Common Chunk (COMM) header value in an AIFF file and (2) a large invalid value in an MP3 file.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/33478; http://www.securityfocus.com/bid/33226; http://www.vupen.com/english/advisories/2009/0113
CVE: CVE-2008-5260
Published: 2009-01-26
Description: Heap-based buffer overflow in the CamImage.CamImage.1 ActiveX control in AxisCamControl.ocx in AXIS Camera Control 2.40.0.0 allows remote attackers to execute arbitrary code via a long image_pan_tilt property value.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/51532; http://secunia.com/advisories/33444; http://secunia.com/secunia_research/2008-58/
CVE: CVE-2009-0264
Published: 2009-01-26
Description: Buffer overflow in the Registry Setting Tool in Fujitsu SystemcastWizard Lite 2.0A, 2.0, 1.9, and earlier has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.fujitsu.com/global/services/computing/server/primequest/products/os/windows-server-2008-2.html; http://www.securityfocus.com/bid/33644; https://exchange.xforce.ibmcloud.com/vulnerabilities/48315
CVE: CVE-2009-0265
Published: 2009-01-26
Description: Internet Systems Consortium (ISC) BIND 9.6.0 and earlier does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077 and CVE-2009-0025.
CVSS Score: 7.5 (HIGH)
CWE: CWE-252, CWE-295
References: http://groups.google.com/group/comp.protocols.dns.bind/browse_thread/thread/49ef622c8329fd33; http://secunia.com/advisories/33559; http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.540362
CVE: CVE-2009-0266
Published: 2009-01-26
Description: Stack-based buffer overflow in Triologic Media Player 8.0.0.0 allows user-assisted remote attackers to execute arbitrary code via a long string in a .m3l playlist file.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/33496; http://secunia.com/advisories/33496
CVE: CVE-2009-0267
Published: 2009-01-26
Description: libike in Sun Solaris 9 and 10, and OpenSolaris before snv_100, does not properly check packets, which allows remote attackers to cause a denial of service (in.iked daemon crash) via an unspecified IKE packet, a different vulnerability than CVE-2007-2989.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/33702; http://sunsolve.sun.com/search/document.do?assetkey=1-21-113451-15-1; http://sunsolve.sun.com/search/document.do?assetkey=1-66-247406-1
CVE: CVE-2009-0268
Published: 2009-01-26
Description: Race condition in the pseudo-terminal (aka pty) driver module in Sun Solaris 8 through 10, and OpenSolaris before snv_103, allows local users to cause a denial of service (panic) via unspecified vectors related to lack of "properly sequenced code" in ptc and ptsl.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-362
References: http://secunia.com/advisories/33708; http://sunsolve.sun.com/search/document.do?assetkey=1-21-113685-07-1; http://sunsolve.sun.com/search/document.do?assetkey=1-66-249586-1
CVE: CVE-2009-0269
Published: 2009-01-26
Description: fs/ecryptfs/inode.c in the eCryptfs subsystem in the Linux kernel before 2.6.28.1 allows local users to cause a denial of service (fault or memory corruption), or possibly have unspecified other impact, via a readlink call that results in an error, leading to use of a -1 return value as an array index.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-787
References: http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.27.y.git%3Ba=commit%3Bh=a17d5232de7b53d34229de79ec22f4bb04adb7e4; http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00000.html
CVE: CVE-2009-0270
Published: 2009-01-26
Description: Stack-based buffer overflow in PXEService.exe in Fujitsu SystemcastWizard Lite 2.0A, 2.0, 1.9, and earlier allows remote attackers to execute arbitrary code via a large PXE protocol request in a UDP packet.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://osvdb.org/51486; http://secunia.com/advisories/33594; http://www.fujitsu.com/global/services/computing/server/primequest/products/os/windows-server-2008-2.html
CVE: CVE-2009-0271
Published: 2009-01-26
Description: Directory traversal vulnerability in the TFTP service in Fujitsu SystemcastWizard Lite 2.0A, 2.0, 1.9, and earlier allows remote attackers to read arbitrary files via directory traversal sequences in unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/51487; http://secunia.com/advisories/33594; http://www.fujitsu.com/global/services/computing/server/primequest/products/os/windows-server-2008-2.html
CVE: CVE-2008-5965
Published: 2009-01-26
Description: Directory traversal vulnerability in index.php in LokiCMS 0.3.4 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to check for the existence of arbitrary files via a .. (dot dot) in the page parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/30472; http://www.securityfocus.com/bid/31730; http://www.vupen.com/english/advisories/2008/2798
CVE: CVE-2008-5966
Published: 2009-01-26
Description: globsy_edit.php in Globsy 1.0 and earlier allows remote attackers to create or overwrite arbitrary files via a filename in the file parameter and file contents in the data parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/31727; https://exchange.xforce.ibmcloud.com/vulnerabilities/48324; https://www.exploit-db.com/exploits/6735
CVE: CVE-2008-5967
Published: 2009-01-26
Description: admin/index.php in PHP iCalendar 2.3.4, 2.24, and earlier does not require administrative authentication for an addupdate action, which allows remote attackers to upload a calendar (aka .ics) file with arbitrary content to the calendars/ directory outside the web root.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/31944; https://exchange.xforce.ibmcloud.com/vulnerabilities/48323; https://www.exploit-db.com/exploits/6519
CVE: CVE-2008-5968
Published: 2009-01-26
Description: Directory traversal vulnerability in print.php in PHP iCalendar 2.24 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the cookie_language parameter in a phpicalendar_* cookie, a different vector than CVE-2006-1292.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/48322; https://www.exploit-db.com/exploits/6519; https://exchange.xforce.ibmcloud.com/vulnerabilities/48322
CVE: CVE-2009-0275
Published: 2009-01-26
Description: Static code injection vulnerability in admin.php in Ryneezy phoSheezy 0.2 allows remote authenticated administrators to inject arbitrary PHP code into config/header via the header parameter.  NOTE: this can be exploited by unauthenticated attackers by leveraging CVE-2009-0250. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/33531; http://www.osvdb.org/51412; http://secunia.com/advisories/33531
CVE: CVE-2008-5969
Published: 2009-01-27
Description: SQL injection vulnerability in popupproduct.php in Sunbyte e-Flower allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32923; http://www.securityfocus.com/bid/32589; https://www.exploit-db.com/exploits/7323
CVE: CVE-2008-5970
Published: 2009-01-27
Description: SQL injection vulnerability in profile_social.php in i-Net Solution Orkut Clone allows remote authenticated users to execute arbitrary SQL commands via the id parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://packetstorm.linuxsecurity.com/0812-exploits/orkut-sqlxss.txt; http://secunia.com/advisories/32937; http://www.securityfocus.com/bid/32600
CVE: CVE-2008-5971
Published: 2009-01-27
Description: Cross-site scripting (XSS) vulnerability in profile_social.php in i-Net Solution Orkut Clone allows remote authenticated users to inject arbitrary web script or HTML via the id parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstorm.linuxsecurity.com/0812-exploits/orkut-sqlxss.txt; http://secunia.com/advisories/32937; http://www.securityfocus.com/bid/32600
CVE: CVE-2008-5972
Published: 2009-01-27
Description: SQL injection vulnerability in default.asp in Active Business Directory 2 allows remote attackers to execute arbitrary SQL commands via the catid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32894; http://www.securityfocus.com/bid/32551; http://www.vupen.com/english/advisories/2008/3294
CVE: CVE-2008-5973
Published: 2009-01-27
Description: SQL injection vulnerability in login.aspx in Active Web Mail 4.0 allows remote attackers to execute arbitrary SQL commands via the password parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32921; https://exchange.xforce.ibmcloud.com/vulnerabilities/46915; https://www.exploit-db.com/exploits/7281
CVE: CVE-2008-5974
Published: 2009-01-27
Description: Multiple SQL injection vulnerabilities in login.aspx in Active Price Comparison 4.0 allow remote attackers to execute arbitrary SQL commands via the (1) password and (2) username fields.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32921; http://www.vupen.com/english/advisories/2008/3296; https://exchange.xforce.ibmcloud.com/vulnerabilities/46909
CVE: CVE-2008-5975
Published: 2009-01-27
Description: SQL injection vulnerability in links.asp in Active Price Comparison 4.0 allows remote attackers to execute arbitrary SQL commands via the linkid parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/32550; http://www.vupen.com/english/advisories/2008/3296; https://exchange.xforce.ibmcloud.com/vulnerabilities/48318
CVE: CVE-2008-5976
Published: 2009-01-27
Description: Multiple cross-site scripting (XSS) vulnerabilities in siteadmin/forgot.php in PHP JOBWEBSITE PRO allow remote attackers to inject arbitrary web script or HTML via (1) the adname parameter in a Submit action or (2) the UserName field.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30686; http://www.packetstormsecurity.org/0812-exploits/phpjobwebsite-cmsqlxss.txt; http://www.securityfocus.com/bid/32570
CVE: CVE-2008-5977
Published: 2009-01-27
Description: SQL injection vulnerability in siteadmin/forgot.php in PHP JOBWEBSITE PRO allows remote attackers to execute arbitrary SQL commands via the adname parameter in a Submit action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.packetstormsecurity.org/0812-exploits/phpjobwebsite-cmsqlxss.txt; http://www.securityfocus.com/bid/32570; https://exchange.xforce.ibmcloud.com/vulnerabilities/46998
CVE: CVE-2008-5978
Published: 2009-01-27
Description: Multiple SQL injection vulnerabilities in Ocean12 Mailing List Manager Gold allow remote attackers to execute arbitrary SQL commands via the Email parameter to (1) default.asp and (2) s_edit.asp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32929; http://www.securityfocus.com/bid/32587; https://exchange.xforce.ibmcloud.com/vulnerabilities/47021
CVE: CVE-2008-5979
Published: 2009-01-27
Description: Cross-site scripting (XSS) vulnerability in default.asp in Ocean12 Mailing List Manager Gold allows remote attackers to inject arbitrary web script or HTML via the Email parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/32929; http://www.securityfocus.com/bid/32587; https://exchange.xforce.ibmcloud.com/vulnerabilities/47022
CVE: CVE-2008-5980
Published: 2009-01-27
Description: Ocean12 Mailing List Manager Gold stores sensitive data under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for o12mail.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/32929; https://exchange.xforce.ibmcloud.com/vulnerabilities/47023; https://www.exploit-db.com/exploits/7319
CVE: CVE-2008-5981
Published: 2009-01-27
Description: PacPoll 4.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for (1) poll.mdb or (2) poll97.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/46976; https://www.exploit-db.com/exploits/7318; https://exchange.xforce.ibmcloud.com/vulnerabilities/46976
CVE: CVE-2009-0277
Published: 2009-01-27
Description: Unspecified vulnerability in the kernel in OpenSolaris snv_100 through snv_102 on the Sun UltraSPARC T2 and T2+ sun4v platforms allows local users to cause a denial of service (panic) via unknown vectors.
CVSS Score: 7.8 (HIGH)
References: http://sunsolve.sun.com/search/document.do?assetkey=1-66-250066-1; http://www.securityfocus.com/bid/33398; http://www.vupen.com/english/advisories/2009/0209
CVE: CVE-2009-0278
Published: 2009-01-27
Description: Sun Java System Application Server (AS) 8.1 and 8.2 allows remote attackers to read the Web Application configuration files in the (1) WEB-INF or (2) META-INF directory via a malformed request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/51604; http://secunia.com/advisories/33725; http://sunsolve.sun.com/search/document.do?assetkey=1-21-119166-35-1