deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-0227
Published: 2009-05-12
Description: Stack-based buffer overflow in the PowerPoint 4.2 conversion filter (PP4X32.DLL) in Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3 allows remote attackers to execute arbitrary code via a large number of structures in sound data in a file that uses a PowerPoint 4.0 native file format, leading to memory corruption, aka "Legacy File Format Vulnerability," a different vulnerability than CVE-2009-0222, CVE-2009-0223, CVE-2009-0226, and CVE-2009-1137.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=787; http://osvdb.org/54384; http://secunia.com/advisories/32428
CVE: CVE-2009-1128
Published: 2009-05-12
Description: Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3 allows remote attackers to execute arbitrary code via crafted sound data in a file that uses a PowerPoint 95 native file format, leading to memory corruption, aka "PP7 Memory Corruption Vulnerability," a different vulnerability than CVE-2009-1129.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/32428; http://www.securityfocus.com/bid/34837; http://www.securitytracker.com/id?1022205
CVE: CVE-2009-1129
Published: 2009-05-12
Description: Multiple stack-based buffer overflows in the PowerPoint 95 importer (PP7X32.DLL) in Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3 allow remote attackers to execute arbitrary code via an inconsistent record length in sound data in a file that uses a PowerPoint 95 (PPT95) native file format, aka "PP7 Memory Corruption Vulnerability," a different vulnerability than CVE-2009-1128.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=791; http://osvdb.org/54387; http://secunia.com/advisories/32428
CVE: CVE-2009-1130
Published: 2009-05-12
Description: Heap-based buffer overflow in Microsoft Office PowerPoint 2002 SP3 and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows remote attackers to execute arbitrary code via a crafted structure in a Notes container in a PowerPoint file that causes PowerPoint to read more data than was allocated when creating a C++ object, leading to an overwrite of a function pointer, aka "Heap Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=794; http://secunia.com/advisories/32428; http://www.securityfocus.com/archive/1/503454
CVE: CVE-2009-1131
Published: 2009-05-12
Description: Multiple stack-based buffer overflows in Microsoft Office PowerPoint 2000 SP3 allow remote attackers to execute arbitrary code via a large amount of data associated with unspecified atoms in a PowerPoint file that triggers memory corruption, aka "Data Out of Bounds Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/54393; http://secunia.com/advisories/32428; http://secunia.com/secunia_research/2008-46/
CVE: CVE-2009-1137
Published: 2009-05-12
Description: Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3 allows remote attackers to execute arbitrary code via crafted sound data in a file that uses a PowerPoint 4.0 native file format, leading to memory corruption, aka "Legacy File Format Vulnerability," a different vulnerability than CVE-2009-0222, CVE-2009-0223, CVE-2009-0226, and CVE-2009-0227.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/54381; http://secunia.com/advisories/32428; http://www.securityfocus.com/bid/34876
CVE: CVE-2008-1517
Published: 2009-05-13
Description: Array index error in the xnu (Mach) kernel in Apple Mac OS X 10.5 before 10.5.7 allows local users to gain privileges or cause a denial of service (system shutdown) via unspecified vectors related to workqueues.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=797; http://lists.apple.com/archives/security-announce/2009/May/msg00002.html; http://secunia.com/advisories/35074
CVE: CVE-2009-0010
Published: 2009-05-13
Description: Integer underflow in QuickDraw Manager in Apple Mac OS X 10.4.11 and 10.5 before 10.5.7, and Apple QuickTime before 7.6.2, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PICT image with a crafted 0x77 Poly tag and a crafted length field, which triggers a heap-based buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://lists.apple.com/archives/security-announce/2009/Jun/msg00000.html; http://lists.apple.com/archives/security-announce/2009/May/msg00002.html; http://secunia.com/advisories/35074
CVE: CVE-2009-0144
Published: 2009-05-13
Description: CFNetwork in Apple Mac OS X 10.5 before 10.5.7 does not properly parse noncompliant Set-Cookie headers, which allows remote attackers to obtain sensitive information by sniffing the network for "secure cookies" that are sent over unencrypted HTTP connections.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-16
References: http://lists.apple.com/archives/security-announce/2009/May/msg00002.html; http://secunia.com/advisories/35074; http://support.apple.com/kb/HT3549
CVE: CVE-2009-0145
Published: 2009-05-13
Description: CoreGraphics in Apple Mac OS X 10.4.11 and 10.5 before 10.5.7, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PDF file that triggers memory corruption.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html; http://lists.apple.com/archives/security-announce/2009/May/msg00002.html; http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html
CVE: CVE-2009-0149
Published: 2009-05-13
Description: Apple Mac OS X 10.4.11 and 10.5 before 10.5.7 allows local users to gain privileges or cause a denial of service (application crash) by attempting to mount a crafted sparse disk image that triggers memory corruption.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-94
References: http://lists.apple.com/archives/security-announce/2009/May/msg00002.html; http://secunia.com/advisories/35074; http://support.apple.com/kb/HT3549
CVE: CVE-2009-0150
Published: 2009-05-13
Description: Stack-based buffer overflow in Apple Mac OS X 10.5 before 10.5.7 allows local users to gain privileges or cause a denial of service (application crash) by attempting to mount a crafted sparse disk image.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2009/May/msg00002.html; http://secunia.com/advisories/35074; http://support.apple.com/kb/HT3549
CVE: CVE-2009-0152
Published: 2009-05-13
Description: iChat in Apple Mac OS X 10.5 before 10.5.7 disables SSL for AOL Instant Messenger (AIM) communication in certain circumstances that are inconsistent with the Require SSL setting, which allows remote attackers to obtain sensitive information by sniffing the network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: http://lists.apple.com/archives/security-announce/2009/May/msg00002.html; http://secunia.com/advisories/35074; http://support.apple.com/kb/HT3549
CVE: CVE-2009-0153
Published: 2009-05-13
Description: International Components for Unicode (ICU) 4.0, 3.6, and other 3.x versions, as used in Apple Mac OS X 10.5 before 10.5.7, iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Fedora 9 and 10, and possibly other operating systems, does not properly handle invalid byte sequences during Unicode conversion, which might allow remote attackers to conduct cross-site scripting (XSS) attacks.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://bugs.icu-project.org/trac/ticket/5691; http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html; http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
CVE: CVE-2009-0154
Published: 2009-05-13
Description: Heap-based buffer overflow in Apple Type Services (ATS) in Apple Mac OS X 10.4.11 and 10.5 before 10.5.7 allows remote attackers to execute arbitrary code via a crafted Compact Font Format (CFF) font.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2009/May/msg00002.html; http://secunia.com/advisories/35074; http://support.apple.com/kb/HT3549
CVE: CVE-2009-0155
Published: 2009-05-13
Description: Integer underflow in CoreGraphics in Apple Mac OS X 10.5 before 10.5.7, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PDF file that triggers a heap-based buffer overflow.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html; http://lists.apple.com/archives/security-announce/2009/May/msg00002.html; http://secunia.com/advisories/35074
CVE: CVE-2009-0156
Published: 2009-05-13
Description: Launch Services in Apple Mac OS X 10.4.11 and 10.5 before 10.5.7 allows remote attackers to cause a denial of service (persistent Finder crash) via a crafted Mach-O executable that triggers an out-of-bounds memory read.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2009/May/msg00002.html; http://secunia.com/advisories/35074; http://support.apple.com/kb/HT3549
CVE: CVE-2009-0157
Published: 2009-05-13
Description: Heap-based buffer overflow in CFNetwork in Apple Mac OS X 10.5 before 10.5.7 allows remote web servers to execute arbitrary code or cause a denial of service (application crash) via long HTTP headers.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2009/May/msg00002.html; http://secunia.com/advisories/35074; http://support.apple.com/kb/HT3549
CVE: CVE-2009-0158
Published: 2009-05-13
Description: Stack-based buffer overflow in telnet in Apple Mac OS X 10.4.11 and 10.5 before 10.5.7 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a long hostname for a telnet server.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2009/May/msg00002.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0018&w=2; http://secunia.com/advisories/35074
CVE: CVE-2009-0160
Published: 2009-05-13
Description: QuickDraw Manager in Apple Mac OS X 10.4.11 and 10.5 before 10.5.7 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PICT image that triggers memory corruption.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://lists.apple.com/archives/security-announce/2009/May/msg00002.html; http://secunia.com/advisories/35074; http://support.apple.com/kb/HT3549
CVE: CVE-2009-0161
Published: 2009-05-13
Description: The OpenSSL::OCSP module for Ruby in Apple Mac OS X 10.5 before 10.5.7 misinterprets an unspecified invalid response as a successful OCSP certificate validation, which might allow remote attackers to spoof certificate authentication via a revoked certificate.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2009/May/msg00002.html; http://secunia.com/advisories/35074; http://support.apple.com/kb/HT3549
CVE: CVE-2009-0162
Published: 2009-05-13
Description: Cross-site scripting (XSS) vulnerability in Safari before 3.2.3, and 4 Public Beta, on Apple Mac OS X 10.5 before 10.5.7 and Windows allows remote attackers to inject arbitrary web script or HTML via a crafted feed: URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.apple.com/archives/security-announce/2009/May/msg00000.html; http://lists.apple.com/archives/security-announce/2009/May/msg00001.html; http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
CVE: CVE-2009-0942
Published: 2009-05-13
Description: Help Viewer in Apple Mac OS X 10.4.11 and 10.5 before 10.5.7 does not verify that certain Cascading Style Sheets (CSS) are located in a registered help book, which allows remote attackers to execute arbitrary code via a help: URL that triggers invocation of AppleScript files.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2009/May/msg00002.html; http://secunia.com/advisories/35074; http://support.apple.com/kb/HT3549
CVE: CVE-2009-0943
Published: 2009-05-13
Description: Help Viewer in Apple Mac OS X 10.4.11 and 10.5 before 10.5.7 does not verify that HTML pathnames are located in a registered help book, which allows remote attackers to execute arbitrary code via a help: URL that triggers invocation of AppleScript files.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2009/May/msg00002.html; http://secunia.com/advisories/35074; http://support.apple.com/kb/HT3549
CVE: CVE-2009-0944
Published: 2009-05-13
Description: The Microsoft Office Spotlight Importer in Spotlight in Apple Mac OS X 10.4.11 and 10.5 before 10.5.7 does not properly validate Microsoft Office files, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a file that triggers memory corruption.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://lists.apple.com/archives/security-announce/2009/May/msg00002.html; http://secunia.com/advisories/35074; http://support.apple.com/kb/HT3549
CVE: CVE-2009-0945
Published: 2009-05-13
Description: Array index error in the insertItemBefore method in WebKit, as used in Apple Safari before 3.2.3 and 4 Public Beta, iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Google Chrome Stable before 1.0.154.65, and possibly other products allows remote attackers to execute arbitrary code via a document with a SVGPathList data structure containing a negative index in the (1) SVGTransformList, (2) SVGStringList, (3) SVGNumberList, (4) SVGPathSegList, (5) SVGPointList, or (6) SVGLengthList SVGList object, which triggers memory corruption.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://code.google.com/p/chromium/issues/detail?id=9019; http://googlechromereleases.blogspot.com/2009/05/stable-update-bug-fix.html; http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html
CVE: CVE-2009-0714
Published: 2009-05-14
Description: Unspecified vulnerability in the dpwinsup module (dpwinsup.dll) for dpwingad (dpwingad.exe) in HP Data Protector Express and Express SSE 3.x before build 47065, and Express and Express SSE 4.x before build 46537, allows remote attackers to cause a denial of service (application crash) or read portions of memory via one or more crafted packets.
CVSS Score: 7.2 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01697543; http://ivizsecurity.com/security-advisory-iviz-sr-09002.html; http://secunia.com/advisories/35084
CVE: CVE-2009-1464
Published: 2009-05-14
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in index.aas in Application Access Server (A-A-S) 2.0.48 allow remote attackers to hijack the authentication of administrators for requests that (1) execute arbitrary programs via a command job, (2) stop services via a setservice job, or (3) terminate processes via a killprocess job.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/35034; http://securitytracker.com/id?1022204; http://www.securityfocus.com/archive/1/503434/100/0/threaded
CVE: CVE-2009-1465
Published: 2009-05-14
Description: Application Access Server (A-A-S) 2.0.48 has "wildbat" as its default password for the admin account, which makes it easier for remote attackers to obtain access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://securitytracker.com/id?1022204; http://www.securityfocus.com/archive/1/503434/100/0/threaded; http://www.securityfocus.com/bid/34911
CVE: CVE-2009-1466
Published: 2009-05-14
Description: Application Access Server (A-A-S) 2.0.48 stores (1) passwords and (2) the port keyword in cleartext in aas.ini, which allows local users to obtain sensitive information by reading this file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312
References: http://securitytracker.com/id?1022204; http://www.securityfocus.com/archive/1/503434/100/0/threaded; http://www.securityfocus.com/bid/34911
CVE: CVE-2009-1578
Published: 2009-05-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail before 1.4.18 and NaSMail before 1.7 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) certain encrypted strings in e-mail headers, related to contrib/decrypt_headers.php; (2) PHP_SELF; and (3) the query string (aka QUERY_STRING).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://download.gna.org/nasmail/nasmail-1.7.zip; http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html; http://osvdb.org/60468
CVE: CVE-2009-1579
Published: 2009-05-14
Description: The map_yp_alias function in functions/imap_general.php in SquirrelMail before 1.4.18 and NaSMail before 1.7 allows remote attackers to execute arbitrary commands via shell metacharacters in a username string that is used by the ypmatch program.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://download.gna.org/nasmail/nasmail-1.7.zip; http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html; http://secunia.com/advisories/35052
CVE: CVE-2009-1580
Published: 2009-05-14
Description: Session fixation vulnerability in SquirrelMail before 1.4.18 allows remote attackers to hijack web sessions via a crafted cookie.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-287
References: http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html; http://secunia.com/advisories/35052; http://secunia.com/advisories/35073
CVE: CVE-2009-1581
Published: 2009-05-14
Description: functions/mime.php in SquirrelMail before 1.4.18 does not protect the application's content from Cascading Style Sheets (CSS) positioning in HTML e-mail messages, which allows remote attackers to spoof the user interface, and conduct cross-site scripting (XSS) and phishing attacks, via a crafted message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html; http://secunia.com/advisories/35052; http://secunia.com/advisories/35073
CVE: CVE-2009-1629
Published: 2009-05-14
Description: ajaxterm.js in AjaxTerm 0.10 and earlier generates session IDs with predictable random numbers based on certain JavaScript functions, which makes it easier for remote attackers to (1) hijack a session or (2) cause a denial of service (session ID exhaustion) via a brute-force attack.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052655.html; http://secunia.com/advisories/42784; http://www.ocert.org/advisories/ocert-2009-004.html
CVE: CVE-2009-1630
Published: 2009-05-14
Description: The nfs_permission function in fs/nfs/dir.c in the NFS client implementation in the Linux kernel 2.6.29.3 and earlier, when atomic_open is available, does not check execute (aka EXEC or MAY_EXEC) permission bits, which allows local users to bypass permissions and execute files, as demonstrated by files on an NFSv4 fileserver.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-264
References: http://article.gmane.org/gmane.linux.nfs/26592; http://bugzilla.linux-nfs.org/show_bug.cgi?id=131; http://linux-nfs.org/pipermail/nfsv4/2006-November/005313.html
CVE: CVE-2009-1631
Published: 2009-05-14
Description: The Mailer component in Evolution 2.26.1 and earlier uses world-readable permissions for the .evolution directory, and certain directories and files under .evolution/ related to local mail, which allows local users to obtain sensitive information by reading these files.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=526409; http://bugzilla.gnome.org/show_bug.cgi?id=581604; http://www.openwall.com/lists/oss-security/2009/05/12/6
CVE: CVE-2009-1632
Published: 2009-05-14
Description: Multiple memory leaks in Ipsec-tools before 0.7.2 allow remote attackers to cause a denial of service (memory consumption) via vectors involving (1) signature verification during user authentication with X.509 certificates, related to the eay_check_x509sign function in src/racoon/crypto_openssl.c; and (2) the NAT-Traversal (aka NAT-T) keepalive implementation, related to src/racoon/nattraversal.c.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://cvsweb.netbsd.org/bsdweb.cgi/src/crypto/dist/ipsec-tools/src/racoon/crypto_openssl.c; http://cvsweb.netbsd.org/bsdweb.cgi/src/crypto/dist/ipsec-tools/src/racoon/crypto_openssl.c.diff?r1=1.11.6.4&r2=1.11.6.5&f=h; http://cvsweb.netbsd.org/bsdweb.cgi/src/crypto/dist/ipsec-tools/src/racoon/nattraversal.c
CVE: CVE-2009-0688
Published: 2009-05-15
Description: Multiple buffer overflows in the CMU Cyrus SASL library before 2.1.23 might allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via strings that are used as input to the sasl_encode64 function in lib/saslutil.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: ftp://ftp.andrew.cmu.edu/pub/cyrus-mail/cyrus-sasl-2.1.23.tar.gz; http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html
CVE: CVE-2009-1637
Published: 2009-05-15
Description: profile.php in Simple Customer 1.3 does not require administrative authentication, which allows remote attackers to change the admin e-mail address and password via the email and password parameters.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/54280; http://secunia.com/advisories/35030; http://www.securityfocus.com/bid/34872
CVE: CVE-2009-1638
Published: 2009-05-15
Description: Techno Dreams Job Career Package 3.0 allows remote attackers to bypass authentication and obtain administrative access by setting the JobCareerAdmin cookie to Login.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://osvdb.org/54278; http://secunia.com/advisories/34996; http://www.securityfocus.com/bid/34865
CVE: CVE-2009-1639
Published: 2009-05-15
Description: Stack-based buffer overflow in Nucleus Data Recovery Kernel Recovery for Novell 4.03 allows user-assisted attackers to execute arbitrary code via a crafted .NKNT file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/34798; http://www.insight-tech.org/index.php?p=Kernel-recovery-for-Novell-Traditional-volumes-v-4-03-Code-Execution-and-DoS; http://www.insight-tech.org/xploits/KernelrecoveryforNovell%28Traditionalvolumes%29v.4.03CodeExecutionandDoS.py
CVE: CVE-2009-1640
Published: 2009-05-15
Description: Stack-based buffer overflow in Nucleus Data Recovery Kernel Recovery for Macintosh 4.04 allows user-assisted attackers to execute arbitrary code via a crafted .AMHH file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/54224; http://secunia.com/advisories/34860; http://www.insight-tech.org/index.php?p=Kernel-recovery-for-Macintosh-v-4-04-Buffer-Overflow
CVE: CVE-2009-1641
Published: 2009-05-15
Description: Multiple stack-based buffer overflows in Mini-stream Ripper 3.0.1.1 allow remote attackers to execute arbitrary code via (1) a long rtsp URL in a .ram file and (2) a long string in the HREF attribute of a REF element in a .asx file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/34860; http://www.securityfocus.com/bid/34864; https://exchange.xforce.ibmcloud.com/vulnerabilities/50375
CVE: CVE-2009-1642
Published: 2009-05-15
Description: Multiple stack-based buffer overflows in Mini-stream ASX to MP3 Converter 3.0.0.7 allow remote attackers to execute arbitrary code via (1) a long rtsp URL in a .ram file and (2) a long string in the HREF attribute of a REF element in a .asx file.  NOTE: the latter was also subsequently reported in "prior to 3.1.3.7."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/34860; http://www.securityfocus.com/bid/34864; https://exchange.xforce.ibmcloud.com/vulnerabilities/50374