deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-1531
Published: 2009-06-10
Description: Microsoft Internet Explorer 7 for Windows XP SP2 and SP3; 7 for Server 2003 SP2; 7 for Vista Gold, SP1, and SP2; and 7 for Server 2008 SP2 allows remote attackers to execute arbitrary code via frequent calls to the getElementsByTagName function combined with the creation of an object during reordering of elements, followed by an onreadystatechange event, which triggers an access of an object that (1) was not properly initialized or (2) is deleted, aka "HTML Object Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://osvdb.org/54950; http://www.securityfocus.com/archive/1/504216/100/0/threaded; http://www.securityfocus.com/bid/35234
CVE: CVE-2009-1532
Published: 2009-06-10
Description: Microsoft Internet Explorer 8 for Windows XP SP2 and SP3; 8 for Server 2003 SP2; 8 for Vista Gold, SP1, and SP2; and 8 for Server 2008 SP2 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code via "malformed row property references" that trigger an access of an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "HTML Objects Memory Corruption Vulnerability" or "HTML Object Memory Corruption Vulnerability."
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://osvdb.org/54951; http://www.securityfocus.com/archive/1/504208/100/0/threaded; http://www.securitytracker.com/id?1022350
CVE: CVE-2009-2027
Published: 2009-06-10
Description: The Installer in Apple Safari before 4.0 on Windows allows local users to gain privileges by checking a box that specifies an immediate launch of the application after installation, related to an unspecified compression method.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html; http://support.apple.com/kb/HT3613; http://www.securityfocus.com/bid/35339
CVE: CVE-2009-0198
Published: 2009-06-11
Description: Heap-based buffer overflow in the JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PDF file that contains JBIG2 text region segments with Huffman encoding.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html; http://secunia.com/advisories/34580
CVE: CVE-2009-0509
Published: 2009-06-11
Description: Heap-based buffer overflow in the JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 allows remote attackers to execute arbitrary code via a crafted file that triggers memory corruption.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html; http://secunia.com/advisories/34580
CVE: CVE-2009-0510
Published: 2009-06-11
Description: Heap-based buffer overflow in the JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 might allow remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2009-0511, CVE-2009-0512, CVE-2009-0888, and CVE-2009-0889.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html; http://secunia.com/advisories/34580
CVE: CVE-2009-0511
Published: 2009-06-11
Description: Heap-based buffer overflow in the JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 might allow remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2009-0510, CVE-2009-0512, CVE-2009-0888, and CVE-2009-0889.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html; http://secunia.com/advisories/34580
CVE: CVE-2009-0512
Published: 2009-06-11
Description: Heap-based buffer overflow in the JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 might allow remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2009-0510, CVE-2009-0511, CVE-2009-0888, and CVE-2009-0889.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html; http://secunia.com/advisories/34580
CVE: CVE-2009-0888
Published: 2009-06-11
Description: Heap-based buffer overflow in the JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 might allow remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2009-0510, CVE-2009-0511, CVE-2009-0512, and CVE-2009-0889.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/34580; http://secunia.com/advisories/35496; http://secunia.com/advisories/35734
CVE: CVE-2009-0889
Published: 2009-06-11
Description: Heap-based buffer overflow in the JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 might allow remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2009-0510, CVE-2009-0511, CVE-2009-0512, and CVE-2009-0888.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/34580; http://secunia.com/advisories/35496; http://secunia.com/advisories/35734
CVE: CVE-2009-1420
Published: 2009-06-11
Description: Stack-based buffer overflow in rping in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53, when used with SNMP (aka HPOvNNM.HPOVSNMP) before 1.30.009 and MIB (aka HPOvNNM.HPOVMIB) before 1.30.009, allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=810; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4552&w=2; http://secunia.com/advisories/35408
CVE: CVE-2009-1855
Published: 2009-06-11
Description: Stack-based buffer overflow in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 might allow attackers to execute arbitrary code via a PDF file containing a malformed U3D model file with a crafted extension block.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html; http://secunia.com/advisories/34580
CVE: CVE-2009-1856
Published: 2009-06-11
Description: Integer overflow in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 allows attackers to cause a denial of service or possibly execute arbitrary code via a PDF file containing unspecified parameters to the FlateDecode filter, which triggers a heap-based buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=807; http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html
CVE: CVE-2009-1857
Published: 2009-06-11
Description: Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 allow attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a PDF document with a crafted TrueType font.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html; http://secunia.com/advisories/34580
CVE: CVE-2009-1858
Published: 2009-06-11
Description: The JBIG2 filter in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 might allow remote attackers to execute arbitrary code via unspecified vectors that trigger memory corruption.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html; http://secunia.com/advisories/34580
CVE: CVE-2009-1859
Published: 2009-06-11
Description: Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 might allow attackers to execute arbitrary code via unspecified vectors that trigger memory corruption.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html; http://secunia.com/advisories/34580
CVE: CVE-2009-1861
Published: 2009-06-11
Description: Multiple heap-based buffer overflows in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 might allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PDF file with a JPX (aka JPEG2000) stream that triggers heap memory corruption.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html; http://secunia.com/advisories/34580
CVE: CVE-2009-2028
Published: 2009-06-11
Description: Multiple unspecified vulnerabilities in Adobe Reader 7 and Acrobat 7 before 7.1.3, Adobe Reader 8 and Acrobat 8 before 8.1.6, and Adobe Reader 9 and Acrobat 9 before 9.1.2 have unknown impact and attack vectors, related to "Adobe internally discovered issues."
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/35496; http://secunia.com/advisories/35734; http://security.gentoo.org/glsa/glsa-200907-06.xml
CVE: CVE-2009-2029
Published: 2009-06-11
Description: Unspecified vulnerability in rpc.nisd in Sun Solaris 8 through 10, and OpenSolaris before snv_104, allows remote authenticated users to cause a denial of service (NIS+ daemon hang) via unspecified vectors related to NIS+ callbacks.
CVSS Score: 5.0 (MEDIUM)
References: http://sunsolve.sun.com/search/document.do?assetkey=1-21-112960-67-1; http://sunsolve.sun.com/search/document.do?assetkey=1-66-256748-1; http://www.securityfocus.com/bid/35276
CVE: CVE-2009-0202
Published: 2009-06-11
Description: Array index error in FL21WIN.DLL in the PowerPoint Freelance Windows 2.1 Translator in Microsoft PowerPoint 2000 and 2002 allows remote attackers to execute arbitrary code via a Freelance file with unspecified "layout information" that triggers a heap-based buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/35184; http://secunia.com/secunia_research/2009-29/; http://securitytracker.com/id?1022369
CVE: CVE-2009-1760
Published: 2009-06-11
Description: Directory traversal vulnerability in src/torrent_info.cpp in Rasterbar libtorrent before 0.14.4, as used in firetorrent, qBittorrent, deluge Torrent, and other applications, allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) and partial relative pathname in a Multiple File Mode list element in a .torrent file.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-22
References: http://census-labs.com/news/2009/06/08/libtorrent-rasterbar/; http://secunia.com/advisories/35277; http://secunia.com/advisories/35848
CVE: CVE-2009-1904
Published: 2009-06-11
Description: The BigDecimal library in Ruby 1.8.6 before p369 and 1.8.7 before p173 allows context-dependent attackers to cause a denial of service (application crash) via a string argument that represents a large number, as demonstrated by an attempted conversion to the Float data type.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=532689; http://bugs.gentoo.org/show_bug.cgi?id=273213; http://github.com/NZKoz/bigdecimal-segfault-fix/tree/master
CVE: CVE-2009-2030
Published: 2009-06-11
Description: Unspecified vulnerability in the XML Digital Signature verification functionality in JVA-RUN in JDK 6.0 in IBM OS/400 i5/OS V5R4M0 and V6R1M0 has unknown impact and attack vectors related to "XML SECURITY PATCH."
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/35356; http://www-01.ibm.com/support/docview.wss?uid=nas2741c96b7c573b81a862575cc003c726e; http://www-01.ibm.com/support/docview.wss?uid=nas2e858199605d[PII_REDACTED]5cc003c7276
CVE: CVE-2009-2031
Published: 2009-06-11
Description: smbfs in Sun OpenSolaris snv_84 through snv_110, when default mount permissions are used, allows local users to read arbitrary files, and list arbitrary directories, on CIFS volumes.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://sunsolve.sun.com/search/document.do?assetkey=1-66-257548-1; http://www.securityfocus.com/bid/35306; http://www.vupen.com/english/advisories/2009/1569
CVE: CVE-2009-2032
Published: 2009-06-12
Description: Cross-site scripting (XSS) vulnerability in search.asp in PDshopPro, when downloaded before 20070308, allows remote attackers to inject arbitrary web script or HTML via the search parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/55020; http://packetstorm.linuxsecurity.com/0906-exploits/pdshoppro-xss.txt; http://secunia.com/advisories/34200
CVE: CVE-2009-2033
Published: 2009-06-12
Description: Cross-site scripting (XSS) vulnerability in index.php in Yogurt 0.3 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/55097; http://www.securityfocus.com/bid/35324; https://www.exploit-db.com/exploits/8932
CVE: CVE-2009-2034
Published: 2009-06-12
Description: SQL injection vulnerability in writemessage.php in Yogurt 0.3, when register_globals is enabled, allows remote authenticated users to execute arbitrary SQL commands via the original parameter.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/55098; http://www.securityfocus.com/bid/35324; https://www.exploit-db.com/exploits/8932
CVE: CVE-2009-2035
Published: 2009-06-12
Description: Unspecified vulnerability in Services 6.x before 6.x-0.14, a module for Drupal, when key-based access is enabled, allows remote attackers to read or add keys and access unauthorized services via unspecified vectors.
CVSS Score: 6.4 (MEDIUM)
References: http://drupal.org/node/487784; http://drupal.org/node/488004; http://osvdb.org/54999
CVE: CVE-2009-2036
Published: 2009-06-12
Description: SQL injection vulnerability in index.php in Open Biller 0.1 allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/55103; http://www.securityfocus.com/archive/1/504231/100/0/threaded; https://www.exploit-db.com/exploits/8927
CVE: CVE-2009-2037
Published: 2009-06-12
Description: Multiple directory traversal vulnerabilities in Online Grades & Attendance 3.2.5 and earlier, and possibly 3.2.6, when register_globals is enabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) GLOBALS[SKIN] parameter to index.php and the (2) skin parameter to admin/admin.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/50901; https://exchange.xforce.ibmcloud.com/vulnerabilities/50902; https://www.exploit-db.com/exploits/8853
CVE: CVE-2009-2038
Published: 2009-06-12
Description: Unspecified vulnerability in the Finnish Bank Payment module 2.2 for osCommerce has unknown impact and attack vectors related to bank charges.
CVSS Score: 10.0 (HIGH)
References: http://addons.oscommerce.com/info/5485; http://secunia.com/advisories/35385; http://www.cert.fi/haavoittuvuudet/2009/haavoittuvuus-2009-046.html
CVE: CVE-2009-2039
Published: 2009-06-12
Description: Unspecified vulnerability in the Luottokunta module before 1.3 for osCommerce has unknown impact and attack vectors related to orders.
CVSS Score: 10.0 (HIGH)
References: http://addons.oscommerce.com/info/3698; http://secunia.com/advisories/35291; http://www.cert.fi/haavoittuvuudet/2009/haavoittuvuus-2009-046.html
CVE: CVE-2009-2040
Published: 2009-06-12
Description: admin/options.php in Grestul 1.2 does not properly restrict access, which allows remote attackers to bypass authentication and create administrative accounts via a manage_admin action in a direct request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/35367; https://exchange.xforce.ibmcloud.com/vulnerabilities/50999; https://www.exploit-db.com/exploits/8902
CVE: CVE-2009-2041
Published: 2009-06-12
Description: Cross-site scripting (XSS) vulnerability in A51 D.O.O. activeCollab 0.7.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2009-1772.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN55752635/index.html; http://osvdb.org/55099; https://exchange.xforce.ibmcloud.com/vulnerabilities/51190
CVE: CVE-2009-2042
Published: 2009-06-12
Description: libpng before 1.2.37 does not properly parse 1-bit interlaced images with width values that are not divisible by 8, which causes libpng to include uninitialized bits in certain rows of a PNG file and might allow remote attackers to read portions of sensitive memory via "out-of-bounds pixels" in the file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/bugtraq/2010-04/0077.html; http://archives.neohapsis.com/archives/fulldisclosure/2010-04/0121.html; http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
CVE: CVE-2009-1392
Published: 2009-06-12
Description: The browser engine in Mozilla Firefox 3 before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to (1) nsEventStateManager::GetContentState and nsNativeTheme::CheckBooleanAttr; (2) UnhookTextRunFromFrames and ClearAllTextRunReferences; (3) nsTextFrame::ClearTextRun; (4) IsPercentageAware; (5) PL_DHashTableFinish; (6) nsListBoxBodyFrame::GetNextItemBox; (7) AtomTableClearEntry, related to the atom table, DOM mutation events, and Unicode surrogates; (8) nsHTMLEditor::HideResizers; and (9) nsWindow::SetCursor, related to changing the cursor; and other vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://osvdb.org/55144; http://osvdb.org/55145; http://osvdb.org/55146
CVE: CVE-2009-1832
Published: 2009-06-12
Description: Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors involving "double frame construction."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://osvdb.org/55148; http://secunia.com/advisories/35331; http://secunia.com/advisories/35415
CVE: CVE-2009-1833
Published: 2009-06-12
Description: The JavaScript engine in Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to (1) js_LeaveSharpObject, (2) ParseXMLSource, and (3) a certain assertion in jsinterp.c; and other vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://osvdb.org/55152; http://osvdb.org/55153; http://osvdb.org/55154
CVE: CVE-2009-1834
Published: 2009-06-12
Description: Visual truncation vulnerability in netwerk/dns/src/nsIDNService.cpp in Mozilla Firefox before 3.0.11 and SeaMonkey before 1.1.17 allows remote attackers to spoof the location bar via an IDN with invalid Unicode characters that are displayed as whitespace, as demonstrated by the \u115A through \u115E characters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/55162; http://secunia.com/advisories/35331; http://secunia.com/advisories/35415
CVE: CVE-2009-1835
Published: 2009-06-12
Description: Mozilla Firefox before 3.0.11 and SeaMonkey before 1.1.17 associate local documents with external domain names located after the file:// substring in a URL, which allows user-assisted remote attackers to read arbitrary cookies via a crafted HTML document, as demonstrated by a URL with file://example.com/C:/ at the beginning.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/55161; http://rhn.redhat.com/errata/RHSA-2009-1096.html; http://secunia.com/advisories/35331
CVE: CVE-2009-1836
Published: 2009-06-12
Description: Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 use the HTTP Host header to determine the context of a document provided in a non-200 CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" attack.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://osvdb.org/55160; http://research.microsoft.com/apps/pubs/default.aspx?id=79323; http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf
CVE: CVE-2009-1837
Published: 2009-06-12
Description: Race condition in the NPObjWrapper_NewResolve function in modules/plugin/base/src/nsJSNPRuntime.cpp in xul.dll in Mozilla Firefox 3 before 3.0.11 might allow remote attackers to execute arbitrary code via a page transition during Java applet loading, related to a use-after-free vulnerability for memory associated with a destroyed Java object.
CVSS Score: 7.5 (HIGH)
CWE: CWE-362, CWE-416
References: http://secunia.com/advisories/34241; http://secunia.com/advisories/35331; http://secunia.com/advisories/35415
CVE: CVE-2009-1838
Published: 2009-06-12
Description: The garbage-collection implementation in Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 sets an element's owner document to null in unspecified circumstances, which allows remote attackers to execute arbitrary JavaScript with chrome privileges via a crafted event handler, related to an incorrect context for this event handler.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://osvdb.org/55157; http://rhn.redhat.com/errata/RHSA-2009-1096.html; http://secunia.com/advisories/35331
CVE: CVE-2009-1839
Published: 2009-06-12
Description: Mozilla Firefox 3 before 3.0.11 associates an incorrect principal with a file: URL loaded through the location bar, which allows user-assisted remote attackers to bypass intended access restrictions and read files via a crafted HTML document, aka a "file-URL-to-file-URL scripting" attack.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/55163; http://secunia.com/advisories/35331; http://secunia.com/advisories/35415