deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-0835
Published: 2009-03-06
Description: The __secure_computing function in kernel/seccomp.c in the seccomp subsystem in the Linux kernel 2.6.28.7 and earlier on the x86_64 platform, when CONFIG_SECCOMP is enabled, does not properly handle (1) a 32-bit process making a 64-bit syscall or (2) a 64-bit process making a 32-bit syscall, which allows local users to bypass intended access restrictions via crafted syscalls that are misinterpreted as (a) stat or (b) chmod, a related issue to CVE-2009-0342 and CVE-2009-0343.
CVSS Score: 3.6 (LOW)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00000.html
CVE: CVE-2008-6416
Published: 2009-03-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in GreenSQL-Console before 0.3.5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "internal pages."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/45870; http://secunia.com/advisories/30475; http://www.greensql.net/node/70
CVE: CVE-2008-6417
Published: 2009-03-06
Description: Unspecified vulnerability in GreenSQL-Console before 0.3.5 allows attackers to obtain the "installation directory" via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/45871; http://secunia.com/advisories/30475; http://www.greensql.net/node/70
CVE: CVE-2008-6418
Published: 2009-03-06
Description: SQL injection vulnerability in scrape.php in TorrentTrader before 2008-05-13 allows remote attackers to execute arbitrary SQL commands via the info_hash parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/45858; http://secunia.com/advisories/30480; http://sourceforge.net/project/shownotes.php?group_id=98584&release_id=545219
CVE: CVE-2008-6419
Published: 2009-03-06
Description: Multiple SQL injection vulnerabilities in Social Site Generator (SSG) 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) sgc_id parameter to display_blog.php, (2) scm_mem_id parameter to social_my_profile_download.php, and the (3) catid parameter to social_forum_subcategories.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/45859; http://osvdb.org/45860; http://osvdb.org/45861
CVE: CVE-2008-6420
Published: 2009-03-06
Description: Social Site Generator (SSG) 2.0 allows remote attackers to read arbitrary files via the file parameter to (1) filedload.php, (2) webadmin/download.php, and (3) webadmin/download_file.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/45862; http://osvdb.org/45863; http://osvdb.org/45864
CVE: CVE-2008-6421
Published: 2009-03-06
Description: PHP remote file inclusion vulnerability in social_game_play.php in Social Site Generator (SSG) 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the path parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/45865; http://secunia.com/advisories/30462; http://www.securityfocus.com/bid/29462
CVE: CVE-2008-6422
Published: 2009-03-06
Description: Multiple SQL injection vulnerabilities in PsychoStats 2.3, 2.3.1, and 2.3.3 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) weapon.php and (2) map.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/45868; http://osvdb.org/45869; http://secunia.com/advisories/30464
CVE: CVE-2008-6423
Published: 2009-03-06
Description: Directory traversal vulnerability in passwiki.php in PassWiki 0.9.16 RC3 and earlier allows remote attackers to read arbitrary local files via a .. (dot dot) in the site_id parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/45853; http://secunia.com/advisories/30496; http://www.securityfocus.com/bid/29455
CVE: CVE-2008-6424
Published: 2009-03-06
Description: Directory traversal vulnerability in FFFTP 1.96b allows remote FTP servers to create or overwrite arbitrary files via a response to an FTP LIST command with a filename that contains a .. (dot dot).
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: http://osvdb.org/45894; http://secunia.com/advisories/30428; http://vuln.sg/FFFTP196b-en.html
CVE: CVE-2008-6425
Published: 2009-03-06
Description: SQL injection vulnerability in news.php in ComicShout 2.8 allows remote attackers to execute arbitrary SQL commands via the news_id parameter, a different vector than CVE-2008-2456.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/51438; http://www.comicshout.com/; http://www.securityfocus.com/archive/1/492918
CVE: CVE-2008-6427
Published: 2009-03-06
Description: SQL injection vulnerability in index.php in Hivemaker Professional 1.0.2 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the cid parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://e-rdc.org/v1/news.php?readmore=91; http://osvdb.org/45916; http://secunia.com/advisories/30465
CVE: CVE-2008-6428
Published: 2009-03-06
Description: The CGI framework in Kaya 0.4.0 allows remote attackers to inject arbitrary HTTP headers and conduct cross-site scripting (XSS) attacks via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://kayalang.org/about/news; http://osvdb.org/45882; http://secunia.com/advisories/30466
CVE: CVE-2008-6429
Published: 2009-03-06
Description: SQL injection vulnerability in the PrayerCenter (com_prayercenter) component 1.4.9 and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a view_request action to index2.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/45856; http://secunia.com/advisories/30493; https://exchange.xforce.ibmcloud.com/vulnerabilities/42772
CVE: CVE-2008-6430
Published: 2009-03-06
Description: SQL injection vulnerability in the MyContent (com_mycontent) component 1.1.13 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a view action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/45852; http://secunia.com/advisories/30490; http://www.securityfocus.com/bid/29468
CVE: CVE-2008-6431
Published: 2009-03-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in BMForum 5.6 allow remote attackers to inject arbitrary web script or HTML via the (1) outpused parameter to index.php, the (2) footer_copyright and (3) verandproname parameters to newtem/footer/bsd01footer.php, and the (4) topads and (5) myplugin parameters to newtem/header/bsd01header.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/45612; http://osvdb.org/45613; http://osvdb.org/45614
CVE: CVE-2008-6433
Published: 2009-03-06
Description: Cross-site scripting (XSS) vulnerability in index.cfm in Blue River Interactive Group Sava CMS before 5.0.122 allows remote attackers to inject arbitrary web script or HTML via the keywords parameter in a search action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://holisticinfosec.org/content/view/67/45/; http://osvdb.org/45615; http://secunia.com/advisories/30367
CVE: CVE-2008-6434
Published: 2009-03-06
Description: SQL injection vulnerability in index.cfm in Blue River Interactive Group Sava CMS before 5.0.122 allows remote attackers to execute arbitrary SQL commands via the LinkServID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://holisticinfosec.org/content/view/67/45/; http://osvdb.org/45616; http://secunia.com/advisories/30367
CVE: CVE-2008-6435
Published: 2009-03-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in phpSQLiteCMS 1 RC2 allow remote attackers to inject arbitrary web script or HTML via the (1) lang[home], (2) lang[admin_menu], and (3) lang[admin_menu_page_overview] parameters to cms/includes/header.inc.php; and the (4) lang[login_username] and (5) lang[login_password] parameters to cms/includes/login.inc.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/492446/100/0/threaded; http://www.securityfocus.com/bid/29338; https://exchange.xforce.ibmcloud.com/vulnerabilities/42585
CVE: CVE-2008-6436
Published: 2009-03-06
Description: Cross-site scripting (XSS) vulnerability in the Web Server in Xerox WorkCentre 7132, 7228, 7235, and 7245 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/45627; http://secunia.com/advisories/30364; http://www.securityfocus.com/bid/29345
CVE: CVE-2008-6437
Published: 2009-03-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in PHPFreeForum 1.0 RC2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) message parameter to error.php, and the (2) nickname and (3) randomid parameters to part/menu.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/45607; http://osvdb.org/45608; http://secunia.com/advisories/30372
CVE: CVE-2008-6438
Published: 2009-03-06
Description: SQL injection vulnerability in macgurublog_menu/macgurublog.php in the MacGuru BLOG Engine plugin 2.2 for e107 allows remote attackers to execute arbitrary SQL commands via the uid parameter, a different vector than CVE-2008-2455.  NOTE: it was later reported that 2.1.4 is also affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/51408; http://secunia.com/advisories/30212; http://www.securityfocus.com/archive/1/492506/100/0/threaded
CVE: CVE-2008-6439
Published: 2009-03-06
Description: Cross-site scripting (XSS) vulnerability in search_results.php in ABK-Soft AbleDating 2.4 allows remote attackers to inject arbitrary web script or HTML via the keyword parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30366; http://www.securityfocus.com/archive/1/492478/100/0/threaded; http://www.securityfocus.com/bid/29342
CVE: CVE-2008-6440
Published: 2009-03-06
Description: Cerberus Helpdesk before 4.0 (Build 600) allows remote attackers to obtain sensitive information via direct requests for "controllers ... that aren't standard helpdesk pages," possibly involving the (1) /display and (2) /kb URIs.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/30344; http://www.cerb4.com/blog/2008/05/15/important-security-patch-40-build-599/; http://www.securityfocus.com/bid/29335
CVE: CVE-2009-0838
Published: 2009-03-06
Description: The crypto pseudo device driver in Sun Solaris 10, and OpenSolaris snv_88 through snv_102, does not properly free memory, which allows local users to cause a denial of service (panic) via unspecified vectors, related to the vmem_hash_delete function.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/34149; http://secunia.com/advisories/34455; http://securitytracker.com/id?1021810
CVE: CVE-2008-6441
Published: 2009-03-09
Description: Format string vulnerability in the Epic Games Unreal engine client, as used in multiple games, allows remote servers to execute arbitrary code via (1) the CLASS parameter in a DLMGR command, (2) a malformed package (PKG), and possibly (3) the LEVEL parameter in a WELCOME command.
CVSS Score: 9.3 (HIGH)
CWE: CWE-134
References: http://aluigi.altervista.org/adv/unrealcfs-adv.txt; http://archives.neohapsis.com/archives/fulldisclosure/2008-09/0190.html; http://secunia.com/advisories/31854
CVE: CVE-2008-6442
Published: 2009-03-09
Description: Insecure method vulnerability in Sina Inc. DLoader Class ActiveX Control allows remote attackers to overwrite arbitrary files via a URL in the first parameter to the DonwloadAndInstall method.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 5.8 (MEDIUM)
References: http://downloads.securityfocus.com/vulnerabilities/exploits/30223.html; http://www.securityfocus.com/bid/30223; https://exchange.xforce.ibmcloud.com/vulnerabilities/43881
CVE: CVE-2008-6443
Published: 2009-03-09
Description: SQL injection vulnerability in forum_duzen.php in phpKF allows remote attackers to execute arbitrary SQL commands via the fno parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/30318; http://www.securityfocus.com/bid/30318/exploit; https://exchange.xforce.ibmcloud.com/vulnerabilities/43944
CVE: CVE-2008-6444
Published: 2009-03-09
Description: Stack-based buffer overflow in CSTransfer.dll in Baidu Hi IM might allow remote attackers to execute arbitrary code via a crafted packet, probably related to an improper length value.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://osvdb.org/51696; http://www.securityfocus.com/archive/1/496322/100/0/threaded; http://www.securityfocus.com/bid/31162
CVE: CVE-2008-6445
Published: 2009-03-09
Description: Unspecified vulnerability in YourPlace before 1.0.1 has unknown impact and attack vectors, possibly related to improper authentication and the ability to upload arbitrary PHP code.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://osvdb.org/46754; http://secunia.com/advisories/30956; http://sourceforge.net/project/shownotes.php?release_id=611591&group_id=229069
CVE: CVE-2008-6446
Published: 2009-03-09
Description: Static code injection vulnerability in the Guestbook component in CMS MAXSITE allows remote attackers to inject arbitrary PHP code into the guestbook via the message parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/32588; https://exchange.xforce.ibmcloud.com/vulnerabilities/47025; https://www.exploit-db.com/exploits/7322
CVE: CVE-2008-6447
Published: 2009-03-09
Description: Buffer overflow in emmailstore.dll 6.5.0.3 in the QuikSoft EasyMail MailStore ActiveX control allows remote attackers to execute arbitrary code via a long first argument to the CreateStore method.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/32722; https://exchange.xforce.ibmcloud.com/vulnerabilities/47207; https://www.exploit-db.com/exploits/7402
CVE: CVE-2008-6448
Published: 2009-03-09
Description: Cross-site scripting (XSS) vulnerability in install.cgi in SKYARC System MTCMS WYSIWYG Editor allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN21312708/index.html; http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000003.html; http://www.mtcms.jp/01/3886.html
CVE: CVE-2008-6449
Published: 2009-03-09
Description: Cross-site request forgery (CSRF) vulnerability in multiple Century Systems routers including XR-410 before 1.6.9, XR-510 before 3.5.3, XR-440 before 1.7.8, and other XR series routers from XR-510 to XR-730 allows remote attackers to modify configuration as the administrator via unknown vectors.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-352
References: http://jvn.jp/en/jp/JVN67573833/index.html; http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000042.html; http://secunia.com/advisories/31173
CVE: CVE-2008-6450
Published: 2009-03-09
Description: Cross-site scripting (XSS) vulnerability in Under Construction, Baby (UCB) PC2M 0.9.22.4 and earlier allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN38893575/index.html; http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000008.html; http://www.rcdtokyo.com/pc2m/note/archives/i000854.php
CVE: CVE-2009-0849
Published: 2009-03-09
Description: Stack-based buffer overflow in the DtbClsLogin function in NovaStor NovaNET 12 allows remote attackers to (1) execute arbitrary code on Linux platforms via a long username field during backup domain authentication, related to libnnlindtb.so; or (2) cause a denial of service (daemon crash) on Windows platforms via a long username field during backup domain authentication, related to nnwindtb.dll.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://osvdb.org/52301; http://osvdb.org/52302; http://secunia.com/advisories/34024
CVE: CVE-2009-0850
Published: 2009-03-09
Description: Cross-site scripting (XSS) vulnerability in BitDefender Internet Security 2009 allows user-assisted remote attackers to inject arbitrary web script or HTML via the filename of a virus-infected file, as demonstrated by a filename inside a (1) rar or (2) zip archive file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/34082; http://www.securityfocus.com/archive/1/501277/100/0/threaded; http://www.securityfocus.com/archive/1/501299/100/0/threaded
CVE: CVE-2009-0851
Published: 2009-03-09
Description: Multiple SQL injection vulnerabilities in CelerBB 0.0.2, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) viewforum.php and (2) viewtopic.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://www.securityfocus.com/archive/1/501481/100/0/threaded; http://www.securityfocus.com/bid/34014; https://www.exploit-db.com/exploits/8161
CVE: CVE-2009-0852
Published: 2009-03-09
Description: showme.php in CelerBB 0.0.2 allows remote attackers to obtain "reserved information" via the user parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/archive/1/501481/100/0/threaded; http://www.securityfocus.com/bid/34014; https://www.exploit-db.com/exploits/8161
CVE: CVE-2009-0853
Published: 2009-03-09
Description: login.php in CelerBB 0.0.2, when magic_quotes_gpc is disabled, allows remote attackers to bypass authentication and obtain administrative access via special characters in the Username parameter, as demonstrated by an admin'# parameter value.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://www.securityfocus.com/archive/1/501481/100/0/threaded; http://www.securityfocus.com/bid/34014; https://www.exploit-db.com/exploits/8161
CVE: CVE-2009-0027
Published: 2009-03-09
Description: The request handler in JBossWS in JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP06 and 4.3 before 4.3.0.CP04 does not properly validate the resource path during a request for a WSDL file with a custom web-service endpoint, which allows remote attackers to read arbitrary XML files via a crafted request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://rhn.redhat.com/errata/RHSA-2009-0346.html; http://rhn.redhat.com/errata/RHSA-2009-0347.html; http://rhn.redhat.com/errata/RHSA-2009-0348.html
CVE: CVE-2009-0537
Published: 2009-03-09
Description: Integer overflow in the fts_build function in fts.c in libc in (1) OpenBSD 4.4 and earlier and (2) Microsoft Interix 6.0 build 10.0.6030.0 allows context-dependent attackers to cause a denial of service (application crash) via a deep directory tree, related to the fts_level structure member, as demonstrated by (a) du, (b) rm, (c) chmod, and (d) chgrp on OpenBSD; and (e) SearchIndexer.exe on Vista Enterprise.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-189
References: http://securityreason.com/achievement_securityalert/60; http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gen/fts.c; http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gen/fts.c.diff?r1=1.41%3Br2=1.42%3Bf=h
CVE: CVE-2009-0781
Published: 2009-03-09
Description: Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6623&w=2
CVE: CVE-2009-0825
Published: 2009-03-09
Description: SQL injection vulnerability in system/rss.php in TinX/cms 3.x before 3.5.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://en.securitylab.ru/lab/PT-2009-13; http://secunia.com/advisories/34178; http://sourceforge.net/project/showfiles.php?group_id=133415
CVE: CVE-2009-0855
Published: 2009-03-09
Description: Cross-site scripting (XSS) vulnerability in the administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.23 on z/OS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/170073/IBM-Websphere-Application-Server-7.0-Cross-Site-Scripting.html; http://secunia.com/advisories/34131; http://secunia.com/advisories/34461
CVE: CVE-2009-0856
Published: 2009-03-09
Description: Multiple cross-site scripting (XSS) vulnerabilities in sample applications in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.35, and 6.1 before 6.1.0.23 on z/OS, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securitytracker.com/id?1021811; http://www-01.ibm.com/support/docview.wss?uid=swg1PK76720; http://www-01.ibm.com/support/docview.wss?uid=swg1PK81212
CVE: CVE-2009-0857
Published: 2009-03-09
Description: Cross-site scripting (XSS) vulnerability in /prm/reports in the Performance Reporting Module (PRM) for Sun Management Center (SunMC) 3.6.1 and 4.0 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.  NOTE: this can be leveraged for access to the SunMC Web Console.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/34146; http://securitytracker.com/id?1021809; http://sunsolve.sun.com/search/document.do?assetkey=1-21-125191-04-1
CVE: CVE-2009-0858
Published: 2009-03-09
Description: The response_addname function in response.c in Daniel J. Bernstein djbdns 1.05 and earlier does not constrain offsets in the required manner, which allows remote attackers, with control over a third-party subdomain served by tinydns and axfrdns, to trigger DNS responses containing arbitrary records via crafted zone data for this subdomain.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://it.slashdot.org/article.pl?sid=09/03/05/2014249; http://marc.info/?l=djbdns&m=[PII_REDACTED]0038; http://marc.info/?l=djbdns&m=[PII_REDACTED]0446&w=2
CVE: CVE-2009-0859
Published: 2009-03-09
Description: The shm_get_stat function in ipc/shm.c in the shm subsystem in the Linux kernel before 2.6.28.5, when CONFIG_SHMEM is disabled, misinterprets the data type of an inode, which allows local users to cause a denial of service (system hang) via an SHM_INFO shmctl call, as demonstrated by running the ipcs program.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-20
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a68e61e8ff2d46327a37b69056998b47745db6fa; http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.28.5; http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00002.html
CVE: CVE-2009-0860
Published: 2009-03-10
Description: Cross-site scripting (XSS) vulnerability in the web user interface in the login application in NetMRI 3.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to error pages.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://connection.netcordia.com/forums/t/731.aspx; http://secunia.com/advisories/33963; http://www.securityfocus.com/archive/1/501033/100/0/threaded
CVE: CVE-2009-0861
Published: 2009-03-10
Description: Cross-site scripting (XSS) vulnerability in phpDenora before 1.2.3 allows remote attackers to inject arbitrary web script or HTML via an IRC channel name.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/51981; http://secunia.com/advisories/33960; http://sourceforge.net/project/shownotes.php?release_id=661189