deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-1376
Published: 2008-08-01
Description: A certain Red Hat build script for nfs-utils before 1.0.9-35z.el5_2 on Red Hat Enterprise Linux (RHEL) 5 omits TCP wrappers support, which might allow remote attackers to bypass intended access restrictions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/31322; http://secunia.com/advisories/35162; http://www.redhat.com/support/errata/RHSA-2008-0486.html
CVE: CVE-2008-1662
Published: 2008-08-01
Description: Unspecified vulnerability in the HP System Administration Manager (SAM) on HP-UX B.11.11 and B.11.23, when used to configure NFS, might allow remote attackers to read or modify arbitrary files, related to an "empty systems list."
CVSS Score: 10.0 (HIGH)
CWE: CWE-16
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01367453; http://secunia.com/advisories/31309; http://securitytracker.com/id?1020580
CVE: CVE-2008-1810
Published: 2008-08-01
Description: Untrusted search path vulnerability in dbmsrv in SAP MaxDB 7.6.03.15 on Linux allows local users to gain privileges via a modified PATH environment variable.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-264
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=729; http://secunia.com/advisories/31318; http://www.securityfocus.com/bid/30474
CVE: CVE-2008-2235
Published: 2008-08-01
Description: OpenSC before 0.11.5 uses weak permissions (ADMIN file control information of 00) for the 5015 directory on smart cards and USB crypto tokens running Siemens CardOS M4, which allows physically proximate attackers to change the PIN.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-310
References: http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html; http://secunia.com/advisories/31330
CVE: CVE-2008-2315
Published: 2008-08-01
Description: Multiple integer overflows in Python 2.5.2 and earlier allow context-dependent attackers to have an unknown impact via vectors related to the (1) stringobject, (2) unicodeobject, (3) bufferobject, (4) longobject, (5) tupleobject, (6) stropmodule, (7) gcmodule, and (8) mmapmodule modules.  NOTE: The expandtabs integer overflows in stringobject and unicodeobject in 2.5.2 are covered by CVE-2008-5031.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: http://bugs.gentoo.org/attachment.cgi?id=159418&action=view; http://bugs.gentoo.org/show_bug.cgi?id=230640; http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html
CVE: CVE-2008-2316
Published: 2008-08-01
Description: Integer overflow in _hashopenssl.c in the hashlib module in Python 2.5.2 and earlier might allow context-dependent attackers to defeat cryptographic digests, related to "partial hashlib hashing of data exceeding 4GB."
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://bugs.gentoo.org/attachment.cgi?id=159422&action=view; http://bugs.gentoo.org/show_bug.cgi?id=230640; http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html
CVE: CVE-2008-2935
Published: 2008-08-01
Description: Multiple heap-based buffer overflows in the rc4 (1) encryption (aka exsltCryptoRc4EncryptFunction) and (2) decryption (aka exsltCryptoRc4DecryptFunction) functions in crypto.c in libexslt in libxslt 1.1.8 through 1.1.24 allow context-dependent attackers to execute arbitrary code via an XML file containing a long string as "an argument in the XSL input."
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/31230; http://secunia.com/advisories/31310; http://secunia.com/advisories/31331
CVE: CVE-2008-3142
Published: 2008-08-01
Description: Multiple buffer overflows in Python 2.5.2 and earlier on 32bit platforms allow context-dependent attackers to cause a denial of service (crash) or have unspecified other impact via a long string that leads to incorrect memory allocation during Unicode string processing, related to the unicode_resize function and the PyMem_RESIZE macro.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: http://bugs.gentoo.org/show_bug.cgi?id=232137; http://bugs.python.org/file10825/issue2620-gps02-patch.txt; http://bugs.python.org/issue2620
CVE: CVE-2008-3143
Published: 2008-08-01
Description: Multiple integer overflows in Python before 2.5.2 might allow context-dependent attackers to have an unknown impact via vectors related to (1) Include/pymem.h; (2) _csv.c, (3) _struct.c, (4) arraymodule.c, (5) audioop.c, (6) binascii.c, (7) cPickle.c, (8) cStringIO.c, (9) cjkcodecs/multibytecodec.c, (10) datetimemodule.c, (11) md5.c, (12) rgbimgmodule.c, and (13) stropmodule.c in Modules/; (14) bufferobject.c, (15) listobject.c, and (16) obmalloc.c in Objects/; (17) Parser/node.c; and (18) asdl.c, (19) ast.c, (20) bltinmodule.c, and (21) compile.c in Python/, as addressed by "checks for integer overflows, contributed by Google."
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: http://bugs.gentoo.org/show_bug.cgi?id=232137; http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html; http://secunia.com/advisories/31332
CVE: CVE-2008-3144
Published: 2008-08-01
Description: Multiple integer overflows in the PyOS_vsnprintf function in Python/mysnprintf.c in Python 2.5.2 and earlier allow context-dependent attackers to cause a denial of service (memory corruption) or have unspecified other impact via crafted input to string formatting operations.  NOTE: the handling of certain integer values is also affected by related integer underflows and an off-by-one error.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-190
References: http://bugs.gentoo.org/show_bug.cgi?id=232137; http://bugs.python.org/issue2588; http://bugs.python.org/issue2589
CVE: CVE-2008-3175
Published: 2008-08-01
Description: Integer underflow in rxRPC.dll in the LGServer service in the server in CA ARCserve Backup for Laptops and Desktops 11.0 through 11.5 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted message that triggers a buffer overflow.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-July/063594.html; http://secunia.com/advisories/31319; http://www.securityfocus.com/archive/1/495020/100/0/threaded
CVE: CVE-2008-3433
Published: 2008-08-01
Description: SpeedBit Download Accelerator Plus (DAP) before 8.6.3.9 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://archives.neohapsis.com/archives/bugtraq/2008-07/0250.html; http://www.infobyte.com.ar/down/Francisco%20Amato%20-%20evilgrade%20-%20ENG.pdf; http://www.infobyte.com.ar/down/isr-evilgrade-1.0.0.tar.gz
CVE: CVE-2008-3434
Published: 2008-08-01
Description: Apple iTunes before 10.5.1 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://archives.neohapsis.com/archives/bugtraq/2008-07/0250.html; http://lists.apple.com/archives/Security-announce/2011/Nov/msg00003.html; http://support.apple.com/kb/HT5030
CVE: CVE-2008-3435
Published: 2008-08-01
Description: LinkedIn Browser Toolbar 3.0.3.1100 and earlier does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://archives.neohapsis.com/archives/bugtraq/2008-07/0250.html; http://www.infobyte.com.ar/down/Francisco%20Amato%20-%20evilgrade%20-%20ENG.pdf; http://www.infobyte.com.ar/down/isr-evilgrade-1.0.0.tar.gz
CVE: CVE-2008-3436
Published: 2008-08-01
Description: The GUP generic update process in Notepad++ before 4.8.1 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://archives.neohapsis.com/archives/bugtraq/2008-07/0250.html; http://www.infobyte.com.ar/down/Francisco%20Amato%20-%20evilgrade%20-%20ENG.pdf; http://www.infobyte.com.ar/down/isr-evilgrade-1.0.0.tar.gz
CVE: CVE-2008-3437
Published: 2008-08-01
Description: OpenOffice.org (OOo) before 2.1.0 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://archives.neohapsis.com/archives/bugtraq/2008-07/0250.html; http://securitytracker.com/id?1020583; http://www.infobyte.com.ar/down/Francisco%20Amato%20-%20evilgrade%20-%20ENG.pdf
CVE: CVE-2008-3438
Published: 2008-08-01
Description: Apple Mac OS X does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.
CVSS Score: 8.1 (HIGH)
CWE: CWE-494
References: http://archives.neohapsis.com/archives/bugtraq/2008-07/0250.html; http://www.infobyte.com.ar/down/Francisco%20Amato%20-%20evilgrade%20-%20ENG.pdf; http://www.infobyte.com.ar/down/isr-evilgrade-1.0.0.tar.gz
CVE: CVE-2008-3439
Published: 2008-08-01
Description: SpeedBit Video Acceleration before 2.2.1.8 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://archives.neohapsis.com/archives/bugtraq/2008-07/0250.html; http://www.infobyte.com.ar/down/Francisco%20Amato%20-%20evilgrade%20-%20ENG.pdf; http://www.infobyte.com.ar/down/isr-evilgrade-1.0.0.tar.gz
CVE: CVE-2008-3440
Published: 2008-08-01
Description: Sun Java 1.6.0_03 and earlier versions, and possibly later versions, does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://archives.neohapsis.com/archives/bugtraq/2008-07/0250.html; http://securitytracker.com/id?1020584; http://www.infobyte.com.ar/down/Francisco%20Amato%20-%20evilgrade%20-%20ENG.pdf
CVE: CVE-2008-3441
Published: 2008-08-01
Description: Nullsoft Winamp before 5.24 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://archives.neohapsis.com/archives/bugtraq/2008-07/0250.html; http://securitytracker.com/id?1020582; http://www.infobyte.com.ar/down/Francisco%20Amato%20-%20evilgrade%20-%20ENG.pdf
CVE: CVE-2008-3442
Published: 2008-08-01
Description: WinZip before 11.0 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://archives.neohapsis.com/archives/bugtraq/2008-07/0250.html; http://securitytracker.com/id?1020581; http://www.infobyte.com.ar/down/Francisco%20Amato%20-%20evilgrade%20-%20ENG.pdf
CVE: CVE-2008-1232
Published: 2008-08-04
Description: Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via a crafted string that is used in the message argument to the HttpServletResponse.sendError method.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://community.ca.com/blogs/casecurityresponseblog/archive/2009/06/15/ca20090615-02-ca-service-desk-tomcat-cross-site-scripting-vulnerability.aspx; http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.html
CVE: CVE-2008-2320
Published: 2008-08-04
Description: Stack-based buffer overflow in CarbonCore in Apple Mac OS X 10.4.11 and 10.5.4, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a long filename to the file management API.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce//2008/Jul/msg00003.html; http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html; http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html
CVE: CVE-2008-2321
Published: 2008-08-04
Description: Unspecified vulnerability in CoreGraphics in Apple Mac OS X 10.4.11 and 10.5.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unknown vectors involving "processing of arguments."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce//2008/Jul/msg00003.html; http://lists.apple.com/archives/security-announce/2008/Nov/msg00002.html; http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html
CVE: CVE-2008-2322
Published: 2008-08-04
Description: Integer overflow in CoreGraphics in Apple Mac OS X 10.4.11, 10.5.2, and 10.5.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PDF file with a long Type 1 font, which triggers a heap-based buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=730; http://lists.apple.com/archives/security-announce//2008/Jul/msg00003.html; http://secunia.com/advisories/31326
CVE: CVE-2008-2323
Published: 2008-08-04
Description: Unspecified vulnerability in Data Detectors Engine in Apple Mac OS X 10.5.4 allows attackers to cause a denial of service (resource consumption) via crafted textual content in messages.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce//2008/Jul/msg00003.html; http://secunia.com/advisories/31326; http://www.securityfocus.com/bid/30483
CVE: CVE-2008-2324
Published: 2008-08-04
Description: The Repair Permissions tool in Disk Utility in Apple Mac OS X 10.4.11 adds the setuid bit to the emacs executable file, which allows local users to gain privileges by executing commands within emacs.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce//2008/Jul/msg00003.html; http://secunia.com/advisories/31326; http://www.securityfocus.com/bid/30483
CVE: CVE-2008-2325
Published: 2008-08-04
Description: QuickLook in Apple Mac OS X 10.4.11 and 10.5.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Microsoft Office file, related to insufficient "bounds checking."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce//2008/Jul/msg00003.html; http://secunia.com/advisories/31326; http://www.securityfocus.com/bid/30483
CVE: CVE-2008-2370
Published: 2008-08-04
Description: Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
CVE: CVE-2008-3423
Published: 2008-08-04
Description: IBM WebSphere Portal 5.1 through 6.1.0.0 allows remote attackers to bypass authentication and obtain administrative access via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/31443; http://www-1.ibm.com/support/docview.wss?uid=swg1PK67104; http://www.securityfocus.com/bid/30500
CVE: CVE-2008-3444
Published: 2008-08-04
Description: The content layout component in Mozilla Firefox 3.0 and 3.0.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted but well-formed web page that contains "a simple set of legitimate HTML tags."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://blog.mozilla.com/security/2008/07/30/low-risk-denial-of-service-in-firefox/; http://www.radware.com/newsevents/pressrelease.aspx?id=6459; http://www.securityfocus.com/bid/30486
CVE: CVE-2008-3445
Published: 2008-08-04
Description: SQL injection vulnerability in index.php in phpMyRealty (PMR) 2.0.0 allows remote attackers to execute arbitrary SQL commands via the location parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/31302; http://securityreason.com/securityalert/4103; http://www.securityfocus.com/bid/30484
CVE: CVE-2008-3446
Published: 2008-08-04
Description: Directory traversal vulnerability in inc/wysiwyg.php in LetterIt 2 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the language parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/31298; http://securityreason.com/securityalert/4101; http://www.securityfocus.com/bid/30482
CVE: CVE-2008-3447
Published: 2008-08-04
Description: The scanning engine in F-Prot Antivirus 6.2.1 4252 allows remote attackers to cause a denial of service (infinite loop) via a malformed ZIP archive, probably related to invalid offsets.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://seclists.org/fulldisclosure/2008/Jul/0569.html; http://secunia.com/advisories/31313; http://www.securityfocus.com/bid/30461
CVE: CVE-2008-3448
Published: 2008-08-04
Description: Cross-site scripting (XSS) vulnerability in index.php in common solutions csphonebook 1.02 allows remote attackers to inject arbitrary web script or HTML via the letter parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/31359; http://securityreason.com/securityalert/4102; http://www.securityfocus.com/archive/1/494971/100/0/threaded
CVE: CVE-2008-3449
Published: 2008-08-04
Description: MailEnable Professional 3.5.2 and Enterprise 3.52 allow remote attackers to cause a denial of service (crash) via multiple IMAP connection requests to the same folder.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/31325; http://www.mailenable.com/hotfix/; http://www.securityfocus.com/bid/30498
CVE: CVE-2008-3450
Published: 2008-08-04
Description: Unspecified vulnerability in the namefs kernel module in Sun Solaris 8 through 10 allows local users to gain privileges or cause a denial of service (panic) via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/31356; http://secunia.com/advisories/31536; http://securitytracker.com/id?1020616
CVE: CVE-2008-3451
Published: 2008-08-04
Description: PhpWebGallery 1.7.0 and 1.7.1 allows remote authenticated users with advisor privileges to obtain the real e-mail addresses of other users by editing the user's profile.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://bugs.phpwebgallery.net/view.php?id=769; http://forum.phpwebgallery.net/viewtopic.php?id=13545; http://secunia.com/advisories/31232
CVE: CVE-2008-3452
Published: 2008-08-04
Description: SQL injection vulnerability in the Calendar module in eNdonesia 8.4 allows remote attackers to execute arbitrary SQL commands via the loc_id parameter in a list_events action to mod.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://securityreason.com/securityalert/4104; http://www.securityfocus.com/bid/30457; https://exchange.xforce.ibmcloud.com/vulnerabilities/44115
CVE: CVE-2008-3453
Published: 2008-08-04
Description: Multiple unspecified vulnerabilities in ImpressCMS 1.0 have unknown impact and attack vectors, related to modules/admin.php and "a few files."
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/31259; http://sourceforge.net/project/shownotes.php?release_id=616122; https://exchange.xforce.ibmcloud.com/vulnerabilities/44122
CVE: CVE-2008-3454
Published: 2008-08-04
Description: JnSHosts PHP Hosting Directory 2.0 allows remote attackers to bypass authentication and gain administrative access by setting the "adm" cookie value to 1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/31235; http://securityreason.com/securityalert/4105; http://www.securityfocus.com/bid/30444
CVE: CVE-2008-3455
Published: 2008-08-04
Description: PHP remote file inclusion vulnerability in include/admin.php in JnSHosts PHP Hosting Directory 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the rd parameter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://securityreason.com/securityalert/4106; http://www.securityfocus.com/bid/30428; https://exchange.xforce.ibmcloud.com/vulnerabilities/44108
CVE: CVE-2008-3456
Published: 2008-08-04
Description: phpMyAdmin before 2.11.8 does not sufficiently prevent its pages from using frames that point to pages in other domains, which makes it easier for remote attackers to conduct spoofing or phishing activities via a cross-site framing attack.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-59
References: http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html; http://secunia.com/advisories/31263; http://secunia.com/advisories/31312
CVE: CVE-2008-3457
Published: 2008-08-04
Description: Cross-site scripting (XSS) vulnerability in setup.php in phpMyAdmin before 2.11.8 allows user-assisted remote attackers to inject arbitrary web script or HTML via crafted setup arguments.  NOTE: this issue can only be exploited in limited scenarios in which the attacker must be able to modify config/config.inc.php.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html; http://secunia.com/advisories/31263; http://secunia.com/advisories/31312
CVE: CVE-2008-3458
Published: 2008-08-04
Description: Vtiger CRM before 5.0.4 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read mail merge templates via a direct request to the wordtemplatedownload directory.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/28370; http://sourceforge.net/project/shownotes.php?release_id=567189; http://trac.vtiger.com/cgi-bin/trac.cgi/changeset/11811
CVE: CVE-2008-3459
Published: 2008-08-04
Description: Unspecified vulnerability in OpenVPN 2.1-beta14 through 2.1-rc8, when running on non-Windows systems, allows remote servers to execute arbitrary commands via crafted (1) lladdr and (2) iproute configuration directives, probably related to shell metacharacters.
CVSS Score: 7.6 (HIGH)
CWE: CWE-16
References: http://openvpn.net/index.php/documentation/change-log/changelog-21.html; http://www.securityfocus.com/bid/30532; http://www.securitytracker.com/id?1020626
CVE: CVE-2008-3356
Published: 2008-08-05
Description: verifydb in Ingres 2.6, Ingres 2006 release 1 (aka 9.0.4), and Ingres 2006 release 2 (aka 9.1.0) on Linux and other Unix platforms sets the ownership or permissions of an iivdb.log file without verifying that it is the application's own log file, which allows local users to overwrite arbitrary files by creating a symlink with an iivdb.log filename.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=731; http://secunia.com/advisories/31357; http://secunia.com/advisories/31398