deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-1206
Published: 2009-04-01
Description: Unspecified vulnerability in futomi's CGI Cafe Access Analyzer CGI Professional Version 4.11.5 and earlier allows remote attackers to gain administrative privileges via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://jvn.jp/en/jp/JVN63511247/index.html; http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000016.html; http://secunia.com/advisories/34516
CVE: CVE-2009-1207
Published: 2009-04-01
Description: Race condition in the dircmp script in Sun Solaris 8 through 10, and OpenSolaris snv_01 through snv_111, allows local users to overwrite arbitrary files, probably involving a symlink attack on temporary files.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-362
References: http://secunia.com/advisories/34558; http://secunia.com/advisories/34813; http://sunsolve.sun.com/search/document.do?assetkey=1-21-138897-01-1
CVE: CVE-2009-1208
Published: 2009-04-01
Description: SQL injection vulnerability in auth2db 0.2.5, and possibly other versions before 0.2.7, uses the addslashes function instead of the mysql_real_escape_string function, which allows remote attackers to conduct SQL injection attacks using multibyte character encodings.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=521823; http://secunia.com/advisories/34488; http://www.auth2db.com.ar/?title=CHANGELOG
CVE: CVE-2009-1209
Published: 2009-04-01
Description: Stack-based buffer overflow in W3C Amaya Web Browser 11.1 allows remote attackers to execute arbitrary code via a script tag with a long defer attribute.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/34531; http://www.securityfocus.com/bid/34295; http://www.vupen.com/english/advisories/2009/0889
CVE: CVE-2009-1210
Published: 2009-04-01
Description: Format string vulnerability in the PROFINET/DCP (PN-DCP) dissector in Wireshark 1.0.6 and earlier allows remote attackers to execute arbitrary code via a PN-DCP packet with format string specifiers in the station name.  NOTE: some of these details are obtained from third party information.
CVSS Score: 10.0 (HIGH)
CWE: CWE-134
References: http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html; http://secunia.com/advisories/34542; http://secunia.com/advisories/34778
CVE: CVE-2009-1211
Published: 2009-04-01
Description: Blue Coat ProxySG, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote endpoint, which allows remote attackers to bypass access controls for Flash, Java, Silverlight, and probably other technologies, and possibly communicate with restricted intranet sites, via a crafted web page that causes a client to send HTTP requests with a modified Host header.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-16
References: http://www.securitytracker.com/id?1021781; https://hypersonic.bluecoat.com/support/securityadvisories/ProxySG_in_transparent_deployments; http://www.securitytracker.com/id?1021781
CVE: CVE-2009-1212
Published: 2009-04-01
Description: Multiple insecure method vulnerabilities in PRECIS~2.DLL in the PrecisionID Datamatrix ActiveX control (DMATRIXLib.Datamatrix) allow remote attackers to overwrite arbitrary files via the (1) SaveBarCode and (2) SaveEnhWMF methods.
CVSS Score: 7.8 (HIGH)
References: http://dsecrg.com/pages/vul/DSECRG-09-030.html; http://www.securityfocus.com/archive/1/502319/100/0/threaded; http://www.securityfocus.com/bid/34322
CVE: CVE-2009-1213
Published: 2009-04-01
Description: Cross-site request forgery (CSRF) vulnerability in attachment.cgi in Bugzilla 3.2 before 3.2.3, 3.3 before 3.3.4, and earlier versions allows remote attackers to hijack the authentication of arbitrary users for requests that use attachment editing.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/34545; http://secunia.com/advisories/34547; http://secunia.com/advisories/34624
CVE: CVE-2009-1214
Published: 2009-04-01
Description: GNU screen 4.0.3 creates the /tmp/screen-exchange temporary file with world-readable permissions, which might allow local users to obtain sensitive session information.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=521123; http://savannah.gnu.org/bugs/?25296; http://www.openwall.com/lists/oss-security/2009/03/25/7
CVE: CVE-2009-1215
Published: 2009-04-01
Description: Race condition in GNU screen 4.0.3 allows local users to create or overwrite arbitrary files via a symlink attack on the /tmp/screen-exchange temporary file.
CVSS Score: 1.9 (LOW)
CWE: CWE-362
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=521123; http://savannah.gnu.org/bugs/?25296; http://www.openwall.com/lists/oss-security/2009/03/25/7
CVE: CVE-2008-3871
Published: 2009-04-01
Description: Multiple format string vulnerabilities in UltraISO 9.3.1.2633, and possibly other versions before 9.3.3.2685, allow user-assisted attackers to execute arbitrary code via format string specifiers in the filename of a (1) DAA or (2) ISZ file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-134
References: http://secunia.com/advisories/32415; http://secunia.com/secunia_research/2008-48/; http://www.ezbsystems.com/ultraiso/history.htm
CVE: CVE-2008-4825
Published: 2009-04-01
Description: Multiple buffer overflows in UltraISO 9.3.1.2633, and possibly other versions before 9.3.3.2685, allow user-assisted attackers to execute arbitrary code via a crafted (1) CIF, (2) C2D, or (3) GI file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/32415; http://secunia.com/secunia_research/2008-49/; http://www.ezbsystems.com/ultraiso/history.htm
CVE: CVE-2009-1216
Published: 2009-04-01
Description: Multiple unspecified vulnerabilities in (1) unlzh.c and (2) unpack.c in the gzip libraries in Microsoft Windows Server 2008, Windows Services for UNIX 3.0 and 3.5, and the Subsystem for UNIX-based Applications (SUA); as used in gunzip, gzip, pack, pcat, and unpack 7.x before 7.0.1701.48, 8.x before 8.0.1969.62, and 9.x before 9.0.3790.2076; allow remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/34428; http://securitytracker.com/id?1021937; http://support.microsoft.com/kb/953602
CVE: CVE-2009-1217
Published: 2009-04-01
Description: Off-by-one error in the GpFont::SetData function in gdiplus.dll in Microsoft GDI+ on Windows XP allows remote attackers to cause a denial of service (stack corruption and application termination) via a crafted EMF file that triggers an integer overflow, as demonstrated by voltage-exploit.emf, aka the "Microsoft GdiPlus EMF GpFont.SetData integer overflow."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-193
References: http://bl4cksecurity.blogspot.com/2009/03/microsoft-gdiplus-emf-gpfontsetdata.html; http://blogs.technet.com/srd/archive/2009/03/26/new-emf-gdiplus-dll-crash-not-exploitable-for-code-execution.aspx; http://www.securityfocus.com/bid/34250
CVE: CVE-2007-4475
Published: 2009-04-01
Description: Stack-based buffer overflow in EAI WebViewer3D ActiveX control (webviewer3d.dll) in SAP AG SAPgui before 7.10 Patch Level 9 allows remote attackers to execute arbitrary code via a long argument to the SaveViewToSessionFile method.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/34559; http://www.kb.cert.org/vuls/id/985449; http://www.securityfocus.com/bid/34310
CVE: CVE-2009-1218
Published: 2009-04-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in Sun Calendar Express Web Server in Sun ONE Calendar Server 6.0 and Sun Java System Calendar Server 6 2004Q2 through 6.3-7.01 allow remote attackers to inject arbitrary web script or HTML via (1) the fmt-out parameter to login.wcap or (2) the date parameter to command.shtml.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://sunsolve.sun.com/search/document.do?assetkey=1-26-256228-1; http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020321.1-1; http://www.coresecurity.com/content/sun-calendar-express
CVE: CVE-2009-1219
Published: 2009-04-01
Description: Sun Calendar Express Web Server in Sun ONE Calendar Server 6.0 and Sun Java System Calendar Server 6 2004Q2 through 6.3-7.01 allows remote attackers to cause a denial of service (daemon crash) via multiple requests to the default URI with alphabetic characters in the tzid parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://sunsolve.sun.com/search/document.do?assetkey=1-26-256228-1; http://sunsolve.sun.com/search/document.do?assetkey=1-66-255008-1; http://www.coresecurity.com/content/sun-calendar-express
CVE: CVE-2009-1220
Published: 2009-04-01
Description: Cross-site scripting (XSS) vulnerability in +webvpn+/index.html in WebVPN on the Cisco Adaptive Security Appliances (ASA) 5520 with software 7.2(4)30 and earlier 7.2 versions including 7.2(2)22, and 8.0(4)28 and earlier 8.0 versions, when clientless mode is enabled, allows remote attackers to inject arbitrary web script or HTML via the Host HTTP header.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2009-03/0478.html; http://tools.cisco.com/security/center/viewAlert.x?alertId=17950; http://www.securityfocus.com/archive/1/502313/100/0/threaded
CVE: CVE-2008-6573
Published: 2009-04-01
Description: Multiple SQL injection vulnerabilities in Avaya SIP Enablement Services (SES) in Avaya Avaya Communication Manager 3.x, 4.0, and 5.0 (1) allow remote attackers to execute arbitrary SQL commands via unspecified vectors related to profiles in the SIP Personal Information Manager (SPIM) in the web interface; and allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors related to (2) permissions for SPIM profiles in the web interface and (3) a crafted SIP request to the SIP server.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/44284; http://osvdb.org/44285; http://osvdb.org/44286
CVE: CVE-2008-6574
Published: 2009-04-01
Description: Unspecified vulnerability in SIP Enablement Services (SES) in Avaya Communication Manager 3.1.x and 4.x allows remote attackers to gain privileges and cause a denial of service via unknown vectors related to reuse of valid credentials.
CVSS Score: 7.5 (HIGH)
References: http://osvdb.org/44288; http://secunia.com/advisories/29744; http://www.securityfocus.com/bid/28687
CVE: CVE-2008-6575
Published: 2009-04-01
Description: Unspecified vulnerability in the SIP server in SIP Enablement Services (SES) in Avaya Communication Manager 3.1.x and 4.x allows remote authenticated users to cause a denial of service (resource consumption) via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/44287; http://secunia.com/advisories/29744; http://www.voipshield.com/research-details.php?id=23
CVE: CVE-2008-6576
Published: 2009-04-01
Description: Unspecified vulnerability in the "session limitation technique" in the FTP service on Nortel Communications Server 1000 (CS1K) 4.50.x, when running on VGMC or signaling nodes, allows remote attackers to cause a denial of service (resource exhaustion and failed updates) via unknown vectors that causes consumption of all available sessions.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/44380; http://secunia.com/advisories/29747; http://securitytracker.com/id?1019845
CVE: CVE-2008-6577
Published: 2009-04-01
Description: Nortel MG1000S, Signaling Server, and Call Server on the Communications Server 1000 (CS1K) 4.50.x contain multiple unspecified hard-coded accounts and passwords, which allows remote attackers to gain privileges.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://osvdb.org/44374; http://secunia.com/advisories/29747; http://securitytracker.com/id?1019848
CVE: CVE-2008-6578
Published: 2009-04-01
Description: Multiple unspecified vulnerabilities in Nortel Communication Server 1000 4.50.x allow remote attackers to execute arbitrary commands to gain privileges, obtain sensitive information, or cause a denial of service via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/44375; http://secunia.com/advisories/29747; http://securitytracker.com/id?1019849
CVE: CVE-2008-6579
Published: 2009-04-01
Description: Nortel Communication Server 1000 4.50.x allows remote attackers to obtain Web application structure via unknown vectors related to "web resources to phones and administrators."
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/44377; http://secunia.com/advisories/29747; http://securitytracker.com/id?1019846
CVE: CVE-2003-1571
Published: 2009-04-02
Description: Web Wiz Guestbook 6.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database and obtain sensitive information via a direct request for database/WWGguestbook.mdb.  NOTE: it was later reported that 8.21 is also affected.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/9639; http://www.ca.com/us/securityadvisor/vulninfo/vuln.aspx?id=25863; http://www.osvdb.org/2492
CVE: CVE-2008-6580
Published: 2009-04-02
Description: The Red_Reservations script for ColdFusion stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database via a direct request to (1) makered.mdb and (2) makered97.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/49817; https://www.exploit-db.com/exploits/7440; https://exchange.xforce.ibmcloud.com/vulnerabilities/49817
CVE: CVE-2008-6581
Published: 2009-04-02
Description: login.php in PhpAddEdit 1.3 allows remote attackers to bypass authentication and gain administrative access by setting the addedit cookie parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://osvdb.org/50674; http://secunia.com/advisories/33124; http://www.phpaddedit.com/page/new/
CVE: CVE-2008-6582
Published: 2009-04-02
Description: SQL injection vulnerability in index.php in Miniweb 2.0 allows remote attackers to execute arbitrary SQL commands via the username parameter in a login action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30085; http://www.securityfocus.com/bid/32819; https://exchange.xforce.ibmcloud.com/vulnerabilities/47364
CVE: CVE-2009-1222
Published: 2009-04-02
Description: Directory traversal vulnerability in index.php in webEdition 6.0.0.4 and earlier, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the WE_LANGUAGE parameter.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/34518; http://www.securityfocus.com/archive/1/502315/100/0/threaded; http://www.securityfocus.com/bid/34323
CVE: CVE-2009-1223
Published: 2009-04-02
Description: aspWebCalendar Free Edition stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing user credentials via a direct request for calendar/calendar.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/archive/1/502311/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/49885; http://www.securityfocus.com/archive/1/502311/100/0/threaded
CVE: CVE-2009-1224
Published: 2009-04-02
Description: SQL injection vulnerability in vsp-core/pub/themes/bismarck/gamestat.php in vsp stats processor 0.45 allows remote attackers to execute arbitrary SQL commands via the gameID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/8331; https://www.exploit-db.com/exploits/8331
CVE: CVE-2009-1225
Published: 2009-04-02
Description: Cross-site scripting (XSS) vulnerability in index.php in Turnkey Ebook Store 1.1 allows remote attackers to inject arbitrary web script or HTML via the keywords parameter in a search action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstorm.linuxsecurity.com/0903-exploits/turnkeyebook-xss.txt; http://secunia.com/advisories/34533; http://packetstorm.linuxsecurity.com/0903-exploits/turnkeyebook-xss.txt
CVE: CVE-2009-1226
Published: 2009-04-02
Description: core/admin/delete.php in Podcast Generator 1.1 and earlier does not properly restrict access to administrative functions, which allows remote attackers to delete arbitrary files via the file parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/34555; http://www.securityfocus.com/bid/34317; https://www.exploit-db.com/exploits/8324
CVE: CVE-2009-1227
Published: 2009-04-02
Description: NOTE: this issue has been disputed by the vendor.  Buffer overflow in the PKI Web Service in Check Point Firewall-1 PKI Web Service allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) Authorization or (2) Referer HTTP header to TCP port 18624.  NOTE: the vendor has disputed this issue, stating "Check Point Security Alert Team has analyzed this report. We've tried to reproduce the attack on all VPN-1 versions from NG FP2 and above with and without HFAs. The issue was not reproduced. We have conducted a thorough analysis of the relevant code and verified that we are secure against this attack. We consider this attack to pose no risk to Check Point customers."  In addition, the original researcher, whose reliability is unknown as of 20090407, also states that the issue "was discovered during a pen-test where the client would not allow further analysis.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/fulldisclosure/2009-03/0463.html; http://www.securityfocus.com/archive/1/502256/100/0/threaded; http://www.securityfocus.com/bid/34286
CVE: CVE-2009-1228
Published: 2009-04-02
Description: Cross-site scripting (XSS) vulnerability in register.php in Arcadwy Arcade Script CMS allows remote attackers to inject arbitrary web script or HTML via the username field (user_name parameter).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/34506; http://www.securityfocus.com/bid/34275; https://exchange.xforce.ibmcloud.com/vulnerabilities/49472
CVE: CVE-2009-1229
Published: 2009-04-02
Description: SQL injection vulnerability in Arcadwy Arcade Script allows remote attackers to execute arbitrary SQL commands via the user cookie parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/34506; http://www.securityfocus.com/bid/34284; http://z0rlu.blogspot.com/2009/03/arcadwy-arcade-script-auth-bypass.html
CVE: CVE-2009-1230
Published: 2009-04-02
Description: Static code injection vulnerability in index.php in Podcast Generator 1.1 and earlier allows remote authenticated administrators to inject arbitrary PHP code into config.php via the recent parameter in a config change action.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: https://www.exploit-db.com/exploits/8324; https://www.exploit-db.com/exploits/8324
CVE: CVE-2009-1231
Published: 2009-04-02
Description: Unspecified vulnerability in the eClient in IBM DB2 Content Manager 8.4.1 before 8.4.1.1 has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/34544; http://www-01.ibm.com/support/docview.wss?uid=swg27015162; http://www-1.ibm.com/support/docview.wss?uid=swg1IO08969
CVE: CVE-2009-1232
Published: 2009-04-02
Description: Mozilla Firefox 3.0.8 and earlier 3.0.x versions allows remote attackers to cause a denial of service (memory corruption) via an XML document composed of a long series of start-tags with no corresponding end-tags. NOTE: it was later reported that 3.0.10 and earlier are also affected.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://milw0rm.com/sploits/2009-Firefox-XUL-0day-PoC.rar; http://websecurity.com.ua/3216/; http://www.securityfocus.com/bid/34522
CVE: CVE-2009-1233
Published: 2009-04-02
Description: Apple Safari 3.2.2 and 4 Beta on Windows allows remote attackers to cause a denial of service (application crash) via an XML document containing many nested A elements.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/34318; https://exchange.xforce.ibmcloud.com/vulnerabilities/49527; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5559
CVE: CVE-2009-1234
Published: 2009-04-02
Description: Opera 9.64 allows remote attackers to cause a denial of service (application crash) via an XML document containing a long series of start-tags with no corresponding end-tags.  NOTE: it was later reported that 9.52 is also affected.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.html; http://websecurity.com.ua/3216/; http://www.securityfocus.com/bid/34298
CVE: CVE-2009-1235
Published: 2009-04-02
Description: XNU 1228.9.59 and earlier on Apple Mac OS X 10.5.6 and earlier does not properly restrict interaction between user space and the HFS IOCTL handler, which allows local users to overwrite kernel memory and gain privileges by attaching an HFS+ disk image and performing certain steps involving HFS_GET_BOOT_INFO fcntl calls.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2009/Aug/msg00001.html; http://secunia.com/advisories/34424; http://secunia.com/advisories/36096
CVE: CVE-2009-1236
Published: 2009-04-02
Description: Heap-based buffer overflow in the AppleTalk networking stack in XNU 1228.3.13 and earlier on Apple Mac OS X 10.5.6 and earlier allows remote attackers to cause a denial of service (system crash) via a ZIP NOTIFY (aka ZIPOP_NOTIFY) packet that overwrites a certain ifPort structure member.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/34424; http://www.digit-labs.org/files/exploits/xnu-appletalk-zip.c; http://www.informationweek.com/news/hardware/mac/showArticle.jhtml?articleID=216401181
CVE: CVE-2009-1237
Published: 2009-04-02
Description: Multiple memory leaks in XNU 1228.3.13 and earlier on Apple Mac OS X 10.5.6 and earlier allow local users to cause a denial of service (kernel memory consumption) via a crafted (1) SYS_add_profil or (2) SYS___mac_getfsstat system call.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/34424; http://www.digit-labs.org/files/exploits/xnu-macfsstat-leak.c; http://www.digit-labs.org/files/exploits/xnu-profil-leak.c
CVE: CVE-2009-1238
Published: 2009-04-02
Description: Race condition in the HFS vfs sysctl interface in XNU 1228.8.20 and earlier on Apple Mac OS X 10.5.6 and earlier allows local users to cause a denial of service (kernel memory corruption) by simultaneously executing the same HFS_SET_PKG_EXTENSIONS code path in multiple threads, which is problematic because of lack of mutex locking for an unspecified global variable.
CVSS Score: 7.2 (HIGH)
CWE: CWE-362
References: http://secunia.com/advisories/34424; http://www.digit-labs.org/files/exploits/xnu-vfssysctl-dos.c; http://www.informationweek.com/news/hardware/mac/showArticle.jhtml?articleID=216401181
CVE: CVE-2008-6583
Published: 2009-04-03
Description: Buffer overflow in BS.player 2.27 build 959 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in a .SRT file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/28811; http://www.vupen.com/english/advisories/2008/1243/references; https://exchange.xforce.ibmcloud.com/vulnerabilities/41841
CVE: CVE-2008-6584
Published: 2009-04-03
Description: html/index.php in TorrentFlux 2.3 allows remote authenticated users to execute arbitrary code via a URL with a file containing an executable extension in the url_upload parameter, which is downloaded by TorrentFlux and can be accessed via a direct request in a html/downloads/ user directory.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/44645; http://secunia.com/advisories/29935; http://www.securityfocus.com/archive/1/491066/100/0/threaded