deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-1534
Published: 2008-03-28
Description: Multiple directory traversal vulnerabilities in PowerPHPBoard 1.00b allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) settings[footer] parameter to footer.inc.php and the (2) settings[header] parameter to header.inc.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://securityreason.com/securityalert/3782; http://www.securityfocus.com/archive/1/490011/100/0/threaded; http://www.securityfocus.com/bid/28421
CVE: CVE-2008-1535
Published: 2008-03-28
Description: SQL injection vulnerability in the Matti Kiviharju rekry (aka com_rekry or rekry!Joom) 1.0.0 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the op_id parameter in a view action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-89
References: http://secunia.com/advisories/29510; http://www.securityfocus.com/bid/28422; https://exchange.xforce.ibmcloud.com/vulnerabilities/41385
CVE: CVE-2008-1536
Published: 2008-03-28
Description: Cross-site scripting (XSS) vulnerability in index.php in Pictures Pro (aka Tim Grissett) Photo Cart 4.1 allows remote attackers to inject arbitrary web script or HTML via the amessage parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29490; http://www.picturespro.com/community/forums/photo_cart/index.php?see=viewTopic&topic=[PII_REDACTED]24075103; http://www.securityfocus.com/bid/28430
CVE: CVE-2008-1537
Published: 2008-03-28
Description: Directory traversal vulnerability in pb_inc/admincenter/index.php in PowerScripts PowerBook 1.21 allows remote attackers to include and execute arbitrary local files via a ..  (dot dot) in the page parameter.  NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC share pathname or an ftp, ftps, or ssh2.sftp URL.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/29480; http://securityreason.com/securityalert/3783; http://www.securityfocus.com/archive/1/490008/100/0/threaded
CVE: CVE-2008-1538
Published: 2008-03-28
Description: Cross-site scripting (XSS) vulnerability in searchAction.do in ManageEngine EventLog Analyzer 5 allows remote attackers to inject arbitrary web script or HTML via the searchText parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Fixed in EventLog Analyzer 10.0 Build 10000.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29524; https://exchange.xforce.ibmcloud.com/vulnerabilities/41408; http://secunia.com/advisories/29524
CVE: CVE-2008-1539
Published: 2008-03-28
Description: SQL injection vulnerability in includes/dynamic_titles.php in PHP-Nuke Platinum 7.6.b.5 allows remote attackers to execute arbitrary SQL commands via the p parameter to modules.php for the Forums module.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/28410; https://exchange.xforce.ibmcloud.com/vulnerabilities/41387; https://www.exploit-db.com/exploits/5295
CVE: CVE-2008-1540
Published: 2008-03-28
Description: SQL injection vulnerability in the Datsogallery (com_datsogallery) 1.3.1 module for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action to index.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/28361; https://exchange.xforce.ibmcloud.com/vulnerabilities/41348; http://www.securityfocus.com/bid/28361
CVE: CVE-2008-1541
Published: 2008-03-28
Description: Directory traversal vulnerability in cgi-bin/his-webshop.pl in HIS Webshop 2.50 allows remote attackers to read arbitrary files via a .. (dot dot) in the t parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/29478; http://securityreason.com/securityalert/3784; http://www.securityfocus.com/archive/1/490016/100/0/threaded
CVE: CVE-2008-0704
Published: 2008-03-28
Description: Unspecified vulnerability in the SSH server in HP OpenVMS TCP/IP Services on OpenVMS on the Alpha platform with 5.4 before ECO 7, and on the Integrity and Alpha platforms with 5.5 before ECO 3 and 5.6 before ECO 2, allows remote attackers to obtain unspecified access via unknown vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/29566; http://www.securityfocus.com/bid/28486; http://www.securitytracker.com/id?1019727
CVE: CVE-2008-1542
Published: 2008-03-28
Description: Airspan Base Station Distribution Unit (BSDU) has "topsecret" as its password for the root account, which allows remote attackers to obtain administrative access via a telnet login, a different vulnerability than CVE-2008-1262.
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://airspan4wimax.googlepages.com/; http://www.kb.cert.org/vuls/id/446403; https://exchange.xforce.ibmcloud.com/vulnerabilities/41437
CVE: CVE-2008-1543
Published: 2008-03-28
Description: The Advanced User Interface Pages in the ProST Web Management component on the Airspan WiMAX ProST have a certain default User ID and password, which makes it easier for remote attackers to obtain partial administrative access, a different vulnerability than CVE-2008-1262.
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://www.sharemethods.net/nepal/servlet/open?keeppath=false&aid=29820; https://exchange.xforce.ibmcloud.com/vulnerabilities/41567; http://www.sharemethods.net/nepal/servlet/open?keeppath=false&aid=29820
CVE: CVE-2008-1544
Published: 2008-03-28
Description: The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 5.01, 6, and 7 does not block dangerous HTTP request headers when certain 8-bit character sequences are appended to a header name, which allows remote attackers to (1) conduct HTTP request splitting and HTTP request smuggling attacks via an incorrect Content-Length header, (2) access arbitrary virtual hosts via a modified Host header, (3) bypass referrer restrictions via an incorrect Referer header, and (4) bypass the same-origin policy and obtain sensitive information via a crafted request header.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3597&w=2; http://secunia.com/advisories/29453; http://securityreason.com/securityalert/3785
CVE: CVE-2008-1545
Published: 2008-03-28
Description: The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 7 does not restrict the dangerous Transfer-Encoding HTTP request header, which allows remote attackers to conduct HTTP request splitting and HTTP request smuggling attacks via a POST containing a "Transfer-Encoding: chunked" header and a request body with an incorrect chunk size.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/29453; http://securityreason.com/securityalert/3786; http://www.mindedsecurity.com/MSA01240108.html
CVE: CVE-2008-1546
Published: 2008-03-28
Description: servlet/MIMEReceiveServlet in the web controller for Mitsubishi Electric GB-50 and GB-50A air-conditioning control systems allows remote attackers to cause a denial of service (air-conditioning outage) via an XML document containing a setRequest command.
CVSS Score: 7.8 (HIGH)
References: http://securityreason.com/securityalert/3794; http://www.securityfocus.com/archive/1/483862/2008-03-21/threaded; http://www.securityfocus.com/archive/1/489970/100/0/threaded
CVE: CVE-2008-0070
Published: 2008-03-31
Description: Integer overflow in Orb Networks Orb 2.00.1014 and Winamp Remote BETA allows remote attackers to execute arbitrary code via an RPC request that specifies a large number of array dimensions, which triggers a heap-based buffer overflow.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-189
References: http://secunia.com/advisories/28203; http://secunia.com/secunia_research/2008-5/advisory/; http://www.securityfocus.com/bid/28431
CVE: CVE-2008-1548
Published: 2008-03-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in Aeries Browser Interface (ABI) 3.8.3.14 in Eagle Software Aries Student Information System allow remote attackers to inject arbitrary web script or HTML via the (1) UserName parameter to loginproc.asp and the (2) usr parameter to Login.asp.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29533; http://securityreason.com/securityalert/3787; http://www.securityfocus.com/archive/1/490033/100/0/threaded
CVE: CVE-2008-1549
Published: 2008-03-31
Description: Multiple SQL injection vulnerabilities in Aeries Browser Interface (ABI) 3.8.3.14 in Eagle Software Aries Student Information System allow remote attackers to execute arbitrary SQL commands via the (1) GrdBk parameter to GradebookOptions.asp and the (2) SchlCode variable to loginproc.asp, a different vector than CVE-2008-0942.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/29533; http://securityreason.com/securityalert/3787; http://www.securityfocus.com/archive/1/490033/100/0/threaded
CVE: CVE-2008-1550
Published: 2008-03-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in CubeCart 4.2.1 allow remote attackers to inject arbitrary web script or HTML via (1) the _a parameter in a searchStr action and the (2) Submit parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://holisticinfosec.org/content/view/51/45/; http://secunia.com/advisories/29532; http://www.securityfocus.com/bid/28452
CVE: CVE-2008-1551
Published: 2008-03-31
Description: SQL injection vulnerability in viewcat.php in the Photo 3.02 module for RunCMS allows remote attackers to execute arbitrary SQL commands via the cid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29513; http://www.securityfocus.com/bid/28395; https://exchange.xforce.ibmcloud.com/vulnerabilities/41378
CVE: CVE-2008-1552
Published: 2008-03-31
Description: The silc_pkcs1_decode function in the silccrypt library (silcpkcs1.c) in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.7, SILC Client before 1.1.4, and SILC Server before 1.1.2 allows remote attackers to execute arbitrary code via a crafted PKCS#1 message, which triggers an integer underflow, signedness error, and a buffer overflow.  NOTE: the researcher describes this as an integer overflow, but CVE uses the "underflow" term in cases of wraparound from unsigned subtraction.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00005.html; http://secunia.com/advisories/29463; http://secunia.com/advisories/29465
CVE: CVE-2008-1553
Published: 2008-03-31
Description: Directory traversal vulnerability in mod.php in TopperMod 1.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the to parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/28449; https://exchange.xforce.ibmcloud.com/vulnerabilities/41442; https://www.exploit-db.com/exploits/5312
CVE: CVE-2008-1554
Published: 2008-03-31
Description: SQL injection vulnerability in account/index.php in TopperMod 2.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via a non-alphanumeric first character the localita parameter, which bypasses a protection mechanism.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://www.securityfocus.com/archive/1/490163/100/0/threaded; http://www.securityfocus.com/bid/28447; https://exchange.xforce.ibmcloud.com/vulnerabilities/41441
CVE: CVE-2008-1555
Published: 2008-03-31
Description: Directory traversal vulnerability in system/_b/contentFiles/gbincluder.php in BolinOS 4.6.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the _bFileToInclude parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/29535; http://securityreason.com/securityalert/3788; http://www.securityfocus.com/archive/1/490058/100/0/threaded
CVE: CVE-2008-1556
Published: 2008-03-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in BolinOS 4.6.1 allow remote attackers to inject arbitrary web script or HTML via the (1) url parameter to (a) system/actionspages/_b/contentFiles/gBImageViewer.php, (2) ForEditor parameter to (b) system/actionspages/_b/contentFiles/gBselectorContents.php, (3) the PATH_INFO to (c) gBLoginPage.php and (d) gBPassword.php in system/actionspages/_b/contentFiles/, (4) formlogin parameter to system/actionspages/_b/contentFiles/gBLoginPage.php, and the (5) bolini_searchengine46Search parameter to (e) help/index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29535; http://securityreason.com/securityalert/3788; http://www.securityfocus.com/archive/1/490058/100/0/threaded
CVE: CVE-2008-1557
Published: 2008-03-31
Description: BolinOS 4.6.1 allows remote attackers to obtain sensitive information via a direct request to system/actionspages/_b/contentFiles/gBphpInfo.php, which calls the phpinfo function.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/29535; http://securityreason.com/securityalert/3788; http://www.securityfocus.com/archive/1/490058/100/0/threaded
CVE: CVE-2008-1558
Published: 2008-03-31
Description: Uncontrolled array index in the sdpplin_parse function in stream/realrtsp/sdpplin.c in MPlayer 1.0 rc2 allows remote attackers to overwrite memory and execute arbitrary code via a large streamid SDP parameter.  NOTE: this issue has been referred to as an integer overflow.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://secunia.com/advisories/29515; http://secunia.com/advisories/29921; http://secunia.com/advisories/30412
CVE: CVE-2008-1559
Published: 2008-03-31
Description: SQL injection vulnerability in the Bernard Gilly AlphaContent (com_alphacontent) 2.5.8 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a view action to index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://www.securityfocus.com/bid/28443; https://exchange.xforce.ibmcloud.com/vulnerabilities/41428; https://www.exploit-db.com/exploits/5310
CVE: CVE-2008-1560
Published: 2008-03-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in Digiappz DigiDomain 2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) domain parameter to lookup_result.asp, and the (2) word1 and (3) word2 parameters to suggest_result.asp.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29572; http://securityreason.com/securityalert/3789; http://www.securityfocus.com/archive/1/490157/100/0/threaded
CVE: CVE-2008-1561
Published: 2008-03-31
Description: Multiple unspecified vulnerabilities in Wireshark (formerly Ethereal) 0.99.5 through 0.99.8 allow remote attackers to cause a denial of service (application crash) via a malformed packet to the (1) X.509sat or (2) Roofnet dissectors.  NOTE: Vector 2 might also lead to a hang.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00005.html; http://secunia.com/advisories/29569; http://secunia.com/advisories/29622
CVE: CVE-2008-1562
Published: 2008-03-31
Description: The LDAP dissector in Wireshark (formerly Ethereal) 0.99.2 through 0.99.8 allows remote attackers to cause a denial of service (application crash) via a malformed packet, a different vulnerability than CVE-2006-5740.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00005.html; http://secunia.com/advisories/29569; http://secunia.com/advisories/29622
CVE: CVE-2008-1563
Published: 2008-03-31
Description: The "decode as" feature in packet-bssap.c in the SCCP dissector in Wireshark (formerly Ethereal) 0.99.6 through 0.99.8 allows remote attackers to cause a denial of service (application crash) via a malformed packet.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00005.html; http://secunia.com/advisories/29569; http://secunia.com/advisories/29622
CVE: CVE-2008-1564
Published: 2008-03-31
Description: Directory traversal vulnerability in Dan Costin File Transfer before 1.2f allows remote attackers to read arbitrary files via a "..\" (dot dot backslash) in the filename.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/29540; http://sourceforge.net/project/shownotes.php?group_id=178021&release_id=586923; http://sourceforge.net/tracker/index.php?func=detail&aid=1829601&group_id=178021&atid=883559
CVE: CVE-2008-1565
Published: 2008-03-31
Description: Directory traversal vulnerability in forum/irc/irc.php in the PJIRC 0.5 module for phpBB allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the phpEx parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://securityreason.com/securityalert/3790; http://www.securityfocus.com/archive/1/490070/100/0/threaded; http://www.securityfocus.com/bid/28446
CVE: CVE-2008-1566
Published: 2008-03-31
Description: Cross-site scripting (XSS) vulnerability in Search.do in ManageEngine Applications Manager 8.x allows remote attackers to inject arbitrary web script or HTML via the query parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29564; http://www.securityfocus.com/bid/28488; https://exchange.xforce.ibmcloud.com/vulnerabilities/41505
CVE: CVE-2008-1567
Published: 2008-03-31
Description: phpMyAdmin before 2.11.5.1 stores the MySQL (1) username and (2) password, and the (3) Blowfish secret key, in cleartext in a Session file under /tmp, which allows local users to obtain sensitive information.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312
References: http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html; http://secunia.com/advisories/29588
CVE: CVE-2008-1568
Published: 2008-03-31
Description: comix 3.6.4 allows attackers to execute arbitrary commands via a filename containing shell metacharacters that are not properly sanitized when executing the rar, unrar, or jpegtran programs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=462840; http://secunia.com/advisories/29621; http://secunia.com/advisories/29731
CVE: CVE-2008-1569
Published: 2008-03-31
Description: policyd-weight 0.1.14 beta-16 and earlier allows local users to modify or delete arbitrary files via a symlink attack on temporary files that are used when creating a socket.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://secunia.com/advisories/29553; http://secunia.com/advisories/29738; http://security.gentoo.org/glsa/glsa-200804-11.xml
CVE: CVE-2008-1570
Published: 2008-03-31
Description: Race condition in the create_lockpath function in policyd-weight 0.1.14 beta-16 allows local users to modify or delete arbitrary files by creating the LOCKPATH directory, then modifying it after the symbolic link check occurs.  NOTE: this is due to an incomplete fix for CVE-2008-1569.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-362
References: http://secunia.com/advisories/29738; http://security.gentoo.org/glsa/glsa-200804-11.xml; http://www.osvdb.org/43888
CVE: CVE-2008-0211
Published: 2008-03-31
Description: Unspecified vulnerability in the BIOS F.04 through F.11 for the HP Compaq Business Notebook PC allows local users to cause a denial of service via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1700&w=2; http://securitytracker.com/id?1019729; http://www.securityfocus.com/bid/28494
CVE: CVE-2008-0706
Published: 2008-03-31
Description: Unspecified vulnerability in the BIOS F.26 and earlier for the HP Compaq Notebook PC allows physically proximate attackers to obtain privileged access via unspecified vectors, possibly involving an authentication bypass of the power-on password.
CVSS Score: 7.2 (HIGH)
CWE: CWE-287
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4094&w=2; http://securitytracker.com/id?1019730; http://www.securityfocus.com/bid/28495
CVE: CVE-2008-1591
Published: 2008-03-31
Description: The pnVarPrepForStore function in PostNuke 0.764 and earlier skips input sanitization when magic_quotes_runtime is enabled, which allows remote attackers to conduct SQL injection attacks and execute arbitrary SQL commands via input associated with server variables, as demonstrated by the CLIENT_IP HTTP header (HTTP_CLIENT_IP variable).
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/28407; https://exchange.xforce.ibmcloud.com/vulnerabilities/41375; https://www.exploit-db.com/exploits/5292
CVE: CVE-2008-1592
Published: 2008-03-31
Description: MQSeries 5.1 in IBM WebSphere MQ 5.1 through 5.3.1 on the HP NonStop and Tandem NSK platforms does not require mqm group membership for execution of administrative tasks, which allows local users to bypass intended access restrictions via the runmqsc program, related to "Pathway panels."
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/29360; http://securitytracker.com/id?1019610; http://www-1.ibm.com/support/docview.wss?uid=swg21297035
CVE: CVE-2008-1593
Published: 2008-03-31
Description: The checkpoint and restart feature in the kernel in IBM AIX 5.2, 5.3, and 6.1 does not properly protect kernel memory, which allows local users to read and modify portions of memory and gain privileges via unspecified vectors involving a restart of a 64-bit process, probably related to the as_getadsp64 function.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://securitytracker.com/id?1019606; http://www.ibm.com/support/docview.wss?uid=isg1IZ11820; http://www.ibm.com/support/docview.wss?uid=isg1IZ12794
CVE: CVE-2008-1594
Published: 2008-03-31
Description: The kernel in IBM AIX 5.2 and 5.3 does not properly handle resizing JFS2 filesystems on concurrent volume groups spread across multiple nodes, which allows local users of one node to cause a denial of service (remote node crash) by using chfs or lreducelv to reduce a filesystem's size.
CVSS Score: 4.9 (MEDIUM)
References: http://securitytracker.com/id?1019606; http://www.ibm.com/support/docview.wss?uid=isg1IZ04946; http://www.ibm.com/support/docview.wss?uid=isg1IZ04953
CVE: CVE-2008-1595
Published: 2008-03-31
Description: The proc filesystem in the kernel in IBM AIX 5.2 and 5.3 does not properly enforce directory permissions when a file executing from a directory has weaker permissions than the directory itself, which allows local users to obtain sensitive information.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://securitytracker.com/id?1019606; http://www.ibm.com/support/docview.wss?uid=isg1IZ06022; http://www.ibm.com/support/docview.wss?uid=isg1IZ06505
CVE: CVE-2008-1596
Published: 2008-03-31
Description: Trusted Execution in IBM AIX 6.1 uses an incorrect pathname argument in a call to the trustchk_block_write function, which might allow local users to modify trusted files, related to missing checks in the TSD_FILES_LOCK policy for modifications performed via hard links, a different vulnerability than CVE-2007-6680.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://securitytracker.com/id?1019606; http://www.ibm.com/support/docview.wss?uid=isg1IZ13418; http://www.securityfocus.com/bid/28467
CVE: CVE-2008-1597
Published: 2008-03-31
Description: The WPAR system call implementation in the kernel in IBM AIX 6.1 allows local users to cause a denial of service via unknown calls that trigger "undefined behavior."
CVSS Score: 4.9 (MEDIUM)
References: http://securitytracker.com/id?1019606; http://www.ibm.com/support/docview.wss?uid=isg1IZ13346; http://www.ibm.com/support/docview.wss?uid=isg1IZ13392