deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-4898
Published: 2008-11-04
Description: Cross-site scripting (XSS) vulnerability in planetluc RateMe 1.3.3 allows remote attackers to inject arbitrary web script or HTML via the rate parameter in a submit rate action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://holisticinfosec.org/content/view/85/45/; http://secunia.com/advisories/32511; http://www.securityfocus.com/bid/32069
CVE: CVE-2008-4899
Published: 2008-11-04
Description: Cross-site request forgery (CSRF) vulnerability in Planetluc RateMe 1.3.3 allows remote attackers to perform unauthorized actions as other users via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://holisticinfosec.org/content/view/85/45/; http://secunia.com/advisories/32511; https://exchange.xforce.ibmcloud.com/vulnerabilities/46201
CVE: CVE-2008-4900
Published: 2008-11-04
Description: SQL injection vulnerability in tr.php in YourFreeWorld Classifieds Blaster Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/49600; http://www.securityfocus.com/bid/32062; http://www.vupen.com/english/advisories/2008/2981
CVE: CVE-2008-4901
Published: 2008-11-04
Description: SQL injection vulnerability in admin/admin.php in Article Publisher Pro 1.5 allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32519; http://www.securityfocus.com/bid/32030; https://exchange.xforce.ibmcloud.com/vulnerabilities/46373
CVE: CVE-2008-4902
Published: 2008-11-04
Description: SQL injection vulnerability in contact_author.php in Article Publisher Pro 1.5 allows remote attackers to execute arbitrary SQL commands via the userid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32519; https://exchange.xforce.ibmcloud.com/vulnerabilities/46266; https://www.exploit-db.com/exploits/6917
CVE: CVE-2008-4903
Published: 2008-11-04
Description: Cross-site scripting (XSS) vulnerability in the leave comment (feedback) feature in Typo 5.1.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) comment[author] (Name) and (2) comment[url] (Website) parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/32272; http://securityreason.com/securityalert/4550; http://www.securityfocus.com/archive/1/497970
CVE: CVE-2008-4904
Published: 2008-11-04
Description: SQL injection vulnerability in the "Manage pages" feature (admin/pages) in Typo 5.1.3 and earlier allows remote authenticated users with "blog publisher" rights to execute arbitrary SQL commands via the search[published_at] parameter.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/32272; http://securityreason.com/securityalert/4550; http://www.securityfocus.com/archive/1/497970
CVE: CVE-2008-4905
Published: 2008-11-04
Description: Typo 5.1.3 and earlier uses a hard-coded salt for calculating password hashes, which makes it easier for attackers to guess passwords via a brute force attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-330
References: http://secunia.com/advisories/32272; http://securityreason.com/securityalert/4550; http://www.securityfocus.com/archive/1/497970
CVE: CVE-2008-4906
Published: 2008-11-04
Description: SQL injection vulnerability in lyrics_song.php in the Lyrics (lyrics_menu) plugin 0.42 for e107 allows remote attackers to execute arbitrary SQL commands via the l_id parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32477; http://securityreason.com/securityalert/4551; http://www.securityfocus.com/bid/32004
CVE: CVE-2008-4907
Published: 2008-11-04
Description: The message parsing feature in Dovecot 1.1.4 and 1.1.5, when using the FETCH ENVELOPE command in the IMAP client, allows remote attackers to cause a denial of service (persistent crash) via an email with a malformed From address, which triggers an assertion error, aka "invalid message address parsing bug."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/32479; http://secunia.com/advisories/32677; http://secunia.com/advisories/33149
CVE: CVE-2008-6432
Published: 2008-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2007-6432.  Reason: This candidate is a duplicate of CVE-2007-6432.  A typo caused the wrong ID to be used.  Notes: All CVE users should reference CVE-2007-6432 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2008-2992
Published: 2008-11-04
Description: Stack-based buffer overflow in Adobe Acrobat and Reader 8.1.2 and earlier allows remote attackers to execute arbitrary code via a PDF file that calls the util.printf JavaScript function with a crafted format string argument, a related issue to CVE-2008-1104.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://download.oracle.com/sunalerts/1019937.1.html; http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html; http://osvdb.org/49520
CVE: CVE-2008-4413
Published: 2008-11-04
Description: Unspecified vulnerability in HP System Management Homepage (SMH) 2.2.6 and earlier on HP-UX B.11.11 and B.11.23, and SMH 2.2.6 and 2.2.8 and earlier on HP-UX B.11.23 and B.11.31, allows local users to gain "unauthorized access" via unknown vectors, possibly related to temporary file permissions.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-264
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3159&w=2; http://osvdb.org/49521; http://secunia.com/advisories/32544
CVE: CVE-2008-4306
Published: 2008-11-04
Description: Buffer overflow in enscript before 1.6.4 has unknown impact and attack vectors, possibly related to the font escape sequence.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00000.html; http://osvdb.org/49569; http://rhn.redhat.com/errata/RHSA-2008-1021.html
CVE: CVE-2008-4918
Published: 2008-11-04
Description: Cross-site scripting (XSS) vulnerability in SonicWALL SonicOS Enhanced before 4.0.1.1, as used in SonicWALL Pro 2040 and TZ 180 and 190, allows remote attackers to inject arbitrary web script or HTML into arbitrary web sites via a URL to a site that is blocked based on content filtering, which is not properly handled in the CFS block page, aka "universal website hijacking."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/32498; http://securityreason.com/securityalert/4556; http://www.gnucitizen.org/blog/new-technique-to-perform-universal-website-hijacking/
CVE: CVE-2008-4919
Published: 2008-11-04
Description: Insecure method vulnerability in VISAGESOFT eXPert PDF Viewer X ActiveX control (VSPDFViewerX.ocx) 3.0.990.0 allows remote attackers to overwrite arbitrary files via a full pathname to the savePageAsBitmap method.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/32426; http://securityreason.com/securityalert/4558; http://www.securityfocus.com/bid/31984
CVE: CVE-2008-4920
Published: 2008-11-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: None.  Reason: this candidate was based on an incorrect claim regarding a directory issue in Agavi.  The vendor has disputed the issue and the original researcher has retracted the original claim, so this is not a vulnerability.  Further investigation by the vendor and original researcher show that the original issue was in a site-specific modification, which is outside the scope of CVE.  Notes: CVE users should not use this identifier
CVE: CVE-2008-4921
Published: 2008-11-04
Description: board/admin/reguser.php in Chipmunk CMS 1.3 allows remote attackers to bypass authentication and gain administrator privileges via a direct request.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://osvdb.org/49494; http://secunia.com/advisories/32476; http://securityreason.com/securityalert/4559
CVE: CVE-2008-4922
Published: 2008-11-04
Description: Buffer overflow in the DjVu ActiveX Control 3.0 for Microsoft Office (DjVu_ActiveX_MSOffice.dll) allows remote attackers to execute arbitrary code via a long (1) ImageURL property, and possibly the (2) Mode, (3) Page, or (4) Zoom properties.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://securityreason.com/securityalert/4560; http://www.securityfocus.com/bid/31987; http://www.vupen.com/english/advisories/2008/2956
CVE: CVE-2008-4923
Published: 2008-11-04
Description: Multiple insecure method vulnerabilities in MW6 Technologies Aztec ActiveX control (AZTECLib.MW6Aztec, Aztec.dll) 3.0.0.1 allow remote attackers to overwrite arbitrary files via a full pathname argument to the (1) SaveAsBMP and (2) SaveAsWMF methods.
CVSS Score: 9.0 (HIGH)
References: http://secunia.com/advisories/32425; http://securityreason.com/securityalert/4561; http://www.securityfocus.com/bid/31974
CVE: CVE-2008-4924
Published: 2008-11-04
Description: Multiple insecure method vulnerabilities in MW6 Technologies 1D Barcode ActiveX control (BARCODELib.MW6Barcode, Barcode.dll) 3.0.0.1 allow remote attackers to overwrite arbitrary files via a full pathname argument to the (1) SaveAsBMP and (2) SaveAsWMF methods.
CVSS Score: 9.0 (HIGH)
References: http://secunia.com/advisories/32425; http://securityreason.com/securityalert/4562; http://www.securityfocus.com/bid/31979
CVE: CVE-2008-4925
Published: 2008-11-04
Description: Multiple insecure method vulnerabilities in MW6 Technologies DataMatrix ActiveX control (DATAMATRIXLib.MW6DataMatrix, DataMatrix.dll) 3.0.0.1 allow remote attackers to overwrite arbitrary files via a full pathname argument to the (1) SaveAsBMP and (2) SaveAsWMF methods.
CVSS Score: 9.0 (HIGH)
References: http://secunia.com/advisories/32425; http://securityreason.com/securityalert/4563; http://www.securityfocus.com/bid/31980
CVE: CVE-2008-4926
Published: 2008-11-04
Description: Multiple insecure method vulnerabilities in MW6 Technologies PDF417 ActiveX control (MW6PDF417Lib.PDF417, MW6PDF417.dll) 3.0.0.1 allow remote attackers to overwrite arbitrary files via a full pathname argument to the (1) SaveAsBMP and (2) SaveAsWMF methods.
CVSS Score: 9.0 (HIGH)
References: http://secunia.com/advisories/32425; http://www.securityfocus.com/bid/31983; https://www.exploit-db.com/exploits/6873
CVE: CVE-2008-4927
Published: 2008-11-04
Description: Microsoft Windows Media Player (WMP) 9.0 through 11 allows user-assisted attackers to cause a denial of service (application crash) via a malformed (1) MIDI or (2) DAT file, related to "MThd Header Parsing." NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/32077; http://www.securityfocus.com/data/vulnerabilities/exploits/32077.py; http://www.securityfocus.com/bid/32077
CVE: CVE-2008-4928
Published: 2008-11-04
Description: Cross-site scripting (XSS) vulnerability in the redirect function in functions.php in MyBB (aka MyBulletinBoard) 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the url parameter in a removesubscriptions action to moderation.php, related to use of the ajax option to request a JavaScript redirect.  NOTE: this can be leveraged to execute PHP code and bypass cross-site request forgery (CSRF) protection.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2008-10/0203.html; http://archives.neohapsis.com/archives/bugtraq/2008-10/0212.html; http://archives.neohapsis.com/archives/fulldisclosure/2008-10/0472.html
CVE: CVE-2008-4929
Published: 2008-11-04
Description: MyBB (aka MyBulletinBoard) 1.4.2 uses insufficient randomness to compose filenames of uploaded files used as attachments, which makes it easier for remote attackers to read these files by guessing filenames.
CVSS Score: 7.5 (HIGH)
CWE: CWE-330
References: http://archives.neohapsis.com/archives/bugtraq/2008-10/0203.html; http://archives.neohapsis.com/archives/fulldisclosure/2008-10/0472.html; http://www.openwall.com/lists/oss-security/2008/11/01/2
CVE: CVE-2008-4930
Published: 2008-11-04
Description: MyBB (aka MyBulletinBoard) 1.4.2 does not properly handle an uploaded file with a nonstandard file type that contains HTML sequences, which allows remote attackers to cause that file to be processed as HTML by Internet Explorer's content inspection, aka "Incomplete protection against MIME-sniffing." NOTE: this could be leveraged for XSS and other attacks.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2008-10/0203.html; http://archives.neohapsis.com/archives/fulldisclosure/2008-10/0472.html; http://www.openwall.com/lists/oss-security/2008/11/01/2
CVE: CVE-2008-3527
Published: 2008-11-05
Description: arch/i386/kernel/sysenter.c in the Virtual Dynamic Shared Objects (vDSO) implementation in the Linux kernel before 2.6.21 does not properly check boundaries, which allows local users to gain privileges or cause a denial of service via unspecified vectors, related to the install_special_mapping, syscall, and syscall32_nopage functions.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=7d91d531900bfa1165d445390b3b13a8013f98f7; http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html; http://secunia.com/advisories/32485
CVE: CVE-2008-4812
Published: 2008-11-05
Description: Array index error in Adobe Reader and Acrobat, and the Explorer extension (aka AcroRd32Info), 8.1.2, 8.1.1, and earlier allows remote attackers to execute arbitrary code via a crafted PDF document that triggers an out-of-bounds write, related to parsing of Type 1 fonts.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://download.oracle.com/sunalerts/1019937.1.html; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=755; http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html
CVE: CVE-2008-4813
Published: 2008-11-05
Description: Adobe Reader and Acrobat 8.1.2 and earlier, and before 7.1.1, allow remote attackers to execute arbitrary code via a crafted PDF document that (1) performs unspecified actions on a Collab object that trigger memory corruption, related to a GetCosObj method; or (2) contains a malformed PDF object that triggers memory corruption during parsing.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://download.oracle.com/sunalerts/1019937.1.html; http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html; http://secunia.com/advisories/32700
CVE: CVE-2008-4814
Published: 2008-11-05
Description: Unspecified vulnerability in a JavaScript method in Adobe Reader and Acrobat 8.1.2 and earlier, and before 7.1.1, allows remote attackers to execute arbitrary code via unknown vectors, related to an "input validation issue."
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://download.oracle.com/sunalerts/1019937.1.html; http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html; http://secunia.com/advisories/32700
CVE: CVE-2008-4815
Published: 2008-11-05
Description: Untrusted search path vulnerability in Adobe Reader and Acrobat 8.1.2 and earlier on Unix and Linux allows attackers to gain privileges via a Trojan Horse program in an unspecified directory that is associated with an insecure RPATH.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://download.oracle.com/sunalerts/1019937.1.html; http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html; http://secunia.com/advisories/32700
CVE: CVE-2008-4816
Published: 2008-11-05
Description: Unspecified vulnerability in the Download Manager in Adobe Reader 8.1.2 and earlier on Windows allows remote attackers to change Internet Security options on a client machine via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html; http://secunia.com/advisories/32872; http://www.adobe.com/support/security/bulletins/apsb08-19.html
CVE: CVE-2008-4817
Published: 2008-11-05
Description: The Download Manager in Adobe Acrobat Professional and Reader 8.1.2 and earlier allows remote attackers to execute arbitrary code via a crafted PDF document that calls an AcroJS function with a long string argument, triggering heap corruption.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://download.oracle.com/sunalerts/1019937.1.html; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=756; http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html
CVE: CVE-2008-4931
Published: 2008-11-05
Description: Cross-site scripting (XSS) vulnerability in the account module in firmCHANNEL Digital Signage 3.24, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via the action parameter to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/49564; http://secunia.com/advisories/32549; http://securityreason.com/securityalert/4566
CVE: CVE-2008-4932
Published: 2008-11-05
Description: webmail/modules/filesystem/edit.php in U-Mail Webmail server 4.91 allows remote attackers to overwrite arbitrary files via an absolute pathname in the path parameter and arbitrary content in the content parameter.  NOTE: this can be leveraged for code execution by writing to a file under the web document root.
CVSS Score: 9.0 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/32540; http://securityreason.com/securityalert/4565; http://www.securityfocus.com/archive/1/497961/100/0/threaded
CVE: CVE-2008-4933
Published: 2008-11-05
Description: Buffer overflow in the hfsplus_find_cat function in fs/hfsplus/catalog.c in the Linux kernel before 2.6.28-rc1 allows attackers to cause a denial of service (memory corruption or system crash) via an hfsplus filesystem image with an invalid catalog namelength field, related to the hfsplus_cat_build_key_uni function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.27.y.git%3Ba=commit%3Bh=efc7ffcb4237f8cb[PII_REDACTED]c4ed38f6e1bf40; http://kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.28-rc1; http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00006.html
CVE: CVE-2008-4934
Published: 2008-11-05
Description: The hfsplus_block_allocate function in fs/hfsplus/bitmap.c in the Linux kernel before 2.6.28-rc1 does not check a certain return value from the read_mapping_page function before calling kmap, which allows attackers to cause a denial of service (system crash) via a crafted hfsplus filesystem image.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.27.y.git%3Ba=commit%3Bh=649f1ee6c705aab644035a7998d7b574193a598a; http://kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.28-rc1; http://rhn.redhat.com/errata/RHSA-2009-0264.html
CVE: CVE-2008-4935
Published: 2008-11-05
Description: asciiview in aview 1.3.0 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/aview#####.pgm temporary file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://bugs.debian.org/496422; http://dev.gentoo.org/~rbu/security/debiantemp/aview; http://secunia.com/advisories/33139
CVE: CVE-2008-4936
Published: 2008-11-05
Description: faxspool in mgetty 1.1.36 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/faxsp.##### temporary file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://bugs.debian.org/496403; http://dev.gentoo.org/~rbu/security/debiantemp/mgetty-fax; http://secunia.com/advisories/33051
CVE: CVE-2008-4937
Published: 2008-11-05
Description: senddoc in OpenOffice.org (OOo) 2.4.1 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/log.obr.##### temporary file.
CVSS Score: 2.6 (LOW)
CWE: CWE-59
References: http://bugs.debian.org/496361; http://dev.gentoo.org/~rbu/security/debiantemp/openoffice.org-common; http://secunia.com/advisories/32856
CVE: CVE-2008-4938
Published: 2008-11-05
Description: aegis 4.24 and aegis-web 4.24 allow local users to overwrite arbitrary files via a symlink attack on (a) /tmp/#####, (b) /tmp/#####.intro, (c) /tmp/aegis.#####.ae, (d) /tmp/aegis.#####, (e) /tmp/aegis.#####.1, (f) /tmp/aegis.#####.2, (g) /tmp/aegis.#####.log, and (h) /tmp/aegis.#####.out temporary files, related to the (1) bng_dvlpd.sh, (2) bng_rvwd.sh, (3) awt_dvlp.sh, (4) awt_intgrtn.sh, and (5) aegis.cgi scripts.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://bugs.debian.org/496400; http://bugs.debian.org/496402; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496402
CVE: CVE-2008-4939
Published: 2008-11-05
Description: apertium 3.0.7 allows local users to overwrite arbitrary files via a symlink attack on (a) /tmp/#####.lex.cc, (b) /tmp/#####.deformat.l, (c) /tmp/#####.reformat.l, (d) /tmp/#####docxorig, (e) /tmp/#####docxsalida.zip, (f) /tmp/#####xlsxembed, (g) /tmp/#####xlsxorig, and (h) /tmp/#####xslxsalida.zip temporary files, related to the (1) apertium-gen-deformat, (2) apertium-gen-reformat, and (3) apertium scripts.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://bugs.debian.org/496395; http://dev.gentoo.org/~rbu/security/debiantemp/apertium; http://uvw.ru/report.lenny.txt
CVE: CVE-2008-4940
Published: 2008-11-05
Description: xmlfile.py in aptoncd 0.1 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/aptoncd temporary file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://bugs.debian.org/496390; http://dev.gentoo.org/~rbu/security/debiantemp/aptoncd; http://uvw.ru/report.lenny.txt
CVE: CVE-2008-4941
Published: 2008-11-05
Description: arb-common 0.0.20071207.1 allows local users to overwrite arbitrary files via a symlink attack on (a) /tmp/arb_fdnaml_*, (b) /tmp/arb_pids_*, (c) /tmp/arbdsmz.html, and (d) /tmp/arbdsmz.htm temporary files, related to the (1) arb_fastdnaml and (2) dszmconnect.pl scripts.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://bugs.debian.org/496396; http://dev.gentoo.org/~rbu/security/debiantemp/arb-common; http://uvw.ru/report.lenny.txt
CVE: CVE-2008-4942
Published: 2008-11-05
Description: audiolink in audiolink 0.05 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/audiolink.db.tmp and (2) /tmp/audiolink.tb.tmp temporary files.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://bugs.debian.org/496433; http://dev.gentoo.org/~rbu/security/debiantemp/audiolink; http://uvw.ru/report.lenny.txt
CVE: CVE-2008-4943
Published: 2008-11-05
Description: bulmages-servers 0.11.1 allows local users to overwrite arbitrary files via a symlink attack on the (a) /tmp/error.txt, (b) /tmp/errores.txt, and possibly other temporary files, related to the (1) creabulmafact, (2) creabulmacont, and possibly (3) actualizabulmacont, (4) installbulmages-db, and (5) actualizabulmafact scripts.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://bugs.debian.org/496382; http://dev.gentoo.org/~rbu/security/debiantemp/bulmages-servers; http://www.openwall.com/lists/oss-security/2008/10/30/2
CVE: CVE-2008-4944
Published: 2008-11-05
Description: writtercontrol in cdcontrol 1.90 allows local users to overwrite arbitrary files via a symlink attack on /tmp/v-recorder*-out temporary files.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://bugs.debian.org/496438; http://dev.gentoo.org/~rbu/security/debiantemp/cdcontrol; http://uvw.ru/report.lenny.txt
CVE: CVE-2008-4945
Published: 2008-11-05
Description: amlabel-cdrw in cdrw-taper 0.4 might allow local users to overwrite arbitrary files via a symlink attack involving a /tmp/amlabel-cdrw.##### temporary directory.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://bugs.debian.org/496380; http://dev.gentoo.org/~rbu/security/debiantemp/cdrw-taper; http://uvw.ru/report.lenny.txt