deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-6959
Published: 2009-08-12
Description: Insecure method vulnerability in the Chilkat Socket ActiveX control (ChilkatSocket.ChilkatSocket.1) in ChilkatSocket.dll 2.3.1.1 allows remote attackers to overwrite arbitrary files via the SaveLastError method.  NOTE: this might be related to CVE-2008-1647.
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/49902; http://secunia.com/advisories/32738; http://www.securityfocus.com/bid/32333
CVE: CVE-2008-6960
Published: 2009-08-12
Description: download.php in X10media x10 Automatic Mp3 Search Engine Script 1.5.5 through 1.6 allows remote attackers to read arbitrary files via an encoded url parameter, as demonstrated by obtaining database credentials from includes/constants.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/49797; http://secunia.com/advisories/32537; http://www.securityfocus.com/bid/32227
CVE: CVE-2009-1427
Published: 2009-08-12
Description: Unspecified vulnerability in HP-UX B.11.31 allows local users to cause a denial of service (system crash) via unknown vectors related to the ttrace system call.
CVSS Score: 4.9 (MEDIUM)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01832652; http://secunia.com/advisories/36261; http://www.securityfocus.com/bid/36017
CVE: CVE-2009-2726
Published: 2009-08-12
Description: The SIP channel driver in Asterisk Open Source 1.2.x before 1.2.34, 1.4.x before 1.4.26.1, 1.6.0.x before 1.6.0.12, and 1.6.1.x before 1.6.1.4; Asterisk Business Edition A.x.x, B.x.x before B.2.5.9, C.2.x before C.2.4.1, and C.3.x before C.3.1; and Asterisk Appliance s800i 1.2.x before 1.3.0.3 does not use a maximum width when invoking sscanf style functions, which allows remote attackers to cause a denial of service (stack memory consumption) via SIP packets containing large sequences of ASCII decimal characters, as demonstrated via vectors related to (1) the CSeq value in a SIP header, (2) large Content-Length value, and (3) SDP.
CVSS Score: 7.8 (HIGH)
CWE: CWE-770
References: http://downloads.digium.com/pub/security/AST-2009-005.html; http://labs.mudynamics.com/advisories/MU-200908-01.txt; http://secunia.com/advisories/36227
CVE: CVE-2009-2730
Published: 2009-08-12
Description: libgnutls in GnuTLS before 2.8.2 does not properly handle a '\0' character in a domain name in the subject's (1) Common Name (CN) or (2) Subject Alternative Name (SAN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
CVSS Score: 7.5 (HIGH)
CWE: CWE-310
References: http://article.gmane.org/gmane.network.gnutls.general/1733; http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.html; http://secunia.com/advisories/36266
CVE: CVE-2009-0562
Published: 2009-08-12
Description: The Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2003 SP3, Office XP Web Components SP3, Office 2003 Web Components SP3, Office 2003 Web Components SP1 for the 2007 Microsoft Office System, Internet Security and Acceleration (ISA) Server 2004 SP3 and 2006 SP1, and Office Small Business Accounting 2006 does not properly allocate memory, which allows remote attackers to execute arbitrary code via unspecified vectors that trigger "system state" corruption, aka "Office Web Components Memory Allocation Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securitytracker.com/id?1022708; http://www.us-cert.gov/cas/techalerts/TA09-223A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-043
CVE: CVE-2009-1133
Published: 2009-08-12
Description: Heap-based buffer overflow in Microsoft Remote Desktop Connection (formerly Terminal Services Client) running RDP 5.0 through 6.1 on Windows, and Remote Desktop Connection Client for Mac 2.0, allows remote attackers to execute arbitrary code via unspecified parameters, aka "Remote Desktop Connection Heap Overflow Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/36229; http://www.securitytracker.com/id?1022709; http://www.us-cert.gov/cas/techalerts/TA09-223A.html
CVE: CVE-2009-1534
Published: 2009-08-12
Description: Buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2000 Web Components SP3, Office XP Web Components SP3, BizTalk Server 2002, and Visual Studio .NET 2003 SP1 allows remote attackers to execute arbitrary code via crafted property values, aka "Office Web Components Buffer Overflow Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/56916; http://www.securityfocus.com/bid/35992; http://www.securitytracker.com/id?1022708
CVE: CVE-2009-1536
Published: 2009-08-12
Description: ASP.NET in Microsoft .NET Framework 2.0 SP1 and SP2 and 3.5 Gold and SP1, when ASP 2.0 is used in integrated mode on IIS 7.0, does not properly manage request scheduling, which allows remote attackers to cause a denial of service (daemon outage) via a series of crafted HTTP requests, aka "Remote Unauthenticated Denial of Service in ASP.NET Vulnerability."
CVSS Score: 2.6 (LOW)
CWE: CWE-20
References: http://blogs.technet.com/srd/archive/2009/08/11/ms09-035-asp-net-denial-of-service-vulnerability.aspx; http://osvdb.org/56905; http://secunia.com/advisories/36127
CVE: CVE-2009-1544
Published: 2009-08-12
Description: Double free vulnerability in the Workstation service in Microsoft Windows allows remote authenticated users to gain privileges via a crafted RPC message to a Windows XP SP2 or SP3 or Server 2003 SP2 system, or cause a denial of service via a crafted RPC message to a Vista Gold, SP1, or SP2 or Server 2008 Gold or SP2 system, aka "Workstation Service Memory Corruption Vulnerability."
CVSS Score: 8.8 (HIGH)
CWE: CWE-399, CWE-415
References: http://www.us-cert.gov/cas/techalerts/TA09-223A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-041; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6286
CVE: CVE-2009-1545
Published: 2009-08-12
Description: Unspecified vulnerability in Avifil32.dll in the Windows Media file handling functionality in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via a malformed header in a crafted AVI file, aka "Malformed AVI Header Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/36206; http://www.securityfocus.com/bid/35967; http://www.securitytracker.com/id?1022711
CVE: CVE-2009-1546
Published: 2009-08-12
Description: Integer overflow in Avifil32.dll in the Windows Media file handling functionality in Microsoft Windows allows remote attackers to execute arbitrary code on a Windows 2000 SP4 system via a crafted AVI file, or cause a denial of service on a Windows XP SP2 or SP3, Server 2003 SP2, Vista Gold, SP1, or SP2, or Server 2008 Gold or SP2 system via a crafted AVI file, aka "AVI Integer Overflow Vulnerability."
CVSS Score: 8.5 (HIGH)
CWE: CWE-189
References: http://osvdb.org/56909; http://secunia.com/advisories/36206; http://www.securityfocus.com/bid/35970
CVE: CVE-2009-1922
Published: 2009-08-12
Description: The Message Queuing (aka MSMQ) service for Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP2, and Vista Gold does not properly validate unspecified IOCTL request data from user mode before passing this data to kernel mode, which allows local users to gain privileges via a crafted request, aka "MSMQ Null Pointer Vulnerability."
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://en.securitylab.ru/lab/PT-2008-09; http://osvdb.org/56901; http://secunia.com/advisories/36214
CVE: CVE-2009-1923
Published: 2009-08-12
Description: Heap-based buffer overflow in the Windows Internet Name Service (WINS) component for Microsoft Windows 2000 SP4 and Server 2003 SP2 allows remote attackers to execute arbitrary code via a crafted WINS replication packet that triggers an incorrect buffer-length calculation, aka "WINS Heap Overflow Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/cas/techalerts/TA09-223A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-039; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6410
CVE: CVE-2009-1924
Published: 2009-08-12
Description: Integer overflow in the Windows Internet Name Service (WINS) component for Microsoft Windows 2000 SP4 allows remote WINS replication partners to execute arbitrary code via crafted data structures in a packet, aka "WINS Integer Overflow Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://www.us-cert.gov/cas/techalerts/TA09-223A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-039; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6354
CVE: CVE-2009-1929
Published: 2009-08-12
Description: Heap-based buffer overflow in the Microsoft Terminal Services Client ActiveX control running RDP 6.1 on Windows XP SP2, Vista SP1 or SP2, or Server 2008 Gold or SP2; or 5.2 or 6.1 on Windows XP SP3; allows remote attackers to execute arbitrary code via unspecified parameters to unknown methods, aka "Remote Desktop Connection ActiveX Control Heap Overflow Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/56912; http://secunia.com/advisories/36229; http://www.securityfocus.com/bid/35973
CVE: CVE-2009-1930
Published: 2009-08-12
Description: The Telnet service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows remote Telnet servers to execute arbitrary code on a client machine by replaying the NTLM credentials of a client user, aka "Telnet Credential Reflection Vulnerability," a related issue to CVE-2000-0834.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://osvdb.org/56904; http://secunia.com/advisories/36222; http://securitytracker.com/id?1022716
CVE: CVE-2009-2494
Published: 2009-08-12
Description: The Active Template Library (ATL) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via vectors related to erroneous free operations after reading a variant from a stream and deleting this variant, aka "ATL Object Type Mismatch Vulnerability."
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: http://blogs.technet.com/srd/archive/2009/08/11/ms09-037-why-we-are-using-cve-s-already-used-in-ms09-035.aspx; http://osvdb.org/56910; http://secunia.com/advisories/36187
CVE: CVE-2009-2496
Published: 2009-08-12
Description: Heap-based buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2003 SP3, Office XP Web Components SP3, Office 2003 Web Components SP3, Office 2003 Web Components SP1 for the 2007 Microsoft Office System, Internet Security and Acceleration (ISA) Server 2004 SP3 and 2006 SP1, and Office Small Business Accounting 2006 allows remote attackers to execute arbitrary code via unspecified parameters to unknown methods, aka "Office Web Components Heap Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id?1022708; http://www.us-cert.gov/cas/techalerts/TA09-223A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-043
CVE: CVE-2009-2195
Published: 2009-08-12
Description: Buffer overflow in WebKit in Apple Safari before 4.0.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted floating-point numbers.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2009/Aug/msg00002.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
CVE: CVE-2009-2196
Published: 2009-08-12
Description: Unspecified vulnerability in Apple Safari 4 before 4.0.3 allows remote web servers to place an arbitrary web site in the Top Sites view, and possibly conduct phishing attacks, via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2009/Aug/msg00002.html; http://support.apple.com/kb/HT3733; http://www.securityfocus.com/bid/36022
CVE: CVE-2009-2199
Published: 2009-08-12
Description: Incomplete blacklist vulnerability in WebKit in Apple Safari before 4.0.3, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms, allows remote attackers to spoof domain names in URLs, and possibly conduct phishing attacks, via unspecified homoglyphs.
CVSS Score: 5.8 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2009/Aug/msg00002.html; http://lists.apple.com/archives/security-announce/2009/Sep/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
CVE: CVE-2009-2200
Published: 2009-08-12
Description: WebKit in Apple Safari before 4.0.3 does not properly restrict the URL scheme of the pluginspage attribute of an EMBED element, which allows user-assisted remote attackers to launch arbitrary file: URLs and obtain sensitive information via a crafted HTML document.
CVSS Score: 7.1 (HIGH)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2009/Aug/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html; http://secunia.com/advisories/43068
CVE: CVE-2008-6961
Published: 2009-08-13
Description: mailnews in Mozilla Thunderbird before 2.0.0.18 and SeaMonkey before 1.1.13, when JavaScript is enabled in mail, allows remote attackers to obtain sensitive information about the recipient, or comments in forwarded mail, via script that reads the (1) .documentURI or (2) .textContent DOM properties.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/32714; http://secunia.com/advisories/32715; http://www.mozilla.org/security/announce/2008/mfsa2008-59.html
CVE: CVE-2008-6962
Published: 2009-08-13
Description: Avira AntiVir Premium, Premium Security Suite, AntiVir Professional, and AntiVir Personal - FREE allows local users to execute arbitrary code via a crafted IOCTL request that overwrites a kernel pointer.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/32269; http://www.vupen.com/english/VUPEN-Security-Advisory-20081112.txt; http://www.vupen.com/english/advisories/2008/3130
CVE: CVE-2008-6963
Published: 2009-08-13
Description: admin.php in TurnkeyForms Text Link Sales allows remote attackers to bypass authentication and gain administrative privileges via a direct request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://osvdb.org/49868; http://secunia.com/advisories/32732; http://www.securityfocus.com/bid/32302
CVE: CVE-2008-6964
Published: 2009-08-13
Description: SQL injection vulnerability in the login page in X7 Chat 2.0.5 allows remote attackers to execute arbitrary SQL commands via the password field.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/32309; https://exchange.xforce.ibmcloud.com/vulnerabilities/46640; https://www.exploit-db.com/exploits/7123
CVE: CVE-2008-6965
Published: 2009-08-13
Description: AJ Square AJ Auction OOPD, Pro Platinum Skin #1, Pro Platinum Skin #2, and Web 2.0 send a redirect but do not exit when certain scripts are called directly, which allows remote attackers to bypass authentication via a direct request to (1) site.php, (2) auction.php, (3) mail.php, (4) fee_setting.php, (5) earnings.php, (6) insertion_fee_settings.php, (7) custom_category.php, (8) subcategory.php, (9) category.php, (10) report.php, (11) store_manager.php, and (12) choose_sell_format.php in admin/, and possibly other vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.securityfocus.com/bid/32243; https://exchange.xforce.ibmcloud.com/vulnerabilities/46528; https://www.exploit-db.com/exploits/7087
CVE: CVE-2008-6966
Published: 2009-08-13
Description: AJ Square AJ Auction Pro Platinum Skin #1 sends a redirect but does not exit when it is called directly, which allows remote attackers to bypass authentication via a direct request to admin/user.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/32243; https://exchange.xforce.ibmcloud.com/vulnerabilities/46528; https://www.exploit-db.com/exploits/7087
CVE: CVE-2008-6967
Published: 2009-08-13
Description: Multiple unspecified vulnerabilities in WorldClient in Alt-N MDaemon before 10.02 have unknown impact and attack vectors, probably related to cross-site scripting (XSS) and WorldClient DLL 10.0.1, a different vulnerability than CVE-2008-6893.
CVSS Score: 5.0 (MEDIUM)
References: http://files.altn.com/MDaemon/Release/RelNotes_en.txt; http://osvdb.org/50011; http://secunia.com/advisories/32142
CVE: CVE-2008-6968
Published: 2009-08-13
Description: Multiple SQL injection vulnerabilities in submit.php in Pligg CMS 9.9.5 allow remote attackers to execute arbitrary SQL commands via the (1) category and (2) id parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.digitrustgroup.com/advisories/web-application-security-pligg; http://www.securityfocus.com/bid/31062; https://exchange.xforce.ibmcloud.com/vulnerabilities/45086
CVE: CVE-2008-6969
Published: 2009-08-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in checkout.php in Avactis Shopping Cart 1.8.0 and 1.8.1 allow remote attackers to inject arbitrary web script or HTML via the (1) step_id and (2) CHECKOUT_CZ_BLOWFISH_KEY parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://holisticinfosec.org/content/view/81/45/; http://osvdb.org/47946; http://secunia.com/advisories/31768
CVE: CVE-2008-6970
Published: 2009-08-13
Description: SQL injection vulnerability in dosearch.inc.php in UBB.threads 7.3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the Forum[] array parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/47954; http://secunia.com/advisories/31804; http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]8
CVE: CVE-2008-6971
Published: 2009-08-13
Description: The password reset functionality in Simple Machines Forum (SMF) 1.0.x before 1.0.14, 1.1.x before 1.1.6, and 2.0 before 2.0 beta 4 includes clues about the random number generator state within a hidden form field and generates predictable validation codes, which allows remote attackers to modify passwords of other users and gain privileges.
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://osvdb.org/47945; http://secunia.com/advisories/31750; http://www.securityfocus.com/bid/31053
CVE: CVE-2008-6972
Published: 2009-08-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in Drupal Content Construction Kit (CCK) 5.x through 5.x-1.8 allow remote authenticated users with "administer content" permissions to inject arbitrary web script or HTML via the (1) "field label," (2) "help text," or (3) "allowed values" settings.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/304093; http://osvdb.org/47929; http://secunia.com/advisories/31757
CVE: CVE-2009-2761
Published: 2009-08-13
Description: Unquoted Windows search path vulnerability in the scheduler (sched.exe) in Avira AntiVir, AntiVir Premium, Premium Security Suite, and AntiVir Professional might allow local users to gain privileges via a malicious antivir.exe file in the "C:\Program Files\avira\" directory.
CVSS Score: 7.2 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2009-01/0146.html; http://blog.zoller.lu/2009/01/tzo-2009-2-avira-antivir-priviledge.html; http://www.osvdb.org/55647
CVE: CVE-2009-2762
Published: 2009-08-13
Description: wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the database, possibly the administrator, via a key[] array variable in a resetpass (aka rp) action, which bypasses a check that assumes that $key is not an array.
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://archives.neohapsis.com/archives/fulldisclosure/2009-08/0114.html; http://core.trac.wordpress.org/changeset/11798; http://secunia.com/advisories/36237
CVE: CVE-2008-6973
Published: 2009-08-13
Description: Multiple unspecified vulnerabilities in IBM WebSphere Commerce 6.0 before 6.0.0.7 have unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://publib.boulder.ibm.com/infocenter/wchelp/v6r0m0/topic/com.ibm.commerce.admin.doc/refs/rig_new_and_changed.htm; http://www-01.ibm.com/support/docview.wss?uid=swg24021397; http://www-1.ibm.com/support/docview.wss?uid=swg1LI74127
CVE: CVE-2009-0906
Published: 2009-08-13
Description: The Service Component Architecture (SCA) feature pack for IBM WebSphere Application Server (WAS) SCA 1.0 before 1.0.0.3 allows remote authenticated users to bypass intended authentication.transport access restrictions and obtain unspecified access via unknown vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/36306; http://www-01.ibm.com/support/docview.wss?uid=swg27015429; http://www-1.ibm.com/support/docview.wss?uid=swg1PK86047
CVE: CVE-2009-0907
Published: 2009-08-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2009-1899.  Reason: This candidate is a duplicate of CVE-2009-1899.  Notes: All CVE users should reference CVE-2009-1899 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2009-2085
Published: 2009-08-13
Description: The Security component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5 does not properly handle use of Identity Assertion with CSIv2 Security, which allows remote attackers to bypass intended CSIv2 access restrictions via vectors involving Enterprise JavaBeans (EJB).
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www-01.ibm.com/support/docview.wss?uid=swg27007951; http://www-01.ibm.com/support/docview.wss?uid=swg27014463; http://www-1.ibm.com/support/docview.wss?uid=swg1PK83097
CVE: CVE-2009-2086
Published: 2009-08-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2009-1900.  Reason: This candidate is a duplicate of CVE-2009-1900.  Notes: All CVE users should reference CVE-2009-1900 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2009-2087
Published: 2009-08-13
Description: The Web Services functionality in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5, in certain circumstances involving the ibm-webservicesclient-bind.xmi file and custom password encryption, uses weak password obfuscation, which allows local users to cause a denial of service (deployment failure) via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-255
References: http://secunia.com/advisories/34461; http://www-01.ibm.com/support/docview.wss?uid=swg27007951; http://www-01.ibm.com/support/docview.wss?uid=swg27014463
CVE: CVE-2009-2088
Published: 2009-08-13
Description: The Servlet Engine/Web Container component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5, when SPNEGO Single Sign-on (SSO) and disableSecurityPreInvokeOnFilters are configured, allows remote attackers to bypass authentication via a request for a "secure URL," related to a certain invokefilterscompatibility property.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www-01.ibm.com/support/docview.wss?uid=swg24022479; http://www-01.ibm.com/support/docview.wss?uid=swg27007951; http://www-01.ibm.com/support/docview.wss?uid=swg27014463