deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-0049
Published: 2008-03-18
Description: AppKit in Apple Mac OS X 10.4.11 inadvertently makes an NSApplication mach port available for inter-process communication instead of inter-thread communication, which allows local users to execute arbitrary code via crafted messages to privileged applications.
CVSS Score: 1.9 (LOW)
CWE: CWE-264
References: http://docs.info.apple.com/article.html?artnum=307562; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html; http://secunia.com/advisories/29420
CVE: CVE-2008-0050
Published: 2008-03-18
Description: CFNetwork in Apple Mac OS X 10.4.11 allows remote HTTPS proxy servers to spoof secure websites via data in a 502 Bad Gateway error.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://docs.info.apple.com/article.html?artnum=307562; http://docs.info.apple.com/article.html?artnum=307563; http://lists.apple.com/archives/security-announce/2008//Jul/msg00001.html
CVE: CVE-2008-0051
Published: 2008-03-18
Description: Integer overflow in CoreFoundation in Apple Mac OS X 10.4.11 might allow local users to execute arbitrary code via crafted time zone data.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-189
References: http://docs.info.apple.com/article.html?artnum=307562; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html; http://secunia.com/advisories/29420
CVE: CVE-2008-0057
Published: 2008-03-18
Description: Multiple integer overflows in a "legacy serialization format" parser in AppKit in Apple Mac OS X 10.4.11 allows remote attackers to execute arbitrary code via a crafted serialized property list.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://docs.info.apple.com/article.html?artnum=307562; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html; http://www.securityfocus.com/bid/28304
CVE: CVE-2008-0997
Published: 2008-03-18
Description: Stack-based buffer overflow in AppKit in Apple Mac OS X 10.4.11 allows user-assisted remote attackers to cause a denial of service (application termination) and execute arbitrary code via a crafted PostScript Printer Description (PPD) file that is not properly handled when querying a network printer.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://docs.info.apple.com/article.html?artnum=307562; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html; http://www.securityfocus.com/bid/28304
CVE: CVE-2008-1383
Published: 2008-03-18
Description: The docert function in ssl-cert.eclass, when used by src_compile or src_install on Gentoo Linux, stores the SSL key in a binpkg, which allows local users to extract the key from the binpkg, and causes multiple systems that use this binpkg to have the same SSL key and certificate.
CVSS Score: 1.9 (LOW)
CWE: CWE-310
References: http://osvdb.org/43479; http://secunia.com/advisories/29436; http://security.gentoo.org/glsa/glsa-200803-30.xml
CVE: CVE-2008-0047
Published: 2008-03-18
Description: Heap-based buffer overflow in the cgiCompileSearch function in CUPS 1.3.5, and other versions including the version bundled with Apple Mac OS X 10.5.2, when printer sharing is enabled, allows remote attackers to execute arbitrary code via crafted search expressions.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://docs.info.apple.com/article.html?artnum=307562; http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=674; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html
CVE: CVE-2008-0052
Published: 2008-03-18
Description: CoreServices in Apple Mac OS X 10.4.11 treats .ief as a safe file type, which allows remote attackers to force Safari users into opening an .ief file in AppleWorks, even when the "Open 'Safe' files" preference is set.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-200
References: http://docs.info.apple.com/article.html?artnum=307562; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html; http://secunia.com/advisories/29420
CVE: CVE-2008-0053
Published: 2008-03-18
Description: Multiple buffer overflows in the HP-GL/2-to-PostScript filter in CUPS before 1.3.6 might allow remote attackers to execute arbitrary code via a crafted HP-GL/2 file.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://docs.info.apple.com/article.html?artnum=307562; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00003.html
CVE: CVE-2008-0054
Published: 2008-03-18
Description: Foundation in Apple Mac OS X 10.4.11 might allow context-dependent attackers to execute arbitrary code via a malformed selector name to the NSSelectorFromString API, which causes an "unexpected selector" to be used.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: http://docs.info.apple.com/article.html?artnum=307562; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html; http://secunia.com/advisories/29420
CVE: CVE-2008-0055
Published: 2008-03-18
Description: Foundation in Apple Mac OS X 10.4.11 creates world-writable directories while NSFileManager copies files recursively and only modifies the permissions afterward, which allows local users to modify copied files to cause a denial of service and possibly gain privileges.
CVSS Score: 7.2 (HIGH)
CWE: CWE-362
References: http://docs.info.apple.com/article.html?artnum=307562; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html; http://secunia.com/advisories/29420
CVE: CVE-2008-0056
Published: 2008-03-18
Description: Stack-based buffer overflow in Foundation in Apple Mac OS X 10.4.11 allows context-dependent attackers to execute arbitrary code via a "long pathname with an unexpected structure" that triggers the overflow in NSFileManager.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://docs.info.apple.com/article.html?artnum=307562; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html; http://secunia.com/advisories/29420
CVE: CVE-2008-0058
Published: 2008-03-18
Description: Race condition in the NSURLConnection cache management functionality in Foundation for Apple Mac OS X 10.4.11 allows remote attackers to execute arbitrary code via unspecified manipulations that cause messages to be sent to a deallocated object.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-362
References: http://docs.info.apple.com/article.html?artnum=307562; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html; http://secunia.com/advisories/29420
CVE: CVE-2008-0059
Published: 2008-03-18
Description: Race condition in NSXML in Foundation for Apple Mac OS X 10.4.11 allows context-dependent attackers to execute arbitrary code via a crafted XML file, related to "error handling logic."
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-362
References: http://docs.info.apple.com/article.html?artnum=307562; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html; http://secunia.com/advisories/29420
CVE: CVE-2008-0060
Published: 2008-03-18
Description: Help Viewer in Apple Mac OS X 10.4.11 and 10.5.2 allows remote attackers to execute arbitrary Applescript via a help:topic_list URL that injects HTML or JavaScript into a topic list page, as demonstrated using a help:runscript link.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://docs.info.apple.com/article.html?artnum=307562; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html; http://secunia.com/advisories/29420
CVE: CVE-2008-0987
Published: 2008-03-18
Description: Stack-based buffer overflow in Image Raw in Apple Mac OS X 10.5.2, and Digital Camera RAW Compatibility before Update 2.0 for Aperture 2 and iPhoto 7.1.2, allows remote attackers to execute arbitrary code via a crafted Adobe Digital Negative (DNG) image.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://docs.info.apple.com/article.html?artnum=307562; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html; http://lists.apple.com/archives/security-announce/2008/Mar/msg00003.html
CVE: CVE-2008-0988
Published: 2008-03-18
Description: Off-by-one error in the Libsystem strnstr API in libc on Apple Mac OS X 10.4.11 allows context-dependent attackers to cause a denial of service (crash) via crafted arguments that trigger a buffer over-read.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://docs.info.apple.com/article.html?artnum=307562; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html; http://secunia.com/advisories/29420
CVE: CVE-2008-0989
Published: 2008-03-18
Description: Format string vulnerability in mDNSResponderHelper in Apple Mac OS X 10.5.2 allows local users to execute arbitrary code via format string specifiers in the local hostname.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-134
References: http://docs.info.apple.com/article.html?artnum=307562; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html; http://secunia.com/advisories/29420
CVE: CVE-2008-0990
Published: 2008-03-18
Description: notifyd in Apple Mac OS X 10.4.11 does not verify that Mach port death notifications have originated from the kernel, which allows local users to cause a denial of service via spoofed death notifications that prevent other applications from receiving notifications.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-200
References: http://docs.info.apple.com/article.html?artnum=307562; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html; http://secunia.com/advisories/29420
CVE: CVE-2008-0992
Published: 2008-03-18
Description: Array index error in pax in Apple Mac OS X 10.5.2 allows context-dependent attackers to execute arbitrary code via an archive with a crafted length value.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-119
References: http://docs.info.apple.com/article.html?artnum=307562; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html; http://secunia.com/advisories/29420
CVE: CVE-2008-0993
Published: 2008-03-18
Description: Podcast Capture in Podcast Producer for Apple Mac OS X 10.5.2 invokes a subtask with passwords in command line arguments, which allows local users to read the passwords via process listings.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://docs.info.apple.com/article.html?artnum=307562; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html; http://secunia.com/advisories/29420
CVE: CVE-2008-0994
Published: 2008-03-18
Description: Preview in Apple Mac OS X 10.5.2 uses 40-bit RC4 when saving a PDF file with encryption, which makes it easier for attackers to decrypt the file via brute force methods.
CVSS Score: 2.6 (LOW)
CWE: CWE-200
References: http://docs.info.apple.com/article.html?artnum=307562; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html; http://secunia.com/advisories/29420
CVE: CVE-2008-0995
Published: 2008-03-18
Description: The Printing component in Apple Mac OS X 10.5.2 uses 40-bit RC4 when printing to an encrypted PDF file, which makes it easier for attackers to decrypt the file via brute force methods.
CVSS Score: 2.6 (LOW)
CWE: CWE-200
References: http://docs.info.apple.com/article.html?artnum=307562; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html; http://secunia.com/advisories/29420
CVE: CVE-2008-0996
Published: 2008-03-18
Description: The Printing component in Apple Mac OS X 10.5.2 might save authentication credentials to disk when starting a job on an authenticated print queue, which might allow local users to obtain the credentials.
CVSS Score: 1.7 (LOW)
CWE: CWE-200, CWE-255
References: http://docs.info.apple.com/article.html?artnum=307562; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html; http://secunia.com/advisories/29420
CVE: CVE-2008-0998
Published: 2008-03-18
Description: Unspecified vulnerability in NetCfgTool in the System Configuration component in Apple Mac OS X 10.4.11 and 10.5.2 allows local users to bypass authorization and execute arbitrary code via crafted distributed objects.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://docs.info.apple.com/article.html?artnum=307562; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html; http://secunia.com/advisories/29420
CVE: CVE-2008-0999
Published: 2008-03-18
Description: Apple Mac OS X 10.5.2 allows user-assisted attackers to cause a denial of service (crash) via a crafted Universal Disc Format (UDF) disk image, which triggers a NULL pointer dereference.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://docs.info.apple.com/article.html?artnum=307562; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html; http://secunia.com/advisories/29420
CVE: CVE-2008-1000
Published: 2008-03-18
Description: Directory traversal vulnerability in ContentServer.py in the Wiki Server in Apple Mac OS X 10.5.2 (aka Leopard) allows remote authenticated users to write arbitrary files via ".." sequences in file attachments.
CVSS Score: 8.5 (HIGH)
CWE: CWE-22
References: http://docs.info.apple.com/article.html?artnum=307562; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html; http://secunia.com/advisories/29420
CVE: CVE-2008-0947
Published: 2008-03-19
Description: Buffer overflow in the RPC library used by libgssrpc and kadmind in MIT Kerberos 5 (krb5) 1.4 through 1.6.3 allows remote attackers to execute arbitrary code by triggering a large number of open file descriptors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00006.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7107&w=2; http://secunia.com/advisories/29424
CVE: CVE-2008-0948
Published: 2008-03-19
Description: Buffer overflow in the RPC library (lib/rpc/rpc_dtablesize.c) used by libgssrpc and kadmind in MIT Kerberos 5 (krb5) 1.2.2, and probably other versions before 1.3, when running on systems whose unistd.h does not define the FD_SETSIZE macro, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by triggering a large number of open file descriptors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00006.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]7107&w=2; http://secunia.com/advisories/29423
CVE: CVE-2008-1001
Published: 2008-03-19
Description: Cross-site scripting (XSS) vulnerability in Apple Safari before 3.1, when running on Windows XP or Vista, allows remote attackers to inject arbitrary web script or HTML via a crafted URL that is not properly handled in the error page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://docs.info.apple.com/article.html?artnum=307563; http://lists.apple.com/archives/security-announce/2008/Mar/msg00000.html; http://www.securityfocus.com/bid/28290
CVE: CVE-2008-1002
Published: 2008-03-19
Description: Cross-site scripting (XSS) vulnerability in Apple Safari before 3.1 allows remote attackers to inject arbitrary web script or HTML via a crafted javascript: URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://docs.info.apple.com/article.html?artnum=307563; http://lists.apple.com/archives/security-announce/2008/Mar/msg00000.html; http://secunia.com/advisories/29393
CVE: CVE-2008-1003
Published: 2008-03-19
Description: Cross-site scripting (XSS) vulnerability in WebCore, as used in Apple Safari before 3.1, allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to sites that set the document.domain property or have the same document.domain.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://docs.info.apple.com/article.html?artnum=307563; http://lists.apple.com/archives/security-announce/2008/Mar/msg00000.html; http://secunia.com/advisories/29393
CVE: CVE-2008-1004
Published: 2008-03-19
Description: Cross-site scripting (XSS) vulnerability in WebCore, as used in Apple Safari before 3.1, allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to the Web Inspector.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://docs.info.apple.com/article.html?artnum=307563; http://lists.apple.com/archives/security-announce/2008/Mar/msg00000.html; http://secunia.com/advisories/29393
CVE: CVE-2008-1005
Published: 2008-03-19
Description: WebCore, as used in Apple Safari before 3.1, does not properly mask the password field when reverse conversion is used with the Kotoeri input method, which allows physically proximate attackers to read the password.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://docs.info.apple.com/article.html?artnum=307563; http://lists.apple.com/archives/security-announce/2008/Mar/msg00000.html; http://secunia.com/advisories/29393
CVE: CVE-2008-1006
Published: 2008-03-19
Description: Cross-site scripting (XSS) vulnerability in WebCore, as used in Apple Safari before 3.1, allows remote attackers to inject arbitrary web script or HTML by using the window.open function to change the security context of a web page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://docs.info.apple.com/article.html?artnum=307563; http://lists.apple.com/archives/security-announce/2008/Mar/msg00000.html; http://secunia.com/advisories/29393
CVE: CVE-2008-1007
Published: 2008-03-19
Description: WebCore, as used in Apple Safari before 3.1, does not enforce the frame navigation policy for Java applets, which allows remote attackers to conduct cross-site scripting (XSS) attacks.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://docs.info.apple.com/article.html?artnum=307563; http://lists.apple.com/archives/security-announce/2008/Mar/msg00000.html; http://secunia.com/advisories/29393
CVE: CVE-2008-1008
Published: 2008-03-19
Description: Cross-site scripting (XSS) vulnerability in WebCore, as used in Apple Safari before 3.1, allows remote attackers to inject arbitrary web script or HTML via the document.domain property.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://docs.info.apple.com/article.html?artnum=307563; http://lists.apple.com/archives/security-announce/2008/Mar/msg00000.html; http://secunia.com/advisories/29393
CVE: CVE-2008-1009
Published: 2008-03-19
Description: Cross-site scripting (XSS) vulnerability in WebCore, as used in Apple Safari before 3.1, allows remote attackers to inject arbitrary JavaScript by modifying the history object.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://docs.info.apple.com/article.html?artnum=307563; http://lists.apple.com/archives/security-announce/2008/Mar/msg00000.html; http://secunia.com/advisories/29393
CVE: CVE-2008-1010
Published: 2008-03-19
Description: Buffer overflow in WebKit, as used in Apple Safari before 3.1, allows remote attackers to execute arbitrary code via crafted regular expressions in JavaScript.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://docs.info.apple.com/article.html?artnum=307563; http://lists.apple.com/archives/security-announce/2008/Mar/msg00000.html; http://secunia.com/advisories/29393
CVE: CVE-2008-1011
Published: 2008-03-19
Description: Cross-site scripting (XSS) vulnerability in WebKit, as used in Apple Safari before 3.1, allows remote attackers to inject arbitrary web script or HTML via a frame that calls a method instance in another frame.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://docs.info.apple.com/article.html?artnum=307563; http://lists.apple.com/archives/security-announce/2008/Mar/msg00000.html; http://secunia.com/advisories/29393
CVE: CVE-2008-0062
Published: 2008-03-19
Description: KDC in MIT Kerberos 5 (krb5kdc) does not set a global variable for some krb4 message types, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted messages that trigger a NULL pointer dereference or double-free.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-665
References: http://docs.info.apple.com/article.html?artnum=307562; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00006.html
CVE: CVE-2008-0063
Published: 2008-03-19
Description: The Kerberos 4 support in KDC in MIT Kerberos 5 (krb5kdc) does not properly clear the unused portion of a buffer when generating an error message, which might allow remote attackers to obtain sensitive information, aka "Uninitialized stack values."
CVSS Score: 7.5 (HIGH)
CWE: CWE-908
References: http://docs.info.apple.com/article.html?artnum=307562; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00006.html
CVE: CVE-2007-4592
Published: 2008-03-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in the web interface for IBM Rational ClearQuest before 2003.06.16 Patch 2008A, 7.0.0.2_iFix01, and 7.0.1.1_iFix01 allow remote attackers to inject arbitrary web script or HTML via the (1) contextid, (2) username, (3) userNameVal, and (4) schema parameters to the login component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29467; http://securityreason.com/securityalert/3753; http://www.securityfocus.com/archive/1/489861/100/0/threaded
CVE: CVE-2007-6254
Published: 2008-03-20
Description: Stack-based buffer overflow in the SAP Business Objects BusinessObjects RptViewerAX ActiveX control in RptViewerAX.dll in Business Objects 6.5 before CHF74 allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/29437; http://www.kb.cert.org/vuls/id/329673; http://www.kb.cert.org/vuls/id/MIMG-732R7X
CVE: CVE-2008-0164
Published: 2008-03-20
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Plone CMS 3.0.5 and 3.0.6 allow remote attackers to (1) add arbitrary accounts via the join_form page and (2) change the privileges of arbitrary groups via the prefs_groups_overview page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://plone.org/about/security/advisories/cve-2008-0164; http://secunia.com/advisories/29361; http://securityreason.com/securityalert/3754
CVE: CVE-2008-0707
Published: 2008-03-20
Description: HP StorageWorks Library and Tape Tools (LTT) before 4.5 SR1 on HP-UX B.11.11 and B.11.23 allows local users to gain privileges via unspecified vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/29442; http://securitytracker.com/id?1019651; http://www.securityfocus.com/bid/28314
CVE: CVE-2008-0889
Published: 2008-03-20
Description: Red Hat Directory Server 8.0, when running on Red Hat Enterprise Linux, uses insecure permissions for the redhat-idm-console script, which allows local users to execute arbitrary code by modifying the script.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://secunia.com/advisories/29482; http://www.redhat.com/support/errata/RHSA-2008-0191.html; http://www.securityfocus.com/bid/28327
CVE: CVE-2008-1332
Published: 2008-03-20
Description: Unspecified vulnerability in Asterisk Open Source 1.2.x before 1.2.27, 1.4.x before 1.4.18.1 and 1.4.19-rc3; Business Edition A.x.x, B.x.x before B.2.5.1, and C.x.x before C.1.6.2; AsteriskNOW 1.0.x before 1.0.2; Appliance Developer Kit before 1.4 revision 109393; and s800i 1.0.x before 1.1.0.2; allows remote attackers to access the SIP channel driver via a crafted From header.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: http://downloads.digium.com/pub/security/AST-2008-003.html; http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00011.html; http://secunia.com/advisories/29426
CVE: CVE-2008-1333
Published: 2008-03-20
Description: Format string vulnerability in Asterisk Open Source 1.6.x before 1.6.0-beta6 might allow remote attackers to execute arbitrary code via logging messages that are not properly handled by (1) the ast_verbose logging API call, or (2) the astman_append function.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-134
References: http://downloads.digium.com/pub/security/AST-2008-004.html; http://secunia.com/advisories/29426; http://secunia.com/advisories/29456