deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-6118
Published: 2009-02-11
Description: win/content/upload.php in Goople CMS 1.7 allows remote attackers to bypass authentication and gain administrative access by setting the loggedin cookie to 1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/32819; http://www.securityfocus.com/bid/32437; http://www.vupen.com/english/advisories/2008/3235
CVE: CVE-2008-6119
Published: 2009-02-11
Description: Static code injection vulnerability in gooplecms/admin/account/action/editpass.php in Goople CMS 1.7 allows remote attackers to inject arbitrary PHP code into admin/userandpass.php via the (1) username and (2) password parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/32819; http://www.securityfocus.com/bid/33848; https://exchange.xforce.ibmcloud.com/vulnerabilities/46800
CVE: CVE-2008-6120
Published: 2009-02-11
Description: SQL injection vulnerability in profile_comments.php in SocialEngine (SE) 2.7 and earlier allows remote attackers to execute arbitrary SQL commands via the comment_secure parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8665&w=2; http://www.securityfocus.com/bid/32382; https://exchange.xforce.ibmcloud.com/vulnerabilities/46770
CVE: CVE-2008-6121
Published: 2009-02-11
Description: CRLF injection vulnerability in SocialEngine (SE) 2.7 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the PHPSESSID cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8665&w=2; http://www.securityfocus.com/bid/32382; https://exchange.xforce.ibmcloud.com/vulnerabilities/46771
CVE: CVE-2008-6122
Published: 2009-02-11
Description: The web management interface in Netgear WGR614v9 allows remote attackers to cause a denial of service (crash) via a request that contains a question mark ("?").
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-November/065619.html; http://secunia.com/advisories/32716; http://www.securityfocus.com/bid/32290
CVE: CVE-2009-0036
Published: 2009-02-11
Description: Buffer overflow in the proxyReadClientSocket function in proxy/libvirt_proxy.c in libvirt_proxy 0.5.1 might allow local users to gain privileges by sending a portion of the header of a virProxyPacket packet, and then sending the remainder of the packet with crafted values in the header, related to use of uninitialized memory in a validation check.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-119
References: http://git.et.redhat.com/?p=libvirt.git%3Ba=commitdiff%3Bh=2bb0657e28; http://openwall.com/lists/oss-security/2009/02/10/8; http://secunia.com/advisories/34397
CVE: CVE-2009-0525
Published: 2009-02-11
Description: Cross-site scripting (XSS) vulnerability in the sajax_get_common_js function in php/Sajax.php in Sajax 0.12 allows remote attackers to inject arbitrary web script or HTML via the URL parameter, which is not properly handled when using browsers that do not URL-encode requests, such as Internet Explorer 6.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/33894; http://www.securityfocus.com/bid/33711; http://secunia.com/advisories/33894
CVE: CVE-2009-0526
Published: 2009-02-11
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in AdaptCMS Lite 1.4 allow remote attackers to inject arbitrary web script or HTML via the (1) url and (2) acuparam parameters, and (3) the URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/33866; http://www.securityfocus.com/bid/33698; https://exchange.xforce.ibmcloud.com/vulnerabilities/48611
CVE: CVE-2009-0527
Published: 2009-02-11
Description: PHP remote file inclusion vulnerability in plugins/rss_importer_functions.php in AdaptCMS Lite 1.4 allows remote attackers to execute arbitrary PHP code via a URL in the sitepath parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/33866; http://www.securityfocus.com/bid/33698; https://exchange.xforce.ibmcloud.com/vulnerabilities/48610
CVE: CVE-2009-0528
Published: 2009-02-11
Description: SQL injection vulnerability in frame.php in Rhadrix If-CMS 2.07 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33883; http://www.securityfocus.com/bid/33697; https://www.exploit-db.com/exploits/8007
CVE: CVE-2009-0529
Published: 2009-02-11
Description: Cross-site scripting (XSS) vulnerability in index.php in SnippetMaster Webpage Editor 2.2.2 allows remote attackers to inject arbitrary web script or HTML via the language parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/33865; http://www.securityfocus.com/bid/33705; https://www.exploit-db.com/exploits/8017
CVE: CVE-2009-0530
Published: 2009-02-11
Description: Multiple PHP remote file inclusion vulnerabilities in SnippetMaster 2.2.2, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) _SESSION[SCRIPT_PATH] parameter to includes/vars.inc.php and the (2) g_pcltar_lib_dir parameter to includes/tar_lib/pcltar.lib.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/33865; http://www.securityfocus.com/bid/33705; https://www.exploit-db.com/exploits/8017
CVE: CVE-2009-0531
Published: 2009-02-11
Description: SQL injection vulnerability in gallery/view.asp in A Better Member-Based ASP Photo Gallery before 1.2 allows remote attackers to execute arbitrary SQL commands via the entry parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/33874; http://www.ontarioabandonedplaces.com/ipguardian/gallery/readme.txt; http://www.securityfocus.com/bid/33693
CVE: CVE-2009-0532
Published: 2009-02-11
Description: Cross-site scripting (XSS) vulnerability in password.php in Scripts For Sites (SFS) EZ Baby allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly involving the u2 parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/33989; http://www.securityfocus.com/bid/33635; https://exchange.xforce.ibmcloud.com/vulnerabilities/48547
CVE: CVE-2009-0533
Published: 2009-02-11
Description: Cross-site scripting (XSS) vulnerability in password.php in Scripts for Sites EZ Reminder allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly involving the u2 parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/33989; http://www.securityfocus.com/bid/33641; https://exchange.xforce.ibmcloud.com/vulnerabilities/48548
CVE: CVE-2009-0534
Published: 2009-02-11
Description: SQL injection vulnerability in FlexCMS allows remote attackers to execute arbitrary SQL commands via the catId parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/33696; https://exchange.xforce.ibmcloud.com/vulnerabilities/48609; https://www.exploit-db.com/exploits/8018
CVE: CVE-2009-0535
Published: 2009-02-11
Description: Directory traversal vulnerability in export.php in Thyme 1.3 and earlier, when register_globals is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the export_to parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.exploit-db.com/exploits/8029; https://www.exploit-db.com/exploits/8029
CVE: CVE-2009-0536
Published: 2009-02-11
Description: at in bos.rte.cron on IBM AIX 5.2.0, 5.3.0 through 5.3.9, and 6.1.0 through 6.1.2 allows local users to read arbitrary files via unspecified vectors, related to failure to drop root privileges.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://aix.software.ibm.com/aix/efixes/security/at_advisory.asc; http://osvdb.org/51952; http://secunia.com/advisories/33915
CVE: CVE-2008-6123
Published: 2009-02-12
Description: The netsnmp_udp_fmtaddr function (snmplib/snmpUDPDomain.c) in net-snmp 5.0.9 through 5.4.2.1, when using TCP wrappers for client authorization, does not properly parse hosts.allow rules, which allows remote attackers to bypass intended access restrictions and execute SNMP queries, related to "source/destination IP address confusion."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-863
References: http://bugs.gentoo.org/show_bug.cgi?id=250429; http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html
CVE: CVE-2009-0542
Published: 2009-02-12
Description: SQL injection vulnerability in ProFTPD Server 1.3.1 through 1.3.2rc2 allows remote attackers to execute arbitrary SQL commands via a "%" (percent) character in the username, which introduces a "'" (single quote) character during variable substitution by mod_sql.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://bugs.proftpd.org/show_bug.cgi?id=3180; http://secunia.com/advisories/34268; http://security.gentoo.org/glsa/glsa-200903-27.xml
CVE: CVE-2009-0543
Published: 2009-02-12
Description: ProFTPD Server 1.3.1, with NLS support enabled, allows remote attackers to bypass SQL injection protection mechanisms via invalid, encoded multibyte characters, which are not properly handled in (1) mod_sql_mysql and (2) mod_sql_postgres.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://bugs.proftpd.org/show_bug.cgi?id=3173; http://secunia.com/advisories/34268; http://security.gentoo.org/glsa/glsa-200903-27.xml
CVE: CVE-2009-0544
Published: 2009-02-12
Description: Buffer overflow in the PyCrypto ARC2 module 2.0.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large ARC2 key length.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://gitweb2.dlitz.net/?p=crypto/pycrypto-2.x.git%3Ba=commitdiff%3Bh=d1c4875e1f220652fe7ff8358f56dee3b2aba31b; http://gitweb2.dlitz.net/?p=crypto/pycrypto-2.x.git%3Ba=commitdiff%3Bh=fd73731dfad451a81056fbb01e09aa78ab82eb5d; http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html
CVE: CVE-2009-0142
Published: 2009-02-12
Description: Race condition in AFP Server in Apple Mac OS X 10.5.6 allows local users to cause a denial of service (infinite loop) via unspecified vectors related to "file enumeration logic."
CVSS Score: 1.9 (LOW)
CWE: CWE-362
References: http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html; http://secunia.com/advisories/33937; http://support.apple.com/kb/HT3438
CVE: CVE-2009-0545
Published: 2009-02-12
Description: cgi-bin/kerbynet in ZeroShell 1.0beta11 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the type parameter in a NoAuthREQ x509List action.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://www.ikkisoft.com/stuff/LC-2009-01.txt; http://www.securityfocus.com/archive/1/500763/100/0/threaded; http://www.vupen.com/english/advisories/2009/0385
CVE: CVE-2009-0546
Published: 2009-02-12
Description: Stack-based buffer overflow in NewsGator FeedDemon 2.7 and earlier allows user-assisted remote attackers to execute arbitrary code via a long text attribute in an outline element in a .opml file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/51753; http://secunia.com/advisories/33718; http://security.bkis.vn/?p=329
CVE: CVE-2009-0547
Published: 2009-02-12
Description: Evolution 2.22.3.1 checks S/MIME signatures against a copy of the e-mail text within a signed-data blob, not the copy of the e-mail text displayed to the user, which allows remote attackers to spoof a signature by modifying the latter copy, a different vulnerability than CVE-2008-5077.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508479; http://bugzilla.gnome.org/show_bug.cgi?id=564465; http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html
CVE: CVE-2009-0548
Published: 2009-02-12
Description: Cross-site scripting (XSS) vulnerability in the Additional Report Settings interface in ESET Remote Administrator before 3.0.105 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/51804; http://secunia.com/advisories/33805; http://www.eset.eu/support/changelog-eset-remote-administrator-3
CVE: CVE-2009-0009
Published: 2009-02-13
Description: Unspecified vulnerability in the Pixlet codec in Apple Mac OS X 10.4.11 and 10.5.6 allows remote attackers to cause a denial of service (application termination) and possibly execute arbitrary code via a crafted movie file that triggers memory corruption.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html; http://osvdb.org/51980; http://secunia.com/advisories/33937
CVE: CVE-2009-0011
Published: 2009-02-13
Description: Certificate Assistant in Apple Mac OS X 10.5.6 allows local users to overwrite arbitrary files via unknown vectors related to an "insecure file operation" on a temporary file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html; http://osvdb.org/51979; http://secunia.com/advisories/33937
CVE: CVE-2009-0012
Published: 2009-02-13
Description: Heap-based buffer overflow in CoreText in Apple Mac OS X 10.5.6 allows remote attackers to execute arbitrary code via a crafted Unicode string.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html; http://osvdb.org/51977; http://secunia.com/advisories/33937
CVE: CVE-2009-0013
Published: 2009-02-13
Description: dscl in DS Tools in Apple Mac OS X 10.4.11 and 10.5.6 requires that passwords must be provided as command line arguments, which allows local users to gain privileges by listing process information.
CVSS Score: 2.1 (LOW)
CWE: CWE-255
References: http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html; http://secunia.com/advisories/33937; http://securitytracker.com/alerts/2009/Feb/1021722.html
CVE: CVE-2009-0014
Published: 2009-02-13
Description: Folder Manager in Apple Mac OS X 10.5.6 uses insecure default permissions when recreating a Downloads folder after it has been deleted, which allows local users to bypass intended access restrictions and read the Downloads folder.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html; http://secunia.com/advisories/33937; http://support.apple.com/kb/HT3438
CVE: CVE-2009-0015
Published: 2009-02-13
Description: Unspecified vulnerability in fseventsd in the FSEvents framework in Apple Mac OS X 10.5.6 allows local users to obtain sensitive information (filesystem activities and directory names) via unknown vectors related to "credential management."
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-255
References: http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html; http://secunia.com/advisories/33937; http://support.apple.com/kb/HT3438
CVE: CVE-2009-0017
Published: 2009-02-13
Description: csregprinter in the Printing component in Apple Mac OS X 10.4.11 and 10.5.6 does not properly handle error conditions, which allows local users to execute arbitrary code via unknown vectors that trigger a heap-based buffer overflow.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html; http://secunia.com/advisories/33937; http://support.apple.com/kb/HT3438
CVE: CVE-2009-0018
Published: 2009-02-13
Description: The Remote Apple Events server in Apple Mac OS X 10.4.11 and 10.5.6 does not properly initialize a buffer, which allows remote attackers to read portions of memory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html; http://secunia.com/advisories/33937; http://support.apple.com/kb/HT3438
CVE: CVE-2009-0019
Published: 2009-02-13
Description: Remote Apple Events in Apple Mac OS X 10.4.11 and 10.5.6 allows remote attackers to cause a denial of service (application termination) or obtain sensitive information via unspecified vectors that trigger an out-of-bounds memory access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html; http://support.apple.com/kb/HT3438; http://www.securityfocus.com/bid/33759
CVE: CVE-2009-0020
Published: 2009-02-13
Description: Unspecified vulnerability in CarbonCore in Apple Mac OS X 10.4.11 and 10.5.6 allows remote attackers to cause a denial of service (application termination) and execute arbitrary code via a crafted resource fork that triggers memory corruption.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html; http://secunia.com/advisories/33937; http://support.apple.com/kb/HT3438
CVE: CVE-2009-0137
Published: 2009-02-13
Description: Multiple unspecified vulnerabilities in Safari RSS in Apple Mac OS X 10.4.11 and 10.5.6, and Windows XP and Vista, allow remote attackers to execute arbitrary JavaScript in the local security zone via a crafted feed: URL, related to "input validation issues."
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html; http://lists.apple.com/archives/security-announce/2009/Feb/msg00001.html; http://support.apple.com/kb/HT3438
CVE: CVE-2009-0138
Published: 2009-02-13
Description: servermgrd (Server Manager) in Apple Mac OS X 10.5.6 does not properly validate authentication credentials, which allows remote attackers to modify the system configuration.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html; http://secunia.com/advisories/33937; http://support.apple.com/kb/HT3438
CVE: CVE-2009-0139
Published: 2009-02-13
Description: Integer overflow in the SMB component in Apple Mac OS X 10.5.6 allows remote SMB servers to cause a denial of service (system shutdown) or execute arbitrary code via a crafted SMB file system that triggers a heap-based buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html; http://secunia.com/advisories/33937; http://support.apple.com/kb/HT3438
CVE: CVE-2009-0140
Published: 2009-02-13
Description: Unspecified vulnerability in the SMB component in Apple Mac OS X 10.4.11 and 10.5.6 allows remote SMB servers to cause a denial of service (memory exhaustion and system shutdown) via a crafted file system name.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html; http://secunia.com/advisories/33937; http://support.apple.com/kb/HT3438
CVE: CVE-2009-0141
Published: 2009-02-13
Description: XTerm in Apple Mac OS X 10.4.11 and 10.5.6, when used with luit, creates tty devices with insecure world-writable permissions, which allows local users to write to the Xterm of another user.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-732
References: http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html; http://secunia.com/advisories/33937; http://securitytracker.com/alerts/2009/Feb/1021729.html
CVE: CVE-2008-6124
Published: 2009-02-13
Description: SQL injection vulnerability in the hotpot_delete_selected_attempts function in report.php in the HotPot module in Moodle 1.6 before 1.6.7, 1.7 before 1.7.5, 1.8 before 1.8.6, and 1.9 before 1.9.2 allows remote attackers to execute arbitrary SQL commands via a crafted selected attempt.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://cvs.moodle.org/moodle/mod/hotpot/report.php?r1=1.8.6.1&r2=1.8.6.2; http://moodle.org/mod/forum/discuss.php?d=101402; http://www.debian.org/security/2008/dsa-1691
CVE: CVE-2008-6125
Published: 2009-02-13
Description: Unspecified vulnerability in the user editing interface in Moodle 1.5.x, 1.6 before 1.6.6, and 1.7 before 1.7.3 allows remote authenticated users to gain privileges via unknown vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://moodle.org/mod/forum/discuss.php?d=87971; http://www.debian.org/security/2008/dsa-1691; http://moodle.org/mod/forum/discuss.php?d=87971
CVE: CVE-2009-0362
Published: 2009-02-13
Description: filter.d/wuftpd.conf in Fail2ban 0.8.3 uses an incorrect regular expression that allows remote attackers to cause a denial of service (forced authentication failures) via a crafted reverse-resolved DNS name (rhost) entry that contains a substring that is interpreted as an IP address, a different vulnerability than CVE-2007-4321.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-287
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=514163; http://secunia.com/advisories/33890; http://www.securityfocus.com/bid/33734
CVE: CVE-2009-0569
Published: 2009-02-13
Description: Buffer overflow in Becky! Internet Mail 2.48.02 and earlier allows remote attackers to execute arbitrary code via a mail message with a crafted return receipt request.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://jvn.jp/en/jp/JVN29641290/index.html; http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000011.html; http://secunia.com/advisories/33892
CVE: CVE-2009-0216
Published: 2009-02-13
Description: GE Fanuc iFIX 5.0 and earlier relies on client-side authentication involving a weakly encrypted local password file, which allows remote attackers to bypass intended access restrictions and start privileged server login sessions by recovering a password or by using a modified program module.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://support.gefanuc.com/support/index?page=kbchannel&id=S:KB13253&actp=search; http://www.kb.cert.org/vuls/id/310355; http://www.mcgrewsecurity.com/2009/02/10/ge-fanuc-releases-info-on-ifix-vulnerabilities-vu-310355/
CVE: CVE-2009-0360
Published: 2009-02-13
Description: Russ Allbery pam-krb5 before 3.13, when linked against MIT Kerberos, does not properly initialize the Kerberos libraries for setuid use, which allows local users to gain privileges by pointing an environment variable to a modified Kerberos configuration file, and then launching a PAM-based setuid application.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/33914; http://secunia.com/advisories/33917; http://secunia.com/advisories/34260
CVE: CVE-2009-0361
Published: 2009-02-13
Description: Russ Allbery pam-krb5 before 3.13, as used by libpam-heimdal, su in Solaris 10, and other software, does not properly handle calls to pam_setcred when running setuid, which allows local users to overwrite and change the ownership of arbitrary files by setting the KRB5CCNAME environment variable, and then launching a setuid application that performs certain pam_setcred operations.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/33914; http://secunia.com/advisories/33917; http://secunia.com/advisories/33918
CVE: CVE-2009-0503
Published: 2009-02-13
Description: IBM WebSphere Message Broker 6.1.x before 6.1.0.2 writes a database connection password to the Event Log and System Log during exception handling for a JDBC error, which allows local users to obtain sensitive information by reading these logs.
CVSS Score: 2.1 (LOW)
CWE: CWE-255
References: http://www-01.ibm.com/support/docview.wss?rs=849&uid=swg27011431; http://www-1.ibm.com/support/docview.wss?uid=swg1IC55298; http://www.securityfocus.com/bid/33819