deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-4281
Published: 2008-11-10
Description: Directory traversal vulnerability in VMWare ESXi 3.5 before ESXe[PII_REDACTED]01-O-UG and ESX 3.5 before ESX[PII_REDACTED]01-UG allows administrators with the Datastore.FileManagement privilege to gain privileges via unknown vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-22
References: http://lists.vmware.com/pipermail/security-announce/2008/000042.html; http://secunia.com/advisories/32624; http://www.securityfocus.com/archive/1/498138/100/0/threaded
CVE: CVE-2008-4818
Published: 2008-11-10
Description: Cross-site scripting (XSS) vulnerability in Adobe Flash Player 9.0.124.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving HTTP response headers.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.apple.com/archives/security-announce//2008//Dec/msg00000.html; http://secunia.com/advisories/32702; http://secunia.com/advisories/33179
CVE: CVE-2008-4819
Published: 2008-11-10
Description: Unspecified vulnerability in Adobe Flash Player 9.0.124.0 and earlier makes it easier for remote attackers to conduct DNS rebinding attacks via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.apple.com/archives/security-announce//2008//Dec/msg00000.html; http://secunia.com/advisories/32702; http://secunia.com/advisories/33179
CVE: CVE-2008-4820
Published: 2008-11-10
Description: Unspecified vulnerability in the Flash Player ActiveX control in Adobe Flash Player 9.0.124.0 and earlier on Windows allows attackers to obtain sensitive information via unknown vectors.
CVSS Score: 7.1 (HIGH)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce//2008//Dec/msg00000.html; http://secunia.com/advisories/33179; http://secunia.com/advisories/33390
CVE: CVE-2008-4821
Published: 2008-11-10
Description: Adobe Flash Player 9.0.124.0 and earlier, when a Mozilla browser is used, does not properly interpret jar: URLs, which allows attackers to obtain sensitive information via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce//2008//Dec/msg00000.html; http://secunia.com/advisories/32702; http://secunia.com/advisories/33179
CVE: CVE-2008-4822
Published: 2008-11-10
Description: Adobe Flash Player 9.0.124.0 and earlier does not properly interpret policy files, which allows remote attackers to bypass a non-root domain policy.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce//2008//Dec/msg00000.html; http://secunia.com/advisories/32702; http://secunia.com/advisories/33179
CVE: CVE-2008-4823
Published: 2008-11-10
Description: Cross-site scripting (XSS) vulnerability in Adobe Flash Player 9.0.124.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors related to loose interpretation of an ActionScript attribute.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.apple.com/archives/security-announce//2008//Dec/msg00000.html; http://secunia.com/advisories/32702; http://secunia.com/advisories/33179
CVE: CVE-2008-4831
Published: 2008-11-10
Description: Unspecified vulnerability in Adobe ColdFusion 8 and 8.0.1 and ColdFusion MX 7.0.2 allows local users to bypass sandbox restrictions, and obtain sensitive information or possibly gain privileges, via unknown vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://osvdb.org/49709; http://secunia.com/advisories/32567; http://www.adobe.com/support/security/bulletins/apsb08-21.html
CVE: CVE-2008-4915
Published: 2008-11-10
Description: The CPU hardware emulation in VMware Workstation 6.0.5 and earlier and 5.5.8 and earlier; Player 2.0.x through 2.0.5 and 1.0.x through 1.0.8; ACE 2.0.x through 2.0.5 and earlier, and 1.0.x through 1.0.7; Server 1.0.x through 1.0.7; ESX 2.5.4 through 3.5; and ESXi 3.5, when running 32-bit and 64-bit guest operating systems, does not properly handle the Trap flag, which allows authenticated guest OS users to gain privileges on the guest OS.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://lists.vmware.com/pipermail/security-announce/2008/000042.html; http://secunia.com/advisories/32612; http://secunia.com/advisories/32624
CVE: CVE-2008-5000
Published: 2008-11-10
Description: SQL injection vulnerability in admin/includes/news.inc.php in PHPX 3.5.16, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via uppercase characters in the news_id parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/32564; http://securityreason.com/securityalert/4572; https://exchange.xforce.ibmcloud.com/vulnerabilities/46548
CVE: CVE-2008-5001
Published: 2008-11-10
Description: Multiple stack-based buffer overflows in multiple functions in vncviewer/FileTransfer.cpp in vncviewer for UltraVNC 1.0.2 and 1.0.4 before 01252008, when in LISTENING mode or when using the DSM plugin, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified parameters, a different issue than CVE-2008-0610.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://forum.ultravnc.info/viewtopic.php?p=45150#45150; http://secunia.com/advisories/28804; http://sourceforge.net/project/shownotes.php?release_id=571174&group_id=63887
CVE: CVE-2008-5002
Published: 2008-11-10
Description: Insecure method vulnerability in the ChilkatCrypt2.ChilkatCrypt2.1 ActiveX control (ChilkatCrypt2.dll 4.3.2.1) in Chilkat Crypt ActiveX Component allows remote attackers to create and overwrite arbitrary files via the WriteFile method.  NOTE: this could be leveraged for code execution by creating executable files in Startup folders or by accessing files using hcp:// URLs.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/32513; http://securityreason.com/securityalert/4571; http://www.securityfocus.com/bid/32073
CVE: CVE-2008-5003
Published: 2008-11-10
Description: SQL injection vulnerability in ndetail.php in Shahrood allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4569; http://www.vupen.com/english/advisories/2008/2996; https://exchange.xforce.ibmcloud.com/vulnerabilities/46295
CVE: CVE-2008-5004
Published: 2008-11-10
Description: SQL injection vulnerability in genscode.php in myWebland Bloggie Lite 0.0.2 beta allows remote attackers to execute arbitrary SQL commands via a crafted cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/32040; https://exchange.xforce.ibmcloud.com/vulnerabilities/46299; https://www.exploit-db.com/exploits/6925
CVE: CVE-2008-5005
Published: 2008-11-10
Description: Multiple stack-based buffer overflows in (1) University of Washington IMAP Toolkit 2002 through 2007c, (2) University of Washington Alpine 2.00 and earlier, and (3) Panda IMAP allow (a) local users to gain privileges by specifying a long folder extension argument on the command line to the tmail or dmail program; and (b) remote attackers to execute arbitrary code by sending e-mail to a destination mailbox name composed of a username and '+' character followed by a long string, processed by the tmail or possibly dmail program.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://mailman2.u.washington.edu/pipermail/imap-uw/2008-October/002267.html; http://mailman2.u.washington.edu/pipermail/imap-uw/2008-October/002268.html; http://marc.info/?l=full-disclosure&m=[PII_REDACTED]2610&w=4
CVE: CVE-2008-5006
Published: 2008-11-10
Description: smtp.c in the c-client library in University of Washington IMAP Toolkit 2007b allows remote SMTP servers to cause a denial of service (NULL pointer dereference and application crash) by responding to the QUIT command with a close of the TCP connection instead of the expected 221 response code.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/33142; http://www.debian.org/security/2008/dsa-1685; http://www.mandriva.com/security/advisories?name=MDVSA-2009:146
CVE: CVE-2008-5007
Published: 2008-11-10
Description: create_lazarus_export_tgz.sh in lazarus 0.9.24 allows local users to overwrite or delete arbitrary files via a symlink attack on a (1) /tmp/lazarus.tgz temporary file or a (2) /tmp/lazarus temporary directory.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://bugs.debian.org/496377; http://code.google.com/p/bollin/source/browse/lazarus/trunk/debian/patches/07_sh_using_tmp.dpatch?spec=svn3462&r=3462; http://dev.gentoo.org/~rbu/security/debiantemp/lazarus-src
CVE: CVE-2008-5008
Published: 2008-11-10
Description: Buffer overflow in src/src_sinc.c in Secret Rabbit Code (aka SRC or libsamplerate) before 0.1.4, when "extreme low conversion ratios" are used, allows user-assisted attackers to have an unknown impact via a crafted audio file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://security.gentoo.org/glsa/glsa-200812-05.xml; http://www.mandriva.com/security/advisories?name=MDVSA-2008:238; http://www.mega-nerd.com/SRC/ChangeLog
CVE: CVE-2008-5009
Published: 2008-11-10
Description: Race condition in the s_xout kernel module in Sun Solstice X.25 9.2, when running on a multiple CPU machine, allows local users to cause a denial of service (panic) via vectors involving reading the /dev/xty file.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-362
References: http://secunia.com/advisories/32667; http://securitytracker.com/id?1021156; http://sunsolve.sun.com/search/document.do?assetkey=1-21-108669-21-1
CVE: CVE-2008-5010
Published: 2008-11-10
Description: in.dhcpd in the DHCP implementation in Sun Solaris 8 through 10, and OpenSolaris before snv_103, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via unknown DHCP requests related to the "number of offers," aka Bug ID 6713805.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/32668; http://securitytracker.com/id?1021157; http://sunsolve.sun.com/search/document.do?assetkey=1-21-109077-21-1
CVE: CVE-2008-5011
Published: 2008-11-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in IBM Lotus Quickr 8.1 before 8.1.0.2 services for Lotus Domino allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to qpconfig_sample.xml, aka SPR CWIR7KMPVP and THES7F9NVR, a different vulnerability than CVE-2008-2163 and CVE-2008-3860.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/49777; http://osvdb.org/49778; http://secunia.com/advisories/32574
CVE: CVE-2008-5026
Published: 2008-11-10
Description: Microsoft SharePoint uses URLs with the same hostname and port number for a web site's primary files and individual users' uploaded files (aka attachments), which allows remote authenticated users to leverage same-origin relationships and conduct cross-site scripting (XSS) attacks by uploading HTML documents.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2008-11/0055.html; http://archives.neohapsis.com/archives/bugtraq/2008-11/0056.html; http://archives.neohapsis.com/archives/bugtraq/2008-11/0058.html
CVE: CVE-2008-5027
Published: 2008-11-10
Description: The Nagios process in (1) Nagios before 3.0.5 and (2) op5 Monitor before 4.0.1 allows remote authenticated users to bypass authorization checks, and trigger execution of arbitrary programs by this process, via an (a) custom form or a (b) browser addon.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8637&w=2; http://secunia.com/advisories/33320; http://secunia.com/advisories/35002
CVE: CVE-2008-5028
Published: 2008-11-10
Description: Cross-site request forgery (CSRF) vulnerability in cmd.cgi in (1) Nagios 3.0.5 and (2) op5 Monitor before 4.0.1 allows remote attackers to send commands to the Nagios process, and trigger execution of arbitrary programs by this process, via unspecified HTTP requests.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://git.op5.org/git/?p=nagios.git%3Ba=commit%3Bh=814d8d4d1a73f7151eeed187c0667585d79fea18; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8637&w=2; http://osvdb.org/49678
CVE: CVE-2008-4387
Published: 2008-11-10
Description: Unspecified vulnerability in the Simba MDrmSap ActiveX control in mdrmsap.dll in SAP SAPgui allows remote attackers to execute arbitrary code via unknown vectors involving instantiation by Internet Explorer.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://osvdb.org/49721; http://www.kb.cert.org/vuls/id/277313; http://www.securityfocus.com/bid/32186
CVE: CVE-2008-5029
Published: 2008-11-10
Description: The __scm_destroy function in net/core/scm.c in the Linux kernel 2.6.27.4, 2.6.26, and earlier makes indirect recursive calls to itself through calls to the fput function, which allows local users to cause a denial of service (panic) via vectors related to sending an SCM_RIGHTS message through a UNIX domain socket and closing file descriptors.
CVSS Score: 4.9 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2009-01/0006.html; http://darkircop.org/unix.c; http://kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.36.9
CVE: CVE-2008-5030
Published: 2008-11-10
Description: Heap-based buffer overflow in the cddb_read_disc_data function in cddb.c in libcdaudio 0.99.12p2 allows remote CDDB servers to execute arbitrary code via long CDDB data.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00000.html; http://secunia.com/advisories/32678; http://secunia.com/advisories/34353
CVE: CVE-2008-5031
Published: 2008-11-10
Description: Multiple integer overflows in Python 2.2.3 through 2.5.1, and 2.6, allow context-dependent attackers to have an unknown impact via a large integer value in the tabsize argument to the expandtabs method, as implemented by (1) the string_expandtabs function in Objects/stringobject.c and (2) the unicode_expandtabs function in Objects/unicodeobject.c.  NOTE: this vulnerability reportedly exists because of an incomplete fix for CVE-2008-2315.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html; http://scary.beasts.org/security/CESA-2008-008.html; http://secunia.com/advisories/33937
CVE: CVE-2008-5032
Published: 2008-11-10
Description: Stack-based buffer overflow in VideoLAN VLC media player 0.5.0 through 0.9.5 might allow user-assisted attackers to execute arbitrary code via the header of an invalid CUE image file, related to modules/access/vcd/cdrom.c.  NOTE: this identifier originally included an issue related to RealText, but that issue has been assigned a separate identifier, CVE-2008-5036.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://git.videolan.org/?p=vlc.git%3Ba=commitdiff%3Bh=5f63f1562d43f32331006c2c1a61742de031b84d; http://secunia.com/advisories/32569; http://secunia.com/advisories/33315
CVE: CVE-2008-5033
Published: 2008-11-10
Description: The chip_command function in drivers/media/video/tvaudio.c in the Linux kernel 2.6.25.x before 2.6.25.19, 2.6.26.x before 2.6.26.7, and 2.6.27.x before 2.6.27.3 allows attackers to cause a denial of service (NULL function pointer dereference and OOPS) via unknown vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=5ba2f67afb02c5302b2898949ed6fc3b3d37dcf1; http://secunia.com/advisories/32918; http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.25.19
CVE: CVE-2008-5034
Published: 2008-11-10
Description: master-filter in printfilters-ppd 2.13 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/filter.debug temporary file.  NOTE: the vendor disputes this vulnerability, stating 'this package does not have " possibility of attack with the help of symlinks"'
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://bugs.debian.org/496417; http://dev.gentoo.org/~rbu/security/debiantemp/printfilters-ppd; http://www.openwall.com/lists/oss-security/2008/10/30/2
CVE: CVE-2008-5035
Published: 2008-11-10
Description: The Resource Monitoring and Control (RMC) daemon in IBM Hardware Management Console (HMC) 7 release 3.2.0 SP1 and 3.3.0 SP2 allows remote attackers to cause a denial of service (daemon crash or hang) via a packet with an invalid length.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/32571; http://www-1.ibm.com/support/docview.wss?uid=isg1MB02482; http://www-1.ibm.com/support/docview.wss?uid=isg1MB02485
CVE: CVE-2008-5036
Published: 2008-11-10
Description: Stack-based buffer overflow in VideoLAN VLC media player 0.9.x before 0.9.6 might allow user-assisted attackers to execute arbitrary code via an an invalid RealText (rt) subtitle file, related to the ParseRealText function in modules/demux/subtitle.c.  NOTE: this issue was SPLIT from CVE-2008-5032 on 20081110.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://git.videolan.org/?p=vlc.git%3Ba=commitdiff%3Bh=e3cef651125701a2e33a8d75b815b3e39681a447; http://secunia.com/advisories/32569; http://secunia.com/advisories/33315
CVE: CVE-2008-5037
Published: 2008-11-12
Description: SQL injection vulnerability in view.php in ElkaGroup Image Gallery 1.0 allows remote attackers to execute arbitrary SQL commands via the cid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstorm.linuxsecurity.com/0810-exploits/elkagroup-sql.txt; http://secunia.com/advisories/25844; http://www.securityfocus.com/bid/31966
CVE: CVE-2008-5038
Published: 2008-11-12
Description: Use-after-free vulnerability in the NetWare Core Protocol (NCP) feature in Novell eDirectory 8.7.3 SP10 before 8.7.3 SP10 FTF1 and 8.8 SP2 for Windows allows remote attackers to cause a denial of service and possibly execute arbitrary code via a sequence of "Get NCP Extension Information By Name" requests that cause one thread to operate on memory after it has been freed in another thread, which triggers memory corruption, aka Novell Bug 373852.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=748; http://osvdb.org/48206; http://secunia.com/advisories/32395
CVE: CVE-2008-5039
Published: 2008-11-12
Description: Cross-site scripting (XSS) vulnerability in the League module for PHP-Nuke, possibly 2.4, allows remote attackers to inject arbitrary web script or HTML via the tid parameter in a team action to modules.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/4575; http://www.securityfocus.com/archive/1/497855/100/0/threaded; http://www.securityfocus.com/bid/31952
CVE: CVE-2008-5040
Published: 2008-11-12
Description: Graphiks MyForum 1.3 allows remote attackers to bypass authentication and gain administrative access by setting the (1) myforum_login and (2) myforum_pass cookies to 1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://securityreason.com/securityalert/4577; http://www.securityfocus.com/bid/31955; https://exchange.xforce.ibmcloud.com/vulnerabilities/46157
CVE: CVE-2008-5041
Published: 2008-11-12
Description: Sweex RO002 Router with firmware Ts03-072 has "rdc123" as its default password for the "rdc123" account, which makes it easier for remote attackers to obtain access.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://osvdb.org/49865; http://secunia.com/advisories/32623; http://www.securityfocus.com/bid/32249
CVE: CVE-2008-5042
Published: 2008-11-12
Description: Zeeways PhotoVideoTube 1.1 and earlier allows remote attackers to bypass authentication and perform administrative tasks via a direct request to admin/home.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/32601; http://securityreason.com/securityalert/4574; http://www.securityfocus.com/bid/32223
CVE: CVE-2008-4029
Published: 2008-11-12
Description: Cross-domain vulnerability in Microsoft XML Core Services 3.0 and 4.0, as used in Internet Explorer, allows remote attackers to obtain sensitive information from another domain via a crafted XML document, related to improper error checks for external DTDs, aka "MSXML DTD Cross-Domain Scripting Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1213&w=2; http://securitytracker.com/id?1021164; http://www.securityfocus.com/bid/32155
CVE: CVE-2008-4033
Published: 2008-11-12
Description: Cross-domain vulnerability in Microsoft XML Core Services 3.0 through 6.0, as used in Microsoft Expression Web, Office, Internet Explorer, and other products, allows remote attackers to obtain sensitive information from another domain and corrupt the session state via HTTP request header fields, as demonstrated by the Transfer-Encoding field, aka "MSXML Header Request Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1213&w=2; http://securitytracker.com/id?1021164; http://www.securityfocus.com/bid/32204
CVE: CVE-2008-4037
Published: 2008-11-12
Description: Microsoft Windows 2000 Gold through SP4, XP Gold through SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote SMB servers to execute arbitrary code on a client machine by replaying the NTLM credentials of a client user, as demonstrated by backrush, aka "SMB Credential Reflection Vulnerability."  NOTE: some reliable sources report that this vulnerability exists because of an insufficient fix for CVE-2000-0834.
CVSS Score: 9.3 (HIGH)
CWE: CWE-287
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]1213&w=2; http://osvdb.org/49736; http://secunia.com/advisories/32633
CVE: CVE-2008-5043
Published: 2008-11-12
Description: Multiple cross-site scripting (XSS) vulnerabilities in the web-based interface in IBM Metrica Service Assurance Framework allow remote authenticated users to inject arbitrary web script or HTML via (1) the elementid parameter in a generatedreportresults action to the ReportTree program, (2) the jnlpname parameter to the Launch program, or (3) the :tasklabel parameter to the ReportRequest program, related to the name of a report.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://lists.grok.org.uk/pipermail/full-disclosure/2008-November/065520.html; http://secunia.com/advisories/32683; http://securityreason.com/securityalert/4578
CVE: CVE-2008-5044
Published: 2008-11-12
Description: Race condition in Microsoft Windows Server 2003 and Vista allows local users to cause a denial of service (crash or hang) via a multi-threaded application that makes many calls to UnhookWindowsHookEx while certain other desktop activity is occurring.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-362
References: http://killprog.com/whk.zip; http://securityreason.com/securityalert/4576; http://www.securityfocus.com/archive/1/498165/100/0/threaded
CVE: CVE-2008-4989
Published: 2008-11-13
Description: The _gnutls_x509_verify_certificate function in lib/x509/verify.c in libgnutls in GnuTLS before 2.6.1 trusts certificate chains in which the last certificate is an arbitrary trusted, self-signed certificate, which allows man-in-the-middle attackers to insert a spoofed certificate for any Distinguished Name (DN).
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3215; http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3217; http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.html
CVE: CVE-2008-5045
Published: 2008-11-13
Description: Heap-based buffer overflow in Network-Client FTP Now 2.6, and possibly other versions, allows remote FTP servers to cause a denial of service (crash) via a 200 server response that is exactly 1024 characters long.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://securityreason.com/securityalert/4583; http://www.securityfocus.com/bid/32080; https://exchange.xforce.ibmcloud.com/vulnerabilities/46319