deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-5356
Published: 2008-12-05
Description: Heap-based buffer overflow in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier might allow remote attackers to execute arbitrary code via a crafted TrueType font file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=757; http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.html
CVE: CVE-2008-5357
Published: 2008-12-05
Description: Integer overflow in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; SDK and JRE 1.4.2_18 and earlier; and SDK and JRE 1.3.1_23 and earlier might allow remote attackers to execute arbitrary code via a crafted TrueType font file, which triggers a heap-based buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=760; http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.html
CVE: CVE-2008-5358
Published: 2008-12-05
Description: Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier might allow remote attackers to execute arbitrary code via a crafted GIF file that triggers memory corruption during display of the splash screen, possibly related to splashscreen.dll.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=758; http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00004.html
CVE: CVE-2008-5359
Published: 2008-12-05
Description: Buffer overflow in Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; SDK and JRE 1.4.2_18 and earlier; and SDK and JRE 1.3.1_23 and earlier might allow remote attackers to execute arbitrary code, related to a ConvolveOp operation in the Java AWT library.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00004.html
CVE: CVE-2008-5360
Published: 2008-12-05
Description: Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; SDK and JRE 1.4.2_18 and earlier; and SDK and JRE 1.3.1_23 and earlier creates temporary files with predictable file names, which allows attackers to write malicious JAR files via unknown vectors.
CVSS Score: 6.4 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00004.html
CVE: CVE-2008-5361
Published: 2008-12-08
Description: The ActionScript 2 virtual machine in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0, and Adobe AIR before 1.5, does not verify a member element's size when performing (1) DefineConstantPool, (2) ActionJump, (3) ActionPush, (4) ActionTry, and unspecified other actions, which allows remote attackers to read sensitive data from process memory via a crafted PDF file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/33390; http://secunia.com/advisories/34226; http://security.gentoo.org/glsa/glsa-200903-23.xml
CVE: CVE-2008-5362
Published: 2008-12-08
Description: The DefineConstantPool action in the ActionScript 2 virtual machine in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0, and Adobe AIR before 1.5, accepts an untrusted input value for a "constant count," which allows remote attackers to read sensitive data from process memory via a crafted PDF file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/33390; http://secunia.com/advisories/34226; http://security.gentoo.org/glsa/glsa-200903-23.xml
CVE: CVE-2008-5363
Published: 2008-12-08
Description: The ActionScript 2 virtual machine in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0, and Adobe AIR before 1.5, does not validate character elements during retrieval from the dictionary data structure, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/33390; http://secunia.com/advisories/34226; http://security.gentoo.org/glsa/glsa-200903-23.xml
CVE: CVE-2008-5364
Published: 2008-12-08
Description: Stack-based buffer overflow in the getPlus ActiveX control in gp.ocx 1.2.2.50 in NOS Microsystems getPlus Download Manager, as used for the Adobe Reader 8.1 installation process and other downloads, allows remote attackers to execute arbitrary code via unspecified vectors, a different issue than CVE-2008-4817.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=754; http://www.adobe.com/support/security/bulletins/apsb08-19.html; http://www.securityfocus.com/bid/32105
CVE: CVE-2008-5365
Published: 2008-12-08
Description: SQL injection vulnerability in VoteHistory.asp in ActiveWebSoftwares ActiveVotes 2.2 allows remote attackers to execute arbitrary SQL commands via the AccountID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/50391; http://secunia.com/advisories/32922; http://www.securityfocus.com/bid/32541
CVE: CVE-2008-5366
Published: 2008-12-08
Description: The postinst script in ppp 2.4.4rel on Debian GNU/Linux allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/probe-finished or (2) /tmp/ppp-errors temporary file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://lists.debian.org/debian-devel/2008/08/msg00283.html; http://www.securityfocus.com/bid/32740; http://lists.debian.org/debian-devel/2008/08/msg00283.html
CVE: CVE-2008-5367
Published: 2008-12-08
Description: ip-up in ppp-udeb 2.4.4rel on Debian GNU/Linux allows local users to overwrite arbitrary files via a symlink attack on the /tmp/resolv.conf.tmp temporary file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://lists.debian.org/debian-devel/2008/08/msg00283.html; http://lists.debian.org/debian-devel/2008/08/msg00283.html
CVE: CVE-2008-5368
Published: 2008-12-08
Description: muttprint in muttprint 0.72d allows local users to overwrite arbitrary files via a symlink attack on the /tmp/muttprint.log temporary file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://lists.debian.org/debian-devel/2008/08/msg00283.html; http://secunia.com/advisories/34439; http://www.gentoo.org/security/en/glsa/glsa-200903-35.xml
CVE: CVE-2008-5369
Published: 2008-12-08
Description: noip2 in noip2 2.1.7 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/noip2 temporary file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://lists.debian.org/debian-devel/2008/08/msg00283.html; http://lists.debian.org/debian-devel/2008/08/msg00283.html
CVE: CVE-2008-5370
Published: 2008-12-08
Description: pvpgn-support-installer in pvpgn 1.8.1 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/pvpgn-support-1.0.tar.gz temporary file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://lists.debian.org/debian-devel/2008/08/msg00283.html; http://lists.debian.org/debian-devel/2008/08/msg00283.html
CVE: CVE-2008-5371
Published: 2008-12-08
Description: screenie in screenie 1.30.0 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/.screenie.##### temporary file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://lists.debian.org/debian-devel/2008/08/msg00283.html; http://www.securityfocus.com/bid/32737; http://lists.debian.org/debian-devel/2008/08/msg00283.html
CVE: CVE-2008-5372
Published: 2008-12-08
Description: sdm-login in sdm-terminal 0.4.0b allows local users to overwrite arbitrary files via a symlink attack on the /tmp/sdm.autologin.once temporary file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://lists.debian.org/debian-devel/2008/08/msg00283.html; http://lists.debian.org/debian-devel/2008/08/msg00283.html
CVE: CVE-2008-5373
Published: 2008-12-08
Description: mtx-changer.Adic-Scalar-24 in bacula-common 2.4.2 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/mtx.##### temporary file, probably a related issue to CVE-2005-2995.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://lists.debian.org/debian-devel/2008/08/msg00347.html; http://uvw.ru/report.sid.txt; http://lists.debian.org/debian-devel/2008/08/msg00347.html
CVE: CVE-2008-5374
Published: 2008-12-08
Description: bash-doc 3.2 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/cb#####.? temporary file, related to the (1) aliasconv.sh, (2) aliasconv.bash, and (3) cshtobash scripts.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://lists.debian.org/debian-devel/2008/08/msg00347.html; http://secunia.com/advisories/43365; http://secunia.com/advisories/51086
CVE: CVE-2008-5375
Published: 2008-12-08
Description: cmus-status-display in cmus 2.2.0 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/cmus-status temporary file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://lists.debian.org/debian-devel/2008/08/msg00347.html; http://secunia.com/advisories/33113; http://uvw.ru/report.sid.txt
CVE: CVE-2008-5376
Published: 2008-12-08
Description: editcomment in crip 3.7 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/*.tag.tmp temporary file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://lists.debian.org/debian-devel/2008/08/msg00347.html; http://uvw.ru/report.sid.txt; http://lists.debian.org/debian-devel/2008/08/msg00347.html
CVE: CVE-2008-5377
Published: 2008-12-08
Description: pstopdf in CUPS 1.3.8 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/pstopdf.log temporary file, a different vulnerability than CVE-2001-1333.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://lists.debian.org/debian-devel/2008/08/msg00347.html; http://uvw.ru/report.sid.txt; https://www.exploit-db.com/exploits/7550
CVE: CVE-2008-5378
Published: 2008-12-08
Description: arb-kill in arb 0.0.20071207.1 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/arb_pids_*_* temporary file.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://lists.debian.org/debian-devel/2008/08/msg00285.html; http://www.securityfocus.com/bid/30895; http://lists.debian.org/debian-devel/2008/08/msg00285.html
CVE: CVE-2008-5379
Published: 2008-12-08
Description: netdisco-mibs-installer 1.0 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/netdisco-mibs-0.6.tar.gz temporary file, related to the (1) netdisco-mibs-install and (2) netdisco-mibs-download scripts.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://lists.debian.org/debian-devel/2008/08/msg00285.html; http://lists.debian.org/debian-devel/2008/08/msg00285.html
CVE: CVE-2008-5380
Published: 2008-12-08
Description: gpsdrive (aka gpsdrive-scripts) 2.09 allows local users to overwrite arbitrary files via a symlink attack on an (a) /tmp/geo#####, a (b) /tmp/geocaching.loc, a (c) /tmp/geo#####.*, or a (d) /tmp/geo.* temporary file, related to the (1) geo-code and (2) geo-nearest scripts, different vectors than CVE-2008-4959.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://lists.debian.org/debian-devel/2008/08/msg00285.html; http://secunia.com/advisories/31694; http://secunia.com/advisories/33825
CVE: CVE-2008-4310
Published: 2008-12-09
Description: httputils.rb in WEBrick in Ruby 1.8.1 and 1.8.5, as used in Red Hat Enterprise Linux 4 and 5, allows remote attackers to cause a denial of service (CPU consumption) via a crafted HTTP request.  NOTE: this issue exists because of an incomplete fix for CVE-2008-3656.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/33013; http://www.openwall.com/lists/oss-security/2008/12/04/2; http://www.redhat.com/support/errata/RHSA-2008-0981.html
CVE: CVE-2008-4390
Published: 2008-12-09
Description: The Cisco Linksys WVC54GC wireless video camera before firmware 1.25 sends cleartext configuration data in response to a Setup Wizard remote-management command, which allows remote attackers to obtain sensitive information such as passwords by sniffing the network.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: http://secunia.com/advisories/33032; http://www.kb.cert.org/vuls/id/528993; http://www.kb.cert.org/vuls/id/MAPG-7HJKSA
CVE: CVE-2008-4391
Published: 2008-12-09
Description: Stack-based buffer overflow in the SetSource method in the NetCamPlayerWeb11gv2 ActiveX control in NetCamPlayerWeb11gv2.ocx on the Cisco Linksys WVC54GC wireless video camera before firmware 1.25 allows remote attackers to execute arbitrary code via long invalid arguments.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/33032; http://www.kb.cert.org/vuls/id/639345; http://www.kb.cert.org/vuls/id/WDON-7M2U52
CVE: CVE-2008-4917
Published: 2008-12-09
Description: Unspecified vulnerability in VMware Workstation 5.5.8 and earlier, and 6.0.5 and earlier 6.x versions; VMware Player 1.0.8 and earlier, and 2.0.5 and earlier 2.x versions; VMware Server 1.0.9 and earlier; VMware ESXi 3.5; and VMware ESX 3.0.2 through 3.5 allows guest OS users to have an unknown impact by sending the virtual hardware a request that triggers an arbitrary physical-memory write operation, leading to memory corruption.
CVSS Score: 7.2 (HIGH)
CWE: CWE-399
References: http://kb.vmware.com/kb/1006980; http://kb.vmware.com/kb/1006986; http://secunia.com/advisories/32965
CVE: CVE-2008-5079
Published: 2008-12-09
Description: net/atm/svc.c in the ATM subsystem in the Linux kernel 2.6.27.8 and earlier allows local users to cause a denial of service (kernel infinite loop) by making two calls to svc_listen for the same socket, and then reading a /proc/net/atm/*vc file, related to corruption of the vcc table.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00003.html
CVE: CVE-2008-5277
Published: 2008-12-09
Description: PowerDNS before 2.9.21.2 allows remote attackers to cause a denial of service (daemon crash) via a CH HINFO query.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-16
References: http://doc.powerdns.com/powerdns-advisory-2008-03.html; http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.html; http://secunia.com/advisories/32979
CVE: CVE-2008-5381
Published: 2008-12-09
Description: Buffer overflow in the URL processing in ffdshow (aka ffdshow-tryout) before SVN revision 2347 allows remote attackers to execute arbitrary code via a long URL.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/32846; http://secunia.com/advisories/32881; http://security.bkis.vn/?p=277
CVE: CVE-2008-5382
Published: 2008-12-09
Description: Cross-site request forgery (CSRF) vulnerability in I-O DATA DEVICE HDL-F160, HDL-F250, HDL-F300, and HDL-F320 firmware before 1.02 allows remote attackers to (1) change a configuration or (2) delete files as an authenticated user via unknown vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://jvn.jp/en/jp/JVN70599814/index.html; http://osvdb.org/50183; http://secunia.com/advisories/32836
CVE: CVE-2008-5383
Published: 2008-12-09
Description: Stack-based buffer overflow in National Instruments Electronics Workbench allows user-assisted attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted .ewb file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://securityreason.com/securityalert/4698; http://www.securityfocus.com/bid/32542; https://exchange.xforce.ibmcloud.com/vulnerabilities/46996
CVE: CVE-2008-5384
Published: 2008-12-09
Description: crontab in bos.rte.cron in IBM AIX 6.1.0 through 6.1.2 allows local users with aix.system.config.cron authorization to gain privileges by launching an editor.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://aix.software.ibm.com/aix/efixes/security/aix61_advisory.asc; http://osvdb.org/50218; http://secunia.com/advisories/32916
CVE: CVE-2008-5385
Published: 2008-12-09
Description: enq in bos.rte.printers in IBM AIX 6.1.0 through 6.1.2, when a print queue is defined in /etc/qconfig, allows local users to delete arbitrary files via unspecified vectors.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://aix.software.ibm.com/aix/efixes/security/aix61_advisory.asc; http://osvdb.org/50217; http://secunia.com/advisories/32916
CVE: CVE-2008-5386
Published: 2008-12-09
Description: Buffer overflow in ndp in IBM AIX 6.1.0 through 6.1.2, when the netcd daemon is running, allows local users to gain privileges via unspecified vectors.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-119
References: http://aix.software.ibm.com/aix/efixes/security/aix61_advisory.asc; http://osvdb.org/50215; http://secunia.com/advisories/32916
CVE: CVE-2008-5387
Published: 2008-12-09
Description: Buffer overflow in autoconf6 in IBM AIX 6.1.0 through 6.1.2, when Role-Based Access Control is enabled, allows local users with aix.network.config.tcpip authorization to gain privileges via unspecified vectors.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-119
References: http://aix.software.ibm.com/aix/efixes/security/aix61_advisory.asc; http://osvdb.org/50216; http://secunia.com/advisories/32916
CVE: CVE-2008-5393
Published: 2008-12-09
Description: UPR-Kernel in Ubuntu Privacy Remix (UPR) before 8.04_r1 includes kernel support for mounting RAID arrays, which might allow remote attackers to bypass intended isolation mechanisms by (1) reading from or (2) writing to these arrays.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://securityreason.com/securityalert/4696; http://www.securityfocus.com/archive/1/498905/100/0/threaded; http://www.securityfocus.com/bid/32629
CVE: CVE-2008-5394
Published: 2008-12-09
Description: /bin/login in shadow 4.0.18.1 in Debian GNU/Linux, and probably other Linux distributions, allows local users in the utmp group to overwrite arbitrary files via a symlink attack on a temporary file referenced in a line (aka ut_line) field in a utmp entry.
CVSS Score: 7.2 (HIGH)
CWE: CWE-59
References: http://bugs.debian.org/332198; http://bugs.debian.org/505071; http://bugs.debian.org/505271
CVE: CVE-2008-5395
Published: 2008-12-09
Description: The parisc_show_stack function in arch/parisc/kernel/traps.c in the Linux kernel before 2.6.28-rc7 on PA-RISC allows local users to cause a denial of service (system crash) via vectors associated with an attempt to unwind a stack that contains userspace addresses.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-119
References: http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.27.y.git%3Ba=commit%3Bh=7a3f5134a8f5bd7fa38b5645eef05e8a4eb62951; http://kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.28-rc7; http://marc.info/?l=linux-parisc&m=[PII_REDACTED]3624&w=2
CVE: CVE-2008-5396
Published: 2008-12-09
Description: Array index error in the (1) torisa.c and (2) dahdi/tor2.c drivers in Zaptel (aka DAHDI) 1.4.11 and earlier allows local users in the dialout group to overwrite an integer value in kernel memory by writing to /dev/zap/ctl, related to missing validation of the sync field associated with the ZT_SPANCONFIG ioctl.
CVSS Score: 7.2 (HIGH)
CWE: CWE-189
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507459; http://bugs.digium.com/view.php?id=13954; http://secunia.com/advisories/32947
CVE: CVE-2008-5397
Published: 2008-12-09
Description: Tor before 0.2.0.32 does not properly process the (1) User and (2) Group configuration options, which might allow local users to gain privileges by leveraging unintended supplementary group memberships of the Tor process.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://blog.torproject.org/blog/tor-0.2.0.32-released; http://secunia.com/advisories/33025; http://secunia.com/advisories/34583
CVE: CVE-2008-5398
Published: 2008-12-09
Description: Tor before 0.2.0.32 does not properly process the ClientDNSRejectInternalAddresses configuration option in situations where an exit relay issues a policy-based refusal of a stream, which allows remote exit relays to have an unknown impact by mapping an internal IP address to the destination hostname of a refused stream.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://blog.torproject.org/blog/tor-0.2.0.32-released; http://secunia.com/advisories/33025; http://secunia.com/advisories/34583
CVE: CVE-2008-4311
Published: 2008-12-10
Description: The default configuration of system.conf in D-Bus (aka DBus) before 1.2.6 omits the send_type attribute in certain rules, which allows local users to bypass intended access restrictions by (1) sending messages, related to send_requested_reply; and possibly (2) receiving messages, related to receive_requested_reply.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-16
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=503532; http://forums.fedoraforum.org/showthread.php?t=206797; http://lists.freedesktop.org/archives/dbus/2008-December/010702.html
CVE: CVE-2008-5304
Published: 2008-12-10
Description: Cross-site scripting (XSS) vulnerability in TWiki before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via the %URLPARAM{}% variable.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/33040; http://securitytracker.com/id?1021351; http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2008-5304
CVE: CVE-2008-5305
Published: 2008-12-10
Description: Eval injection vulnerability in TWiki before 4.2.4 allows remote attackers to execute arbitrary Perl code via the %SEARCH{}% variable.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/33040; http://securitytracker.com/id?1021352; http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2008-5305
CVE: CVE-2008-5410
Published: 2008-12-10
Description: The PK11_SESSION cache in the OpenSSL PKCS#11 engine in Sun Solaris 10 does not maintain reference counts for operations with asymmetric keys, which allows context-dependent attackers to cause a denial of service (failed cryptographic operations) via unspecified vectors, related to the (1) RSA_sign and (2) RSA_verify functions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-310
References: http://secunia.com/advisories/33050; http://sunsolve.sun.com/search/document.do?assetkey=1-21-138863-02-1; http://sunsolve.sun.com/search/document.do?assetkey=1-21-139459-01-1
CVE: CVE-2008-5411
Published: 2008-12-10
Description: IBM WebSphere Application Server (WAS) 7 before 7.0.0.1 sends SSL traffic over "unsecured TCP," which makes it easier for remote attackers to obtain sensitive information by sniffing the network.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://secunia.com/advisories/33022; http://www-01.ibm.com/support/docview.wss?uid=swg27014463; http://www-1.ibm.com/support/docview.wss?uid=swg1PK74777
CVE: CVE-2008-5412
Published: 2008-12-10
Description: Unspecified vulnerability in IBM WebSphere Application Server (WAS) 7 before 7.0.0.1 on Windows has unknown impact and attack vectors related to JSPs.  NOTE: this is probably a duplicate of CVE-2009-0438.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/33022; http://www-01.ibm.com/support/docview.wss?uid=swg27014463; http://www-1.ibm.com/support/docview.wss?uid=swg1PK75248