deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-3832
Published: 2009-10-30
Description: Opera before 10.01 on Windows does not prevent use of Web fonts in rendering the product's own user interface, which allows remote attackers to spoof the address field via a crafted web site.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-601
References: http://secunia.com/advisories/37182; http://www.opera.com/docs/changelogs/windows/1001/; http://www.opera.com/support/kb/view/940/
CVE: CVE-2009-2267
Published: 2009-11-02
Description: VMware Workstation 6.5.x before 6.5.3 build 185404, VMware Player 2.5.x before 2.5.3 build 185404, VMware ACE 2.5.x before 2.5.3 build 185404, VMware Server 1.x before 1.0.10 build 203137 and 2.x before 2.0.2 build 203138, VMware Fusion 2.x before 2.0.6 build 196839, VMware ESXi 3.5 and 4.0, and VMware ESX 2.5.5, 3.0.3, 3.5, and 4.0, when Virtual-8086 mode is used, do not properly set the exception code upon a page fault (aka #PF) exception, which allows guest OS users to gain privileges on the guest OS by specifying a crafted value for the cs register.
CVSS Score: 6.9 (MEDIUM)
References: http://lists.vmware.com/pipermail/security-announce/2009/000069.html; http://secunia.com/advisories/37172; http://security.gentoo.org/glsa/glsa-201209-25.xml
CVE: CVE-2009-3605
Published: 2009-11-02
Description: Multiple integer overflows in Poppler 0.10.5 and earlier allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF file, related to (1) glib/poppler-page.cc; (2) ArthurOutputDev.cc, (3) CairoOutputDev.cc, (4) GfxState.cc, (5) JBIG2Stream.cc, (6) PSOutputDev.cc, and (7) SplashOutputDev.cc in poppler/; and (8) SplashBitmap.cc, (9) Splash.cc, and (10) SplashFTFont.cc in splash/.  NOTE: this may overlap CVE-2009-0791.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://cgit.freedesktop.org/poppler/poppler/commit/?id=284a92899602daa4a7f429e61849e794569310b5; http://cgit.freedesktop.org/poppler/poppler/commit/?id=7b2d314a61fd0e12f47c62996cb49ec0d1ba747a; http://cgit.freedesktop.org/poppler/poppler/commit/?id=9cf2325fb22f812b31858e519411f57747d39bd8
CVE: CVE-2009-3624
Published: 2009-11-02
Description: The get_instantiation_keyring function in security/keys/keyctl.c in the KEYS subsystem in the Linux kernel before 2.6.32-rc5 does not properly maintain the reference count of a keyring, which allows local users to gain privileges or cause a denial of service (OOPS) via vectors involving calls to this function without specifying a keyring by ID, as demonstrated by a series of keyctl request2 and keyctl list commands.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-310
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=21279cfa107af07ef985539ac0de2152b9cba5f5; http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00000.html; http://marc.info/?l=oss-security&m=[PII_REDACTED]5341&w=2
CVE: CVE-2009-3628
Published: 2009-11-02
Description: The Backend subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote authenticated users to determine an encryption key via crafted input to a tt_content form element.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://marc.info/?l=oss-security&m=[PII_REDACTED]6736&w=2; http://secunia.com/advisories/37122; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-016
CVE: CVE-2009-3629
Published: 2009-11-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Backend subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://marc.info/?l=oss-security&m=[PII_REDACTED]6736&w=2; http://marc.info/?l=oss-security&m=[PII_REDACTED]1438&w=2; http://secunia.com/advisories/37122
CVE: CVE-2009-3630
Published: 2009-11-02
Description: The Backend subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote authenticated users to place arbitrary web sites in TYPO3 backend framesets via crafted parameters, related to a "frame hijacking" issue.
CVSS Score: 5.5 (MEDIUM)
References: http://marc.info/?l=oss-security&m=[PII_REDACTED]6736&w=2; http://secunia.com/advisories/37122; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-016/
CVE: CVE-2009-3631
Published: 2009-11-02
Description: The Backend subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2, when the DAM extension or ftp upload is enabled, allows remote authenticated users to execute arbitrary commands via shell metacharacters in a filename.
CVSS Score: 8.5 (HIGH)
CWE: CWE-94
References: http://marc.info/?l=oss-security&m=[PII_REDACTED]6736&w=2; http://secunia.com/advisories/37122; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-016/
CVE: CVE-2009-3632
Published: 2009-11-02
Description: SQL injection vulnerability in the traditional frontend editing feature in the Frontend Editing subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote authenticated users to execute arbitrary SQL commands via unspecified parameters.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://marc.info/?l=oss-security&m=[PII_REDACTED]6736&w=2; http://secunia.com/advisories/37122; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-016/
CVE: CVE-2009-3633
Published: 2009-11-02
Description: Cross-site scripting (XSS) vulnerability in the t3lib_div::quoteJSvalue API function in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the sanitizing algorithm.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://marc.info/?l=oss-security&m=[PII_REDACTED]6736&w=2; http://marc.info/?l=oss-security&m=[PII_REDACTED]1438&w=2; http://secunia.com/advisories/37122
CVE: CVE-2009-3634
Published: 2009-11-02
Description: Cross-site scripting (XSS) vulnerability in the Frontend Login Box (aka felogin) subcomponent in TYPO3 4.2.0 through 4.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=oss-security&m=[PII_REDACTED]6736&w=2; http://marc.info/?l=oss-security&m=[PII_REDACTED]1438&w=2; http://secunia.com/advisories/37122
CVE: CVE-2009-3635
Published: 2009-11-02
Description: The Install Tool subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote attackers to gain access by using only the password's md5 hash as a credential.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://marc.info/?l=oss-security&m=[PII_REDACTED]6736&w=2; http://secunia.com/advisories/37122; http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-016/
CVE: CVE-2009-3636
Published: 2009-11-02
Description: Cross-site scripting (XSS) vulnerability in the Install Tool subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=oss-security&m=[PII_REDACTED]6736&w=2; http://marc.info/?l=oss-security&m=[PII_REDACTED]1438&w=2; http://secunia.com/advisories/37122
CVE: CVE-2009-3733
Published: 2009-11-02
Description: Directory traversal vulnerability in VMware Server 1.x before 1.0.10 build 203137 and 2.x before 2.0.2 build 203138 on Linux, VMware ESXi 3.5, and VMware ESX 3.0.3 and 3.5 allows remote attackers to read arbitrary files via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://lists.vmware.com/pipermail/security-announce/2009/000069.html; http://secunia.com/advisories/37186; http://security.gentoo.org/glsa/glsa-201209-25.xml
CVE: CVE-2009-3833
Published: 2009-11-02
Description: Cross-site scripting (XSS) vulnerability in index.php in TFTgallery 0.13 allows remote attackers to inject arbitrary web script or HTML via the album parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0910-exploits/tftgallery-xss.txt; http://secunia.com/advisories/37156; http://packetstormsecurity.org/0910-exploits/tftgallery-xss.txt
CVE: CVE-2009-3834
Published: 2009-11-02
Description: SQL injection vulnerability in the Photoblog (com_photoblog) component alpha 3 and alpha 3a for Joomla! allows remote attackers to execute arbitrary SQL commands via the category parameter in a blogs action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0910-exploits/joomlaphotoblog-sql.txt; http://www.securityfocus.com/bid/36809; https://exchange.xforce.ibmcloud.com/vulnerabilities/53943
CVE: CVE-2009-3835
Published: 2009-11-02
Description: SQL injection vulnerability in the JShop (com_jshop) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the pid parameter in a product action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.packetstormsecurity.org/0910-exploits/joomlajshop-sql.txt; http://www.securityfocus.com/bid/36808; https://exchange.xforce.ibmcloud.com/vulnerabilities/53944
CVE: CVE-2009-3836
Published: 2009-11-02
Description: ArubaOS 3.3.1.x, 3.3.2.x, RN 3.1.x, 3.4.x, and 3.3.2.x-FIPS on the Aruba Mobility Controller allows remote attackers to cause a denial of service (Access Point crash) via a malformed 802.11 Association Request management frame.
CVSS Score: 6.1 (MEDIUM)
References: http://secunia.com/advisories/37085; http://www.arubanetworks.com/support/alerts/aid-102609.asc; http://www.securityfocus.com/bid/36832
CVE: CVE-2009-3837
Published: 2009-11-02
Description: Stack-based buffer overflow in Eureka Email 2.2q allows remote POP3 servers to execute arbitrary code via a long error message.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/59262; http://secunia.com/advisories/37132; http://www.packetstormsecurity.org/0910-exploits/eurekamc-dos.txt
CVE: CVE-2009-3838
Published: 2009-11-02
Description: Stack-based buffer overflow in Pegasus Mail (PMail) 4.41 and possibly 4.51 allows remote POP3 servers to cause a denial of service (application crash) or possibly execute arbitrary code via a long error message.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/59261; http://secunia.com/advisories/37134; http://www.packetstormsecurity.org/0910-exploits/pegasusmc-dos.txt
CVE: CVE-2009-3839
Published: 2009-11-02
Description: Unspecified vulnerability in the Solaris Trusted Extensions Policy configuration in Sun Solaris 10, and OpenSolaris snv_37 through snv_125, might allow remote attackers to execute arbitrary code by leveraging access to the X server.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/37184; http://sunsolve.sun.com/search/document.do?assetkey=1-66-270969-1; http://www.securityfocus.com/bid/36840
CVE: CVE-2009-3031
Published: 2009-11-03
Description: Stack-based buffer overflow in the BrowseAndSaveFile method in the Altiris eXpress NS ConsoleUtilities ActiveX control 6.0.0.1846 in AeXNSConsoleUtilities.dll in Symantec Altiris Notification Server (NS) 6.0 before R12, Deployment Server 6.8 and 6.9 in Symantec Altiris Deployment Solution 6.9 SP3, and Symantec Management Platform (SMP) 7.0 before SP3 allows remote attackers to execute arbitrary code via a long string in the second argument.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://sotiriu.de/adv/NSOADV-2009-001.txt; http://www.securityfocus.com/archive/1/507625/100/0/threaded; http://www.securityfocus.com/bid/36698
CVE: CVE-2009-3298
Published: 2009-11-03
Description: Mahara before 1.0.13, and 1.1.x before 1.1.7, allows remote authenticated institution administrators to reset a site administrator password via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://eduforge.org/frs/shownotes.php?release_id=546; http://eduforge.org/frs/shownotes.php?release_id=547; http://mahara.org/interaction/forum/topic.php?id=1169
CVE: CVE-2009-3299
Published: 2009-11-03
Description: Cross-site scripting (XSS) vulnerability in the resume blocktype in Mahara before 1.0.13, and 1.1.x before 1.1.7, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://eduforge.org/frs/shownotes.php?release_id=546; http://eduforge.org/frs/shownotes.php?release_id=547; http://mahara.org/interaction/forum/topic.php?id=1170
CVE: CVE-2009-3720
Published: 2009-11-03
Description: The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted UTF-8 sequences that trigger a buffer over-read, a different vulnerability than CVE-2009-2625.
CVSS Score: 5.0 (MEDIUM)
References: http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?r1=1.13&r2=1.15&view=patch; http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?view=log; http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051228.html
CVE: CVE-2009-3851
Published: 2009-11-03
Description: Trusted Extensions in Sun Solaris 10 interferes with the operation of the xscreensaver-demo command for the XScreenSaver application, which makes it easier for physically proximate attackers to access an unattended workstation for which the intended screen locking did not occur, related to the "restart daemon."
CVSS Score: 7.2 (HIGH)
References: http://sunsolve.sun.com/search/document.do?assetkey=1-21-120094-28-1; http://sunsolve.sun.com/search/document.do?assetkey=1-66-270809-1; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6845
CVE: CVE-2009-3852
Published: 2009-11-03
Description: Unspecified vulnerability in the XML component in IBM Runtimes for Java Technology 5.0.0 before SR10 has unknown impact and attack vectors, related to the "updated version of XML4J 4.4.17."
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/37210; http://www-01.ibm.com/support/docview.wss?uid=swg1IZ63920; http://www.securityfocus.com/bid/36894
CVE: CVE-2009-0306
Published: 2009-11-04
Description: Buffer overflow in the IBM Lotus Notes Intellisync ActiveX control in lnresobject.dll in BlackBerry Desktop Manager in Research In Motion (RIM) BlackBerry Desktop Software before 5.0.1 allows remote attackers to execute arbitrary code via a crafted web page.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.blackberry.com/btsc/search.do?cmd=displayKC&docType=kc&externalId=KB19701; http://www.securityfocus.com/bid/36903; http://www.vupen.com/english/advisories/2009/3133
CVE: CVE-2009-3463
Published: 2009-11-04
Description: Array index error in Adobe Shockwave Player before 11.5.2.602 allows remote attackers to execute arbitrary code via crafted Shockwave content on a web site.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://securitytracker.com/id?1023123; http://www.adobe.com/support/security/bulletins/apsb09-16.html; http://www.securityfocus.com/bid/36905
CVE: CVE-2009-3464
Published: 2009-11-04
Description: Adobe Shockwave Player before 11.5.2.602 allows remote attackers to execute arbitrary code via crafted Shockwave content on a web site, related to an "invalid pointer vulnerability," a different issue than CVE-2009-3465.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://securitytracker.com/id?1023123; http://www.adobe.com/support/security/bulletins/apsb09-16.html; http://www.securityfocus.com/bid/36905
CVE: CVE-2009-3465
Published: 2009-11-04
Description: Adobe Shockwave Player before 11.5.2.602 allows remote attackers to execute arbitrary code via crafted Shockwave content on a web site, related to an "invalid pointer vulnerability," a different issue than CVE-2009-3464.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://securitytracker.com/id?1023123; http://www.adobe.com/support/security/bulletins/apsb09-16.html; http://www.securityfocus.com/bid/36905
CVE: CVE-2009-3466
Published: 2009-11-04
Description: Adobe Shockwave Player before 11.5.2.602 allows remote attackers to execute arbitrary code via a crafted web page that triggers memory corruption, related to an "invalid string length vulnerability." NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://securitytracker.com/id?1023123; http://www.adobe.com/support/security/bulletins/apsb09-16.html; http://www.securityfocus.com/bid/36905
CVE: CVE-2009-3547
Published: 2009-11-04
Description: Multiple race conditions in fs/pipe.c in the Linux kernel before 2.6.32-rc6 allow local users to cause a denial of service (NULL pointer dereference and system crash) or gain privileges by attempting to open an anonymous pipe via a /proc/*/fd/ pathname.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-476, CWE-672
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=ad3960243e55320d74195fb85c975e0a8cc4466c; http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00007.html
CVE: CVE-2009-3853
Published: 2009-11-04
Description: Stack-based buffer overflow in the client acceptor daemon (CAD) scheduler in the client in IBM Tivoli Storage Manager (TSM) 5.3 before 5.3.6.7, 5.4 before 5.4.3, 5.5 before 5.5.2.2, and 6.1 before 6.1.0.2, and TSM Express 5.3.3.0 through 5.3.6.6, allows remote attackers to execute arbitrary code via crafted data in a TCP packet.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/32534; http://secunia.com/secunia_research/2008-51/; http://securitytracker.com/id?1023136
CVE: CVE-2009-3854
Published: 2009-11-04
Description: Buffer overflow in the traditional client scheduler in the client in IBM Tivoli Storage Manager (TSM) 5.3 before 5.3.6.7 and 5.4 before 5.4.2 allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/32534; http://securitytracker.com/id?1023136; http://www-01.ibm.com/support/docview.wss?uid=swg1IC61058
CVE: CVE-2009-3855
Published: 2009-11-04
Description: Multiple unspecified vulnerabilities in the (1) UNIX and (2) Linux backup-archive clients, and the (3) OS/400 API client, in IBM Tivoli Storage Manager (TSM) 5.3 before 5.3.6.6, 5.4 before 5.4.2, and 5.5 before 5.5.1, when the MAILPROG option is enabled, allow attackers to read, modify, or delete arbitrary files via unknown vectors.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/32534; http://www-01.ibm.com/support/docview.wss?uid=swg1IC54489; http://www-01.ibm.com/support/docview.wss?uid=swg21405562
CVE: CVE-2009-3856
Published: 2009-11-04
Description: Cross-site scripting (XSS) vulnerability in the default URI in news/ in Twilight CMS before 4.1 allows remote attackers to inject arbitrary web script or HTML via the calendar parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://onsec.ru/vuln?id=10; http://secunia.com/advisories/37204; http://onsec.ru/vuln?id=10
CVE: CVE-2009-3857
Published: 2009-11-04
Description: Buffer overflow in Softonic International SciTE 1.72 allows user-assisted remote attackers to cause a denial of service (application crash) via a Ruby (.rb) file containing a long string, which triggers the crash when a scroll bar is used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://www.exploit-db.com/exploits/9133; https://exchange.xforce.ibmcloud.com/vulnerabilities/51674; http://www.exploit-db.com/exploits/9133
CVE: CVE-2009-3858
Published: 2009-11-04
Description: Cross-site scripting (XSS) vulnerability in GejoSoft allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI in photos/tags.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/56061; http://packetstormsecurity.org/0907-exploits/gejosoft-xss.txt; http://secunia.com/advisories/35921
CVE: CVE-2009-3859
Published: 2009-11-04
Description: Buffer overflow in eEye Retina WiFi Scanner 1.0.8.68, as used in Retina Network Security Scanner 5.10.14, allows user-assisted remote attackers to cause a denial of service (application crash) or execute arbitrary code via a .rws file with a long RWS010 entry.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/55744; http://research.eeye.com/html/advisories/published/AD20090710.html; http://secunia.com/advisories/35786
CVE: CVE-2009-3860
Published: 2009-11-04
Description: Multiple insecure method vulnerabilities in Idefense Labs COMRaider allow remote attackers to create or overwrite arbitrary files via the (1) CreateFolder and (2) Copy methods.  NOTE: this might only be a vulnerability in certain insecure configurations of Internet Explorer.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://www.juniper.net/security/auto/vulnerabilities/vuln35725.html; http://www.securityfocus.com/archive/1/505042/100/0/threaded; http://www.securityfocus.com/bid/35725
CVE: CVE-2009-3861
Published: 2009-11-04
Description: Stack-based buffer overflow in SafeNet SoftRemote 10.8.5 (Build 2) and 10.3.5 (Build 6), and possibly other versions before 10.8.9, allows local users to execute arbitrary code via a long string in a (1) TREENAME or (2) GROUPNAME Policy file (spd).
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/archive/1/507593/100/0/threaded; http://www.securitytracker.com/id?1023117; http://www.senseofsecurity.com.au/advisories/SOS-09-008
CVE: CVE-2009-3862
Published: 2009-11-04
Description: The NDSD process in Novell eDirectory 8.7.3 before 8.7.3.10 ftf2 and eDirectory 8.8 before 8.8.5 ftf1 does not properly handle certain LDAP search requests, which allows remote attackers to cause a denial of service (application hang) via a search request with a NULL BaseDN value.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://www.novell.com/support/viewContent.do?externalId=7004721; http://www.securityfocus.com/bid/36902; http://www.vupen.com/english/advisories/2009/3120
CVE: CVE-2009-3863
Published: 2009-11-04
Description: Buffer overflow in the gxmim1.dll ActiveX control in Novell Groupwise Client 7.0.3.1294 allows remote attackers to cause a denial of service (application crash) via a long argument to the SetFontFace method.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://www.exploit-db.com/exploits/9683; http://www.exploit-db.com/exploits/9683
CVE: CVE-2009-3864
Published: 2009-11-05
Description: The Java Update functionality in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22 and JDK and JRE 6 before Update 17, when a non-English version of Windows is used, does not retrieve available new JRE versions, which allows remote attackers to leverage vulnerabilities in older releases of this software, aka Bug Id 6869694.
CVSS Score: 7.5 (HIGH)
References: http://java.sun.com/javase/6/webnotes/6u17.html; http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00010.html; http://secunia.com/advisories/37231
CVE: CVE-2009-3865
Published: 2009-11-05
Description: The launch method in the Deployment Toolkit plugin in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 6 before Update 17 allows remote attackers to execute arbitrary commands via a crafted web page, aka Bug Id 6869752.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://java.sun.com/javase/6/webnotes/6u17.html; http://lists.apple.com/archives/security-announce/2009/Dec/msg00000.html; http://lists.apple.com/archives/security-announce/2009/Dec/msg00001.html