deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-6718
Published: 2009-04-13
Description: U&M Software JustBookIt 1.0 does not require administrative authentication for all scripts in the admin/ directory, which allows remote attackers to have an unspecified impact via a direct request to (1) user_manual.php, (2) user_config.php, (3) user_kundnamn.php, (4) user_kundlista.php, (5) user_aktiva_kunder.php, (6) database.php, and possibly (7) index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.securityfocus.com/bid/32166; https://www.exploit-db.com/exploits/7033; http://www.securityfocus.com/bid/32166
CVE: CVE-2008-6719
Published: 2009-04-13
Description: U&M Software Event Lister (aka JustListIt) 1.0 does not require administrative authentication for all scripts in the admin/ directory, which allows remote attackers to have an unspecified impact via a direct request to (1) start.php, (2) aktivitet.php, (3) prop_aktivitet.php, (4) kategorier.php, (5) konfig.php, (6) security.php, (7) manual.php, and possibly (8) index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.securityfocus.com/bid/32166; https://exchange.xforce.ibmcloud.com/vulnerabilities/46441; https://www.exploit-db.com/exploits/7034
CVE: CVE-2008-6720
Published: 2009-04-13
Description: SQL injection vulnerability in admin/adm_login.php in DeltaScripts PHP Links 1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the admin_username parameter (aka the admin field).
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/32163; https://exchange.xforce.ibmcloud.com/vulnerabilities/50392; https://www.exploit-db.com/exploits/7024
CVE: CVE-2008-4420
Published: 2009-04-13
Description: Multiple stack-based buffer overflows in DZIP32.DLL before 5.0.0.8 in DynaZip Max and DZIPS32.DLL before 6.0.0.5 in DynaZip Max Secure; as used in HP OpenView Performance Agent C.04.60, HP Performance Agent C.04.70 and C.04.72, TurboZIP 6.0, and other products; allow user-assisted attackers to execute arbitrary code via a long filename in a ZIP archive during a (1) Fix (aka Repair), (2) Add, (3) Update, or (4) Freshen action, a related issue to CVE-2006-3985.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01622011; http://innermedia.com/upgrades.html; http://osvdb.org/53478
CVE: CVE-2009-0218
Published: 2009-04-13
Description: Insecure method vulnerability in Particle Software IntraLaunch Application Launcher ActiveX control in IntraLaunch.ocx, as used in LDRA TBbrowse and possibly other products, allows remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 9.3 (HIGH)
References: http://www.kb.cert.org/vuls/id/908801; http://www.kb.cert.org/vuls/id/MAPG-7PYRP4; http://www.kb.cert.org/vuls/id/WDON-7Q4RZN
CVE: CVE-2009-0794
Published: 2009-04-13
Description: Integer overflow in the PulseAudioTargetDataL class in src/java/org/classpath/icedtea/pulseaudio/PulseAudioTargetDataLine.java in Pulse-Java, as used in OpenJDK 1.6.0.0 and other products, allows remote attackers to cause a denial of service (applet crash) via a crafted Pulse Audio source data line.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2009-February/004729.html; http://secunia.com/advisories/34623; http://www.mandriva.com/security/advisories?name=MDVSA-2009:137
CVE: CVE-2009-1244
Published: 2009-04-13
Description: Unspecified vulnerability in the virtual machine display function in VMware Workstation 6.5.1 and earlier; VMware Player 2.5.1 and earlier; VMware ACE 2.5.1 and earlier; VMware Server 1.x before 1.0.9 build 156507 and 2.x before 2.0.1 build 156745; VMware Fusion before 2.0.4 build 159196; VMware ESXi 3.5; and VMware ESX 3.0.2, 3.0.3, and 3.5 allows guest OS users to execute arbitrary code on the host OS via unknown vectors, a different vulnerability than CVE-2008-4916.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.vmware.com/pipermail/security-announce/2009/000055.html; http://osvdb.org/53634; http://security.gentoo.org/glsa/glsa-201209-25.xml
CVE: CVE-2009-1267
Published: 2009-04-13
Description: Unspecified vulnerability in the LDAP dissector in Wireshark 0.99.2 through 1.0.6, when running on Windows, allows remote attackers to cause a denial of service (crash) via unknown attack vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html; http://secunia.com/advisories/34778; http://secunia.com/advisories/35416
CVE: CVE-2009-1268
Published: 2009-04-13
Description: The Check Point High-Availability Protocol (CPHAP) dissector in Wireshark 0.9.6 through 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted FWHA_MY_STATE packet.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html; http://secunia.com/advisories/34778; http://secunia.com/advisories/34970
CVE: CVE-2009-1269
Published: 2009-04-13
Description: Unspecified vulnerability in Wireshark 0.99.6 through 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted Tektronix .rf5 file.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html; http://secunia.com/advisories/34778; http://secunia.com/advisories/34970
CVE: CVE-2009-1286
Published: 2009-04-13
Description: The IMAP task in the server in IBM Lotus Domino 8.0.2 before FP1 IF1 and 8.5 before IF3 allows remote attackers to cause a denial of service (daemon crash) via a MIME e-mail message with RFC822 attachments (aka blobs) containing malformed root entities.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/34657; http://securitytracker.com/id?1022024; http://www-01.ibm.com/support/docview.wss?uid=swg21379894
CVE: CVE-2009-1287
Published: 2009-04-13
Description: Cross-site scripting (XSS) vulnerability in Cisco Subscriber Edge Services Manager (SESM) allows remote attackers to inject arbitrary web script or HTML via the URI.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securitytracker.com/id?1022030; http://www.securityfocus.com/bid/34454; http://www.xc0re.net/index.php?p=1_17_Cisco-Subscriber-Edge-Services-Manager-Multiple-Vulnerabilities
CVE: CVE-2009-1288
Published: 2009-04-13
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Advanced Management Module (AMM) on the IBM BladeCenter, including the BladeCenter H with BPET36H 54, allow remote attackers to inject arbitrary web script or HTML via (1) the username in a login action or (2) the PATH parameter to private/file_management.ssi in the File manager.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/53657; http://osvdb.org/53658; http://securitytracker.com/id?1022025
CVE: CVE-2009-1289
Published: 2009-04-13
Description: private/login.ssi in the Advanced Management Module (AMM) on the IBM BladeCenter, including the BladeCenter H with BPET36H 54, allows remote attackers to discover the access roles and scopes of arbitrary user accounts via a modified WEBINDEX parameter.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://osvdb.org/53659; http://securitytracker.com/id?1022025; http://www.louhinetworks.fi/advisory/ibm_090409.txt
CVE: CVE-2009-1290
Published: 2009-04-13
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration interface in the Advanced Management Module (AMM) on the IBM BladeCenter, including the BladeCenter H with BPET36H 54, allow remote attackers to hijack the authentication of administrators, as demonstrated by a power-off request to the private/blade_power_action script.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/53660; http://securitytracker.com/id?1022025; http://www.louhinetworks.fi/advisory/ibm_090409.txt
CVE: CVE-2009-0159
Published: 2009-04-14
Description: Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code via a crafted response.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-006.txt.asc; http://bugs.pardus.org.tr/show_bug.cgi?id=9532; http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
CVE: CVE-2008-6721
Published: 2009-04-14
Description: SQL injection vulnerability in index.php in AJ Square AJ Article allows remote attackers to execute arbitrary SQL commands via the txtName parameter (aka the username field).
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/32054; https://exchange.xforce.ibmcloud.com/vulnerabilities/46297; https://www.exploit-db.com/exploits/6932
CVE: CVE-2008-6722
Published: 2009-04-14
Description: Novell Access Manager 3 SP4 does not properly expire X.509 certificate sessions, which allows physically proximate attackers to obtain a logged-in session by using a victim's web-browser process that continues to send the original and valid SSL sessionID, related to inability of Apache Tomcat to clear entries from its SSL cache.
CVSS Score: 1.9 (LOW)
CWE: CWE-200
References: http://osvdb.org/49737; http://secunia.com/advisories/32554; http://www.novell.com/support/viewContent.do?externalId=7001788
CVE: CVE-2008-6723
Published: 2009-04-14
Description: TurnkeyForms Entertainment Portal 2.0 allows remote attackers to bypass authentication and gain administrative access by setting the adminLogged cookie to Administrator.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://osvdb.org/49749; http://secunia.com/advisories/32535; http://www.securityfocus.com/bid/32174
CVE: CVE-2009-0792
Published: 2009-04-14
Description: Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code by using a device file for a translation request that operates on a crafted image file and targets a certain "native color space," related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.  NOTE: this issue exists because of an incomplete fix for CVE-2009-0583.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html; http://secunia.com/advisories/34373
CVE: CVE-2009-1292
Published: 2009-04-14
Description: UCM-CQ in IBM Rational ClearCase 7.0.0.x before 7.0.0.5, 7.0.1.x before 7.0.1.4, and 7.1.x before 7.1.0.1 on Linux and AIX places a username and password on the command line, which allows local users to obtain credentials by listing the process.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://secunia.com/advisories/34689; http://www-01.ibm.com/support/docview.wss?uid=swg1PK75832; http://www.securityfocus.com/bid/34483
CVE: CVE-2009-0077
Published: 2009-04-15
Description: The firewall engine in Microsoft Forefront Threat Management Gateway, Medium Business Edition (TMG MBE); and Internet Security and Acceleration (ISA) Server 2004 SP3, 2006, 2006 Supportability Update, and 2006 SP1; does not properly manage the session state of web listeners, which allows remote attackers to cause a denial of service (many stale sessions) via crafted packets, aka "Web Proxy TCP State Limited Denial of Service Vulnerability."
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/53636; http://secunia.com/advisories/34687; http://www.securitytracker.com/id?1022045
CVE: CVE-2009-0078
Published: 2009-04-15
Description: The Windows Management Instrumentation (WMI) provider in Microsoft Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 does not properly implement isolation among a set of distinct processes that (1) all run under the NetworkService account or (2) all run under the LocalService account, which allows local users to gain privileges by accessing the resources of one of the processes, aka "Windows WMI Service Isolation Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://osvdb.org/53666; http://www.securitytracker.com/id?1022044; http://www.us-cert.gov/cas/techalerts/TA09-104A.html
CVE: CVE-2009-0079
Published: 2009-04-15
Description: The RPCSS service in Microsoft Windows XP SP2 and SP3 and Server 2003 SP1 and SP2 does not properly implement isolation among a set of distinct processes that (1) all run under the NetworkService account or (2) all run under the LocalService account, which allows local users to gain privileges by accessing the resources of one of the processes, aka "Windows RPCSS Service Isolation Vulnerability."
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/53667; http://www.securitytracker.com/id?1022044; http://www.us-cert.gov/cas/techalerts/TA09-104A.html
CVE: CVE-2009-0080
Published: 2009-04-15
Description: The ThreadPool class in Windows Vista Gold and SP1, and Server 2008, does not properly implement isolation among a set of distinct processes that (1) all run under the NetworkService account or (2) all run under the LocalService account, which allows local users to gain privileges by leveraging incorrect thread ACLs to access the resources of one of the processes, aka "Windows Thread Pool ACL Weakness Vulnerability."
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-269
References: http://osvdb.org/53668; http://www.securitytracker.com/id?1022044; http://www.us-cert.gov/cas/techalerts/TA09-104A.html
CVE: CVE-2009-0084
Published: 2009-04-15
Description: Use-after-free vulnerability in DirectShow in Microsoft DirectX 8.1 and 9.0 allows remote attackers to execute arbitrary code via an MJPEG file or video stream with a malformed Huffman table, which triggers an exception that frees heap memory that is later accessed, aka "MJPEG Decompression Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://osvdb.org/53632; http://secunia.com/advisories/34665; http://support.avaya.com/elmodocs2/security/ASA-2009-132.htm
CVE: CVE-2009-0086
Published: 2009-04-15
Description: Integer underflow in Windows HTTP Services (aka WinHTTP) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote HTTP servers to execute arbitrary code via crafted parameter values in a response, related to error handling, aka "Windows HTTP Services Integer Underflow Vulnerability."
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://osvdb.org/53620; http://secunia.com/advisories/34677; http://www.securityfocus.com/bid/34435
CVE: CVE-2009-0087
Published: 2009-04-15
Description: Unspecified vulnerability in the Word 6 text converter in WordPad in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2; and the Word 6 text converter in Microsoft Office Word 2000 SP3 and 2002 SP3; allows remote attackers to execute arbitrary code via a crafted Word 6 file that contains malformed data, aka "WordPad and Office Text Converter Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
References: http://osvdb.org/53662; http://www.securitytracker.com/id?1022043; http://www.us-cert.gov/cas/techalerts/TA09-104A.html
CVE: CVE-2009-0088
Published: 2009-04-15
Description: The WordPerfect 6.x Converter (WPFT632.CNV, 1998.1.27.0) in Microsoft Office Word 2000 SP3 and Microsoft Office Converter Pack does not properly validate the length of an unspecified string, which allows remote attackers to execute arbitrary code via a crafted WordPerfect 6.x file, related to an unspecified counter and control structures on the stack, aka "Word 2000 WordPerfect 6.x Converter Stack Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=782; http://osvdb.org/53663; http://www.securitytracker.com/id?1022043
CVE: CVE-2009-0089
Published: 2009-04-15
Description: Windows HTTP Services (aka WinHTTP) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, and Vista Gold allows remote web servers to impersonate arbitrary https web sites by using DNS spoofing to "forward a connection" to a different https web site that has a valid certificate matching its own domain name, but not a certificate matching the domain name of the host requested by the user, aka "Windows HTTP Services Certificate Name Mismatch Vulnerability."
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/34677; http://www.securityfocus.com/bid/34437; http://www.securitytracker.com/id?1022041
CVE: CVE-2009-0100
Published: 2009-04-15
Description: Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel in Microsoft Office 2004 and 2008 for Mac; Microsoft Office Excel Viewer and Excel Viewer 2003 SP3; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 do not properly parse the Excel spreadsheet file format, which allows remote attackers to execute arbitrary code via a crafted spreadsheet that contains a malformed object with "an offset and a two-byte value" that trigger a memory calculation error, aka "Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://osvdb.org/53665; http://www.fortiguardcenter.com/advisory/FGA-2009-16.html; http://www.securityfocus.com/archive/1/502696/100/0/threaded
CVE: CVE-2009-0235
Published: 2009-04-15
Description: Stack-based buffer overflow in the Word 97 text converter in WordPad in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted Word 97 file that triggers memory corruption, related to use of inconsistent integer data sizes for an unspecified length field, aka "WordPad Word 97 Text Converter Stack Overflow Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=783; http://osvdb.org/53664; http://www.securityfocus.com/bid/34470
CVE: CVE-2009-0237
Published: 2009-04-15
Description: Cross-site scripting (XSS) vulnerability in cookieauth.dll in the HTML forms authentication component in Microsoft Forefront Threat Management Gateway, Medium Business Edition (TMG MBE); and Internet Security and Acceleration (ISA) Server 2006, 2006 Supportability Update, and 2006 SP1; allows remote attackers to inject arbitrary web script or HTML via "authentication input" to this component, aka "Cross-Site Scripting Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/53637; http://secunia.com/advisories/34687; http://www.securitytracker.com/id?1022046
CVE: CVE-2009-0550
Published: 2009-04-15
Description: Windows HTTP Services (aka WinHTTP) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008; and WinINet in Microsoft Internet Explorer 5.01 SP4, 6 SP1, 6 and 7 on Windows XP SP2 and SP3, 6 and 7 on Windows Server 2003 SP1 and SP2, 7 on Windows Vista Gold and SP1, and 7 on Windows Server 2008; allows remote web servers to capture and replay NTLM credentials, and execute arbitrary code, via vectors related to absence of a "credential-reflection protections" opt-in step, aka "Windows HTTP Services Credential Reflection Vulnerability" and "WinINet Credential Reflection Vulnerability."
CVSS Score: 9.3 (HIGH)
References: http://blogs.technet.com/srd/archive/2009/04/14/ntlm-credential-reflection-updates-for-http-clients.aspx; http://osvdb.org/53619; http://secunia.com/advisories/34677
CVE: CVE-2009-0551
Published: 2009-04-15
Description: Microsoft Internet Explorer 6 SP1, 6 and 7 on Windows XP SP2 and SP3, 6 and 7 on Windows Server 2003 SP1 and SP2, 7 on Windows Vista Gold and SP1, and 7 on Windows Server 2008 does not properly handle transition errors in a request for one HTTP document followed by a request for a second HTTP document, which allows remote attackers to execute arbitrary code via vectors involving (1) multiple crafted pages on a web site or (2) a web page with crafted inline content such as banner advertisements, aka "Page Transition Memory Corruption Vulnerability."
CVSS Score: 8.1 (HIGH)
CWE: CWE-399
References: http://osvdb.org/53624; http://secunia.com/advisories/34678; http://support.avaya.com/elmodocs2/security/ASA-2009-133.htm
CVE: CVE-2009-0552
Published: 2009-04-15
Description: Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4, 6 SP1, 6 on Windows XP SP2 and SP3, and 6 on Windows Server 2003 SP1 and SP2 allows remote attackers to execute arbitrary code via a web page that triggers presence of an object in memory that was (1) not properly initialized or (2) deleted, aka "Uninitialized Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://osvdb.org/53625; http://secunia.com/advisories/34678; http://support.avaya.com/elmodocs2/security/ASA-2009-133.htm
CVE: CVE-2009-0553
Published: 2009-04-15
Description: Microsoft Internet Explorer 6 SP1, 6 and 7 on Windows XP SP2 and SP3, 6 and 7 on Windows Server 2003 SP1 and SP2, 7 on Windows Vista Gold and SP1, and 7 on Windows Server 2008 allows remote attackers to execute arbitrary code via a web page that triggers presence of an object in memory that was (1) not properly initialized or (2) deleted, aka "Uninitialized Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://osvdb.org/53626; http://secunia.com/advisories/34678; http://skypher.com/index.php/2009/04/19/ms09-014-embed-element-memory-corruption/
CVE: CVE-2009-0554
Published: 2009-04-15
Description: Microsoft Internet Explorer 5.01 SP4, 6 SP1, 6 and 7 on Windows XP SP2 and SP3, 6 and 7 on Windows Server 2003 SP1 and SP2, 7 on Windows Vista Gold and SP1, and 7 on Windows Server 2008 allows remote attackers to execute arbitrary code via a web page that triggers presence of an object in memory that was (1) not properly initialized or (2) deleted, aka "Uninitialized Memory Corruption Vulnerability."
CVSS Score: 8.8 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/34678; http://support.avaya.com/elmodocs2/security/ASA-2009-133.htm; http://www.securitytracker.com/id?1022042
CVE: CVE-2007-4514
Published: 2009-04-15
Description: Unspecified vulnerability in HP ProCurve Manager and HP ProCurve Manager Plus 2.3 and earlier allows remote attackers to obtain sensitive information from the ProCurve Manager server via unknown attack vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4665&w=2; http://osvdb.org/53596; http://secunia.com/advisories/34705
CVE: CVE-2009-0681
Published: 2009-04-15
Description: PGP Desktop before 9.10 allows local users to (1) cause a denial of service (crash) via a crafted IOCTL request to pgpdisk.sys, and (2) cause a denial of service (crash) and execute arbitrary code via a crafted IRP in an IOCTL request to pgpwded.sys.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://en.securitylab.ru/lab/PT-2009-01; http://www.securityfocus.com/archive/1/502633/100/0/threaded; http://www.securitytracker.com/id?1022034
CVE: CVE-2009-0972
Published: 2009-04-15
Description: Unspecified vulnerability in the Workspace Manager component in Oracle Database 11.1.0.6, 11.1.0.7, 10.2.0.3, 10.2.0.4, 10.1.0.5, 9.2.0.8, and 9.2.0.8DV allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.
CVSS Score: 6.5 (MEDIUM)
References: http://secunia.com/advisories/34693; http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html; http://www.securityfocus.com/bid/34461
CVE: CVE-2009-0973
Published: 2009-04-15
Description: Unspecified vulnerability in the Cluster Ready Services component in Oracle Database 10.1.0.5 allows remote attackers to affect availability via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/53736; http://secunia.com/advisories/34693; http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html