deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-2809
Published: 2008-07-08
Description: Mozilla 1.9 M8 and earlier, Mozilla Firefox 2 before 2.0.0.15, SeaMonkey 1.1.5 and other versions before 1.1.10, Netscape 9.0, and other Mozilla-based web browsers, when a user accepts an SSL server certificate on the basis of the CN domain name in the DN field, regard the certificate as also accepted for all domain names in subjectAltName:dNSName fields, which makes it easier for remote attackers to trick a user into accepting an invalid certificate for a spoofed web site.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00004.html; http://nils.toedtmann.net/pub/subjectAltName.txt; http://rhn.redhat.com/errata/RHSA-2008-0616.html
CVE: CVE-2007-1899
Published: 2008-07-09
Description: Multiple SQL injection vulnerabilities in myWebland myBloggie 2.1.6 allow remote attackers to execute arbitrary SQL commands via (1) the user_id parameter in a viewuser action to index.php, and allow remote authenticated administrators to execute arbitrary SQL commands via (2) the post_id parameter in an edit action to admin.php.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-89
References: http://descriptions.securescout.com/tc/17969; http://secunia.com/advisories/30892; http://www.netvigilance.com/advisory0040
CVE: CVE-2007-3650
Published: 2008-07-09
Description: myWebland myBloggie 2.1.6 allow remote attackers to obtain sensitive information via (1) an invalid year parameter to calendar.php, reached through index.php; (2) a direct request to common.php; and (3) a mode array parameter in the query string to login.php, which reveal the installation path in various error messages.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: http://descriptions.securescout.com/tc/17970; http://www.netvigilance.com/advisory0039; http://descriptions.securescout.com/tc/17970
CVE: CVE-2007-3651
Published: 2008-07-09
Description: class/page.php in Farsi Script (aka FaScript) FaName 1.0 allows remote attackers to obtain sensitive information via a '; (quote semicolon) sequence in the id parameter, which reveals the installation path in an error message.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: http://descriptions.securescout.com/tc/17971; http://www.netvigilance.com/advisory0041; http://descriptions.securescout.com/tc/17971
CVE: CVE-2007-3652
Published: 2008-07-09
Description: SQL injection vulnerability in class/page.php in Farsi Script (aka FaScript) FaName 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.  NOTE: this might be the same issue as CVE-2008-0328.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: http://descriptions.securescout.com/tc/17972; http://www.netvigilance.com/advisory0042; http://descriptions.securescout.com/tc/17972
CVE: CVE-2007-3653
Published: 2008-07-09
Description: Multiple cross-site scripting (XSS) vulnerabilities in Farsi Script (aka FaScript) FaName 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) key or (2) desc parameter to index.php, or (3) the name parameter to page.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://descriptions.securescout.com/tc/17973; http://www.netvigilance.com/advisory0043; https://exchange.xforce.ibmcloud.com/vulnerabilities/43502
CVE: CVE-2008-1663
Published: 2008-07-09
Description: Cross-site scripting (XSS) vulnerability in HP System Management Homepage (SMH) 2.1.10 and 2.1.11 on Linux and Windows allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6894&w=2; http://secunia.com/advisories/30912; http://securityreason.com/securityalert/3979
CVE: CVE-2008-2375
Published: 2008-07-09
Description: Memory leak in a certain Red Hat deployment of vsftpd before 2.0.5 on Red Hat Enterprise Linux (RHEL) 3 and 4, when PAM is used, allows remote attackers to cause a denial of service (memory consumption) via a large number of invalid authentication attempts within the same session, a different vulnerability than CVE-2007-5962.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/31007; http://secunia.com/advisories/31223; http://secunia.com/advisories/32263
CVE: CVE-2008-2376
Published: 2008-07-09
Description: Integer overflow in the rb_ary_fill function in array.c in Ruby before revision 17756 allows context-dependent attackers to cause a denial of service (crash) or possibly have unspecified other impact via a call to the Array#fill method with a start (aka beg) argument greater than ARY_MAX_SIZE.  NOTE: this issue exists because of an incomplete fix for other closely related integer overflows.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://lists.apple.com/archives/security-announce//2008/Sep/msg00005.html; http://secunia.com/advisories/30927; http://secunia.com/advisories/31006
CVE: CVE-2008-2812
Published: 2008-07-09
Description: The Linux kernel before 2.6.25.10 does not properly perform tty operations, which allows local users to cause a denial of service (system crash) or possibly gain privileges via vectors involving NULL pointer dereference of function pointers in (1) hamradio/6pack.c, (2) hamradio/mkiss.c, (3) irda/irtty-sir.c, (4) ppp_async.c, (5) ppp_synctty.c, (6) slip.c, (7) wan/x25_asy.c, and (8) wireless/strip.c in drivers/net/.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.25.y.git%3Ba=commitdiff%3Bh=2a739dd53ad7ee010ae6e155438507f329dce788; http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.25.10; http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00007.html
CVE: CVE-2008-3077
Published: 2008-07-09
Description: arch/x86/kernel/ptrace.c in the Linux kernel before 2.6.25.10 on the x86_64 platform leaks task_struct references into the sys32_ptrace function, which allows local users to cause a denial of service (system crash) or have unspecified other impact via unknown vectors, possibly a use-after-free vulnerability.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-416
References: http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.25.y.git%3Ba=commitdiff%3Bh=1e9a615bfce7996ea4d815d45d364b47ac6a74e8; http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.25.10; http://secunia.com/advisories/31048
CVE: CVE-2008-3078
Published: 2008-07-09
Description: Opera before 9.51 does not properly manage memory within functions supporting the CANVAS element, which allows remote attackers to read uninitialized memory contents by using JavaScript to read a canvas image.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00001.html; http://secunia.com/advisories/30935; http://secunia.com/advisories/31339
CVE: CVE-2008-3079
Published: 2008-07-09
Description: Unspecified vulnerability in Opera before 9.51 on Windows allows attackers to execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/30937; http://www.opera.com/docs/changelogs/windows/951/; http://www.vupen.com/english/advisories/2008/1998/references
CVE: CVE-2008-3080
Published: 2008-07-09
Description: Cross-site request forgery (CSRF) vulnerability in admin.php in myWebland myBloggie 2.1.6 allows remote attackers to perform edit actions as administrators.  NOTE: this can be leveraged to execute SQL commands by also exploiting CVE-2007-1899.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-352
References: http://www.netvigilance.com/advisory0040; https://www.exploit-db.com/exploits/5975; http://www.netvigilance.com/advisory0040
CVE: CVE-2008-3081
Published: 2008-07-09
Description: Multiple unspecified "input validation" vulnerabilities in the Web management interface (aka Messaging Administration interface) in Avaya Message Storage Server (MSS) 3.x and 4.0, and possibly Communication Manager 3.1.x, allow remote authenticated administrators to execute arbitrary commands as user vexvm via vectors related to (1) SFTP Remote Store configuration; (2) remote FTP storage settings; (3) name server lookup; (4) pinging another host; (5) TCP/IP Networking parameter configuration; (6) the external hosts configuration main page; (7) adding and changing external hosts; (8) Windows domain parameter configuration; (9) date, time, and NTP server configuration; (10) alarm settings; (11) the command line history form; (12) the maintenance form; and (13) the server events form.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/46587; http://secunia.com/advisories/30777; http://support.avaya.com/elmodocs2/security/ASA-2008-269.htm
CVE: CVE-2008-3082
Published: 2008-07-09
Description: Cross-site scripting (XSS) vulnerability in UPM/English/login/login.asp in Commtouch Enterprise Anti-Spam Gateway 4 and 5 allows remote attackers to inject arbitrary web script or HTML via the PARAMS parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.commtouch.com/cafe/email-security-news/vulnerability-in-commtouch-gateway-not-anymore/; http://lists.grok.org.uk/pipermail/full-disclosure/2008-June/062955.html; http://secunia.com/advisories/30876
CVE: CVE-2008-3083
Published: 2008-07-09
Description: SQL injection vulnerability in Brightcode Weblinks (com_brightweblinks) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30922; http://www.securityfocus.com/bid/30060; https://exchange.xforce.ibmcloud.com/vulnerabilities/43535
CVE: CVE-2008-2931
Published: 2008-07-09
Description: The do_change_type function in fs/namespace.c in the Linux kernel before 2.6.22 does not verify that the caller has the CAP_SYS_ADMIN capability, which allows local users to gain privileges or cause a denial of service by modifying the properties of a mountpoint.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=ee6f958291e2a768fd727e7a67badfff0b67711a; http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.22; http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00007.html
CVE: CVE-2008-2991
Published: 2008-07-09
Description: Cross-site scripting (XSS) vulnerability in Adobe RoboHelp Server 6 and 7 allows remote attackers to inject arbitrary web script or HTML via vectors related to the Help Errors log.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://secunia.com/advisories/31001; http://securitytracker.com/id?1020442; http://www.adobe.com/support/security/bulletins/apsb08-16.html
CVE: CVE-2008-3087
Published: 2008-07-09
Description: Directory traversal vulnerability in Kasseler CMS 1.3.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter to index.php, possibly related to the phpManual module.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/30946; https://exchange.xforce.ibmcloud.com/vulnerabilities/43600; https://www.exploit-db.com/exploits/6007
CVE: CVE-2008-3088
Published: 2008-07-09
Description: Cross-site scripting (XSS) vulnerability in the Files module in Kasseler CMS 1.3.0 and 1.3.1 Lite allows remote attackers to inject arbitrary web script or HTML via the cid parameter in a Category action to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30946; http://www.securityfocus.com/bid/30095; https://exchange.xforce.ibmcloud.com/vulnerabilities/43604
CVE: CVE-2008-3089
Published: 2008-07-09
Description: SQL injection vulnerability in user.html in Xpoze Pro 3.06 (aka Xpoze Pro CMS 2008) allows remote attackers to execute arbitrary SQL commands via the uid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30926; http://www.securityfocus.com/bid/30101; https://exchange.xforce.ibmcloud.com/vulnerabilities/43607
CVE: CVE-2008-3090
Published: 2008-07-09
Description: Multiple SQL injection vulnerabilities in index.php in BlognPlus (BURO GUN +) 2.5.5 MySQL and PostgreSQL editions allow remote attackers to execute arbitrary SQL commands via the (1) p, (2) e, (3) d, and (4) m parameters, a different vulnerability than CVE-2008-2819.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30959; http://vuln.sg/blognplus255-en.html; http://www.blogn.org/index.php?e=171
CVE: CVE-2008-3091
Published: 2008-07-09
Description: Cross-site scripting (XSS) vulnerability in the Taxonomy Autotagger module 5.x before 5.x-1.8 for Drupal allows remote authenticated users, with create or edit post permissions, to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/277877; http://secunia.com/advisories/30933; http://www.securityfocus.com/bid/30067
CVE: CVE-2008-3092
Published: 2008-07-09
Description: SQL injection vulnerability in the Taxonomy Autotagger module 5.x before 5.x-1.8 for Drupal allows remote authenticated users, with create or edit post permissions, to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://drupal.org/node/277877; http://secunia.com/advisories/30933; http://www.securityfocus.com/bid/30067
CVE: CVE-2008-3093
Published: 2008-07-09
Description: Unrestricted file upload vulnerability in ImperialBB 2.3.5 and earlier allows remote authenticated users to upload and execute arbitrary PHP code by placing a .php filename in the Upload_Avatar parameter and sending the image/gif content type.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: http://phplizardo.breizh-web.net/blog/2008/07/05/advisory-1-imperialbb; http://secunia.com/advisories/30939; http://www.securityfocus.com/bid/30100
CVE: CVE-2008-3094
Published: 2008-07-09
Description: The Organic Groups (OG) module 5.x before 5.x-7.3 and 6.x before 6.x-1.0-RC1, a module for Drupal, allows remote attackers to obtain sensitive information (private group names) via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://drupal.org/node/277873; http://secunia.com/advisories/30928; http://www.securityfocus.com/bid/30070
CVE: CVE-2008-3095
Published: 2008-07-09
Description: Cross-site scripting (XSS) vulnerability in the Organic Groups (OG) module 5.x before 5.x-7.3 and 6.x before 6.x-1.0-RC1, a module for Drupal, allows remote authenticated users, with group owner permissions, to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/277873; http://secunia.com/advisories/30928; http://www.securityfocus.com/bid/30070
CVE: CVE-2008-3096
Published: 2008-07-09
Description: The Outline Designer module 5.x before 5.x-1.4 for Drupal changes each content reader's authentication level to match that of the content author, which might allow remote attackers to gain privileges.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://drupal.org/node/277883; http://secunia.com/advisories/30936; http://www.securityfocus.com/bid/30066
CVE: CVE-2008-3097
Published: 2008-07-09
Description: Cross-site scripting (XSS) vulnerability in the Tinytax module (aka Tinytax taxonomy block) 5.x before 5.x-1.10-1 for Drupal allows remote authenticated users to inject arbitrary web script or HTML, probably by creating a crafted taxonomy term.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://drupal.org/node/277879; http://secunia.com/advisories/30934; http://www.securityfocus.com/bid/30069
CVE: CVE-2008-2244
Published: 2008-07-09
Description: Microsoft Office Word 2002 SP3 allows remote attackers to execute arbitrary code via a .doc file that contains malformed data, as exploited in the wild in July 2008, and as demonstrated by attachement.doc.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://blogs.technet.com/msrc/archive/2008/07/08/vulnerability-in-microsoft-word-could-allow-remote-code-execution.aspx; http://isc.sans.org/diary.html?storyid=4696; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6986&w=2
CVE: CVE-2008-3103
Published: 2008-07-09
Description: Unspecified vulnerability in the Java Management Extensions (JMX) management agent in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier and JDK and JRE 5.0 Update 15 and earlier, when local monitoring is enabled, allows remote attackers to "perform unauthorized operations" via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce//2008/Sep/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00009.html
CVE: CVE-2008-3104
Published: 2008-07-09
Description: Multiple unspecified vulnerabilities in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, SDK and JRE 1.4.x before 1.4.2_18, and SDK and JRE 1.3.x before 1.3.1_23 allow remote attackers to violate the security model for an applet's outbound connections by connecting to localhost services running on the machine that loaded the applet.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce//2008/Sep/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00000.html
CVE: CVE-2008-3105
Published: 2008-07-09
Description: Unspecified vulnerability in the JAX-WS client and service in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier allows remote attackers to access URLs or cause a denial of service via unknown vectors involving "processing of XML data" by a trusted application.
CVSS Score: 8.3 (HIGH)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce//2008/Sep/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00005.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3057&w=2
CVE: CVE-2008-3106
Published: 2008-07-09
Description: Unspecified vulnerability in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier and JDK and JRE 5.0 Update 15 and earlier allows remote attackers to access URLs via unknown vectors involving processing of XML data by an untrusted (1) application or (2) applet, a different vulnerability than CVE-2008-3105.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce//2008/Sep/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00000.html
CVE: CVE-2008-3107
Published: 2008-07-09
Description: Unspecified vulnerability in the Virtual Machine in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows context-dependent attackers to gain privileges via an untrusted (1) application or (2) applet, as demonstrated by an application or applet that grants itself privileges to (a) read local files, (b) write to local files, or (c) execute local programs.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce//2008/Sep/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00005.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3057&w=2
CVE: CVE-2008-3108
Published: 2008-07-09
Description: Buffer overflow in Sun Java Runtime Environment (JRE) in JDK and JRE 5.0 before Update 10, SDK and JRE 1.4.x before 1.4.2_18, and SDK and JRE 1.3.x before 1.3.1_23 allows context-dependent attackers to gain privileges via unspecified vectors related to font processing.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce//2008/Sep/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00000.html
CVE: CVE-2008-3109
Published: 2008-07-09
Description: Unspecified vulnerability in scripting language support in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier allows context-dependent attackers to gain privileges via an untrusted (1) application or (2) applet, as demonstrated by an application or applet that grants itself privileges to (a) read local files, (b) write to local files, or (c) execute local programs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce//2008/Sep/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00005.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3057&w=2
CVE: CVE-2008-3110
Published: 2008-07-09
Description: Unspecified vulnerability in scripting language support in Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 6 and earlier allows remote attackers to obtain sensitive information by using an applet to read information from another applet.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce//2008/Sep/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00005.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3057&w=2
CVE: CVE-2008-3111
Published: 2008-07-09
Description: Multiple buffer overflows in Sun Java Web Start in JDK and JRE 6 before Update 4, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allow context-dependent attackers to gain privileges via an untrusted application, as demonstrated by (a) an application that grants itself privileges to (1) read local files, (2) write to local files, or (3) execute local programs; and as demonstrated by (b) a long value associated with a java-vm-args attribute in a j2se tag in a JNLP file, which triggers a stack-based buffer overflow in the GetVMArgsOption function; aka CR 6557220.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20, CWE-119
References: http://lists.apple.com/archives/security-announce//2008/Sep/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00000.html
CVE: CVE-2008-3112
Published: 2008-07-09
Description: Directory traversal vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows remote attackers to create arbitrary files via the writeManifest method in the CacheEntry class, aka CR 6703909.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce//2008/Sep/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00000.html
CVE: CVE-2008-3113
Published: 2008-07-09
Description: Unspecified vulnerability in Sun Java Web Start in JDK and JRE 5.0 before Update 16 and SDK and JRE 1.4.x before 1.4.2_18 allows remote attackers to create or delete arbitrary files via an untrusted application, aka CR 6704077.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce//2008/Sep/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00000.html
CVE: CVE-2008-3114
Published: 2008-07-09
Description: Unspecified vulnerability in Sun Java Web Start in JDK and JRE 6 before Update 7, JDK and JRE 5.0 before Update 16, and SDK and JRE 1.4.x before 1.4.2_18 allows context-dependent attackers to obtain sensitive information (the cache location) via an untrusted application, aka CR 6704074.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce//2008/Sep/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00000.html