deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-1501
Published: 2008-03-25
Description: The send_user_mode function in s_user.c in (1) Undernet ircu 2.10.12.12 and earlier, (2) snircd 1.3.4 and earlier, and unspecified other ircu derivatives allows remote attackers to cause a denial of service (daemon crash) via a malformed MODE command.
CVSS Score: 5.0 (MEDIUM)
References: http://hg.quakenet.org/snircd/rev/2da2b881d9f5; http://lists.grok.org.uk/pipermail/full-disclosure/2008-March/060906.html; http://osvdb.org/43613
CVE: CVE-2008-1502
Published: 2008-03-25
Description: The _bad_protocol_once function in phpgwapi/inc/class.kses.inc.php in KSES, as used in eGroupWare before 1.4.003, Moodle before 1.8.5, and other products, allows remote attackers to bypass HTML filtering and conduct cross-site scripting (XSS) attacks via a string containing crafted URL protocols.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://docs.moodle.org/en/Release_Notes#Moodle_1.8.5; http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00006.html; http://secunia.com/advisories/29491
CVE: CVE-2008-1503
Published: 2008-03-25
Description: Cross-site scripting (XSS) vulnerability in the web management interface in F5 BIG-IP 9.4.3 allows remote attackers to inject arbitrary web script or HTML via (1) the name of a node object, or the (2) sysContact or (3) sysLocation SNMP configuration field, aka "Audit Log XSS." NOTE: these issues might be resultant from cross-site request forgery (CSRF) vulnerabilities.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/3778; http://www.securityfocus.com/archive/1/489991/100/0/threaded; http://www.securityfocus.com/bid/28416
CVE: CVE-2008-1504
Published: 2008-03-25
Description: Cross-site scripting (XSS) vulnerability in setup.php3 in phpHeaven phpMyChat 0.14.5 allows remote attackers to inject arbitrary web script or HTML via the Lang parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/28399; https://exchange.xforce.ibmcloud.com/vulnerabilities/41381; http://www.securityfocus.com/bid/28399
CVE: CVE-2008-1505
Published: 2008-03-25
Description: PHP remote file inclusion vulnerability in the SSTREAMTV custompages (com_custompages) 1.1 and earlier component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the cpage parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/29520; http://www.securityfocus.com/bid/28409; https://exchange.xforce.ibmcloud.com/vulnerabilities/41396
CVE: CVE-2008-1506
Published: 2008-03-25
Description: PEEL, possibly 3.x and earlier, allows remote attackers to obtain configuration information via a direct request to phpinfo.php, which calls the phpinfo function.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://realn.free.fr/releases/70207; https://exchange.xforce.ibmcloud.com/vulnerabilities/41494; https://www.exploit-db.com/exploits/5281
CVE: CVE-2008-1507
Published: 2008-03-25
Description: PEEL, possibly 3.x and earlier, has (1) a default info@peel.fr account with password admin, and (2) a default contact@peel.fr account with password cinema, which allows remote attackers to gain administrative access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-16
References: http://realn.free.fr/releases/70207; https://exchange.xforce.ibmcloud.com/vulnerabilities/41493; https://www.exploit-db.com/exploits/5281
CVE: CVE-2008-1508
Published: 2008-03-25
Description: SQL injection vulnerability in EfesTech E-Kontör and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29499; http://securityreason.com/securityalert/3776; http://www.securityfocus.com/archive/1/489989/100/0/threaded
CVE: CVE-2008-1509
Published: 2008-03-25
Description: SQL injection vulnerability in index.php in XLPortal 2.2.4 and earlier allows remote attackers to execute arbitrary SQL commands via the query parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29479; http://www.securityfocus.com/bid/28408; https://exchange.xforce.ibmcloud.com/vulnerabilities/41379
CVE: CVE-2008-1510
Published: 2008-03-25
Description: Cross-site scripting (XSS) vulnerability in system/workplace/admin/accounts/users_list.jsp in Alkacon OpenCMS 7.0.3 allows remote attackers to inject arbitrary web script or HTML via the (1) searchfilter or (2) listSearchFilter parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/3777; http://www.securityfocus.com/archive/1/489984/100/0/threaded; http://www.securityfocus.com/bid/28411
CVE: CVE-2008-1511
Published: 2008-03-25
Description: Multiple PHP remote file inclusion vulnerabilities in ooComments 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the PathToComment parameter for (1) classes/class_admin.php and (2) classes/class_comments.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: http://www.securityfocus.com/bid/28401; http://www.securityfocus.com/bid/28401/exploit; http://www.securityfocus.com/bid/28401
CVE: CVE-2008-1512
Published: 2008-03-25
Description: Directory traversal vulnerability in admin/admin_xs.php in eXtreme Styles module (XS-Mod) 2.3.1 and 2.4.0 for phpBB allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the phpEx parameter. NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/29487; http://www.securityfocus.com/bid/28432; https://exchange.xforce.ibmcloud.com/vulnerabilities/41404
CVE: CVE-2008-1513
Published: 2008-03-25
Description: SQL injection vulnerability in index.php in Danneo CMS 0.5.1 and earlier, when the Referers statistics option is enabled, allows remote attackers to execute arbitrary SQL commands via the HTTP Referer header.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/41153; https://www.exploit-db.com/exploits/5239; https://exchange.xforce.ibmcloud.com/vulnerabilities/41153
CVE: CVE-2008-1514
Published: 2008-03-26
Description: arch/s390/kernel/ptrace.c in Linux kernel 2.6.9, and other versions before 2.6.27-rc6, on s390 platforms allows local users to cause a denial of service (kernel panic) via the user-area-padding test from the ptrace testsuite in 31-bit mode, which triggers an invalid dereference.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=3d6e48f43340343d97839eadb1ab7b6a3ea98797; http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.26.6; http://kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.27-rc6
CVE: CVE-2008-1521
Published: 2008-03-26
Description: ZyXEL Prestige routers, including P-660 and P-661 models with firmware 3.40(AGD.2) through 3.40(AHQ.3), allow remote authenticated users to gain privileges by accessing administrative URIs, as demonstrated by rpSysAdmin.html.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://www.gnucitizen.org/projects/router-hacking-challenge/; http://www.procheckup.com/Hacking_ZyXEL_Gateways.pdf; http://www.securityfocus.com/archive/1/489009/100/0/threaded
CVE: CVE-2008-1522
Published: 2008-03-26
Description: ZyXEL Prestige routers, including P-660 and P-661 models with firmware 3.40(AGD.2) through 3.40(AHQ.3), have (1) "user" as their default password for the "user" account and (2) "1234" as their default password for the "admin" account, which makes it easier for remote attackers to obtain access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-16
References: http://www.gnucitizen.org/projects/router-hacking-challenge/; http://www.procheckup.com/Hacking_ZyXEL_Gateways.pdf; http://www.securityfocus.com/archive/1/489009/100/0/threaded
CVE: CVE-2008-1523
Published: 2008-03-26
Description: ZyXEL Prestige routers, including P-660, P-661, and P-662 models with firmware 3.40(AGD.2) through 3.40(AHQ.3), allow remote authenticated users to obtain ISP and Dynamic DNS credentials by sending a direct request for (1) WAN.html, (2) wzPPPOE.html, and (3) rpDyDNS.html, and then reading the HTML source.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.gnucitizen.org/projects/router-hacking-challenge/; http://www.procheckup.com/Hacking_ZyXEL_Gateways.pdf; http://www.securityfocus.com/archive/1/489009/100/0/threaded
CVE: CVE-2008-1524
Published: 2008-03-26
Description: The SNMP service on ZyXEL Prestige routers, including P-660 and P-661 models with firmware 3.40(AGD.2) through 3.40(AHQ.3), has "public" as its default community for both (1) read and (2) write operations, which allows remote attackers to perform administrative actions via SNMP, as demonstrated by reading the Dynamic DNS service password or inserting an XSS sequence into the system.sysName.0 variable, which is displayed on the System Status page.
CVSS Score: 7.5 (HIGH)
CWE: CWE-16
References: http://www.gnucitizen.org/projects/router-hacking-challenge/; http://www.procheckup.com/Hacking_ZyXEL_Gateways.pdf; http://www.securityfocus.com/archive/1/489009/100/0/threaded
CVE: CVE-2008-1525
Published: 2008-03-26
Description: The default SNMP configuration on ZyXEL Prestige routers, including P-660 and P-661 models with firmware 3.40(AGD.2) through 3.40(AHQ.3), has a Trusted Host value of 0.0.0.0, which allows remote attackers to send SNMP requests from any source IP address.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-16
References: http://www.gnucitizen.org/projects/router-hacking-challenge/; http://www.procheckup.com/Hacking_ZyXEL_Gateways.pdf; http://www.securityfocus.com/archive/1/489009/100/0/threaded
CVE: CVE-2008-1526
Published: 2008-03-26
Description: ZyXEL Prestige routers, including P-660, P-661, and P-662 models with firmware 3.40(PE9) and 3.40(AGD.2) through 3.40(AHQ.3), do not use a salt when calculating an MD5 password hash, which makes it easier for attackers to crack passwords.
CVSS Score: 7.5 (HIGH)
CWE: CWE-916
References: http://www.gnucitizen.org/projects/router-hacking-challenge/; http://www.procheckup.com/Hacking_ZyXEL_Gateways.pdf; http://www.securityfocus.com/archive/1/489009/100/0/threaded
CVE: CVE-2008-1527
Published: 2008-03-26
Description: ZyXEL Prestige routers, including P-660, P-661, and P-662 models with firmware 3.40(PE9) and 3.40(AGD.2) through 3.40(AHQ.3), support authentication over HTTP via a hash string in the hiddenPassword field, which allows remote attackers to obtain access via a replay attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-310
References: http://www.gnucitizen.org/projects/router-hacking-challenge/; http://www.procheckup.com/Hacking_ZyXEL_Gateways.pdf; http://www.securityfocus.com/archive/1/489009/100/0/threaded
CVE: CVE-2008-1528
Published: 2008-03-26
Description: ZyXEL Prestige routers, including P-660, P-661, and P-662 models with firmware 3.40(AGD.2) through 3.40(AHQ.3), allow remote authenticated users to obtain authentication data by making direct HTTP requests and then reading the HTML source, as demonstrated by a request for (1) RemMagSNMP.html, which discloses SNMP communities; or (2) WLAN.html, which discloses WEP keys.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-287
References: http://www.gnucitizen.org/projects/router-hacking-challenge/; http://www.procheckup.com/Hacking_ZyXEL_Gateways.pdf; http://www.securityfocus.com/archive/1/489009/100/0/threaded
CVE: CVE-2008-1529
Published: 2008-03-26
Description: ZyXEL Prestige routers have a minimum password length for the admin account that is too small, which makes it easier for remote attackers to guess passwords via brute force methods.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://www.gnucitizen.org/projects/router-hacking-challenge/; http://www.procheckup.com/Hacking_ZyXEL_Gateways.pdf; http://www.securityfocus.com/archive/1/489009/100/0/threaded
CVE: CVE-2008-0537
Published: 2008-03-27
Description: Unspecified vulnerability in the Supervisor Engine 32 (Sup32), Supervisor Engine 720 (Sup720), and Route Switch Processor 720 (RSP720) for multiple Cisco products, when using Multi Protocol Label Switching (MPLS) VPN and OSPF sham-link, allows remote attackers to cause a denial of service (blocked queue, device restart, or memory leak) via unknown vectors.
CVSS Score: 7.1 (HIGH)
References: http://secunia.com/advisories/29559; http://www.cisco.com/warp/public/707/cisco-sa-20080326-queue.shtml; http://www.securityfocus.com/bid/28463
CVE: CVE-2008-1153
Published: 2008-03-27
Description: Cisco IOS 12.1, 12.2, 12.3, and 12.4, with IPv4 UDP services and the IPv6 protocol enabled, allows remote attackers to cause a denial of service (device crash and possible blocked interface) via a crafted IPv6 packet to the device.
CVSS Score: 7.1 (HIGH)
References: http://secunia.com/advisories/29507; http://www.cisco.com/warp/public/707/cisco-sa-20080326-IPv4IPv6.shtml; http://www.kb.cert.org/vuls/id/936177
CVE: CVE-2008-1156
Published: 2008-03-27
Description: Unspecified vulnerability in the Multicast Virtual Private Network (MVPN) implementation in Cisco IOS 12.0, 12.2, 12.3, and 12.4 allows remote attackers to create "extra multicast states on the core routers" via a crafted Multicast Distribution Tree (MDT) Data Join message.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-16, CWE-200
References: http://secunia.com/advisories/29507; http://www.cisco.com/warp/public/707/cisco-sa-20080326-mvpn.shtml; http://www.securityfocus.com/bid/28464
CVE: CVE-2008-1233
Published: 2008-03-27
Description: Unspecified vulnerability in Mozilla Firefox before 2.0.0.13, Thunderbird before 2.0.0.13, and SeaMonkey before 1.1.9 allows remote attackers to execute arbitrary code via "XPCNativeWrapper pollution."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00002.html; http://rhn.redhat.com/errata/RHSA-2008-0208.html; http://secunia.com/advisories/29391
CVE: CVE-2008-1234
Published: 2008-03-27
Description: Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 2.0.0.13, Thunderbird before 2.0.0.13, and SeaMonkey before 1.1.9 allows remote attackers to inject arbitrary web script or HTML via event handlers, aka "Universal XSS using event handlers."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00002.html; http://rhn.redhat.com/errata/RHSA-2008-0208.html; http://secunia.com/advisories/29391
CVE: CVE-2008-1235
Published: 2008-03-27
Description: Unspecified vulnerability in Mozilla Firefox before 2.0.0.13, Thunderbird before 2.0.0.13, and SeaMonkey before 1.1.9 allows remote attackers to execute arbitrary code via unknown vectors that cause JavaScript to execute with the wrong principal, aka "Privilege escalation via incorrect principals."
CVSS Score: 9.3 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00002.html; http://rhn.redhat.com/errata/RHSA-2008-0208.html; http://secunia.com/advisories/29391
CVE: CVE-2008-1236
Published: 2008-03-27
Description: Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.13, Thunderbird before 2.0.0.13, and SeaMonkey before 1.1.9 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors related to the layout engine.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00002.html; http://rhn.redhat.com/errata/RHSA-2008-0208.html; http://secunia.com/advisories/29391
CVE: CVE-2008-1237
Published: 2008-03-27
Description: Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.13, Thunderbird before 2.0.0.13, and SeaMonkey before 1.1.9 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors related to the JavaScript engine.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2008-05/msg00000.html; http://rhn.redhat.com/errata/RHSA-2008-0208.html
CVE: CVE-2008-1238
Published: 2008-03-27
Description: Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9, when generating the HTTP Referer header, does not list the entire URL when it contains Basic Authentication credentials without a username, which makes it easier for remote attackers to bypass application protection mechanisms that rely on Referer headers, such as with some Cross-Site Request Forgery (CSRF) mechanisms.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00002.html; http://rhn.redhat.com/errata/RHSA-2008-0208.html; http://secunia.com/advisories/29391
CVE: CVE-2008-1241
Published: 2008-03-27
Description: GUI overlay vulnerability in Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9 allows remote attackers to spoof form elements and redirect user inputs via a borderless XUL pop-up window from a background tab.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-59
References: http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00002.html; http://rhn.redhat.com/errata/RHSA-2008-0208.html; http://secunia.com/advisories/29391
CVE: CVE-2008-1150
Published: 2008-03-27
Description: The virtual private dial-up network (VPDN) component in Cisco IOS before 12.3 allows remote attackers to cause a denial of service (resource exhaustion) via a series of PPTP sessions, related to the persistence of interface descriptor block (IDB) data structures after process termination, aka bug ID CSCdv59309.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/29507; http://securitytracker.com/id?1019714; http://www.cisco.com/en/US/products/products_security_advisory09186a[PII_REDACTED].shtml
CVE: CVE-2008-1151
Published: 2008-03-27
Description: Memory leak in the virtual private dial-up network (VPDN) component in Cisco IOS before 12.3 allows remote attackers to cause a denial of service (memory consumption) via a series of PPTP sessions, related to "dead memory" that remains allocated after process termination, aka bug ID CSCsj58566.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/29507; http://securitytracker.com/id?1019714; http://www.cisco.com/en/US/products/products_security_advisory09186a[PII_REDACTED].shtml
CVE: CVE-2008-1152
Published: 2008-03-27
Description: The data-link switching (DLSw) component in Cisco IOS 12.0 through 12.4 allows remote attackers to cause a denial of service (device restart or memory consumption) via crafted (1) UDP port 2067 or (2) IP protocol 91 packets.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/29507; http://www.cisco.com/en/US/products/products_security_advisory09186a[PII_REDACTED].shtml; http://www.securityfocus.com/bid/28465
CVE: CVE-2008-1384
Published: 2008-03-27
Description: Integer overflow in PHP 5.2.5 and earlier allows context-dependent attackers to cause a denial of service and possibly have unspecified other impact via a printf format parameter with a large width specifier, related to the php_sprintf_appendstring function in formatted_print.c and probably other functions for formatted strings (aka *printf functions).
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://cvs.php.net/viewvc.cgi/php-src/NEWS?revision=1.2027.2.547.2.1120&view=markup; http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00001.html; http://secunia.com/advisories/30158
CVE: CVE-2008-1391
Published: 2008-03-27
Description: Multiple integer overflows in libc in NetBSD 4.x, FreeBSD 6.x and 7.x, and probably other BSD and Apple Mac OS platforms allow context-dependent attackers to execute arbitrary code via large values of certain integer fields in the format argument to (1) the strfmon function in lib/libc/stdlib/strfmon.c, related to the GET_NUMBER macro; and (2) the printf function, related to left_prec and right_prec.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/stdlib/strfmon.c; http://lists.apple.com/archives/security-announce//2008//Dec/msg00000.html; http://secunia.com/advisories/29574
CVE: CVE-2008-1530
Published: 2008-03-27
Description: GnuPG (gpg) 1.4.8 and 2.0.8 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted duplicate keys that are imported from key servers, which triggers "memory corruption around deduplication of user IDs."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.gnupg.org/pipermail/gnupg-announce/2008q1/000272.html; http://secunia.com/advisories/29568; http://www.ocert.org/advisories/ocert-2008-1.html
CVE: CVE-2008-1531
Published: 2008-03-27
Description: The connection_state_machine function (connections.c) in lighttpd 1.4.19 and earlier, and 1.5.x before 1.5.0, allows remote attackers to cause a denial of service (active SSL connection loss) by triggering an SSL error, such as disconnecting before a download has finished, which causes all active SSL connections to be lost.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2008-05/msg00000.html; http://secunia.com/advisories/29505; http://secunia.com/advisories/29544
CVE: CVE-2008-1532
Published: 2008-03-28
Description: Perlbal before 1.70, when buffered upload is enabled, allows remote attackers to cause a denial of service (crash) via a zero-byte chunked upload.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://bugs.gentoo.org/show_bug.cgi?id=214784; http://search.cpan.org/src/BRADFITZ/Perlbal-1.70/CHANGES; http://secunia.com/advisories/29565
CVE: CVE-2008-1533
Published: 2008-03-28
Description: Unspecified vulnerability in the XML-RPC Blogger API plugin in Joomla! 1.5 allows remote attackers to perform unauthorized article operations on articles via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/28861; http://www.joomla.org/content/view/4560/1/; http://www.securityfocus.com/bid/27719
CVE: CVE-2008-1240
Published: 2008-03-28
Description: LiveConnect in Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9 does not properly parse the content origin for jar: URIs before sending them to the Java plugin, which allows remote attackers to access arbitrary ports on the local machine.  NOTE: this is closely related to CVE-2008-1195.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00002.html; http://secunia.com/advisories/29526; http://secunia.com/advisories/29539
CVE: CVE-2008-0924
Published: 2008-03-28
Description: Stack-based buffer overflow in the DoLBURPRequest function in libnldap in ndsd in Novell eDirectory 8.7.3.9 and earlier, and 8.8.1 and earlier in the 8.8.x series, allows remote attackers to cause a denial of service (daemon crash or CPU consumption) or execute arbitrary code via a long delRequest LDAP Extended Request message, probably involving a long Distinguished Name (DN) field.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/29476; http://www.securityfocus.com/archive/1/490117/100/0/threaded; http://www.securityfocus.com/bid/28434
CVE: CVE-2008-0926
Published: 2008-03-28
Description: The SOAP interface to the eMBox module in Novell eDirectory 8.7.3.9 and earlier, and 8.8.x before 8.8.2, relies on client-side authentication, which allows remote attackers to bypass authentication via requests for /SOAP URIs, and cause a denial of service (daemon shutdown) or read arbitrary files. NOTE: it was later reported that 8.7.3.10 (aka 8.7.3 SP10) is also affected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/29527; http://www.securityfocus.com/archive/1/491621/100/0/threaded; http://www.securityfocus.com/bid/28441