deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-4591
Published: 2010-01-07
Description: SQL injection vulnerability in Basic Analysis and Security Engine (BASE) before 1.4.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://base.secureideas.net/news.php; http://secunia.com/advisories/37147; http://secureideas.cvs.sourceforge.net/viewvc/secureideas/base-php4/docs/CHANGELOG?revision=1.359&view=markup
CVE: CVE-2009-4592
Published: 2010-01-07
Description: Unspecified vulnerability in base_local_rules.php in Basic Analysis and Security Engine (BASE) before 1.4.4 allows remote attackers to include arbitrary local files via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://base.secureideas.net/news.php; http://secunia.com/advisories/37147; http://secureideas.cvs.sourceforge.net/viewvc/secureideas/base-php4/docs/CHANGELOG?revision=1.359&view=markup
CVE: CVE-2009-4593
Published: 2010-01-07
Description: The bftpdutmp_log function in bftpdutmp.c in Bftpd before 2.4 does not place a '\0' character at the end of the string value of the ut.bu_host structure member, which might allow remote attackers to cause a denial of service (daemon crash) via unspecified vectors. NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
References: http://bftpd.sourceforge.net/downloads/CHANGELOG; http://bftpd.sourceforge.net/news.html#032130; http://secunia.com/advisories/37185
CVE: CVE-2009-4497
Published: 2010-01-07
Description: Cross-site scripting (XSS) vulnerability in LXR Cross Referencer 0.9.5 and 0.9.6 allows remote attackers to inject arbitrary web script or HTML via the i parameter to the ident program.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/38117; http://sourceforge.net/mailarchive/message.php?msg_name=E1NS2s4-0001PE-F2%403bkjzd1.ch3.sourceforge.com; http://secunia.com/advisories/38117
CVE: CVE-2010-0220
Published: 2010-01-07
Description: The nsObserverList::FillObserverArray function in xpcom/ds/nsObserverList.cpp in Mozilla Firefox before 3.5.7 allows remote attackers to cause a denial of service (application crash) via a crafted web site that triggers memory consumption and an accompanying Low Memory alert dialog, and also triggers attempted removal of an observer from an empty observers array.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://hg.mozilla.org/mozilla-central/rev/51396f6c9f20; http://isc.sans.org/diary.html?storyid=7897; http://www.mandriva.com/security/advisories?name=MDVSA-2010:000
CVE: CVE-2010-0221
Published: 2010-01-07
Description: Kingston DataTraveler BlackBox (DTBB), DataTraveler Secure Privacy Edition (DTSP), and DataTraveler Elite Privacy Edition (DTEP) USB flash drives validate passwords with a program running on the host computer rather than the device hardware, which allows physically proximate attackers to access the cleartext drive contents via a modified program.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://blogs.zdnet.com/hardware/?p=6655; http://it.slashdot.org/story/10/01/05/1734242/; http://news.zdnet.co.uk/security/0%2C[PII_REDACTED]%2C39963327%2C00.htm
CVE: CVE-2010-0222
Published: 2010-01-07
Description: Kingston DataTraveler BlackBox (DTBB), DataTraveler Secure Privacy Edition (DTSP), and DataTraveler Elite Privacy Edition (DTEP) USB flash drives use a fixed 256-bit key for obtaining access to the cleartext drive contents, which makes it easier for physically proximate attackers to read or modify data by determining and providing this key.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-310
References: http://blogs.zdnet.com/hardware/?p=6655; http://it.slashdot.org/story/10/01/05/1734242/; http://news.zdnet.co.uk/security/0%2C[PII_REDACTED]%2C39963327%2C00.htm
CVE: CVE-2010-0223
Published: 2010-01-07
Description: Kingston DataTraveler BlackBox (DTBB), DataTraveler Secure Privacy Edition (DTSP), and DataTraveler Elite Privacy Edition (DTEP) USB flash drives do not prevent password replay attacks, which allows physically proximate attackers to access the cleartext drive contents by providing a key that was captured in a USB data stream at an earlier time.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://www.kingston.com/driveupdate/; http://www.syss.de/fileadmin/ressources/040_veroeffentlichungen/dokumente/SySS_knackt_Kingston_USB-Stick.pdf; http://www.syss.de/index.php?id=108&tx_ttnews%5Btt_news%5D=528&cHash=8d16fa63d9
CVE: CVE-2010-0224
Published: 2010-01-07
Description: SanDisk Cruzer Enterprise USB flash drives validate passwords with a program running on the host computer rather than the device hardware, which allows physically proximate attackers to access the cleartext drive contents via a modified program.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-255
References: http://blogs.zdnet.com/hardware/?p=6655; http://it.slashdot.org/story/10/01/05/1734242/; http://securitytracker.com/id?1023408
CVE: CVE-2010-0225
Published: 2010-01-07
Description: SanDisk Cruzer Enterprise USB flash drives use a fixed 256-bit key for obtaining access to the cleartext drive contents, which makes it easier for physically proximate attackers to read or modify data by determining and providing this key.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-312
References: http://blogs.zdnet.com/hardware/?p=6655; http://it.slashdot.org/story/10/01/05/1734242/; http://www.h-online.com/security/news/item/NIST-certified-USB-Flash-drives-with-hardware-encryption-cracked-895308.html
CVE: CVE-2010-0226
Published: 2010-01-07
Description: SanDisk Cruzer Enterprise USB flash drives do not prevent password replay attacks, which allows physically proximate attackers to access the cleartext drive contents by providing a key that was captured in a USB data stream at an earlier time.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-255
References: http://www.sandisk.com/business-solutions/enterprise/technical-support/security-bulletin-december-2009; http://www.securityfocus.com/bid/37677; http://www.syss.de/fileadmin/ressources/040_veroeffentlichungen/dokumente/SySS_knackt_SanDisk_USB-Stick.pdf
CVE: CVE-2010-0227
Published: 2010-01-07
Description: Verbatim Corporate Secure and Corporate Secure FIPS Edition USB flash drives validate passwords with a program running on the host computer rather than the device hardware, which allows physically proximate attackers to access the cleartext drive contents via a modified program.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-255
References: http://blogs.zdnet.com/hardware/?p=6655; http://it.slashdot.org/story/10/01/05/1734242/; http://securitytracker.com/id?1023409
CVE: CVE-2010-0228
Published: 2010-01-07
Description: Verbatim Corporate Secure and Corporate Secure FIPS Edition USB flash drives use a fixed 256-bit key for obtaining access to the cleartext drive contents, which makes it easier for physically proximate attackers to read or modify data by determining and providing this key.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-310
References: http://blogs.zdnet.com/hardware/?p=6655; http://it.slashdot.org/story/10/01/05/1734242/; http://www.h-online.com/security/news/item/NIST-certified-USB-Flash-drives-with-hardware-encryption-cracked-895308.html
CVE: CVE-2010-0229
Published: 2010-01-07
Description: Verbatim Corporate Secure and Corporate Secure FIPS Edition USB flash drives do not prevent password replay attacks, which allows physically proximate attackers to access the cleartext drive contents by providing a key that was captured in a USB data stream at an earlier time.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-255
References: http://www.verbatim.com/security/security-update.cfm; https://www.ironkey.com/usb-flash-drive-flaw-exposed; http://www.verbatim.com/security/security-update.cfm
CVE: CVE-2009-3742
Published: 2010-01-07
Description: Cross-site scripting (XSS) vulnerability in Liferay Portal before 5.3.0 allows remote attackers to inject arbitrary web script or HTML via the p_p_id parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://issues.liferay.com/browse/LPS-6034; http://www.kb.cert.org/vuls/id/750796; http://issues.liferay.com/browse/LPS-6034
CVE: CVE-2009-3952
Published: 2010-01-08
Description: Buffer overflow in Adobe Illustrator CS3 13.0.3 and earlier and Illustrator CS4 14.0.0 allows attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.adobe.com/support/security/bulletins/apsb10-01.html; http://www.securityfocus.com/bid/37666; http://www.adobe.com/support/security/bulletins/apsb10-01.html
CVE: CVE-2009-4009
Published: 2010-01-08
Description: Buffer overflow in PowerDNS Recursor before 3.1.7.2 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via crafted packets.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://doc.powerdns.com/powerdns-advisory-2010-01.html; http://secunia.com/advisories/38004; http://secunia.com/advisories/38068
CVE: CVE-2009-4010
Published: 2010-01-08
Description: Unspecified vulnerability in PowerDNS Recursor before 3.1.7.2 allows remote attackers to spoof DNS data via crafted zones.
CVSS Score: 7.5 (HIGH)
References: http://doc.powerdns.com/powerdns-advisory-2010-02.html; http://secunia.com/advisories/38004; http://secunia.com/advisories/38068
CVE: CVE-2010-0012
Published: 2010-01-08
Description: Directory traversal vulnerability in libtransmission/metainfo.c in Transmission 1.22, 1.34, 1.75, and 1.76 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in a pathname within a .torrent file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html; http://secunia.com/advisories/37993; http://secunia.com/advisories/38005
CVE: CVE-2010-0271
Published: 2010-01-08
Description: hald in Sun OpenSolaris snv_51 through snv_130 does not have the proc_audit privilege during unspecified attempts to write to the auditing log, which makes it easier for physically proximate attackers to avoid detection of changes to the set of connected hardware devices supporting the Hardware Abstraction Layer (HAL) specification.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://sunsolve.sun.com/search/document.do?assetkey=1-66-274830-1; http://www.securityfocus.com/bid/37656; http://www.securitytracker.com/id?1023416
CVE: CVE-2010-0272
Published: 2010-01-08
Description: Heap-based buffer overflow in Sun Java System Web Server 7.0 Update 6 on Linux allows remote attackers to discover process memory locations via crafted data to TCP port 80, as demonstrated by the vd_sjws2 module in VulnDisco.  NOTE: as of 20100106, this disclosure has no actionable information. However, because the VulnDisco author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://intevydis.com/sjws_demo.html; http://www.intevydis.com/blog/?p=102; https://exchange.xforce.ibmcloud.com/vulnerabilities/55527
CVE: CVE-2010-0273
Published: 2010-01-08
Description: Unspecified vulnerability in Sun Java System Web Server 7.0 Update 6 on Linux allows remote attackers to execute arbitrary code by sending a process memory address and crafted data to TCP port 80, as demonstrated by the vd_sjws2 module in VulnDisco.  NOTE: as of 20100106, this disclosure has no actionable information. However, because the VulnDisco author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
CVSS Score: 7.5 (HIGH)
References: http://intevydis.com/sjws_demo.html; http://www.intevydis.com/blog/?p=102; http://intevydis.com/sjws_demo.html
CVE: CVE-2009-4486
Published: 2010-01-08
Description: Stack-based buffer overflow in the eDirectory plugin in Novell iManager before 2.7.3 allows remote attackers to execute arbitrary code via vectors that trigger long arguments to an unspecified sub-application, related to importing and exporting from a schema.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://osvdb.org/61584; http://secunia.com/advisories/38030; http://www.novell.com/support/viewContent.do?externalId=7004985&sliceId=1
CVE: CVE-2009-4594
Published: 2010-01-09
Description: Unspecified vulnerability in IBM Lotus iNotes (aka Domino Web Access or DWA) before 229.131 for Domino 8.0.x has unknown impact and attack vectors, aka SPR SDOY7RHBNH.
CVSS Score: 10.0 (HIGH)
References: http://www-01.ibm.com/support/docview.wss?uid=swg27015942; http://www-01.ibm.com/support/docview.wss?uid=swg27016085; http://www-01.ibm.com/support/docview.wss?uid=swg27017776
CVE: CVE-2010-0013
Published: 2010-01-09
Description: Directory traversal vulnerability in slp.c in the MSN protocol plugin in libpurple in Pidgin 2.6.4 and Adium 1.3.8 allows remote attackers to read arbitrary files via a .. (dot dot) in an application/x-msnmsgrp2p MSN emoticon (aka custom smiley) request, a related issue to CVE-2004-0122.  NOTE: it could be argued that this is resultant from a vulnerability in which an emoticon download request is processed even without a preceding text/x-mms-emoticon message that announced availability of the emoticon.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://d.pidgin.im/viewmtn/revision/info/3d02401cf232459fc80c0837d31e05fae7ae5467; http://d.pidgin.im/viewmtn/revision/info/4be2df4f72bd8a55cdae7f2554b73342a497c92f; http://d.pidgin.im/viewmtn/revision/info/c64a1adc8bda2b4aeaae1f273541afbc4f71b810
CVE: CVE-2010-0274
Published: 2010-01-09
Description: Unspecified vulnerability in the Edit Contact scene in Ultra-light Mode in IBM Lotus iNotes (aka Domino Web Access or DWA) before 229.241 for Domino 8.0.2 FP3 has unknown impact and attack vectors, aka SPR LSHR7TBLY5.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/38026; http://www-01.ibm.com/support/docview.wss?uid=swg27017776; http://www.securityfocus.com/bid/37675
CVE: CVE-2010-0275
Published: 2010-01-09
Description: Ultra-light Mode in IBM Lotus iNotes (aka Domino Web Access or DWA) before 229.241 for Domino 8.0.2 FP3 does not properly handle script commands in the status-alerts URL, which has unspecified impact and attack vectors, aka SPR LSHR7TBM58.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/38026; http://www-01.ibm.com/support/docview.wss?uid=swg27017776; http://www.securityfocus.com/bid/37675
CVE: CVE-2010-0276
Published: 2010-01-09
Description: IBM Lotus iNotes (aka Domino Web Access or DWA) before 229.241 for Domino 8.0.2 FP3 does not properly handle navigation of the "Try Lotus iNotes anyway" link from the page that reports use of an unsupported browser, which has unspecified impact and attack vectors, aka SPR LSHR7TBMQU.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/38026; http://www-01.ibm.com/support/docview.wss?uid=swg27017776; http://www.securityfocus.com/bid/37675
CVE: CVE-2010-0277
Published: 2010-01-09
Description: slp.c in the MSN protocol plugin in libpurple in Pidgin before 2.6.6, including 2.6.4, and Adium 1.3.8 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a malformed MSNSLP INVITE request in an SLP message, a different issue than CVE-2010-0013.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://blogs.sun.com/security/entry/cve_2010_0277_malformed_msn; http://developer.pidgin.im/wiki/ChangeLog; http://events.ccc.de/congress/2009/Fahrplan/events/3596.en.html
CVE: CVE-2009-4536
Published: 2010-01-12
Description: drivers/net/e1000/e1000_main.c in the e1000 driver in the Linux kernel 2.6.32.3 and earlier handles Ethernet frames that exceed the MTU by processing certain trailing payload data as if it were a complete frame, which allows remote attackers to bypass packet filters via a large packet with a crafted payload.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2009-1385.
CVSS Score: 7.8 (HIGH)
CWE: CWE-189
References: http://blog.c22.cc/2009/12/27/26c3-cat-procsysnetipv4fuckups/; http://events.ccc.de/congress/2009/Fahrplan/events/3596.en.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035159.html
CVE: CVE-2009-4537
Published: 2010-01-12
Description: drivers/net/r8169.c in the r8169 driver in the Linux kernel 2.6.32.3 and earlier does not properly check the size of an Ethernet frame that exceeds the MTU, which allows remote attackers to (1) cause a denial of service (temporary network outage) via a packet with a crafted size, in conjunction with certain packets containing A characters and certain packets containing E characters; or (2) cause a denial of service (system crash) via a packet with a crafted size, in conjunction with certain packets containing '\0' characters, related to the value of the status register and erroneous behavior associated with the RxMaxSize register.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2009-1389.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://blog.c22.cc/2009/12/27/26c3-cat-procsysnetipv4fuckups/; http://events.ccc.de/congress/2009/Fahrplan/events/3596.en.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035159.html
CVE: CVE-2009-4538
Published: 2010-01-12
Description: drivers/net/e1000e/netdev.c in the e1000e driver in the Linux kernel 2.6.32.3 and earlier does not properly check the size of an Ethernet frame that exceeds the MTU, which allows remote attackers to have an unspecified impact via crafted packets, a related issue to CVE-2009-4537.
CVSS Score: 10.0 (HIGH)
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035159.html; http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00008.html
CVE: CVE-2009-4595
Published: 2010-01-12
Description: SQL injection vulnerability in index.php in PHP Inventory 1.2 allows remote authenticated users to execute arbitrary SQL commands via the sup_id parameter in a suppliers details action.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/37672; http://secunia.com/advisories/37672
CVE: CVE-2009-4596
Published: 2010-01-12
Description: Cross-site scripting (XSS) vulnerability in index.php in PHP Inventory 1.2 allows remote attackers to inject arbitrary web script or HTML via the sup_id parameter in a suppliers details action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0912-exploits/phpinventory-sql.txt; http://www.exploit-db.com/exploits/10370; https://exchange.xforce.ibmcloud.com/vulnerabilities/54667
CVE: CVE-2009-4597
Published: 2010-01-12
Description: Multiple SQL injection vulnerabilities in index.php in PHP Inventory 1.2 allow (1) remote authenticated users to execute arbitrary SQL commands via the user_id parameter in a users details action, and allow remote attackers to execute arbitrary SQL commands via the (2) user (username) and (3) pass (password) parameters.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0912-exploits/phpinventory-sql.txt; http://secunia.com/advisories/37672; http://www.exploit-db.com/exploits/10370
CVE: CVE-2009-4598
Published: 2010-01-12
Description: SQL injection vulnerability in the JPhoto (com_jphoto) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a category action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/60864; http://packetstormsecurity.org/0912-exploits/joomlajphoto-sql.txt; http://secunia.com/advisories/37676
CVE: CVE-2009-4599
Published: 2010-01-12
Description: Multiple SQL injection vulnerabilities in the JS Jobs (com_jsjobs) component 1.0.5.6 for Joomla! allow remote attackers to execute arbitrary SQL commands via (1) the md parameter in an employer view_company action to index.php or (2) the oi parameter in an employer view_job action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0912-exploits/joomlajobs-sql.txt; http://www.exploit-db.com/exploits/10366; http://www.securityfocus.com/bid/37281
CVE: CVE-2009-4600
Published: 2010-01-12
Description: SQL injection vulnerability in realestate20/loginaction.php in NetArt Media Real Estate Portal 2.0 allows remote attackers to execute arbitrary SQL commands via the Email parameter (aka the username field).  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/60866; http://secunia.com/advisories/37633; http://www.exploit-db.com/exploits/10361
CVE: CVE-2009-4601
Published: 2010-01-12
Description: Cross-site scripting (XSS) vulnerability in basic_search_result.php in Zeeways ZeeJobsite 3x allows remote attackers to inject arbitrary web script or HTML via the title parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0912-exploits/zeejob-xss.txt; http://secunia.com/advisories/37667; http://www.securityfocus.com/bid/37290
CVE: CVE-2009-4602
Published: 2010-01-12
Description: Cross-site scripting (XSS) vulnerability in the Randomizer module 5.x through 5.x-1.0 and 6.x through 6.x-1.0, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/655668; http://www.securityfocus.com/bid/37274; http://www.vupen.com/english/advisories/2009/3476
CVE: CVE-2009-4603
Published: 2010-01-12
Description: Unspecified vulnerability in sapstartsrv.exe in the SAP Kernel 6.40, 7.00, 7.01, 7.10, 7.11, and 7.20, as used in SAP NetWeaver 7.x and SAP Web Application Server 6.x and 7.x, allows remote attackers to cause a denial of service (Management Console shutdown) via a crafted request. NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/37684; http://www.cybsec.com/vuln/CYBSEC_SAP_sapstartsrv_DoS.pdf; http://www.securityfocus.com/bid/37286
CVE: CVE-2009-4604
Published: 2010-01-12
Description: PHP remote file inclusion vulnerability in mamboleto.php in the Fernando Soares Mamboleto (com_mamboleto) component 2.0 RC3 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.org/0912-exploits/joomlamamboleto-rfi.txt; http://www.exploit-db.com/exploits/10369; http://www.securityfocus.com/bid/37280
CVE: CVE-2010-0278
Published: 2010-01-12
Description: A certain ActiveX control in msgsc.14.0.8089.726.dll in Microsoft Windows Live Messenger 2009 build 14.0.8089.726 on Windows Vista and Windows 7 allows remote attackers to cause a denial of service (msnmsgr.exe crash) by calling the ViewProfile method with a crafted argument during an MSN Messenger session.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/archive/1/508811/100/0/threaded; http://www.securityfocus.com/bid/37680; http://www.securityfocus.com/archive/1/508811/100/0/threaded
CVE: CVE-2009-1996
Published: 2010-01-13
Description: Unspecified vulnerability in the Logical Standby component in Oracle Database allows remote authenticated users to affect integrity via unknown vectors.
CVSS Score: 4.0 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html; http://www.us-cert.gov/cas/techalerts/TA10-012A.html; http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html
CVE: CVE-2009-3410
Published: 2010-01-13
Description: Unspecified vulnerability in the RDBMS component in Oracle Database 11.1.0.7, 10.2.0.3, 10.2.0.4, 10.1.0.5, 9.2.0.8, and 9.2.0.8DV allows remote authenticated users to affect confidentiality and integrity via unknown vectors.
CVSS Score: 3.6 (LOW)
References: http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html; http://www.us-cert.gov/cas/techalerts/TA10-012A.html; http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html