deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-0974
Published: 2009-04-15
Description: Unspecified vulnerability in the Portal component in Oracle Application Server 10.1.2.3 and 10.1.4.2 allows remote attackers to affect integrity via unknown vectors, a different vulnerability than CVE-2009-0983 and CVE-2009-3407.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/53751; http://secunia.com/advisories/34693; http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html
CVE: CVE-2009-0975
Published: 2009-04-15
Description: Unspecified vulnerability in the Workspace Manager component in Oracle Database 10.2.0.4 and 11.1.0.6 allows remote authenticated users to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2009-0978.
CVSS Score: 5.5 (MEDIUM)
References: http://osvdb.org/53732; http://secunia.com/advisories/34693; http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html
CVE: CVE-2009-0976
Published: 2009-04-15
Description: Unspecified vulnerability in the Workspace Manager component in Oracle Database 10.2.0.4 and 11.1.0.6 allows remote authenticated users to affect confidentiality and integrity, related to LTADM.
CVSS Score: 5.5 (MEDIUM)
References: http://osvdb.org/53733; http://secunia.com/advisories/34693; http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html
CVE: CVE-2009-0977
Published: 2009-04-15
Description: Unspecified vulnerability in the Advanced Queuing component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3 allows remote authenticated users to affect confidentiality and integrity, related to DBMS_AQIN.  NOTE: the previous information was obtained from the April 2009 CPU.  Oracle has not commented on reliable researcher claims that this issue is SQL injection in the GRANT_TYPE_ACCESS procedure in the DBMS_AQADM_SYS package.
CVSS Score: 5.5 (MEDIUM)
References: http://secunia.com/advisories/34693; http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html; http://www.red-database-security.com/advisory/oracle_sql_injection_dbms_aqadm_sys.html
CVE: CVE-2009-0978
Published: 2009-04-15
Description: Unspecified vulnerability in the Workspace Manager component in Oracle Database 10.2.0.4 and 11.1.0.6 allows remote authenticated users to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2009-0975.
CVSS Score: 5.5 (MEDIUM)
References: http://osvdb.org/53734; http://secunia.com/advisories/34693; http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html
CVE: CVE-2009-0979
Published: 2009-04-15
Description: Unspecified vulnerability in the Resource Manager component in Oracle Database 9.2.0.8 and 9.2.0.8DV allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.
CVSS Score: 9.0 (HIGH)
References: http://secunia.com/advisories/34693; http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html; http://www.securityfocus.com/bid/34461
CVE: CVE-2009-0980
Published: 2009-04-15
Description: Unspecified vulnerability in the SQLX Functions component in Oracle Database 10.2.0.3 and 11.1.0.6 allows remote authenticated users to affect integrity and availability, related to AGGXQIMP.
CVSS Score: 5.5 (MEDIUM)
References: http://secunia.com/advisories/34693; http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html; http://www.securityfocus.com/bid/34461
CVE: CVE-2009-0981
Published: 2009-04-15
Description: Unspecified vulnerability in the Application Express component in Oracle Database 11.1.0.7 allows remote authenticated users to affect confidentiality, related to APEX.  NOTE: the previous information was obtained from the April 2009 CPU.  Oracle has not commented on reliable researcher claims that this issue allows remote authenticated users to obtain APEX password hashes from the WWV_FLOW_USERS table via a SELECT statement.
CVSS Score: 4.0 (MEDIUM)
References: http://osvdb.org/53738; http://secunia.com/advisories/34693; http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html
CVE: CVE-2009-0982
Published: 2009-04-15
Description: Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.49.19 allows remote authenticated users to affect integrity via unknown vectors.
CVSS Score: 4.0 (MEDIUM)
References: http://osvdb.org/53759; http://secunia.com/advisories/34693; http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html
CVE: CVE-2009-0983
Published: 2009-04-15
Description: Unspecified vulnerability in the Portal component in Oracle Application Server 10.1.2.3 and 10.1.4.2 allows remote attackers to affect integrity via unknown vectors, a different vulnerability than CVE-2009-0974 and CVE-2009-3407.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/53752; http://secunia.com/advisories/34693; http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html
CVE: CVE-2009-0984
Published: 2009-04-15
Description: Unspecified vulnerability in the Database Vault component in Oracle Database 9.2.0.8DV, 10.2.0.4, and 11.1.0.6 allows remote authenticated users to affect confidentiality and integrity, related to DBMS_SYS_SQL.
CVSS Score: 5.5 (MEDIUM)
References: http://secunia.com/advisories/34693; http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html; http://www.securityfocus.com/bid/34461
CVE: CVE-2009-0985
Published: 2009-04-15
Description: Unspecified vulnerability in the Core RDBMS component in Oracle Database 10.1.0.5, 10.2.0.4, and 11.1.0.6 allows remote authenticated users with the IMP_FULL_DATABASE role to affect confidentiality, integrity, and availability.
CVSS Score: 7.1 (HIGH)
References: http://secunia.com/advisories/34693; http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html; http://www.securityfocus.com/bid/34461
CVE: CVE-2009-0986
Published: 2009-04-15
Description: Unspecified vulnerability in the Workspace Manager component in Oracle Database 10.2.0.4 and 11.1.0.6 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.
CVSS Score: 5.4 (MEDIUM)
References: http://osvdb.org/53735; http://secunia.com/advisories/34693; http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html
CVE: CVE-2009-0988
Published: 2009-04-15
Description: Unspecified vulnerability in the Password Policy component in Oracle Database 11.1.0.6 allows remote authenticated users to affect confidentiality via unknown vectors.
CVSS Score: 2.1 (LOW)
References: http://osvdb.org/53740; http://secunia.com/advisories/34693; http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html
CVE: CVE-2009-0989
Published: 2009-04-15
Description: Unspecified vulnerability in the BI Publisher component in Oracle Application Server 5.6.2, 10.1.3.2.1, and 10.1.3.3.3 allows remote authenticated users to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2009-0990.
CVSS Score: 5.5 (MEDIUM)
References: http://osvdb.org/53742; http://secunia.com/advisories/34693; http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html
CVE: CVE-2009-0990
Published: 2009-04-15
Description: Unspecified vulnerability in the BI Publisher component in Oracle Application Server 5.6.2, 10.1.3.2.1, and 10.1.3.3.3 allows remote authenticated users to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2009-0989.
CVSS Score: 5.5 (MEDIUM)
References: http://osvdb.org/53743; http://secunia.com/advisories/34693; http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html
CVE: CVE-2009-0991
Published: 2009-04-15
Description: Unspecified vulnerability in the Listener component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.4, and 11.1.0.7 allows remote attackers to affect availability via unknown vectors, a different vulnerability than CVE-2009-1970.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/53737; http://secunia.com/advisories/34693; http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html
CVE: CVE-2009-0992
Published: 2009-04-15
Description: Unspecified vulnerability in the Advanced Queuing component in Oracle Database 10.1.0.5, 10.2.0.4, and 11.1.0.7 allows remote authenticated users to affect confidentiality and integrity, related to DBMS_AQIN. NOTE: the previous information was obtained from the April 2009 CPU. Oracle has not commented on reliable researcher claims that this issue is SQL injection in the DEQ_EXEJOB procedure.
CVSS Score: 5.5 (MEDIUM)
References: http://secunia.com/advisories/34693; http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html; http://www.red-database-security.com/advisory/oracle_sql_injection_dbms_aqin.html
CVE: CVE-2009-0993
Published: 2009-04-15
Description: Unspecified vulnerability in the OPMN component in Oracle Application Server 10.1.2.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information was obtained from the April 2009 CPU.  Oracle has not commented on reliable researcher claims that this issue is a format string vulnerability that allows remote attackers to execute arbitrary code via format string specifiers in an HTTP POST URI, which are not properly handled when logging to opmn/logs/opmn.log.
CVSS Score: 7.5 (HIGH)
References: http://secunia.com/advisories/34693; http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html; http://www.securityfocus.com/archive/1/502683/100/0/threaded
CVE: CVE-2009-0994
Published: 2009-04-15
Description: Unspecified vulnerability in the BI Publisher component in Oracle Application Server 5.6.2, 10.1.3.2.1, 10.1.3.3.3, and 10.1.3.4 allows remote authenticated users to affect confidentiality via unknown vectors, a different vulnerability than CVE-2009-1017.
CVSS Score: 4.0 (MEDIUM)
References: http://osvdb.org/53744; http://secunia.com/advisories/34693; http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html
CVE: CVE-2009-0995
Published: 2009-04-15
Description: Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 12.0.6 and 11i10CU2 allows remote attackers to affect integrity via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/53754; http://secunia.com/advisories/34693; http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html
CVE: CVE-2009-0996
Published: 2009-04-15
Description: Unspecified vulnerability in the BI Publisher component in Oracle Application Server 10.1.3.2.1, 10.1.3.3.3, and 10.1.3.4 allows remote authenticated users to affect confidentiality via unknown vectors.
CVSS Score: 4.0 (MEDIUM)
References: http://osvdb.org/53745; http://secunia.com/advisories/34693; http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html
CVE: CVE-2009-0997
Published: 2009-04-15
Description: Unspecified vulnerability in the Database Vault component in Oracle Database 11.1.0.6 allows remote authenticated users to affect confidentiality, related to DBMS_SYS_SQL.
CVSS Score: 4.0 (MEDIUM)
References: http://osvdb.org/53739; http://secunia.com/advisories/34693; http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html
CVE: CVE-2009-0998
Published: 2009-04-15
Description: Unspecified vulnerability in the PeopleSoft Enterprise HRMS - eBenefits component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.9.18 and 9.0.8 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.
CVSS Score: 5.5 (MEDIUM)
References: http://osvdb.org/53758; http://secunia.com/advisories/34693; http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html
CVE: CVE-2009-0999
Published: 2009-04-15
Description: Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 12.0.6 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/53753; http://secunia.com/advisories/34693; http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html
CVE: CVE-2009-1000
Published: 2009-04-15
Description: The Oracle Applications Framework component in Oracle E-Business Suite 12.0.6 and 11i10CU2 uses default passwords for unspecified "FND Applications Users (not DB users)," which has unknown impact and attack vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://osvdb.org/53755; http://secunia.com/advisories/34693; http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html
CVE: CVE-2009-1001
Published: 2009-04-15
Description: Unspecified vulnerability in Oracle BEA WebLogic Portal 8.1 Gold through SP6 allows remote authenticated users to gain privileges via unknown vectors.
CVSS Score: 5.5 (MEDIUM)
References: http://osvdb.org/53767; http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html; http://www.oracle.com/technology/deploy/security/wls-security/1001.html
CVE: CVE-2009-1002
Published: 2009-04-15
Description: Unspecified vulnerability in Oracle BEA WebLogic Server 10.3, 10.0 Gold through MP1, 9.2 Gold through MP3, 9.1, 9.0, 8.1 Gold through SP6, and 7.0 Gold through SP7 allows remote attackers to gain privileges via unknown vectors.
CVSS Score: 5.8 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html; http://www.oracle.com/technology/deploy/security/wls-security/1002.html; http://www.securityfocus.com/bid/34461
CVE: CVE-2009-1003
Published: 2009-04-15
Description: Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, and 9.0 allows remote attackers to affect integrity via unknown vectors related to "access to source code of web pages."
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/53762; http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html; http://www.oracle.com/technology/deploy/security/wls-security/1003.html
CVE: CVE-2009-1004
Published: 2009-04-15
Description: Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 10.3 allows remote attackers to affect confidentiality and integrity via unknown vectors.
CVSS Score: 4.0 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html; http://www.securityfocus.com/bid/34461; http://www.securitytracker.com/id?1022059
CVE: CVE-2009-1005
Published: 2009-04-15
Description: Unspecified vulnerability in the Oracle Data Service Integrator (AquaLogic Data Services Platform) component in BEA Product Suite 10.3.0, 3.2, 3.0.1, and 3.0 allows local users to affect confidentiality, integrity, and availability via unknown vectors.
CVSS Score: 4.1 (MEDIUM)
References: http://osvdb.org/53760; http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html; http://www.oracle.com/technology/deploy/security/wls-security/1005.html
CVE: CVE-2009-1006
Published: 2009-04-15
Description: Unspecified vulnerability in the JRockit component in BEA Product Suite R27.6.2 and earlier, with SDK/JRE 1.4.2, JRE/JDK 5, and JRE/JDK 6, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html; http://www.securityfocus.com/bid/34461; http://www.securitytracker.com/id?1022059
CVE: CVE-2009-1008
Published: 2009-04-15
Description: Unspecified vulnerability in the Outside In Technology component in Oracle Application Server 8.2.2 and 8.3.0 allows local users to affect confidentiality, integrity, and availability, related to HTML, a different vulnerability than CVE-2009-1010.
CVSS Score: 4.4 (MEDIUM)
References: http://osvdb.org/53747; http://secunia.com/advisories/34693; http://www-01.ibm.com/support/docview.wss?uid=swg21660640
CVE: CVE-2009-1009
Published: 2009-04-15
Description: Unspecified vulnerability in the Outside In Technology component in Oracle Application Server 8.1.9 allows local users to affect confidentiality, integrity, and availability, related to HTML.
CVSS Score: 4.4 (MEDIUM)
References: http://osvdb.org/53748; http://secunia.com/advisories/34693; http://www-01.ibm.com/support/docview.wss?uid=swg21660640
CVE: CVE-2009-1010
Published: 2009-04-15
Description: Unspecified vulnerability in the Outside In Technology component in Oracle Application Server 8.2.2 and 8.3.0 allows local users to affect confidentiality, integrity, and availability, related to HTML, a different vulnerability than CVE-2009-1008.
CVSS Score: 4.4 (MEDIUM)
References: http://osvdb.org/53749; http://secunia.com/advisories/34693; http://www-01.ibm.com/support/docview.wss?uid=swg21660640
CVE: CVE-2009-1011
Published: 2009-04-15
Description: Unspecified vulnerability in the Outside In Technology component in Oracle Application Server 8.2.2 and 8.3.0 allows local users to affect confidentiality, integrity, and availability, related to HTML.  NOTE: the previous information was obtained from the April 2009 CPU.  Oracle has not commented on reliable researcher claims that this issue is for multiple integer overflows in a function that parses an optional data stream within a Microsoft Office file, leading to a heap-based buffer overflow.
CVSS Score: 4.4 (MEDIUM)
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=798; http://osvdb.org/53750; http://secunia.com/advisories/34693
CVE: CVE-2009-1012
Published: 2009-04-15
Description: Unspecified vulnerability in the plug-ins for Apache and IIS web servers in Oracle BEA WebLogic Server 7.0 Gold through SP7, 8.1 Gold through SP6, 9.0, 9.1, 9.2 Gold through MP3, 10.0 Gold through MP1, and 10.3 allows remote attackers to affect confidentiality, integrity, and availability.  NOTE: the previous information was obtained from the April 2009 CPU.  Oracle has not commented on claims from a reliable researcher that this is an integer overflow in an unspecified plug-in that parses HTTP requests, which leads to a heap-based buffer overflow.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/53765; http://secunia.com/secunia_research/2009-22/; http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html
CVE: CVE-2009-1013
Published: 2009-04-15
Description: Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.49.19 allows remote attackers to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2009-1014.
CVSS Score: 6.4 (MEDIUM)
References: http://osvdb.org/53756; http://secunia.com/advisories/34693; http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html
CVE: CVE-2009-1014
Published: 2009-04-15
Description: Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.49.19 allows remote attackers to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2009-1013.
CVSS Score: 5.8 (MEDIUM)
References: http://osvdb.org/53757; http://secunia.com/advisories/34693; http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html
CVE: CVE-2009-1016
Published: 2009-04-15
Description: Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP6, and 7.0 SP7 allows remote authenticated users to affect confidentiality, integrity, and availability, related to IIS.  NOTE: the previous information was obtained from the April 2009 CPU.  Oracle has not commented on claims from a reliable researcher that this is a stack-based buffer overflow involving an unspecified Server Plug-in and a crafted SSL certificate.
CVSS Score: 8.5 (HIGH)
References: http://secunia.com/secunia_research/2009-23/; http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html; http://www.securityfocus.com/bid/34461
CVE: CVE-2009-1017
Published: 2009-04-15
Description: Unspecified vulnerability in the BI Publisher component in Oracle Application Server 5.6.2, 10.1.3.2.1, 10.1.3.3.3, and 10.1.3.4 allows remote authenticated users to affect confidentiality via unknown vectors, a different vulnerability than CVE-2009-0994.
CVSS Score: 4.0 (MEDIUM)
References: http://osvdb.org/53746; http://secunia.com/advisories/34693; http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html
CVE: CVE-2009-1119
Published: 2009-04-15
Description: Multiple heap-based buffer overflows in EMC RepliStor 6.2 before SP5 and 6.3 before SP2 allow remote attackers to execute arbitrary code via a crafted message to (1) ctrlservice.exe or (2) rep_srv.exe, possibly related to an integer overflow.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/34699; http://www.fortiguardcenter.com/advisory/FGA-2009-13.html; http://www.securityfocus.com/archive/1/502575/100/0/threaded
CVE: CVE-2007-2238
Published: 2009-04-16
Description: Multiple stack-based buffer overflows in the Whale Client Components ActiveX control (WhlMgr.dll), as used in Microsoft Intelligent Application Gateway (IAG) before 3.7 SP2, allow remote attackers to execute arbitrary code via long arguments to the (1) CheckForUpdates or (2) UpdateComponents methods.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/34725; http://www.kb.cert.org/vuls/id/789121; http://www.securityfocus.com/bid/34532
CVE: CVE-2008-4830
Published: 2009-04-16
Description: Insecure method vulnerability in the KWEdit ActiveX control in SAP GUI 6.40 Patch 29 (KWEDIT.DLL 6400.1.1.41) and 7.10 Patch 5 (KWEDIT.DLL 7100.1.1.43) allows remote attackers to (1) overwrite arbitrary files via the SaveDocumentAs method or (2) read or execute arbitrary files via the OpenDocument method.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/32869; http://secunia.com/secunia_research/2008-56/; http://www.securityfocus.com/archive/1/502698/100/0/threaded
CVE: CVE-2008-5259
Published: 2009-04-16
Description: Integer signedness error in DivX Web Player 1.4.2.7, and possibly earlier versions, allows remote attackers to execute arbitrary code via a DivX file containing a crafted Stream Format (STRF) chunk, which triggers a heap-based buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://secunia.com/advisories/33196; http://secunia.com/secunia_research/2008-57/; http://www.securityfocus.com/archive/1/502701/100/0/threaded
CVE: CVE-2009-0196
Published: 2009-04-16
Description: Heap-based buffer overflow in the big2_decode_symbol_dict function (jbig2_symbol_dict.c) in the JBIG2 decoding library (jbig2dec) in Ghostscript 8.64, and probably earlier versions, allows remote attackers to execute arbitrary code via a PDF file with a JBIG2 symbol dictionary segment with a large run length value.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html; http://osvdb.org/53492
CVE: CVE-2009-0579
Published: 2009-04-16
Description: Linux-PAM before 1.0.4 does not enforce the minimum password age (MINDAYS) as specified in /etc/shadow, which allows local users to bypass intended security policy and change their passwords sooner than specified.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=514437; http://secunia.com/advisories/34728; http://secunia.com/advisories/34733
CVE: CVE-2009-1285
Published: 2009-04-16
Description: Static code injection vulnerability in the getConfigFile function in setup/lib/ConfigFile.class.php in phpMyAdmin 3.x before 3.1.3.2 allows remote attackers to inject arbitrary PHP code into configuration files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_3_1_3/phpMyAdmin/setup/lib/ConfigFile.class.php?r1=12248&r2=12301&pathrev=12342; http://secunia.com/advisories/34727; http://secunia.com/advisories/34741