deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-0201
Published: 2009-09-02
Description: Heap-based buffer overflow in OpenOffice.org (OOo) before 3.1.1 and StarOffice/StarSuite 7, 8, and 9 might allow remote attackers to execute arbitrary code via unspecified records in a crafted Word document, related to "table parsing."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://development.openoffice.org/releases/3.1.1.html; http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.html; http://secunia.com/advisories/35036
CVE: CVE-2009-2700
Published: 2009-09-02
Description: src/network/ssl/qsslcertificate.cpp in Nokia Trolltech Qt 4.x does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://qt.gitorious.org/qt/qt/commit/802d8c02eaa0aa9cd8d0c6cbd18cd814e6337bc6; http://secunia.com/advisories/36536; http://secunia.com/advisories/36702
CVE: CVE-2009-2968
Published: 2009-09-02
Description: Directory traversal vulnerability in a support component in the web interface in VMware Studio 2.0 public beta before build 1017-185256 allows remote attackers to upload files to arbitrary locations via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://lists.vmware.com/pipermail/security-announce/2009/000064.html; http://www.securityfocus.com/archive/1/506191/100/0/threaded; http://www.securityfocus.com/bid/36199
CVE: CVE-2009-3043
Published: 2009-09-02
Description: The tty_ldisc_hangup function in drivers/char/tty_ldisc.c in the Linux kernel 2.6.31-rc before 2.6.31-rc8 allows local users to cause a denial of service (system crash, sometimes preceded by a NULL pointer dereference) or possibly gain privileges via certain pseudo-terminal I/O activity, as demonstrated by KernelTtyTest.c.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=5c58ceff103d8a654f24769bb1baaf84a841b0cc; http://lkml.org/lkml/2009/8/20/21; http://lkml.org/lkml/2009/8/20/27
CVE: CVE-2009-3044
Published: 2009-09-02
Description: Opera before 10.00 does not properly handle a (1) '\0' character or (2) invalid wildcard character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://www.opera.com/docs/changelogs/freebsd/1000/; http://www.opera.com/docs/changelogs/linux/1000/; http://www.opera.com/docs/changelogs/mac/1000/
CVE: CVE-2009-3045
Published: 2009-09-02
Description: Opera before 10.00 trusts root X.509 certificates signed with the MD2 algorithm, which makes it easier for man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted server certificate.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://www.opera.com/docs/changelogs/freebsd/1000/; http://www.opera.com/docs/changelogs/linux/1000/; http://www.opera.com/docs/changelogs/mac/1000/
CVE: CVE-2009-3046
Published: 2009-09-02
Description: Opera before 10.00 does not check all intermediate X.509 certificates for revocation, which makes it easier for remote SSL servers to bypass validation of the certificate chain via a revoked certificate.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: http://www.opera.com/docs/changelogs/freebsd/1000/; http://www.opera.com/docs/changelogs/linux/1000/; http://www.opera.com/docs/changelogs/mac/1000/
CVE: CVE-2009-3047
Published: 2009-09-02
Description: Opera before 10.00, when a collapsed address bar is used, does not properly update the domain name from the previously visited site to the currently visited site, which might allow remote attackers to spoof URLs.
CVSS Score: 4.3 (MEDIUM)
References: http://www.opera.com/docs/changelogs/freebsd/1000/; http://www.opera.com/docs/changelogs/linux/1000/; http://www.opera.com/docs/changelogs/mac/1000/
CVE: CVE-2009-3048
Published: 2009-09-02
Description: Opera before 10.00 on Linux, Solaris, and FreeBSD does not properly implement the "INPUT TYPE=file" functionality, which allows remote attackers to trick a user into uploading an unintended file via vectors involving a "dropped file."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.opera.com/docs/changelogs/freebsd/1000/; http://www.opera.com/docs/changelogs/linux/1000/; http://www.opera.com/docs/changelogs/solaris/1000/
CVE: CVE-2009-3049
Published: 2009-09-02
Description: Opera before 10.00 does not properly display all characters in Internationalized Domain Names (IDN) in the address bar, which allows remote attackers to spoof URLs and conduct phishing attacks, related to Unicode and Punycode.
CVSS Score: 5.0 (MEDIUM)
References: http://www.opera.com/docs/changelogs/freebsd/1000/; http://www.opera.com/docs/changelogs/linux/1000/; http://www.opera.com/docs/changelogs/mac/1000/
CVE: CVE-2009-3050
Published: 2009-09-02
Description: Buffer overflow in the set_page_size function in util.cxx in HTMLDOC 1.8.27 and earlier allows context-dependent attackers to execute arbitrary code via a long MEDIA SIZE comment.  NOTE: it was later reported that there were additional vectors in htmllib.cxx and ps-pdf.cxx using an AFM font file with a long glyph name, but these vectors do not cross privilege boundaries.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://bugs.gentoo.org/show_bug.cgi?id=278186; http://packetstormsecurity.org/0907-exploits/htmldoc-overflow.txt; http://secunia.com/advisories/35780
CVE: CVE-2009-3052
Published: 2009-09-03
Description: SQL injection vulnerability in root/includes/prime_quick_style.php in the Prime Quick Style addon before 1.2.3 for phpBB 3 allows remote authenticated users to execute arbitrary SQL commands via the prime_quick_style parameter to ucp.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/36532; http://www.absoluteanime.com/forum/mods/Prime%20Quick%20Style/install.xml; http://www.exploit-db.com/exploits/9569
CVE: CVE-2009-3053
Published: 2009-09-03
Description: Directory traversal vulnerability in the Agora (com_agora) component 3.0.0b for Joomla! allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the action parameter to the avatars page, reachable through index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/9564; http://www.securityfocus.com/bid/36207; https://exchange.xforce.ibmcloud.com/vulnerabilities/52964
CVE: CVE-2009-3054
Published: 2009-09-03
Description: SQL injection vulnerability in the Artetics.com Art Portal (com_artportal) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the portalid parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9563; http://www.securityfocus.com/bid/36206; https://exchange.xforce.ibmcloud.com/vulnerabilities/52962
CVE: CVE-2009-3055
Published: 2009-09-03
Description: PHP remote file inclusion vulnerability in engine/api/api.class.php in DataLife Engine (DLE) 8.2 allows remote attackers to execute arbitrary PHP code via a URL in the dle_config_api parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.exploit-db.com/exploits/9572; http://www.securityfocus.com/bid/36212; http://www.exploit-db.com/exploits/9572
CVE: CVE-2009-3056
Published: 2009-09-03
Description: PHP remote file inclusion vulnerability in include/engine/content/elements/menu.php in KingCMS 0.6.0 allows remote attackers to execute arbitrary PHP code via a URL in the CONFIG[AdminPath] parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.exploit-db.com/exploits/9566; http://www.exploit-db.com/exploits/9566
CVE: CVE-2009-3057
Published: 2009-09-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in AOM Software Beex 3 allow remote attackers to inject arbitrary web script or HTML via the navaction parameter to (1) news.php and (2) partneralle.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0909-exploits/beex-xss.txt; http://secunia.com/advisories/36550; http://packetstormsecurity.org/0909-exploits/beex-xss.txt
CVE: CVE-2009-3058
Published: 2009-09-03
Description: Stack-based buffer overflow in akPlayer 1.9.0 allows remote attackers to execute arbitrary code via a long string in a .plt playlist file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.org/0909-exploits/akplayer-overflow.txt; http://secunia.com/advisories/36521; http://www.exploit-db.com/exploits/9568
CVE: CVE-2009-3059
Published: 2009-09-03
Description: Multiple SQL injection vulnerabilities in Joker Board (aka JBoard) 2.0 and earlier allow remote attackers to execute arbitrary SQL commands via (1) core/select.php or (2) the city parameter to top_add.inc.php, reachable through sboard.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0908-exploits/jboard-sql.txt; http://www.vupen.com/english/advisories/2009/2473; http://packetstormsecurity.org/0908-exploits/jboard-sql.txt
CVE: CVE-2009-3060
Published: 2009-09-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in Joker Board (aka JBoard) 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the notice parameter to editform.php, (2) the edit_user_message parameter to core/edit_user_message.php, or (3) the user_title parameter to inc/head.inc.php, reachable through any PHP script.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0908-exploits/jboard-sql.txt; http://www.vupen.com/english/advisories/2009/2473; http://packetstormsecurity.org/0908-exploits/jboard-sql.txt
CVE: CVE-2009-3061
Published: 2009-09-03
Description: SQL injection vulnerability in lesson.php in Alqatari Q R Script 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0909-exploits/alqatarigroup-sql.txt; http://secunia.com/advisories/36554; http://packetstormsecurity.org/0909-exploits/alqatarigroup-sql.txt
CVE: CVE-2009-3062
Published: 2009-09-03
Description: SQL injection vulnerability in message_box.php in OSI Codes PHP Live! 3.3 allows remote attackers to execute arbitrary SQL commands via the deptid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9578; http://www.exploit-db.com/exploits/9578
CVE: CVE-2009-3063
Published: 2009-09-03
Description: SQL injection vulnerability in the Game Server (com_gameserver) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a gamepanel action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/9571; http://www.securityfocus.com/bid/36213; http://www.vupen.com/english/advisories/2009/2523
CVE: CVE-2009-3064
Published: 2009-09-03
Description: Directory traversal vulnerability in debugger/debug_php.php in Ve-EDIT 0.1.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the _GET[filename] parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/9570; http://www.vupen.com/english/advisories/2009/2522; http://www.exploit-db.com/exploits/9570
CVE: CVE-2009-3065
Published: 2009-09-03
Description: PHP remote file inclusion vulnerability in editor/edit_htmlarea.php in Ve-EDIT 0.1.4 allows remote attackers to execute arbitrary PHP code via a URL in the highlighter parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.exploit-db.com/exploits/9577; http://www.vupen.com/english/advisories/2009/2522; http://www.exploit-db.com/exploits/9577
CVE: CVE-2009-3066
Published: 2009-09-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in PropertyWatchScript.com Property Watch 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) videoid parameter to tools/email.php and (2) redirect parameter to tools/login.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0909-exploits/propertywatch-xss.txt; http://secunia.com/advisories/36548; http://packetstormsecurity.org/0909-exploits/propertywatch-xss.txt
CVE: CVE-2009-3067
Published: 2009-09-03
Description: Cross-site scripting (XSS) vulnerability in index.php in Reservation Manager allows remote attackers to inject arbitrary web script or HTML via the resman_startdate parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0909-exploits/resvman-xss.txt; http://secunia.com/advisories/36547; http://packetstormsecurity.org/0909-exploits/resvman-xss.txt
CVE: CVE-2008-7161
Published: 2009-09-04
Description: Fortinet FortiGuard Fortinet FortiGate-1000 3.00 build 040075,070111 allows remote attackers to bypass URL filtering via fragmented GET or POST requests that use HTTP/1.0 without the Host header.  NOTE: this issue might be related to CVE-2005-3058.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/archive/1/485794/100/200/threaded; http://www.securityfocus.com/archive/1/485813/100/200/threaded; http://www.securityfocus.com/bid/27276
CVE: CVE-2008-7162
Published: 2009-09-04
Description: Buffer overflow in Hero Super Player 3000 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long filename in a .M3U file.  NOTE: this might be related to CVE-2008-4504.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://downloads.securityfocus.com/vulnerabilities/exploits/27478.cpp; http://www.securityfocus.com/bid/27478; https://exchange.xforce.ibmcloud.com/vulnerabilities/40025
CVE: CVE-2008-7163
Published: 2009-09-04
Description: Directory traversal vulnerability in mods/Integrated/index.php in SineCMS 2.3.5 and earlier, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via the sine[config][index_main] parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/40084; http://secunia.com/advisories/28305; http://www.securityfocus.com/bid/27156
CVE: CVE-2008-7164
Published: 2009-09-04
Description: Multiple unspecified vulnerabilities in Shareaza before 2.3.1.0 have unknown impact and attack vectors related to "very important security fixes," possibly involving update notifications and a domain that is no longer controlled by the vendor.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/40217; http://secunia.com/advisories/28302; http://sourceforge.net/project/shownotes.php?group_id=110672&release_id=565250
CVE: CVE-2008-7165
Published: 2009-09-04
Description: Cross-site request forgery in cp06_wifi_m_nocifr.cgi in the administrator panel in TELECOM ITALIA Alice Gate2 Plus Wi-Fi allows remote attackers to hijack the authentication of administrators for requests that disable Wi-Fi encryption via certain values for the wlChannel and wlRadioEnable parameters.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/40739; http://secunia.com/advisories/28618; http://www.securityfocus.com/archive/1/486733/100/200/threaded
CVE: CVE-2008-7166
Published: 2009-09-04
Description: Buffer overflow in the web interface in BitTorrent 6.0.1 (build 7859) and earlier, and uTorrent 1.7.6 (build 7859) and earlier, allows remote attackers to cause a denial of service (memory consumption and crash) via a crafted Range header.  NOTE: this is probably a different vulnerability than CVE-2008-0071 and CVE-2008-0364.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://aluigi.altervista.org/adv/ruttorrent2-adv.txt; http://osvdb.org/42825; http://osvdb.org/42826
CVE: CVE-2009-2521
Published: 2009-09-04
Description: Stack consumption vulnerability in the FTP Service in Microsoft Internet Information Services (IIS) 5.0 through 7.0 allows remote authenticated users to cause a denial of service (daemon crash) via a list (ls) -R command containing a wildcard that references a subdirectory, followed by a .. (dot dot), aka "IIS FTP Service DoS Vulnerability."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-400
References: http://archives.neohapsis.com/archives/fulldisclosure/2009-09/0040.html; http://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ975191; http://www.us-cert.gov/cas/techalerts/TA09-286A.html
CVE: CVE-2009-3068
Published: 2009-09-04
Description: Unrestricted file upload vulnerability in the RoboHelpServer Servlet (robohelp/server) in Adobe RoboHelp Server 8 allows remote attackers to execute arbitrary code by uploading a Java Archive (.jsp) file during a PUBLISH action, then accessing it via a direct request to the file in the robohelp/robo/reserved/web directory under its sessionid subdirectory, as demonstrated by the vd_adobe module in VulnDisco Pack Professional 8.7 through 8.11.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://blogs.adobe.com/psirt/2009/09/potential_robohelp_server_8_is.html; http://intevydis.com/vd-list.shtml; http://secunia.com/advisories/36467
CVE: CVE-2009-2697
Published: 2009-09-04
Description: The Red Hat build script for the GNOME Display Manager (GDM) before 2.16.0-56 on Red Hat Enterprise Linux (RHEL) 5 omits TCP Wrapper support, which might allow remote attackers to bypass intended access restrictions via XDMCP connections, a different vulnerability than CVE-2007-5079.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/36553; http://www.securityfocus.com/bid/36219; https://bugzilla.redhat.com/show_bug.cgi?id=239818
CVE: CVE-2009-2946
Published: 2009-09-04
Description: Eval injection vulnerability in scripts/uscan.pl before Rev 1984 in devscripts allows remote attackers to execute arbitrary Perl code via crafted pathnames on distribution servers for upstream source code used in Debian GNU/Linux packages.
CVSS Score: 9.3 (HIGH)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=515209; http://svn.debian.org/wsvn/devscripts/trunk/scripts/uscan.pl?op=diff&rev=1984&sc=1; http://svn.debian.org/wsvn/devscripts/trunk/scripts/uscan.pl?op=log&rev=0&sc=1&isdir=0
CVE: CVE-2009-3081
Published: 2009-09-04
Description: SQL injection vulnerability in index.php in Uiga Church Portal allows remote attackers to execute arbitrary SQL commands via the month parameter in a calendar action.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/57464; http://secunia.com/advisories/36479; https://exchange.xforce.ibmcloud.com/vulnerabilities/52893
CVE: CVE-2009-3082
Published: 2009-09-04
Description: SQL injection vulnerability in wcategory.php in Snow Hall Silurus System 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/36124; http://secunia.com/advisories/36124
CVE: CVE-2008-7167
Published: 2009-09-08
Description: Unrestricted file upload vulnerability in upload.php in Page Manager 2006-02-04 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/29929; http://www.vupen.com/english/advisories/2008/1952/references; https://exchange.xforce.ibmcloud.com/vulnerabilities/43356
CVE: CVE-2008-7168
Published: 2009-09-08
Description: Insecure method vulnerability in the UUSee UUUpgrade ActiveX control (UUUpgrade.ocx 3.0.2.12) allows remote attackers to force the download and overwrite of arbitrary files via crafted arguments to the Update method, as exploited in the wild in June 2009.
CVSS Score: 9.3 (HIGH)
References: http://downloads.securityfocus.com/vulnerabilities/exploits/29963.html; http://www.securityfocus.com/bid/29963; https://exchange.xforce.ibmcloud.com/vulnerabilities/43428
CVE: CVE-2008-7169
Published: 2009-09-08
Description: SQL injection vulnerability in Jabode horoscope extension (com_jabode) for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a sign task to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/29994; https://www.exploit-db.com/exploits/5963; http://www.securityfocus.com/bid/29994
CVE: CVE-2008-7170
Published: 2009-09-08
Description: GSC build 2067 and earlier relies on the client to enforce administrator privileges, which allows remote attackers to execute arbitrary administrator commands via a crafted packet.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/archive/1/493355/100/0/threaded; http://www.securityfocus.com/bid/29718; https://exchange.xforce.ibmcloud.com/vulnerabilities/43120
CVE: CVE-2008-7171
Published: 2009-09-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in Lightweight news portal (LNP) 1.0b allow remote attackers to inject arbitrary web script or HTML via the (1) photo parameter to show_photo.php, (2) potd parameter to show_potd.php, or (3) the Current question field in a vote action to admin.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/29848; https://exchange.xforce.ibmcloud.com/vulnerabilities/43224; https://exchange.xforce.ibmcloud.com/vulnerabilities/43226
CVE: CVE-2008-7172
Published: 2009-09-08
Description: Lightweight news portal (LNP) 1.0b does not properly restrict access to administrator functionality, which allows remote attackers to gain administrator privileges via direct requests to admin.php with the (1) potd_delete, (2) potd, (3) vote_update, (4) vote, or (5) modifynews actions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/29848; https://exchange.xforce.ibmcloud.com/vulnerabilities/43225; https://www.exploit-db.com/exploits/5873
CVE: CVE-2008-7173
Published: 2009-09-08
Description: The Jura Internet Connection Kit for the Jura Impressa F90 coffee maker does not properly restrict access to privileged functions, which allows remote attackers to cause a denial of service (physical damage), modify coffee settings, and possibly execute code via a crafted request.  NOTE: this issue is being included in CVE because the denial of service may include financial loss or water damage.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://attrition.org/pipermail/vim/2008-June/002002.html; http://news.cnet.com/8301-10784_3-9970757-7.html; http://osvdb.org/46407
CVE: CVE-2008-7174
Published: 2009-09-08
Description: Multiple buffer overflows in the Jura Internet Connection Kit for the Jura Impressa F90 coffee maker allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors related to improper use of the gets and sprintf functions.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://news.cnet.com/8301-10784_3-9970757-7.html; http://www.securityfocus.com/archive/1/493387/100/0/threaded; http://www.securityfocus.com/archive/1/493433/100/0/threaded
CVE: CVE-2008-7175
Published: 2009-09-08
Description: Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in NextGEN Gallery 0.96 and earlier plugin for Wordpress allows remote attackers to inject arbitrary web script or HTML via the picture description field in a page edit action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/51428; http://www.securityfocus.com/archive/1/493182/100/0/threaded; http://osvdb.org/51428