deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-1334
Published: 2008-03-13
Description: cgi/b on the BT Home Hub router allows remote attackers to bypass authentication, and read or modify administrative settings or make arbitrary VoIP telephone calls, by placing a character at the end of the PATH_INFO, as demonstrated by (1) %5C (encoded backslash), (2) '%' (percent), and (3) '~' (tilde).  NOTE: the '/' (slash) vector is already covered by CVE-2007-5383.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.gnucitizen.org/blog/holes-in-embedded-devices-authentication-bypass-pt-1/; http://www.gnucitizen.org/projects/router-hacking-challenge/; http://www.securityfocus.com/archive/1/489009/100/0/threaded
CVE: CVE-2008-1335
Published: 2008-03-13
Description: The ipsec4_get_ulp function in the kernel in NetBSD 2.0 through 3.1 and NetBSD-current before 20071028, when the fast_ipsec subsystem is enabled, allows remote attackers to bypass the IPsec policy by sending packets from a source machine with a different endianness than the destination machine, a different vulnerability than CVE-2006-0905.
CVSS Score: 9.3 (HIGH)
References: ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2008-002.txt.asc; http://secunia.com/advisories/29180; http://securitytracker.com/id?1019533
CVE: CVE-2008-1336
Published: 2008-03-13
Description: SQL injection vulnerability in Koobi CMS 4.2.3 through 4.3.0 allows remote attackers to execute arbitrary SQL commands via the categ parameter in a links action to index.php, a different vector than CVE-2008-1122.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/archive/1/488997/100/0/threaded; http://www.securityfocus.com/archive/1/490886/100/0/threaded; http://www.securityfocus.com/bid/28059
CVE: CVE-2008-0532
Published: 2008-03-14
Description: Multiple buffer overflows in securecgi-bin/CSuserCGI.exe in User-Changeable Password (UCP) before 4.2 in Cisco Secure Access Control Server (ACS) for Windows and ACS Solution Engine allow remote attackers to execute arbitrary code via a long argument located immediately after the Logout argument, and possibly unspecified other vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/29351; http://securityreason.com/securityalert/3743; http://securitytracker.com/id?1019608
CVE: CVE-2008-0533
Published: 2008-03-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in securecgi-bin/CSuserCGI.exe in User-Changeable Password (UCP) before 4.2 in Cisco Secure Access Control Server (ACS) for Windows and ACS Solution Engine allow remote attackers to inject arbitrary web script or HTML via an argument located immediately after the Help argument, and possibly unspecified other vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29351; http://securityreason.com/securityalert/3743; http://securitytracker.com/id?1019607
CVE: CVE-2008-1117
Published: 2008-03-14
Description: Directory traversal vulnerability in the Notes (aka Flash Notes or instant messages) feature in tb2ftp.dll in Timbuktu Pro 8.6.5 for Windows, and possibly 8.7 for Mac OS X, allows remote attackers to upload files to arbitrary locations via a destination filename with a \ (backslash) character followed by ../ (dot dot slash) sequences. NOTE: this can be leveraged for code execution by writing to a Startup folder.  NOTE: this issue reportedly exists because of an incomplete fix for CVE-2007-4220.
CVSS Score: 10.0 (HIGH)
CWE: CWE-22
References: http://aluigi.altervista.org/adv/timbuto-adv.txt; http://aluigi.org/poc/timbuto.zip; http://secunia.com/advisories/29316
CVE: CVE-2008-1118
Published: 2008-03-14
Description: Timbuktu Pro 8.6.5 for Windows, and possibly 8.7 for Mac OS X, does not perform input validation before logging information fields taken from packets from a remote peer, which allows remote attackers to generate crafted log entries, and possibly avoid detection of attacks, via modified (1) computer name, (2) user name, and (3) IP address fields.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/29316; http://securityreason.com/securityalert/3742; http://www.coresecurity.com/?action=item&id=2166
CVE: CVE-2008-1157
Published: 2008-03-14
Description: Cisco CiscoWorks Internetwork Performance Monitor (IPM) 2.6 creates a process that executes a command shell and listens on a randomly chosen TCP port, which allows remote attackers to execute arbitrary commands.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://secunia.com/advisories/29376; http://www.cisco.com/warp/public/707/cisco-sa-20080313-ipm.shtml; http://www.securityfocus.com/bid/28249
CVE: CVE-2008-1337
Published: 2008-03-14
Description: The instant message service in Timbuktu Pro 8.6.5 RC 229 and earlier for Windows allows remote attackers to cause (1) a denial of service (daemon crash) via an invalid Version field or (2) a denial of service (CPU consumption and daemon termination) via an invalid or partial message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://aluigi.altervista.org/adv/timbuto-adv.txt; http://aluigi.org/poc/timbuto.zip; http://secunia.com/advisories/29316
CVE: CVE-2008-1338
Published: 2008-03-14
Description: The Perforce service (p4s.exe) in Perforce Server 2007.3/143793 and earlier allows remote attackers to cause a denial of service (daemon crash) via a server-DiffFile command with an integer value within a certain range, which causes a loop until all memory is exhausted.
CVSS Score: 7.8 (HIGH)
CWE: CWE-189
References: http://aluigi.altervista.org/adv/perforces-adv.txt; http://aluigi.org/poc/perforces.zip; http://secunia.com/advisories/29231
CVE: CVE-2008-1341
Published: 2008-03-17
Description: SQL injection vulnerability in SearchResults.aspx in LaGarde StoreFront 6 before SP8 allows remote attackers to execute arbitrary SQL commands via the CategoryId parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29326; http://support.storefront.net/Updates/60sp8/default.asp; http://www.securityfocus.com/bid/28234
CVE: CVE-2008-1342
Published: 2008-03-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in the search feature in Polymita BPM-Suite and CollagePortal allow remote attackers to inject arbitrary web script or HTML via the (1) _q and (2) lucene_index_field_value parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29355; http://secunia.com/advisories/29355
CVE: CVE-2008-1343
Published: 2008-03-17
Description: Directory traversal vulnerability in (1) pkgadd and (2) pkgrm in SCO UnixWare 7.1.4 allows local users to gain privileges via unknown vectors.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: ftp://ftp.sco.com/pub/unixware7/714/security/p534589/p534589.txt; http://secunia.com/advisories/29370; http://www.securityfocus.com/bid/28236
CVE: CVE-2008-1344
Published: 2008-03-17
Description: Multiple SQL injection vulnerabilities in MyioSoft EasyCalendar 4.0tr and earlier allow remote attackers to execute arbitrary SQL commands via the (1) year parameter in a dayview action to plugins/calendar/calendar_backend.php and the (2) page parameter to ajaxp_backend.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29373; http://www.securityfocus.com/archive/1/489678/100/0/threaded; http://www.securityfocus.com/bid/28232
CVE: CVE-2008-1345
Published: 2008-03-17
Description: Cross-site scripting (XSS) vulnerability in plugins/calendar/calendar_backend.php in MyioSoft EasyCalendar 4.0tr and earlier allows remote attackers to inject arbitrary web script or HTML via the day parameter in a dayview action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29373; http://www.securityfocus.com/archive/1/489678/100/0/threaded; http://www.securityfocus.com/bid/28232
CVE: CVE-2008-1346
Published: 2008-03-17
Description: SQL injection vulnerability in staticpages/easygallery/index.php in MyioSoft EasyGallery 5.0tr and earlier allows remote attackers to execute arbitrary SQL commands via the catid parameter in a category action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29372; http://www.securityfocus.com/archive/1/489583/100/0/threaded; http://www.securityfocus.com/bid/28233
CVE: CVE-2008-1347
Published: 2008-03-17
Description: Multiple cross-site scripting (XSS) vulnerabilities in staticpages/easygallery/index.php in MyioSoft EasyGallery 5.0tr and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO or (2) the q parameter in an about action to the help system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29372; http://www.securityfocus.com/archive/1/489583/100/0/threaded; http://www.securityfocus.com/bid/28233
CVE: CVE-2008-1348
Published: 2008-03-17
Description: Cross-site scripting (XSS) vulnerability in index.php in the eWebsite eWeather (Weather) module for PHP-Nuke allows remote attackers to inject arbitrary web script or HTML via the chart parameter to modules.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/3744; http://www.securityfocus.com/archive/1/489504/100/0/threaded; http://www.securityfocus.com/bid/28241
CVE: CVE-2008-1349
Published: 2008-03-17
Description: SQL injection vulnerability in viewcat.php in the bamaGalerie (Bama Galerie) 3.03 and 3.041 module for eXV2 2.0.6 allows remote attackers to execute arbitrary SQL commands via the cid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0804-exploits/runcms11a-sql.txt; http://secunia.com/advisories/29359; http://secunia.com/advisories/29362
CVE: CVE-2008-1350
Published: 2008-03-17
Description: SQL injection vulnerability in kb.php in Fully Modded phpBB (phpbbfm) 80220 allows remote attackers to execute arbitrary SQL commands via the k parameter in an article action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29339; http://securityreason.com/securityalert/3745; http://www.securityfocus.com/archive/1/489468/100/0/threaded
CVE: CVE-2008-1351
Published: 2008-03-17
Description: SQL injection vulnerability in the Tutorials 2.1b module for XOOPS allows remote attackers to execute arbitrary SQL commands via the tid parameter to printpage.php, which is accessible directly or through a printpage action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/29358; http://www.securityfocus.com/bid/28230; https://www.exploit-db.com/exploits/5245
CVE: CVE-2008-1352
Published: 2008-03-17
Description: Directory traversal vulnerability in search.php in EdiorCMS (ecms) 3.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the _SearchTemplate parameter during a Title search.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://securityreason.com/securityalert/3746; http://www.securityfocus.com/archive/1/489498/100/0/threaded; http://www.securityfocus.com/bid/28242
CVE: CVE-2008-1353
Published: 2008-03-17
Description: zabbix_agentd in ZABBIX 1.4.4 allows remote attackers to cause a denial of service (CPU and connection consumption) via multiple vfs.file.cksum commands with a special device node such as /dev/urandom or /dev/zero.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/29383; http://securityreason.com/securityalert/3747; http://www.securityfocus.com/archive/1/489506/100/0/threaded
CVE: CVE-2008-1354
Published: 2008-03-17
Description: SQL injection vulnerability in MyIssuesView.asp in Advanced Data Solutions Virtual Support Office-XP (VSO-XP) allows remote attackers to execute arbitrary SQL commands via the Issue_ID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://forum.aria-security.com/showthread.php?p=21; http://marc.info/?l=bugtraq&m=[PII_REDACTED]4985&w=2; http://secunia.com/advisories/29365
CVE: CVE-2008-1355
Published: 2008-03-17
Description: Cross-site scripting (XSS) vulnerability in index.php in Jeebles Technology Jeebles Directory 2.9.60 allows remote attackers to inject arbitrary web script or HTML via the path parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://downloads.securityfocus.com/vulnerabilities/exploits/28221.html; http://www.securityfocus.com/bid/28221; https://exchange.xforce.ibmcloud.com/vulnerabilities/41183
CVE: CVE-2008-1356
Published: 2008-03-17
Description: Unspecified vulnerability in xscreensaver in Sun Solaris 10 Java Desktop System (JDS), when using the GNOME On-Screen Keyboard (GOK), allows local users to bypass authentication via unknown vectors that cause the screen saver to crash.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/29368; http://sunsolve.sun.com/search/document.do?assetkey=1-26-234661-1; http://www.securityfocus.com/bid/28243
CVE: CVE-2008-1357
Published: 2008-03-17
Description: Format string vulnerability in the logDetail function of applib.dll in McAfee Common Management Agent (CMA) 3.6.0.574 (Patch 3) and earlier, as used in ePolicy Orchestrator 4.0.0 build 1015, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in a sender field in an AgentWakeup request to UDP port 8082.  NOTE: this issue only exists when the debug level is 8.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-134
References: http://aluigi.altervista.org/adv/meccaffi-adv.txt; http://secunia.com/advisories/29337; http://securityreason.com/securityalert/3748
CVE: CVE-2008-1358
Published: 2008-03-17
Description: Stack-based buffer overflow in the IMAP server in Alt-N Technologies MDaemon 9.6.4 allows remote authenticated users to execute arbitrary code via a FETCH command with a long BODY.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://files.altn.com/MDaemon/Release/RelNotes_en.txt; http://secunia.com/advisories/29382; http://www.be4mind.com/?q=node/256
CVE: CVE-2008-1359
Published: 2008-03-17
Description: Cross-site scripting (XSS) vulnerability in Invision Power Board (IPB or IP.Board) 2.3.4 before 2008-03-13 allows remote attackers to inject arbitrary web script or HTML via nested BBCodes, a different vector than CVE-2008-0913.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://forums.invisionpower.com/index.php?showtopic=270637; http://secunia.com/advisories/29378; http://www.vupen.com/english/advisories/2008/0899/references
CVE: CVE-2008-1360
Published: 2008-03-17
Description: Cross-site scripting (XSS) vulnerability in Nagios before 2.11 allows remote attackers to inject arbitrary web script or HTML via unknown vectors to unspecified CGI scripts, a different issue than CVE-2007-5624.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2008-05/msg00000.html; http://secunia.com/advisories/29363; http://www.mandriva.com/security/advisories?name=MDVSA-2008:067
CVE: CVE-2008-0888
Published: 2008-03-17
Description: The NEEDBITS macro in the inflate_dynamic function in inflate.c for unzip can be invoked using invalid buffers, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors that trigger a free of uninitialized or previously-freed data.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00008.html; http://secunia.com/advisories/29392
CVE: CVE-2008-1365
Published: 2008-03-17
Description: Stack-based buffer overflow in Trend Micro OfficeScan Corporate Edition 8.0 Patch 2 build 1189 and earlier, and 7.3 Patch 3 build 1314 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service (crash) via a long encrypted password, which triggers the overflow in (1) cgiChkMasterPwd.exe, (2) policyserver.exe as reachable through cgiABLogon.exe, and other vectors.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-119
References: http://aluigi.altervista.org/adv/officescaz-adv.txt; http://secunia.com/advisories/29124; http://www.securityfocus.com/bid/28020
CVE: CVE-2008-1366
Published: 2008-03-17
Description: Trend Micro OfficeScan Corporate Edition 8.0 Patch 2 build 1189 and earlier, and 7.3 Patch 3 build 1314 and earlier, allows remote attackers to cause a denial of service (process consumption) via (1) an HTTP request without a Content-Length header or (2) invalid characters in unspecified CGI arguments, which triggers a NULL pointer dereference.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://aluigi.altervista.org/adv/officescaz-adv.txt; http://secunia.com/advisories/29124; http://www.securityfocus.com/bid/28020
CVE: CVE-2008-1367
Published: 2008-03-17
Description: gcc 4.3.x does not generate a cld instruction while compiling functions used for string manipulation such as memcpy and memmove on x86 and i386, which can prevent the direction flag (DF) from being reset in violation of ABI conventions and cause data to be copied in the wrong direction during signal handling in the Linux kernel, which might allow context-dependent attackers to trigger memory corruption. NOTE: this issue was originally reported for CPU consumption in SBCL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=469058; http://gcc.gnu.org/ml/gcc-patches/2008-03/msg00417.html; http://gcc.gnu.org/ml/gcc-patches/2008-03/msg00428.html
CVE: CVE-2008-0727
Published: 2008-03-18
Description: Multiple buffer overflows in oninit.exe in IBM Informix Dynamic Server (IDS) 7.x through 11.x allow (1) remote attackers to execute arbitrary code via a long password and (2) remote authenticated users to execute arbitrary code via a long DBPATH value.
CVSS Score: 8.5 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/29272; http://securityreason.com/securityalert/3749; http://www-1.ibm.com/support/docview.wss?uid=swg1IC55207
CVE: CVE-2008-0949
Published: 2008-03-18
Description: Unspecified vulnerability in IBM Informix Dynamic Server (IDS) 7.x through 11.x allows remote attackers to gain privileges via a malformed connection request packet.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/29272; http://www-1.ibm.com/support/search.wss?rs=0&q=IC55224&apar=only; http://www-1.ibm.com/support/search.wss?rs=0&q=IC55225&apar=only
CVE: CVE-2008-1368
Published: 2008-03-18
Description: CRLF injection vulnerability in Microsoft Internet Explorer 5 and 6 allows remote attackers to execute arbitrary FTP commands via an ftp:// URL that contains a URL-encoded CRLF (%0D%0A) before the FTP command, which causes the commands to be inserted into an authenticated FTP connection established earlier in the same browser session, as demonstrated using a DELE command, a variant or possibly a regression of CVE-2004-1166.  NOTE: a trailing "//" can force Internet Explorer to try to reuse an existing authenticated connection.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/29346; http://securityreason.com/securityalert/3750; http://www.rapid7.com/advisories/R7-0032.jsp
CVE: CVE-2008-1330
Published: 2008-03-18
Description: Unspecified vulnerability in the Windows client API in Novell GroupWise 7 before SP3 and 6.5 before SP6 Update 3 allows remote authenticated users to access the non-shared stored e-mail messages of another user who has shared at least one folder with the attacker.
CVSS Score: 3.5 (LOW)
CWE: CWE-200, CWE-264
References: http://secunia.com/advisories/29409; http://securitytracker.com/id?1019616; http://www.securityfocus.com/bid/28265
CVE: CVE-2008-1369
Published: 2008-03-18
Description: A certain incorrect Sun Solaris 10 image on SPARC Enterprise T5120 and T5220 servers has /etc/default/login and /etc/ssh/sshd_config files that configure root logins in a manner unintended by the vendor, which allows remote attackers to gain privileges via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/29529; http://sunsolve.sun.com/search/document.do?assetkey=1-66-231244-1; http://www.securityfocus.com/bid/28469
CVE: CVE-2008-1370
Published: 2008-03-18
Description: PHP remote file inclusion vulnerability in index.php in wildmary Yap Blog 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://www.securityfocus.com/bid/28120; https://exchange.xforce.ibmcloud.com/vulnerabilities/41049; http://www.securityfocus.com/bid/28120
CVE: CVE-2008-1371
Published: 2008-03-18
Description: Absolute path traversal vulnerability in install/index.php in Drake CMS 0.4.11 RC8 allows remote attackers to read and execute arbitrary files via a full pathname in the d_root parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 3.6 (LOW)
CWE: CWE-22
References: http://www.securityfocus.com/bid/28165; http://www.securityfocus.com/bid/28165/exploit; https://exchange.xforce.ibmcloud.com/vulnerabilities/41345
CVE: CVE-2008-1372
Published: 2008-03-18
Description: bzlib.c in bzip2 before 1.0.5 allows user-assisted remote attackers to cause a denial of service (crash) via a crafted file that triggers a buffer over-read, as demonstrated by the PROTOS GENOME test suite for Archive Formats.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-004.txt.asc; http://kb.vmware.com/kb/1006982; http://kb.vmware.com/kb/1007198
CVE: CVE-2008-0044
Published: 2008-03-18
Description: Multiple buffer overflows in AFP Client in Apple Mac OS X 10.4.11 and 10.5.2 allow remote attackers to cause a denial of service (application termination) and execute arbitrary code via a crafted afp:// URL.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-119
References: http://docs.info.apple.com/article.html?artnum=307562; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html; http://secunia.com/advisories/29420
CVE: CVE-2008-0045
Published: 2008-03-18
Description: Unspecified vulnerability in AFP Server in Apple Mac OS X 10.4.11 allows remote attackers to bypass cross-realm authentication via unknown manipulations of Kerberos principal realm names.
CVSS Score: 7.1 (HIGH)
CWE: CWE-264
References: http://docs.info.apple.com/article.html?artnum=307562; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html; http://secunia.com/advisories/29420
CVE: CVE-2008-0046
Published: 2008-03-18
Description: The Application Firewall in Apple Mac OS X 10.5.2 has an incorrect German translation for the "Set access for specific services and applications" radio button that might cause the user to believe that the button is used to restrict access only to specific services and applications, which might allow attackers to bypass intended access restrictions.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://docs.info.apple.com/article.html?artnum=307562; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html; http://secunia.com/advisories/29420
CVE: CVE-2008-0048
Published: 2008-03-18
Description: Stack-based buffer overflow in AppKit in Apple Mac OS X 10.4.11 allows context-dependent attackers to execute arbitrary code via the a long file name to the NSDocument API.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://docs.info.apple.com/article.html?artnum=307562; http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html; http://secunia.com/advisories/29420