deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-6189
Published: 2009-02-19
Description: SQL injection vulnerability in GForge 4.5.19 allows remote attackers to execute arbitrary SQL commands via the offset parameter to (1) new/index.php, (2) news/index.php, and (3) top/topusers.php, which is not properly handled in database-pgsql.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://gforge.org/tracker/index.php?func=detail&aid=5552&group_id=1&atid=105; http://secunia.com/advisories/32217; https://exchange.xforce.ibmcloud.com/vulnerabilities/45802
CVE: CVE-2008-6190
Published: 2009-02-19
Description: Cross-site scripting (XSS) vulnerability in index.php in EEBCMS 0.95 allows remote attackers to inject arbitrary web script or HTML via the content parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0810-exploits/eebcms-xss.txt; http://www.securityfocus.com/bid/31732; https://exchange.xforce.ibmcloud.com/vulnerabilities/45828
CVE: CVE-2008-6191
Published: 2009-02-19
Description: Conductor.exe in Intrinsic Swimage Encore before 5.0.1.21 contains a hardcoded password, which might allow local users to decrypt certain .bin files.  NOTE: it is not clear whether this issue crosses privilege boundaries.
CVSS Score: 2.1 (LOW)
CWE: CWE-255
References: http://secunia.com/advisories/31540; http://www.kb.cert.org/vuls/id/778427; http://www.securityfocus.com/bid/30736
CVE: CVE-2008-6192
Published: 2009-02-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in unspecified Portlets in Sun Java System Portal Server 7.0 and 7.1 allow remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/31538; http://sunsolve.sun.com/search/document.do?assetkey=1-26-239308-1; http://www.securityfocus.com/bid/30738
CVE: CVE-2008-6193
Published: 2009-02-19
Description: Sam Crew MyBlog stores passwords in cleartext in a MySQL database, which allows context-dependent attackers to obtain sensitive information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/48843; https://www.exploit-db.com/exploits/5913; https://exchange.xforce.ibmcloud.com/vulnerabilities/48843
CVE: CVE-2008-6194
Published: 2009-02-19
Description: Memory leak in the DNS server in Microsoft Windows allows remote attackers to cause a denial of service (memory consumption) via DNS packets.  NOTE: this issue reportedly exists because of an incorrect fix for CVE-2007-3898.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/archive/1/491815/100/0/threaded; http://www.securityfocus.com/archive/1/491831/100/0/threaded; http://www.securityfocus.com/archive/1/491815/100/0/threaded
CVE: CVE-2008-6195
Published: 2009-02-20
Description: Directory traversal vulnerability in the PXE TFTP Service (PXEMTFTP.exe) in LANDesk Management Suite (LDMS) 8.80.1.1 and earlier allows remote attackers to read arbitrary files via a subdirectory name followed by ".." sequences, a different vulnerability than CVE-2008-1643.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://community.landesk.com/support/docs/DOC-2659; http://www.securityfocus.com/archive/1/490390/100/0/threaded; http://www.securityfocus.com/bid/28577
CVE: CVE-2008-6196
Published: 2009-02-20
Description: Multiple PHP remote file inclusion vulnerabilities in Philippe CROCHAT EasySite 2.0 allow remote attackers to execute arbitrary PHP code via a URL in the EASYSITE_BASE parameter to (1) browser.php, (2) image_editor.php and (3) skin_chooser.php in configuration/.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/28563; http://www.securityfocus.com/bid/28563/exploit; https://exchange.xforce.ibmcloud.com/vulnerabilities/41630
CVE: CVE-2008-6197
Published: 2009-02-20
Description: SQL injection vulnerability in index.php in the galerie module for KwsPHP 1.3.456 allows remote attackers to execute arbitrary SQL commands via the id_gal parameter in a gal action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/28590; https://exchange.xforce.ibmcloud.com/vulnerabilities/41621; https://www.exploit-db.com/exploits/5350
CVE: CVE-2008-6198
Published: 2009-02-20
Description: SQL injection vulnerability in pages.php in Custom Pages 1.0 plugin for MyBulletinBoard (MyBB) allows remote attackers to execute arbitrary SQL commands via the page parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/28652; https://exchange.xforce.ibmcloud.com/vulnerabilities/41685; https://www.exploit-db.com/exploits/5379
CVE: CVE-2008-6199
Published: 2009-02-20
Description: 2532designs 2532|Gigs 1.2.2 and earlier allows remote attackers to trigger a backup and obtain sensitive information via a direct request to backup.php, which creates backup.sql under the web root with insufficient access control.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/41912; https://www.exploit-db.com/exploits/5465; https://exchange.xforce.ibmcloud.com/vulnerabilities/41912
CVE: CVE-2008-6200
Published: 2009-02-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in Swiki 1.5 allow remote attackers to inject arbitrary web script or HTML via (1) the query string and (2) a new wiki entry.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/490561/100/0/threaded; http://www.securityfocus.com/bid/28680; https://exchange.xforce.ibmcloud.com/vulnerabilities/48838
CVE: CVE-2008-6201
Published: 2009-02-20
Description: Directory traversal vulnerability in help.php in the eskuel module in KwsPHP 1.3.456, as available before 20080416, allows remote attackers to execute arbitrary commands via the action parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://koogar.alorys-hebergement.com/kwsphp/index.php?mod=news&ac=commentaires&id=49; http://secunia.com/advisories/29802; http://www.securityfocus.com/archive/1/490861
CVE: CVE-2008-6202
Published: 2009-02-20
Description: SQL injection vulnerability in CoBaLT 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter to (1) urun.asp, (2) admin/bayi_listele.asp, (3) admin/urun_grup_listele.asp, and (4) admin/urun_listele.asp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/48835; https://www.exploit-db.com/exploits/5373; https://exchange.xforce.ibmcloud.com/vulnerabilities/48835
CVE: CVE-2008-6203
Published: 2009-02-20
Description: SQL injection vulnerability in adminler.asp in CoBaLT 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/28831; http://www.securityfocus.com/bid/28831/exploit; https://exchange.xforce.ibmcloud.com/vulnerabilities/42739
CVE: CVE-2008-6204
Published: 2009-02-20
Description: Multiple SQL injection vulnerabilities in SuperNET Shop 1.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to secure/admin/guncelle.asp, (2) kulad and sifre parameters to secure/admin/giris.asp, and (3) username and password to secure/admin/default.asp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/28709; http://www.vupen.com/english/advisories/2008/1161/references; https://exchange.xforce.ibmcloud.com/vulnerabilities/41727
CVE: CVE-2008-6205
Published: 2009-02-20
Description: Cross-site scripting (XSS) vulnerability in seeurl.php in Xavier Flahaut URLStreet 1.0 allows remote attackers to inject arbitrary web script or HTML via the (1) language, (2) order, and (3) filter parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://downloads.securityfocus.com/vulnerabilities/exploits/28650.html; http://www.securityfocus.com/bid/28650; https://exchange.xforce.ibmcloud.com/vulnerabilities/41731
CVE: CVE-2008-6206
Published: 2009-02-20
Description: Multiple PHP remote file inclusion vulnerabilities in RobotStats 0.1 allow remote attackers to execute arbitrary PHP code via a URL in the DOCUMENT_ROOT parameter to (1) graph.php and (2) robotstats.inc.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/28615; http://www.securityfocus.com/bid/28615/exploit; https://exchange.xforce.ibmcloud.com/vulnerabilities/41690
CVE: CVE-2008-6207
Published: 2009-02-20
Description: Unrestricted file upload vulnerability in form_upload.php in PHPG Upload 1.0 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 8.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/28955; https://exchange.xforce.ibmcloud.com/vulnerabilities/42119; http://www.securityfocus.com/bid/28955
CVE: CVE-2008-6208
Published: 2009-02-20
Description: Cross-site scripting (XSS) vulnerability in submitnews.php in e107 CMS 0.7.11 allows remote attackers to inject arbitrary web script or HTML via the (1) author_name, (2) itemtitle, and (3) item parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.juniper.net/security/auto/vulnerabilities/vuln28982.html; http://www.securityfocus.com/bid/28982; https://exchange.xforce.ibmcloud.com/vulnerabilities/42248
CVE: CVE-2008-6209
Published: 2009-02-20
Description: SQL injection vulnerability in view_product.php in Vastal I-Tech Software Zone allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/28620; https://exchange.xforce.ibmcloud.com/vulnerabilities/41666; https://www.exploit-db.com/exploits/5359
CVE: CVE-2008-6210
Published: 2009-02-20
Description: SQL injection vulnerability in index.php in dream4 Koobi 4.4 and 5.4 allows remote attackers to execute arbitrary SQL commands via the img_id parameter in the gallerypic page.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.juniper.net/security/auto/vulnerabilities/vuln28711.html; http://www.securityfocus.com/bid/28711; https://exchange.xforce.ibmcloud.com/vulnerabilities/41740
CVE: CVE-2008-6211
Published: 2009-02-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in PhpForums.net mcGallery 1.1 allow remote attackers to inject arbitrary web script or HTML via the lang parameter to (1) admin.php, (2) index.php, (3) sess.php, (4) stats.php, (5) detail.php, (6) resize.php, and (7) show.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://downloads.securityfocus.com/vulnerabilities/exploits/28587.html; http://www.juniper.net/security/auto/vulnerabilities/vuln28587.html; http://www.securityfocus.com/bid/28587
CVE: CVE-2008-6212
Published: 2009-02-20
Description: Cross-site scripting (XSS) vulnerability in admin.php in Php-Stats 0.1.9.1 allows remote attackers to inject arbitrary web script or HTML via the (1) sel_mese and (2) sel_anno parameters in a systems action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.juniper.net/security/auto/vulnerabilities/vuln28824.html; http://www.securityfocus.com/bid/28824; http://www.securityfocus.com/bid/28824/exploit
CVE: CVE-2008-6162
Published: 2009-02-20
Description: Bux.to Clone script allows remote attackers to bypass authentication and gain administrative access by setting the loggedin cookie to 1 and the usNick cookie to admin.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.securityfocus.com/bid/31542; https://exchange.xforce.ibmcloud.com/vulnerabilities/45640; https://www.exploit-db.com/exploits/6652
CVE: CVE-2008-6163
Published: 2009-02-20
Description: SQL injection vulnerability in www/delivery/ac.php in OpenX 2.6.1 allows remote attackers to execute arbitrary SQL commands via the bannerid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://forum.openx.org/index.php?s=8d4c74dab4fd4597a7facda7c7414703&showtopic=503422735; http://secunia.com/advisories/32114; http://www.securityfocus.com/bid/31549
CVE: CVE-2008-6164
Published: 2009-02-20
Description: Cross-site scripting (XSS) vulnerability in index.php in DreamCost HostAdmin 3.1.1 allows remote attackers to inject arbitrary web script or HTML via the page parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/496935/100/0/threaded; http://www.securityfocus.com/bid/31538; https://exchange.xforce.ibmcloud.com/vulnerabilities/45646
CVE: CVE-2009-0640
Published: 2009-02-20
Description: Directory traversal vulnerability in the administrative web server in Swann DVR4-SecuraNet allows remote attackers to read arbitrary files via a .. (dot dot) in the URI, as demonstrated by reading the vy_netman.cfg file that contains passwords.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/51897; http://packetstorm.linuxsecurity.com/0902-exploits/cctv-disclose.txt; http://secunia.com/advisories/33861
CVE: CVE-2009-0641
Published: 2009-02-20
Description: sys_term.c in telnetd in FreeBSD 7.0-RELEASE and other 7.x versions deletes dangerous environment variables with a method that was valid only in older FreeBSD distributions, which might allow remote attackers to execute arbitrary code by passing a crafted environment variable from a telnet client, as demonstrated by an LD_PRELOAD value that references a malicious library.
CVSS Score: 9.3 (HIGH)
CWE: CWE-16, CWE-264
References: http://lists.grok.org.uk/pipermail/full-disclosure/2009-February/067954.html; http://security.freebsd.org/advisories/FreeBSD-SA-09:05.telnetd.asc; http://www.securityfocus.com/bid/33777
CVE: CVE-2009-0642
Published: 2009-02-20
Description: ext/openssl/ossl_ocsp.c in Ruby 1.8 and 1.9 does not properly check the return value from the OCSP_basic_verify function, which might allow remote attackers to successfully present an invalid X.509 certificate, possibly involving a revoked certificate.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=513528; http://redmine.ruby-lang.org/issues/show/1091; http://secunia.com/advisories/33750
CVE: CVE-2009-0643
Published: 2009-02-20
Description: Static code injection vulnerability in post.php in Simple PHP News 1.0 final allows remote attackers to inject arbitrary PHP code into news.txt via the post parameter, and then execute the code via a direct request to display.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-94
References: http://osvdb.org/51816; http://secunia.com/advisories/33814; http://www.vupen.com/english/advisories/2009/0357
CVE: CVE-2008-6213
Published: 2009-02-20
Description: SQL injection vulnerability in mypage.php in Harlandscripts Pro Traffic One allows remote attackers to execute arbitrary SQL commands via the trg parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32467; http://www.securityfocus.com/archive/1/497946; http://www.securityfocus.com/bid/31986
CVE: CVE-2008-6214
Published: 2009-02-20
Description: SQL injection vulnerability in poll_results.php in Harlandscripts Pro Traffic One allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/32467; http://www.securityfocus.com/bid/31994; http://www.vupen.com/english/advisories/2008/2962
CVE: CVE-2008-6215
Published: 2009-02-20
Description: Cross-site scripting (XSS) vulnerability in cadena_ofertas_ext.php in Venalsur Booking Centre Booking System for Hotels Group allows remote attackers to inject arbitrary web script or HTML via the OfertaID parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/49447; http://secunia.com/advisories/32430; http://www.securityfocus.com/bid/31990
CVE: CVE-2008-6216
Published: 2009-02-20
Description: SQL injection vulnerability in cadena_ofertas_ext.php in Venalsur Booking Centre Booking System for Hotels Group allows remote attackers to execute arbitrary SQL commands via the OfertaID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/49446; http://secunia.com/advisories/32430; http://www.securityfocus.com/bid/31990
CVE: CVE-2008-6217
Published: 2009-02-20
Description: Cross-site scripting (XSS) vulnerability in index.php in Extrakt Framework 0.7 allows remote attackers to inject arbitrary web script or HTML via the plugins[file][id] parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/31971; http://www.securityfocus.com/bid/31971/exploit; https://exchange.xforce.ibmcloud.com/vulnerabilities/46186
CVE: CVE-2008-6218
Published: 2009-02-20
Description: Memory leak in the png_handle_tEXt function in pngrutil.c in libpng before 1.2.33 rc02 and 1.4.0 beta36 allows context-dependent attackers to cause a denial of service (memory exhaustion) via a crafted PNG file.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/32418; http://secunia.com/advisories/34265; http://secunia.com/advisories/34320
CVE: CVE-2008-6219
Published: 2009-02-20
Description: nsrexecd.exe in multiple EMC Networker products including EMC NetWorker Server, Storage Node, and Client 7.3.x and 7.4, 7.4.1, 7.4.2, Client and Storage Node for Open VMS 7.3.2 ECO6 and earlier, Module for Microsoft Exchange 5.1 and earlier, Module for Microsoft Applications 2.0 and earlier, Module for Meditech 2.0 and earlier, and PowerSnap 2.4 SP1 and earlier does not properly control the allocation of memory, which allows remote attackers to cause a denial of service (memory exhaustion) via multiple crafted RPC requests.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/32383; http://www.fortiguardcenter.com/advisory/FGA-2008-23.html; http://www.securityfocus.com/archive/1/497645/100/0/threaded
CVE: CVE-2009-0649
Published: 2009-02-20
Description: The web browser in Symbian OS on the Nokia N95 cell phone allows remote attackers to cause a denial of service (crash) via JavaScript code that calls the setAttributeNode method.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/archive/1/500954/100/0/threaded; http://www.securityfocus.com/bid/33767; https://exchange.xforce.ibmcloud.com/vulnerabilities/48763
CVE: CVE-2009-0650
Published: 2009-02-20
Description: Stack-based buffer overflow in the GetStatsFromLine function in TPTEST 3.1.7 and earlier, and possibly 5.02, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a STATS line with a long pwd field.  NOTE: some of these details are obtained from third party information.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/33972; http://www.securityfocus.com/bid/33785; https://exchange.xforce.ibmcloud.com/vulnerabilities/48781
CVE: CVE-2009-0651
Published: 2009-02-20
Description: Unspecified vulnerability in the Veritas network daemon (aka vnetd) in Symantec Veritas NetBackup Server / Enterprise Server 5.x, 6.0 before MP7 SP1, and 6.5 before 6.5.3.1 allows remote attackers to execute arbitrary code via unknown vectors related to "initial communications setup."
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/52269; http://secunia.com/advisories/33953; http://securityresponse.symantec.com/avcenter/security/Content/2009.02.17.html
CVE: CVE-2009-0577
Published: 2009-02-20
Description: Integer overflow in the WriteProlog function in texttops in CUPS 1.1.17 on Red Hat Enterprise Linux (RHEL) 3 allows remote attackers to execute arbitrary code via a crafted PostScript file that triggers a heap-based buffer overflow.  NOTE: this issue exists because of an incorrect fix for CVE-2008-3640.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://secunia.com/advisories/33995; http://support.avaya.com/elmodocs2/security/ASA-2009-064.htm; http://www.redhat.com/support/errata/RHSA-2009-0308.html
CVE: CVE-2009-0652
Published: 2009-02-20
Description: The Internationalized Domain Names (IDN) blacklist in Mozilla Firefox 3.0.6 and other versions before 3.0.9; Thunderbird before 2.0.0.21; and SeaMonkey before 1.1.15 does not include box-drawing characters, which allows remote attackers to spoof URLs and conduct phishing attacks, as demonstrated by homoglyphs of the / (slash) and ? (question mark) characters in a subdomain of a .cn domain name, a different vulnerability than CVE-2005-0233.  NOTE: some third parties claim that 3.0.6 is not affected, but much older versions perhaps are affected.
CVSS Score: 5.8 (MEDIUM)
References: http://lists.immunitysec.com/pipermail/dailydave/2009-February/005556.html; http://lists.immunitysec.com/pipermail/dailydave/2009-February/005563.html; http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html
CVE: CVE-2009-0653
Published: 2009-02-20
Description: OpenSSL, probably 0.9.6, does not verify the Basic Constraints for an intermediate CA-signed certificate, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack, a related issue to CVE-2002-0970.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://www.blackhat.com/html/bh-dc-09/bh-dc-09-speakers.html#Marlinspike; https://www.blackhat.com/presentations/bh-dc-09/Marlinspike/BlackHat-DC-09-Marlinspike-Defeating-SSL.pdf; http://www.blackhat.com/html/bh-dc-09/bh-dc-09-speakers.html#Marlinspike
CVE: CVE-2009-0654
Published: 2009-02-20
Description: Tor 0.2.0.28, and probably 0.2.0.34 and earlier, allows remote attackers, with control of an entry router and an exit router, to confirm that a sender and receiver are communicating via vectors involving (1) replaying, (2) modifying, (3) inserting, or (4) deleting a single cell, and then observing cell recognition errors at the exit router.  NOTE: the vendor disputes the significance of this issue, noting that the product's design "accepted end-to-end correlation as an attack that is too expensive to solve."
CVSS Score: 5.1 (MEDIUM)
References: http://blog.torproject.org/blog/one-cell-enough; http://www.blackhat.com/html/bh-dc-09/bh-dc-09-archives.html#Fu; http://www.blackhat.com/presentations/bh-dc-09/Fu/BlackHat-DC-09-Fu-Break-Tors-Anonymity.pdf
CVE: CVE-2009-0655
Published: 2009-02-20
Description: Lenovo Veriface III allows physically proximate attackers to login to a Windows account by presenting a "plain image" of the authorized user.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-287
References: http://security.bkis.vn/?p=292; http://www.blackhat.com/html/bh-dc-09/bh-dc-09-archives.html#Nguyen; http://www.blackhat.com/presentations/bh-dc-09/Nguyen/BlackHat-DC-09-Nguyen-Face-not-your-password.pdf
CVE: CVE-2009-0656
Published: 2009-02-20
Description: Asus SmartLogon 1.0.0005 allows physically proximate attackers to bypass "security functions" by presenting an image with a modified viewpoint that matches the posture of a stored image of the authorized notebook user.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-255
References: http://security.bkis.vn/?p=292; http://www.blackhat.com/html/bh-dc-09/bh-dc-09-archives.html#Nguyen; http://www.blackhat.com/presentations/bh-dc-09/Nguyen/BlackHat-DC-09-Nguyen-Face-not-your-password.pdf