deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-1141
Published: 2008-03-04
Description: Memory leak in DLMFENC.sys 1.0.0.26 in DESlock+ 3.2.6 and earlier allows local users to cause a denial of service (kernel memory consumption) via a series of DLMFENC_IOCTL requests to \\.\DLKPFSD_Device that allocate "link list structures."
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/29005; http://www.vupen.com/english/advisories/2008/0597; https://www.exploit-db.com/exploits/5141
CVE: CVE-2008-1111
Published: 2008-03-04
Description: mod_cgi in lighttpd 1.4.18 sends the source code of CGI scripts instead of a 500 error when a fork failure occurs, which might allow remote attackers to obtain sensitive information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00005.html; http://secunia.com/advisories/29209; http://secunia.com/advisories/29235
CVE: CVE-2008-1145
Published: 2008-03-04
Description: Directory traversal vulnerability in WEBrick in Ruby 1.8 before 1.8.5-p115 and 1.8.6-p114, and 1.9 through 1.9.0-1, when running on systems that support backslash (\) path separators or case-insensitive file names, allows remote attackers to access arbitrary files via (1) "..%5c" (encoded backslash) sequences or (2) filenames that match patterns in the :NondisclosureName option.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html; http://secunia.com/advisories/29232
CVE: CVE-2008-1146
Published: 2008-03-04
Description: A certain pseudo-random number generator (PRNG) algorithm that uses XOR and 3-bit random hops (aka "Algorithm X3"), as used in OpenBSD 2.8 through 4.2, allows remote attackers to guess sensitive values such as DNS transaction IDs by observing a sequence of previously generated values.  NOTE: this issue can be leveraged for attacks such as DNS cache poisoning against OpenBSD's modification of BIND.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/28819; http://www.securiteam.com/securityreviews/5PP0H0UNGW.html; http://www.securityfocus.com/archive/1/487658
CVE: CVE-2008-1147
Published: 2008-03-04
Description: A certain pseudo-random number generator (PRNG) algorithm that uses XOR and 2-bit random hops (aka "Algorithm X2"), as used in OpenBSD 2.6 through 3.4, Mac OS X 10 through 10.5.1, FreeBSD 4.4 through 7.0, and DragonFlyBSD 1.0 through 1.10.1, allows remote attackers to guess sensitive values such as IP fragmentation IDs by observing a sequence of previously generated values.  NOTE: this issue can be leveraged for attacks such as injection into TCP packets and OS fingerprinting.
CVSS Score: 6.8 (MEDIUM)
References: http://seclists.org/bugtraq/2008/Feb/0052.html; http://seclists.org/bugtraq/2008/Feb/0063.html; http://secunia.com/advisories/28819
CVE: CVE-2008-1148
Published: 2008-03-04
Description: A certain pseudo-random number generator (PRNG) algorithm that uses ADD with 0 random hops (aka "Algorithm A0"), as used in OpenBSD 3.5 through 4.2 and NetBSD 1.6.2 through 4.0, allows remote attackers to guess sensitive values such as (1) DNS transaction IDs or (2) IP fragmentation IDs by observing a sequence of previously generated values.  NOTE: this issue can be leveraged for attacks such as DNS cache poisoning, injection into TCP packets, and OS fingerprinting.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/28819; http://www.securiteam.com/securityreviews/5PP0H0UNGW.html; http://www.securityfocus.com/archive/1/487658
CVE: CVE-2008-1149
Published: 2008-03-04
Description: phpMyAdmin before 2.11.5 accesses $_REQUEST to obtain some parameters instead of $_GET and $_POST, which allows attackers in the same domain to override certain variables and conduct SQL injection and Cross-Site Request Forgery (CSRF) attacks by using crafted cookies.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-89, CWE-352
References: http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html; http://secunia.com/advisories/29143
CVE: CVE-2008-1096
Published: 2008-03-05
Description: The load_tile function in the XCF coder in coders/xcf.c in (1) ImageMagick 6.2.8-0 and (2) GraphicsMagick (aka gm) 1.1.7 allows user-assisted remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted .xcf file that triggers an out-of-bounds heap write, possibly related to the ScaleCharToQuantum function.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=414370; http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00001.html; http://osvdb.org/43212
CVE: CVE-2008-1097
Published: 2008-03-05
Description: Heap-based buffer overflow in the ReadPCXImage function in the PCX coder in coders/pcx.c in (1) ImageMagick 6.2.4-5 and 6.2.8-0 and (2) GraphicsMagick (aka gm) 1.1.7 allows user-assisted remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted .pcx file that triggers incorrect memory allocation for the scanline array, leading to memory corruption.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=413034; http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00001.html; http://osvdb.org/43213
CVE: CVE-2008-1098
Published: 2008-03-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.5.8 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) certain input processed by formatter/text_gedit.py (aka the gui editor formatter); (2) a page name, which triggers an injection in PageEditor.py when the page is successfully deleted by a victim in a DeletePage action; or (3) the destination page name for a RenamePage action, which triggers an injection in PageEditor.py when a victim's rename attempt fails because of a duplicate name.  NOTE: the AttachFile XSS issue is already covered by CVE-2008-0781, and the login XSS issue is already covered by CVE-2008-0780.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://hg.moinmo.in/moin/1.5/rev/4ede07e792dd; http://hg.moinmo.in/moin/1.5/rev/d0152eeb4499; http://moinmo.in/SecurityFixes
CVE: CVE-2008-1099
Published: 2008-03-05
Description: _macro_Getval in wikimacro.py in MoinMoin 1.5.8 and earlier does not properly enforce ACLs, which allows remote attackers to read protected pages.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://hg.moinmo.in/moin/1.5/rev/4a7de0173734; http://moinmo.in/SecurityFixes; http://secunia.com/advisories/29262
CVE: CVE-2007-6704
Published: 2008-03-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass 4100 SSL VPN 5.4.1 through 5.5.2 and 6.0 through 6.0.1, when pre-logon sequences are enabled, allow remote attackers to inject arbitrary web script or HTML via the query string to (1) my.activation.php3 and (2) my.logon.php3.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/27904; http://securityreason.com/securityalert/3712; http://www.osvdb.org/38980
CVE: CVE-2008-1162
Published: 2008-03-05
Description: SQL injection vulnerability in album.php in PHP WEB SCRIPT Dynamic Photo Gallery 1.02 allows remote attackers to execute arbitrary SQL commands via the albumID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://forum.aria-security.net/showthread.php?p=1521; http://secunia.com/advisories/29212; http://www.securityfocus.com/archive/1/489017/100/0/threaded
CVE: CVE-2008-1163
Published: 2008-03-05
Description: SQL injection vulnerability in index.php in phpArcadeScript 1.0 through 3.0 RC2 allows remote attackers to execute arbitrary SQL commands via the userid parameter in a profile action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/28065; https://www.exploit-db.com/exploits/5208; http://www.securityfocus.com/bid/28065
CVE: CVE-2008-1164
Published: 2008-03-05
Description: SQL injection vulnerability in index.php in phpComasy 0.8 allows remote attackers to execute arbitrary SQL commands via the mod_project_id parameter in a project_detail action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/28064; https://www.exploit-db.com/exploits/5209; http://www.securityfocus.com/bid/28064
CVE: CVE-2008-1165
Published: 2008-03-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in Flyspray 0.9.9 through 0.9.9.4 allow remote attackers to inject arbitrary web script or HTML via (1) a forced SQL error message or (2) old_value and new_value database fields in task summaries, related to the item_summary parameter in a details action in index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://flyspray.org/fsa:3; http://secunia.com/advisories/29215; https://exchange.xforce.ibmcloud.com/vulnerabilities/40963
CVE: CVE-2008-1166
Published: 2008-03-05
Description: Flyspray 0.9.9.4 generates different error messages depending on whether the username is valid or invalid, which allows remote attackers to enumerate usernames.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/29215; http://www.securityfocus.com/archive/1/489020/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/40964
CVE: CVE-2008-1167
Published: 2008-03-05
Description: Stack-based buffer overflow in the useragent function in useragent.c in Squid Analysis Report Generator (Sarg) 2.2.3.1 allows remote attackers to execute arbitrary code via a long Squid proxy server User-Agent header.  NOTE: some of these details are obtained from third party information.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00004.html; http://secunia.com/advisories/28668; http://secunia.com/advisories/29309
CVE: CVE-2008-1168
Published: 2008-03-05
Description: Cross-site scripting (XSS) vulnerability in Squid Analysis Report Generator (Sarg) 2.2.3.1 allows remote attackers to inject arbitrary web script or HTML via the User-Agent header, which is not properly handled when displaying the Squid proxy log.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/28668; http://secunia.com/advisories/29309; http://secunia.com/advisories/29500
CVE: CVE-2008-1169
Published: 2008-03-05
Description: Directory traversal vulnerability in the embedded HTTP server in SCI Photo Chat Server 3.4.9 and earlier allows remote attackers to read arbitrary files via a "..\" (dot dot backslash) or "../" (dot dot forward slash) in the GET command.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://aluigi.altervista.org/adv/scichatdt-adv.txt; http://www.securityfocus.com/bid/27872; http://www.vupen.com/english/advisories/2008/0614
CVE: CVE-2008-1170
Published: 2008-03-05
Description: Multiple PHP remote file inclusion vulnerabilities in KCWiki 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the page parameter to (1) minimal/wiki.php and (2) simplest/wiki.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/29218; http://securityreason.com/securityalert/3714; http://www.securityfocus.com/archive/1/489024/100/0/threaded
CVE: CVE-2008-1171
Published: 2008-03-05
Description: Multiple PHP remote file inclusion vulnerabilities in the 123 Flash Chat Module for phpBB allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter to (1) 123flashchat.php and (2) phpbb_login_chat.php.  NOTE: CVE disputes this issue because $phpbb_root_path is explicitly set to "./" in both programs
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://securityreason.com/securityalert/3716; http://www.attrition.org/pipermail/vim/2008-March/001913.html; http://www.securityfocus.com/archive/1/488914/100/0/threaded
CVE: CVE-2008-0072
Published: 2008-03-06
Description: Format string vulnerability in the emf_multipart_encrypted function in mail/em-format.c in Evolution 2.12.3 and earlier allows remote attackers to execute arbitrary code via a crafted encrypted message, as demonstrated using the Version field.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-134
References: http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00003.html; http://secunia.com/advisories/29057; http://secunia.com/advisories/29163
CVE: CVE-2008-0883
Published: 2008-03-06
Description: acroread in Adobe Acrobat Reader 8.1.2 allows local users to overwrite arbitrary files via a symlink attack on temporary files related to SSL certificate handling.
CVSS Score: 3.7 (LOW)
CWE: CWE-59
References: http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html; http://secunia.com/advisories/29229; http://secunia.com/advisories/29242
CVE: CVE-2008-0985
Published: 2008-03-06
Description: Heap-based buffer overflow in the GIF library in the WebKit framework for Google Android SDK m3-rc37a and earlier allows remote attackers to execute arbitrary code via a crafted GIF file whose logical screen height and width are different than the actual height and width.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://android-developers.blogspot.com/2008/03/android-sdk-update-m5-rc15-released.html; http://securityreason.com/securityalert/3727; http://www.coresecurity.com/?action=item&id=2148
CVE: CVE-2008-0986
Published: 2008-03-06
Description: Integer overflow in the BMP::readFromStream method in the libsgl.so library in Google Android SDK m3-rc37a and earlier, and m5-rc14, allows remote attackers to execute arbitrary code via a crafted BMP file with a header containing a negative offset field.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://android-developers.blogspot.com/2008/03/android-sdk-update-m5-rc15-released.html; http://securityreason.com/securityalert/3727; http://www.coresecurity.com/?action=item&id=2148
CVE: CVE-2008-1172
Published: 2008-03-06
Description: Cross-site request forgery (CSRF) vulnerabilities in account-inbox.php in TorrentTrader Classic 1.08 allow remote attackers to perform certain actions as other users, as demonstrated by sending messages.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://securityreason.com/securityalert/3713; http://www.securityfocus.com/archive/1/489039/100/0/threaded; https://exchange.xforce.ibmcloud.com/vulnerabilities/40981
CVE: CVE-2008-1173
Published: 2008-03-06
Description: Cross-site scripting (XSS) vulnerability in account-inbox.php in TorrentTrader Classic 1.08 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29220; http://securityreason.com/securityalert/3713; http://www.securityfocus.com/archive/1/489039/100/0/threaded
CVE: CVE-2008-1174
Published: 2008-03-06
Description: Cross-site scripting (XSS) vulnerability in editUser.asp in AuthentiX 6.3b1 Trial allows remote attackers to inject arbitrary web script or HTML via the username parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=full-disclosure&m=[PII_REDACTED]1185&w=2; http://secunia.com/advisories/29142; http://securitytracker.com/id?1019520
CVE: CVE-2008-1175
Published: 2008-03-06
Description: Cross-site scripting (XSS) vulnerability in AuthentiX 6.3b1 Trial allows remote attackers to inject arbitrary web script or HTML via the username parameter to aspAdmin/deleteUser.asp, a different vector than CVE-2008-1174.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29142; http://secunia.com/advisories/29142
CVE: CVE-2008-1176
Published: 2008-03-06
Description: Cross-site scripting (XSS) vulnerability in function/sideblock.php in Affiliate Market (affmarket) 0.1 BETA allows remote attackers to inject arbitrary web script or HTML via the sideblock4 parameter.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/40514; https://www.exploit-db.com/exploits/5114; https://exchange.xforce.ibmcloud.com/vulnerabilities/40514
CVE: CVE-2008-1177
Published: 2008-03-06
Description: SQL injection vulnerability in shop/detail.php in Affiliate Market (affmarket) 0.1 BETA allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/40515; https://www.exploit-db.com/exploits/5114; https://exchange.xforce.ibmcloud.com/vulnerabilities/40515
CVE: CVE-2008-1178
Published: 2008-03-06
Description: Directory traversal vulnerability in include/doc/index.php in Centreon 1.4.2.3 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the page parameter, a different vector than CVE-2008-1119.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/29158; http://securityreason.com/securityalert/3715; http://www.centreon.com/Product/Changelog-Centreon-1.4.x.html
CVE: CVE-2008-1179
Published: 2008-03-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in include/common/javascript/color_picker.php in Centreon 1.4.2.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) name and (2) title parameters.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29158; http://www.centreon.com/Product/Changelog-Centreon-1.4.x.html; http://www.securityfocus.com/bid/28043
CVE: CVE-2008-1180
Published: 2008-03-06
Description: Cross-site scripting (XSS) vulnerability in dana-na/auth/rdremediate.cgi in Juniper Networks Secure Access 2000 5.5 R1 build 11711 allows remote attackers to inject arbitrary web script or HTML via the delivery_mode parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29165; http://securityreason.com/securityalert/3720; http://www.procheckup.com/Vulnerability_PR07-41.php
CVE: CVE-2008-1181
Published: 2008-03-06
Description: Juniper Networks Secure Access 2000 5.5 R1 (build 11711) allows remote attackers to obtain sensitive information via a direct request for remediate.cgi without certain parameters, which reveals the path in an "Execute failed" error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://securityreason.com/securityalert/3719; http://www.securityfocus.com/archive/1/488919/100/0/threaded; http://www.securityfocus.com/bid/28037
CVE: CVE-2008-1182
Published: 2008-03-06
Description: Cross-site scripting (XSS) vulnerability in BSD Perimeter pfSense before 1.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.pfsense.org/?p=170; http://secunia.com/advisories/29126; http://www.securityfocus.com/bid/28072
CVE: CVE-2008-1183
Published: 2008-03-06
Description: Multiple cross-site scripting (XSS) vulnerabilities in Crafty Syntax Live Help (CSLH) before 2.14.6 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) livehelp.php, (2) user_questions.php, and (3) leavemessage.php.  NOTE: the lostsheep.php vector is covered by CVE-2008-0848.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/29201; http://sourceforge.net/project/shownotes.php?release_id=580994; http://www.securityfocus.com/bid/28071
CVE: CVE-2008-1184
Published: 2008-03-06
Description: The DNSSEC validation library (libval) library in dnssec-tools before 1.3.1 does not properly check that the signing key is the APEX trust anchor, which might allow attackers to conduct unspecified attacks.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://secunia.com/advisories/29095; http://secunia.com/advisories/29127; http://sourceforge.net/mailarchive/forum.php?thread_name=sdlk5lolzj.fsf%40wes.hardakers.net&forum_name=dnssec-tools-users
CVE: CVE-2008-1185
Published: 2008-03-06
Description: Unspecified vulnerability in the Virtual Machine for Sun Java Runtime Environment (JRE) and JDK 6 Update 4 and earlier, 5.0 Update 14 and earlier, and SDK/JRE 1.4.2_16 and earlier allows remote attackers to gain privileges via an untrusted application or applet, a different issue than CVE-2008-1186, aka "the first issue."
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce//2008/Sep/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00000.html; http://secunia.com/advisories/29239
CVE: CVE-2008-1186
Published: 2008-03-06
Description: Unspecified vulnerability in the Virtual Machine for Sun Java Runtime Environment (JRE) and JDK 5.0 Update 13 and earlier, and SDK/JRE 1.4.2_16 and earlier, allows remote attackers to gain privileges via an untrusted application or applet, a different issue than CVE-2008-1185, aka "the second issue."
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce//2008/Sep/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00000.html; http://secunia.com/advisories/29239
CVE: CVE-2008-1187
Published: 2008-03-06
Description: Unspecified vulnerability in Sun Java Runtime Environment (JRE) and JDK 6 Update 4 and earlier, 5.0 Update 14 and earlier, and SDK/JRE 1.4.2_16 and earlier allows remote attackers to cause a denial of service (JRE crash) and possibly execute arbitrary code via unknown vectors related to XSLT transforms.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://dev2dev.bea.com/pub/advisory/277; http://download.novell.com/Download?buildid=q5exhSqeBjA~; http://jvn.jp/en/jp/JVN04032535/index.html
CVE: CVE-2008-1188
Published: 2008-03-06
Description: Multiple buffer overflows in the useEncodingDecl function in Java Web Start in Sun JDK and JRE 6 Update 4 and earlier, and 5.0 Update 14 and earlier, allow remote attackers to execute arbitrary code via a JNLP file with (1) a long key name in the xml header or (2) a long charset value, different issues than CVE-2008-1189, aka "The first two issues."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce//2008/Sep/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00010.html
CVE: CVE-2008-1189
Published: 2008-03-06
Description: Buffer overflow in Java Web Start in Sun JDK and JRE 6 Update 4 and earlier, 5.0 Update 14 and earlier, and SDK/JRE 1.4.2_16 and earlier allows remote attackers to execute arbitrary code via unknown vectors, a different issue than CVE-2008-1188, aka the "third" issue.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce//2008/Sep/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00010.html
CVE: CVE-2008-1190
Published: 2008-03-06
Description: Unspecified vulnerability in Java Web Start in Sun JDK and JRE 6 Update 4 and earlier, 5.0 Update 14 and earlier, and SDK/JRE 1.4.2_16 and earlier allows remote attackers to gain privileges via an untrusted application, a different issue than CVE-2008-1191, aka the "fourth" issue.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce//2008/Sep/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00010.html
CVE: CVE-2008-1191
Published: 2008-03-06
Description: Unspecified vulnerability in Java Web Start in Sun JDK and JRE 6 Update 4 and earlier allows remote attackers to create arbitrary files via an untrusted application, a different issue than CVE-2008-1190, aka "The fifth issue."
CVSS Score: 6.8 (MEDIUM)
References: http://lists.apple.com/archives/security-announce//2008/Sep/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00000.html; http://secunia.com/advisories/29239