deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-4741
Published: 2010-03-26
Description: Unspecified vulnerability in the Extras Manager before 2.0.0.67 in Skype before 4.1.0.179 on Windows has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/37012; http://www.securityfocus.com/bid/36459; https://developer.skype.com/WindowsSkype/ReleaseNotes#head-21c1b2583e7cc405f994ca162d574fb15a6e986b
CVE: CVE-2009-4742
Published: 2010-03-26
Description: Multiple SQL injection vulnerabilities in Docebo 3.6.0.3 allow remote attackers to execute arbitrary SQL commands via (1) the word parameter in a play help action to the faq module, reachable through index.php; (2) the word parameter in a play keyw action to the link module, reachable through index.php; (3) the id_certificate parameter in an elemmetacertificate action to the meta_certificate module, reachable through index.php; or (4) the id_certificate parameter in an elemcertificate action to the certificate module, reachable through index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/archive/1/507072/100/0/threaded; http://www.securityfocus.com/bid/36654; https://exchange.xforce.ibmcloud.com/vulnerabilities/53701
CVE: CVE-2009-4743
Published: 2010-03-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in history-storage.aspx in AfterLogic WebMail Pro 4.7.10 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) HistoryStorageObjectName and (2) HistoryKey parameters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/58712; http://secunia.com/advisories/36964; http://www.gardienvirtuel.com/fichiers/documents/publications/GVI_2009-01_EN.txt
CVE: CVE-2009-4744
Published: 2010-03-26
Description: Cross-site scripting (XSS) vulnerability in the Contact module in Exponent CMS 0.97-GA20090213 allows remote attackers to inject arbitrary web script or HTML via the email parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/58647; http://secunia.com/advisories/36703; http://www.securityfocus.com/bid/36626
CVE: CVE-2009-4745
Published: 2010-03-26
Description: Multiple SQL injection vulnerabilities in index.php in Dreamlevels DreamPoll 3.1 allow remote attackers to execute arbitrary SQL commands via the (1) sortField, (2) sortDesc, or (3) pageNumber parameter in a login action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/archive/1/507039/100/0/threaded; http://www.securityfocus.com/archive/1/507039/100/0/threaded
CVE: CVE-2009-4746
Published: 2010-03-26
Description: Cross-site scripting (XSS) vulnerability in index.php in Dreamlevels DreamPoll 3.1 allows remote attackers to inject arbitrary web script or HTML via the recordsPerPage parameter in a poll_default login action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/507039/100/0/threaded; http://www.securityfocus.com/archive/1/507039/100/0/threaded
CVE: CVE-2009-4747
Published: 2010-03-26
Description: PHP remote file inclusion vulnerability in public/code/cp_html2xhtmlbasic.php in All In One Control Panel (AIOCP) 1.4.001 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter, a different vector than CVE-2009-3220.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/archive/1/507030/100/0/threaded; http://www.securityfocus.com/bid/36609; https://exchange.xforce.ibmcloud.com/vulnerabilities/53679
CVE: CVE-2009-4748
Published: 2010-03-26
Description: SQL injection vulnerability in mycategoryorder.php in the My Category Order plugin 2.8 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the parentID parameter in an act_OrderCategories action to wp-admin/post-new.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0907-exploits/wpmco-sql.txt; http://www.exploit-db.com/exploits/9150; http://www.securityfocus.com/bid/35704
CVE: CVE-2009-4749
Published: 2010-03-26
Description: Multiple SQL injection vulnerabilities in PHP Live! 3.2.1 and 3.2.2 allow remote attackers to execute arbitrary SQL commands via the x parameter to (1) message_box.php and (2) request.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0907-exploits/phplive-sql.txt; http://www.exploit-db.com/exploits/9174; http://www.securityfocus.com/bid/35718
CVE: CVE-2009-4750
Published: 2010-03-26
Description: PHP remote file inclusion vulnerability in home.php in Top Paidmailer allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/35723; http://www.osvdb.org/55797; http://www.packetstormsecurity.org/0907-exploits/toppaidmailer-rfi.txt
CVE: CVE-2009-4751
Published: 2010-03-26
Description: SQL injection vulnerability in anzeiger/start.php in Swinger Club Portal allows remote attackers to execute arbitrary SQL commands via the id parameter in a rubrik action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/35724; http://www.osvdb.org/55794; http://www.packetstormsecurity.org/0907-exploits/swingerclub-sqlrfi.txt
CVE: CVE-2009-4752
Published: 2010-03-26
Description: PHP remote file inclusion vulnerability in anzeiger/start.php in Swinger Club Portal allows remote attackers to execute arbitrary PHP code via a URL in the go parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/35724; http://www.osvdb.org/55795; http://www.packetstormsecurity.org/0907-exploits/swingerclub-sqlrfi.txt
CVE: CVE-2010-1125
Published: 2010-03-26
Description: The JavaScript implementation in Mozilla Firefox 3.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, allows remote attackers to send selected keystrokes to a form field in a hidden frame, instead of the intended form field in a visible frame, via certain calls to the focus method.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-200
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043369.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043405.html; http://lists.opensuse.org/opensuse-security-announce/2010-07/msg00005.html
CVE: CVE-2010-1126
Published: 2010-03-26
Description: The JavaScript implementation in WebKit allows remote attackers to send selected keystrokes to a form field in a hidden frame, instead of the intended form field in a visible frame, via certain calls to the focus method.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html; http://secunia.com/advisories/43068; http://www.securityfocus.com/archive/1/510070/100/0/threaded
CVE: CVE-2010-1127
Published: 2010-03-26
Description: Microsoft Internet Explorer 6 and 7 does not initialize certain data structures during execution of the createElement method, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted JavaScript code, as demonstrated by setting the (1) outerHTML or (2) value property of an object returned by createElement.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2010-01/0237.html; http://archives.neohapsis.com/archives/bugtraq/2010-01/0278.html; http://securityreason.com/exploitalert/7731
CVE: CVE-2010-1128
Published: 2010-03-26
Description: The Linear Congruential Generator (LCG) in PHP before 5.2.13 does not provide the expected entropy, which makes it easier for context-dependent attackers to guess values that were intended to be unpredictable, as demonstrated by session cookies generated by using the uniqid function.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-310
References: http://secunia.com/advisories/38708; http://secunia.com/advisories/42410; http://www.php.net/ChangeLog-5.php
CVE: CVE-2010-1129
Published: 2010-03-26
Description: The safe_mode implementation in PHP before 5.2.13 does not properly handle directory pathnames that lack a trailing / (slash) character, which allows context-dependent attackers to bypass intended access restrictions via vectors related to use of the tempnam function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02286083; http://lists.apple.com/archives/security-announce/2010//Aug/msg00003.html; http://secunia.com/advisories/38708
CVE: CVE-2010-1130
Published: 2010-03-26
Description: session.c in the session extension in PHP before 5.2.13, and 5.3.1, does not properly interpret ; (semicolon) characters in the argument to the session_save_path function, which allows context-dependent attackers to bypass open_basedir and safe_mode restrictions via an argument that contains multiple ; characters in conjunction with a .. (dot dot).
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/38708; http://securityreason.com/achievement_securityalert/82; http://securityreason.com/securityalert/7008
CVE: CVE-2010-1131
Published: 2010-03-27
Description: JavaScriptCore.dll, as used in Apple Safari 4.0.5 on Windows XP SP3, allows remote attackers to cause a denial of service (application crash) via an HTML document composed of many successive occurrences of the <object> substring.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/bid/38884; http://www.securityfocus.com/data/vulnerabilities/exploits/38884.php; http://www.securityfocus.com/bid/38884
CVE: CVE-2010-1132
Published: 2010-03-27
Description: The mlfi_envrcpt function in spamass-milter.cpp in SpamAssassin Milter Plugin 0.3.1, when using the expand option, allows remote attackers to execute arbitrary system commands via shell metacharacters in the RCPT TO field of an email message.
CVSS Score: 9.3 (HIGH)
CWE: CWE-78
References: http://archives.neohapsis.com/archives/fulldisclosure/2010-03/0139.html; http://bugs.debian.org/573228; http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038535.html
CVE: CVE-2010-1133
Published: 2010-03-27
Description: Multiple SQL injection vulnerabilities in TikiWiki CMS/Groupware 4.x before 4.2 allow remote attackers to execute arbitrary SQL commands via unspecified vectors, probably related to (1) tiki-searchindex.php and (2) tiki-searchresults.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://info.tikiwiki.org/article86-Tiki-Announces-3-5-and-4-2-Releases; http://osvdb.org/62800; http://secunia.com/advisories/38896
CVE: CVE-2010-1134
Published: 2010-03-27
Description: SQL injection vulnerability in the _find function in searchlib.php in TikiWiki CMS/Groupware 3.x before 3.5 allows remote attackers to execute arbitrary SQL commands via the $searchDate variable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://info.tikiwiki.org/article86-Tiki-Announces-3-5-and-4-2-Releases; http://osvdb.org/62800; http://secunia.com/advisories/38882
CVE: CVE-2010-1135
Published: 2010-03-27
Description: The user_logout function in TikiWiki CMS/Groupware 4.x before 4.2 does not properly delete user login cookies, which allows remote attackers to gain access via cookie reuse.
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://info.tikiwiki.org/article86-Tiki-Announces-3-5-and-4-2-Releases; http://secunia.com/advisories/38896; http://tikiwiki.svn.sourceforge.net/viewvc/tikiwiki?view=rev&revision=25046
CVE: CVE-2010-1136
Published: 2010-03-27
Description: The Standard Remember method in TikiWiki CMS/Groupware 3.x before 3.5 allows remote attackers to bypass access restrictions related to "persistent login," probably due to the generation of predictable cookies based on the IP address and User agent in userslib.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://info.tikiwiki.org/article86-Tiki-Announces-3-5-and-4-2-Releases; http://osvdb.org/62801; http://secunia.com/advisories/38882
CVE: CVE-2009-4753
Published: 2010-03-29
Description: Multiple buffer overflows in the FTP server on the Addonics NAS Adapter NASU2FW41 with loader 1.17 allow remote attackers to cause a denial of service (TCP/IP outage) via long arguments to the (1) XRMD, (2) delete, (3) RNFR, or (4) RNTO command.
CVSS Score: 7.1 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/34965; http://www.exploit-db.com/exploits/8584; http://www.securityfocus.com/archive/1/503146/100/0/threaded
CVE: CVE-2009-4754
Published: 2010-03-29
Description: Stack-based buffer overflow in Mercury Audio Player 1.21 allows remote attackers to execute arbitrary code via a long string in a malformed playlist (.m3u) file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/34957; http://www.exploit-db.com/exploits/8578; http://www.exploit-db.com/exploits/8583
CVE: CVE-2009-4755
Published: 2010-03-29
Description: Multiple stack-based buffer overflows in Mercury Audio Player 1.21 allow remote attackers to execute arbitrary code via a long string in a malformed (1) .b4s or (2) .pls playlist file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/54170; http://secunia.com/advisories/34957; http://www.exploit-db.com/exploits/8580
CVE: CVE-2009-4756
Published: 2010-03-29
Description: Stack-based buffer overflow in TraktorBeatport.exe 1.0.0.283 in Beatport Player 1.0.0.0 allows remote attackers to execute arbitrary code via a long string in a malformed playlist (.m3u) file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.exploit-db.com/exploits/8588; http://www.exploit-db.com/exploits/8590; http://www.exploit-db.com/exploits/8591
CVE: CVE-2009-4757
Published: 2010-03-29
Description: Stack-based buffer overflow in BrotherSoft EW-MusicPlayer 0.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long string in a malformed playlist (.m3u) file.  NOTE: some of these details are obtained from third party information.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.exploit-db.com/exploits/8601; http://www.securityfocus.com/bid/34806; http://www.exploit-db.com/exploits/8601
CVE: CVE-2009-4758
Published: 2010-03-29
Description: Stack-based buffer overflow in dicas Mpegable Player 2.12 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long string in a .YUV file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.exploit-db.com/exploits/8568; http://www.securityfocus.com/bid/34770; https://exchange.xforce.ibmcloud.com/vulnerabilities/50264
CVE: CVE-2009-4759
Published: 2010-03-29
Description: Buffer overflow in BrotherSoft BMXPlay 0.4.4b allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long string in a .BMX file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.exploit-db.com/exploits/8607; http://www.securityfocus.com/bid/34810; http://www.exploit-db.com/exploits/8607
CVE: CVE-2009-4760
Published: 2010-03-29
Description: Winn ASP Guestbook 1.01 Beta stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for data/guestbook.mdb.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.exploit-db.com/exploits/8596; http://www.vupen.com/english/advisories/2009/1244; https://exchange.xforce.ibmcloud.com/vulnerabilities/50294
CVE: CVE-2009-4761
Published: 2010-03-29
Description: Stack-based buffer overflow in Mini-stream RM Downloader allows remote attackers to execute arbitrary code via a long string in a .smi file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.exploit-db.com/exploits/8589; http://www.exploit-db.com/exploits/8594; http://www.securityfocus.com/bid/34794
CVE: CVE-2010-0452
Published: 2010-03-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in HP Project and Portfolio Management Center (PPMC, formerly Mercury IT Governance) 7.1 through SP10 and 7.5 through SP3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]5011&w=2; http://secunia.com/advisories/39105; http://securitytracker.com/id?1023749
CVE: CVE-2010-1174
Published: 2010-03-29
Description: Cisco TFTP Server 1.1 allows remote attackers to cause a denial of service (daemon crash) via a crafted (1) read (aka RRQ) or (2) write (aka WRQ) request, or other TFTP packet.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/39116; http://www.exploit-db.com/exploits/11878; http://www.securityfocus.com/bid/38968
CVE: CVE-2010-1175
Published: 2010-03-29
Description: Microsoft Internet Explorer 7.0 on Windows XP and Windows Server 2003 allows remote attackers to have an unspecified impact via a certain XML document that references a crafted web site in the SRC attribute of an image element, related to a "0day Vulnerability."
CVSS Score: 9.3 (HIGH)
References: http://www.securityfocus.com/archive/1/510280/100/0/threaded; http://www.securityfocus.com/archive/1/510280/100/0/threaded
CVE: CVE-2010-1176
Published: 2010-03-29
Description: Safari on Apple iPhone OS 3.1.3 for iPod touch allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors related to an array of long strings, an array of IMG elements with crafted strings in their SRC attributes, a TBODY element with no associated TABLE element, and certain calls to the delete operator and the cloneNode, clearAttributes, and CollectGarbage methods, possibly a related issue to CVE-2009-0075.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://nishantdaspatnaik.yolasite.com/ipodpoc1.php; http://www.exploit-db.com/exploits/11891; http://www.securityfocus.com/bid/38989
CVE: CVE-2010-1177
Published: 2010-03-29
Description: Safari on Apple iPhone OS 3.1.3 for iPod touch allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors involving document.write calls with long crafted strings.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://nishantdaspatnaik.yolasite.com/ipodpoc2.php; http://www.securityfocus.com/bid/38994; http://nishantdaspatnaik.yolasite.com/ipodpoc2.php
CVE: CVE-2010-1178
Published: 2010-03-29
Description: Safari on Apple iPhone OS 3.1.3 for iPod touch allows remote attackers to cause a denial of service (application crash) via a JavaScript loop that attempts to construct an infinitely long string.
CVSS Score: 4.3 (MEDIUM)
References: http://nishantdaspatnaik.yolasite.com/ipodpoc3.php; https://exchange.xforce.ibmcloud.com/vulnerabilities/57993; http://nishantdaspatnaik.yolasite.com/ipodpoc3.php
CVE: CVE-2010-1179
Published: 2010-03-29
Description: Safari on Apple iPhone OS 3.1.3 for iPod touch allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a large integer in the numcolors attribute of a recolorinfo element in a VML file, possibly a related issue to CVE-2007-0024.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://nishantdaspatnaik.yolasite.com/ipodpoc4.php; http://www.exploit-db.com/exploits/11890; http://www.securityfocus.com/bid/38990
CVE: CVE-2010-1180
Published: 2010-03-29
Description: Safari on Apple iPhone OS 3.1.3 for iPod touch allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long exception string in a throw statement, possibly a related issue to CVE-2009-1514.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://nishantdaspatnaik.yolasite.com/ipodpoc5.php; http://www.securityfocus.com/bid/38992; https://exchange.xforce.ibmcloud.com/vulnerabilities/57992
CVE: CVE-2010-1181
Published: 2010-03-29
Description: Safari on Apple iPhone OS 3.1.3 for iPod touch allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long string in a MARQUEE element.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://nishantdaspatnaik.yolasite.com/ipodpoc6.php; http://nishantdaspatnaik.yolasite.com/ipodpoc6.php
CVE: CVE-2009-4762
Published: 2010-03-29
Description: MoinMoin 1.7.x before 1.7.3 and 1.8.x before 1.8.3 checks parent ACLs in certain inappropriate circumstances during processing of hierarchical ACLs, which allows remote attackers to bypass intended access restrictions by requesting an item, a different vulnerability than CVE-2008-6603.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://hg.moinmo.in/moin/1.7/rev/897cdbe9e8f2; http://hg.moinmo.in/moin/1.8/rev/897cdbe9e8f2; http://moinmo.in/SecurityFixes
CVE: CVE-2010-1182
Published: 2010-03-29
Description: Multiple unspecified vulnerabilities in the administrative console in IBM WebSphere Application Server (WAS) 7.0.x before 7.0.0.9 on z/OS have unknown impact and attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PK97376; http://www-01.ibm.com/support/docview.wss?uid=swg1PM09161; http://www.vupen.com/english/advisories/2010/0609
CVE: CVE-2010-0451
Published: 2010-03-29
Description: The installation process for NFS/ONCplus B.11.31_08 and earlier on HP HP-UX B.11.31 changes the NFS_SERVER setting in the nfsconf file, which might allow remote attackers to obtain filesystem access via NFS requests.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]3767&w=2; http://osvdb.org/63243; http://secunia.com/advisories/39111
CVE: CVE-2010-1183
Published: 2010-03-29
Description: Certain patch-installation scripts in Oracle Solaris allow local users to append data to arbitrary files via a symlink attack on the /tmp/CLEANUP temporary file, related to use of Update Manager.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://www.securityfocus.com/archive/1/510305/100/0/threaded; http://www.securityfocus.com/archive/1/510311/100/0/threaded; http://www.securityfocus.com/bid/38928
CVE: CVE-2010-1184
Published: 2010-03-29
Description: The Microsoft wireless keyboard uses XOR encryption with a key derived from the MAC address, which makes it easier for remote attackers to obtain keystroke information and inject arbitrary commands via a nearby wireless device, as demonstrated by Keykeriki 2.
CVSS Score: 7.6 (HIGH)
CWE: CWE-310
References: http://www.remote-exploit.org/?p=437; http://www.theregister.co.uk/2010/03/26/open_source_wireless_sniffer/; https://exchange.xforce.ibmcloud.com/vulnerabilities/57978
CVE: CVE-2010-1185
Published: 2010-03-29
Description: Stack-based buffer overflow in serv.exe in SAP MaxDB 7.4.3.32, and 7.6.0.37 through 7.6.06 allows remote attackers to execute arbitrary code via an invalid length parameter in a handshake packet to TCP port 7210.  NOTE: some of these details are obtained from third party information.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://osvdb.org/63047; http://secunia.com/advisories/38955; http://www.securityfocus.com/archive/1/510125/100/0/threaded
CVE: CVE-2009-2801
Published: 2010-03-30
Description: The Application Firewall in Apple Mac OS X 10.5.8 drops unspecified firewall rules after a reboot, which might allow remote attackers to bypass intended access restrictions via packet data, related to a "timing issue."
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
CVE: CVE-2010-0056
Published: 2010-03-30
Description: Buffer overflow in Cocoa spell checking in AppKit in Apple Mac OS X 10.5.8 allows user-assisted remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted document.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html